Att.A - Draft Contract_DMS-2223-084.pdf

4050 Esplanade Way

Tallahassee, FL 32399‐0950

Ron DeSantis, Governor

Pedro Allende, Secretary

ATTACHMENT A

DRAFT CONTRACT

FOR

GROUP TERM LIFE INSURANCE

BETWEEN

THE STATE OF FLORIDA

DEPARTMENT OF MANAGEMENT SERVICES

AND

<<INSERT CONTRACTOR NAME>>

DMS NO: 22/23-084

RFP No.: DMS-22/23-084 Attachment A: Draft Contract Page 2 of Page 47

Table of Contents

Section 1 DEFINITIONS 5

1.1. Definitions 5

CONTRACT DOCUMENTS 8

2.1 Rules of Interpretation 8

2.2 Hierarchy of Documents 9

TERM, SCOPE, AND PAYMENTS 9

3.1 Term 9

3.1.1 Initial term 9

3.1.2 Renewals 9

3.2 Department’s Right to Terminate for Convenience 9

3.3 Scope of Work 10

3.4 Modifications and Changes 10

3.5 Department’s Right to Suspend Work 10

3.6 Department’s Obligation to Supply Data to Contractor 11

3.7 Bills for Travel 11

3.8 Payments 11

3.9 Appropriations 12

3.10 Non-Exclusive Contract 12

CONTRACT ADMINISTRATION 12

4.1 Ownership of Deliverables and Retention of Records 12

4.2 Contractor Obligations 13

4.2.1 General 13

4.2.2 Major Organizational Changes 13

4.2.3 Subcontractors 13

4.2.4 Background Screening, Record Retention, and Warranty of Security 14

4.2.5 Work Locations, No Offshoring of Data 18

4.2.6 E-Verify 21

4.2.7 Scrutinized Companies – Termination by the Department 21

4.2.8 Removal or Replacement of Employees and Subcontractors for Cause 22

4.2.9 Employment of State Workers 22

4.3 Acceptance of Deliverables 22

4.4 Warranty 22

AUDIT RIGHTS 23

DIVERSITY 24

LIQUIDATED DAMAGES 24

7.1 Generally 24

7.2 Implementation Delays 24

7.3 Failure to Meet Other Performance Guarantees 25

7.4 Maximum Liability 26

INSURANCE 26

8.1 Insurance Coverage 26

8.2 Performance Bond 27

Attachment A: Draft Contract Page 3 of Page 47

EVENTS OF DEFAULT REMEDIES 28

9.1 Contractor Events of Default 28

9.2 Department Remedies in the Event of Default 29

9.3 Department Events of Default 30

9.4 Contractor Remedies in the Event of Default 30

9.5 Rights Cumulative, No Waiver 31

TERMINATION FOR CAUSE 31

10.1 Termination for Cause 31

TRANSITION SERVICES 31

GENERAL PROVISIONS 32

12.1 Advertising 32

12.2 Assignment, Acquisition by Third Party 33

12.3 Change of Statute or Regulation or Governmental Restrictions 33

12.4 Compliance with Laws, Including HIPAA 34

12.5 Contract Administrator 35

12.6 Contract Managers 35

12.7 Dispute Resolution, Governing Law and Venue 35

12.8 Entire Contract 36

12.9 Execution in Counterparts 36

12.10 Force Majeure, Notice of Delay and No Damages for Delay 36

12.11 Further Assurances 37

12.12 Indemnification 37

12.13 Defense of Third-Party Claims 38

12.13.1 Notice of Claims 38

12.13.2 Department as Real Party in Interest 38

12.13.3 Contractor as Real Party in Interest 39

12.13.4 Cooperation in the Defense of Administrative and/or Legal Actions 39

12.13.5 Administrative Proceedings 39

12.13.6 Support and Communication with Contractor’s Legal Affairs Department 39

12.14 Right of Setoff 40

12.15 Independent Contractor Status 40

12.16 Inspection at Contractor Site 40

12.17 Intellectual Property 40

12.18 Lobbying and Integrity 40

12.19 Loss of Data 41

12.20 Modifications of Terms 41

12.21 Notices 41

12.22 Cooperation with the Inspector General 42

12.23 Public Records 42

12.23.1 Access to Public Records 42

12.23.2 Redacted Copies of Confidential Information 42

12.23.3 Request for Redacted Information 43

12.23.4 Indemnification 43

12.23.5 Contractor as Agent 43

12.24 Rights to Records 44

12.25 Taxes 44

Attachment A: Draft Contract Page 4 of Page 47

12.26 Waiver 44

12.27 Warranty of Authority 44

12.28 Warranty of Ability to Perform 44

12.29 Severability 45

12.30 Organizational Conflicts of Interest 45

12.31 Best Pricing Clause 45

12.32 Convicted Vendor, Discriminatory Vendor, Antitrust Violator Vendor, and

Suspended Vendor Lists 45

12.33 Section 508 Compliance 46

ATTACHMENTS:

ATTACHMENT 1: AFFIDAVITS

ATTACHMENT 2: ADMINISTRATIVE REQUIREMENTS

ATTACHMENT 3: PERFORMANCE GUARANTEES

ATTACHMENT 4: PLAN BENEFIT DESIGN

ATTACHMENT 5: INTERFACE FILES LAYOUTS LIFE ENROLLMENT SPECIFICATIONS

ATTACHMENT 6: PRICING

ATTACHMENT 7: PRIVACY, SECURITY, AND CONFIDENTIALITY BUSINESS ASSOCIATE

AGREEMENT

ATTACHMENT 8: APPROVED SUBCONTRACTORS (IF APPLICABLE)

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK

Attachment A: Draft Contract Page 5 of Page 47

CONTRACT

This Contract is entered between STATE OF FLORIDA, DEPARTMENT OF MANAGEMENT SERVICES (“Department”), an agency of the State of Florida, with offices at 4050 Esplanade Way, Tallahassee, Florida 32399-0950, and {Insert Contractor Name} (“Contractor” or “Service Provider”), with offices at {Insert Contractor Address}, each, a “Party” and collectively referred to herein as the “Parties”.

WHEREAS, the Contractor responded to the Department’s Request for Proposals (RFP) No.:

DMS-22/23-084 for Group Term Life Insurance (Services); and

WHEREAS, the Parties wish to enter into this Contract in accordance with the terms and conditions of the RFP.

NOW THEREFORE, in consideration of the promises and mutual covenants set forth herein, the Parties agree as follows:

Section 1 DEFINITIONS

1.1. Definitions

The following capitalized terms used in this Contract (including the Attachments thereto) have the meanings ascribed below:

“Acceptance” and “Accepted” mean that the resulting Services provided by the Contractor have been formally acknowledged in writing by the Department as meeting the specified requirements established in the Contract.

“Account Management Team” means the individuals required by Attachment 2: Administrative Requirements, II. Account Management, AR-5.

{Insert Name}, Account Management, Client Consultant {Insert Name}, Account Management, Back-up for {Insert Name above}, Client Consultant {Insert Name}, Account Management, Director, Client Services {Insert Name}, Implementation, Client Acquisition Consultant {Insert Name}, Account Executive/Sales {Insert Name}, Executive Sponsor

Changes to the individuals listed above shall be sent to the Department in writing and will not require a Contract amendment.

“Business Day” means any day of the week excluding weekends and holidays observed by State agencies pursuant to subsection 110.117(1), Florida Statutes (F.S.).

“Calendar Day” means any day in a month, including weekends and holidays.

“Claim(s)” means an application for benefit payment, which is filed in accordance with the Contractor’s and/or Department’s requirements.

“Confidential Information” means information that is confidential, proprietary, trade secret, or otherwise not subject to public disclosure pursuant to section 24, Article I of the Florida

Attachment A: Draft Contract Page 6 of Page 47

Constitution (such exemptions may be found in Chapter 119, Florida Statutes, or any other Florida law, federal law, or regulation that serves to exempt information from public disclosure).

“Contract” means this agreement between the Department and Contractor consisting of, in order of precedence, the following documents:

1. This agreement and its attachments, in the following order of precedence:

a. Attachment 1: Affidavits;

b. Attachment 2: Administrative Requirements;

c. Attachment 3: Performance Guarantees;

d. Attachment 4: Plan Benefit Design;

e. Attachment 5: Interface Files Layouts Life Enrollment Specifications;

f. Attachment 6: Pricing;

g. Attachment 7: Privacy, Security, and Confidentiality Business Associate Agreement;

h. Attachment 8: Approved Subcontractors (if applicable); and

i. RFP No.: DMS-22/23-084 and all addenda, in reverse order of posting on the Vendor

Information Portal.

In the event of conflict between this Contract document and the Attachments, the Attachments will control.

2. The General Contract Conditions - PUR 1000 form, which is incorporated by reference, and available at the weblink listed below. The Parties agree that the following provisions of the PUR 1000 are not applicable to this Contract: 2-13, 16-23, 25-29, 31- 32, 34-38, 44-45, 47).

https://www.dms.myflorida.com/content/download/2933/11777/PUR_1000_General_ Contract_Conditions.pdf

If the Contract terms are inconsistent with the Plan Benefit Schedule or any applicable federal or state statute, administrative rule or regulation; then the provisions of the Plan Benefit Schedule or statute, rule, or regulation will control.

“Contractor” means the life insurance entity contracted to provide the Services to Participants pursuant to benefit documents and to provide other specific Services required by this Contract.

“Contract Administrator” means the person designated pursuant to section 12.5 of this Contract.

“Contract Manager” means those persons designated pursuant to section 12.6 of this Contract.

“Data” or “State of Florida Data” means a representation of information, knowledge, facts, concepts, computer software, or computer programs or instructions (including any that it is exempt; confidential; or Protected Health Information protected under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 45 C.F.R. §§ 160 and 164, the Health Information Technology for Economic and Clinical Health Act of 2009 (the “HITECH Act”), and the regulations promulgated thereunder, or section 110.123(9), F.S.), that is received by the Contractor, or created by the Contractor, in the performance of the Services under the Contract.

State of Florida Data may be in any form, including but not limited to, storage media, computer memory, in transit, presented on a display device, or in physical media such as paper, film, Attachment A: Draft Contract Page 7 of Page 47 microfilm, or microfiche. State of Florida Data includes the original form of the State of Florida Data and all metadata associated with the State of Florida Data.

“Department” means the Florida Department of Management Services or its designee, including the Division of State Group Insurance, which is responsible for all aspects of the purchase and contract management of insurance products for State employees, retirees and other eligible Participants under the State Group Insurance Program, the package of insurance plans authorized in section 110.123(2)(3)(k), Florida Statutes.

“Division” means the Department’s Division of State Group Insurance (DSGI).

“Effective Date” means the date the Contract is fully executed by all Parties, and therefore signals the start of implementation and transition activities.

“Eligible Dependents” means a Dependent of a Participant, as defined by the Florida Administrative Code (F.A.C.) and statutes.

“Final Implementation Plan” means the written description provided by the Contractor, as approved by the Department, of the schedule of actions necessary to implement the Services and begin fulfilling the Contract in a timely manner as described by Contractor in the Reply and modified as necessary by the Department and Contractor and ultimately approved by the Department.

“HIPAA” refers to the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 together with the provisions of the Health Information Technology for Economic and Clinical Health Act (the HITECH Act). The Contractor shall comply with HIPAA.

“Implementation Date” means January 1, 2024, at 12:00 A.M., Eastern Time (EST), the anticipated first date Services are provided to Participants.

“Implementation Period” means the period between the Effective Date and the Implementation Date.

“Material” means important or relevant to the implementation of Contract requirements.

“Notice” means written notification from one Party to the other Party regarding performance under the Contract.

“Participants” means all Subscribers and their enrolled Eligible Dependents.

“Parties” means the Department and Contractor.

“People First” means enterprise-wide suite of services used by the State to manage human capital including the administration of human resources, benefits, payroll, and staffing. People First is the State’s system of record for Plan eligibility.

“Performance Guarantees” means specific measurement indicators assigned to Contract tasks representing timeliness and quality of task output.

“Plan(s)” means the Group Term Life Benefits, as specified in Attachment 4: Plan Benefit Design.

“Plan Year” means the calendar year (January 1st to December 31st).

Attachment A: Draft Contract Page 8 of Page 47

“Program” means the State Group Insurance Program defined in sections 110.123(3) and 110.12315, F.S.

“Protected Health Information” is defined in HIPAA at 45 CFR 160.103, and as used in this Agreement also refers to the term “Protected Health Information,” as defined in the HITECH Act.

“RFP” means the Request for Proposals No.: DMS-22/23-084, Group Term Life Insurance, including all attachments and addenda to the Request for Proposals.

“Reply” means the documents submitted by the Contractor in response to the RFP. The Reply, to the extent the provisions thereof are not in conflict with the Contract, constitutes a Material representation relied upon by the Department in entering into this Contract.

“Respondent” means a life insurance entity that provides a Reply to the RFP.

“Secretary” means the Secretary of the Department or his or her designee.

“Services” means services to be performed by Contractor as specified in this Contract, including the requirements of the Attachments to this Contract. The term “Services” includes but is not limited to, any unspecified service that is inherent in proper delivery of a specified Service. During the term of the Contract, the Department will have the right to add or delete Services. If the Department elects to add Services, the Contractor and the Department will negotiate a mutually agreed amendment to the Contract.

“State” means the State of Florida.

“Subcontractor” refers only to Contractor’s Subcontractors and agents that deliver Services required by this Contract.

CONTRACT DOCUMENTS

2.1 Rules of Interpretation

The following rules of interpretation shall apply, unless otherwise indicated:

a. Reference to, and the definition of, any document (including any attachments) shall be deemed a reference to such document as it may be amended, supplemented, revised or modified;

b. The table of contents and section headings and other captions are for the purpose of reference only and do not limit or affect the content, meaning or interpretation of the text;

c. Defined terms in the singular shall include the plural and vice versa and the masculine, feminine or neutral-genders shall include all genders;

d. The words “hereof,” “herein,” “hereunder,” and words of similar import, shall refer to this Contract as a whole and not to any particular provision of this Contract;

e. The words “include,” “includes” and “including” are deemed to be inclusive and followed by the phrase “without limitation”;

f. Any reference to a governmental entity or person shall include the governmental entity’s or person’s authorized successors and assigns; and

Attachment A: Draft Contract Page 9 of Page 47

g. The words “quarterly,” “on a quarterly basis,” “quarterly meeting” or other similar terms mean, unless otherwise stated herein, once every three (3) months, beginning January 1, 2024.

2.2 Hierarchy of Documents

The Contract sets forth the entire understanding between the Parties. In the event that any of the Contract documents conflict, the conflict will be resolved in the order of precedence as listed in the definition of the term “Contract” in section 1.1. However, if the Contract terms are inconsistent with the Plan Benefits Schedule or any applicable federal or state statute, administrative rule, or regulation; then the provisions of the Plan Benefits Schedule or statute, rule, or regulation will control.

The Contract is an independent contract and has no effect upon any other contracts between the Parties.

TERM, SCOPE, AND PAYMENTS

3.1 Term

3.1.1 Initial term

For the initial term, Services will commence on the Effective Date and end after 11:59:59 P.M. (EST), on December 31, 2027, unless extended, terminated or renewed as provided herein. The Parties acknowledge that the Plan will not be implemented and administered under this Contract until January 1, 2024. While pre-implementation services will be required, premium payments from Participants will be made only in accordance with section 3.8 of the Contract.

3.1.2 Renewals

The Department, at its sole option and discretion, may renew the Contract for up to four

(4) additional years at the same prices as those specified in this Contract or lower negotiated prices. Such renewal will be binding on Contractor and may be in one (1) year or multiple-year increments at the Department’s sole option. Renewal in whole or in part shall be at the sole discretion of the Department and shall be contingent upon the Department’s determination that Contractor has satisfactorily performed its obligations under the Contract. The Department shall also consider whether Contractor has been subject to any performance violations, financial consequences, and/or liquidated damages in complying with any of the Contract requirements. Any renewal shall be in writing and signed by both Parties.

The Contractor shall not charge any costs for renewing the Contract. The renewal is subject to appropriations by legislature and is contingent upon the availability of funds.

This Contract may be extended in accordance with section 287.057(13), F.S.

3.2 Department’s Right to Terminate for Convenience

The Department, by sixty (60) Calendar Days advanced written notice to Contractor, may terminate the Contract for any reason or no reason at all when the Department determines in

Attachment A: Draft Contract Page 10 of Page 47 its sole discretion that it is in the Department’s interest to do so. The Contractor shall not perform any Services after the effective date of the termination, except as necessary to complete the continued portion of the Contract, if any. The Contractor will not be entitled to recover any lost profits, consequential or indirect damages, or any other damages other than the payment amounts due for performance until the effective date of termination. If this Contract is terminated for convenience prior to January 1, 2024, the Department shall reimburse Contractor for direct costs actually incurred for Services authorized by the Department and satisfactorily performed prior to the notice of termination.

3.3 Scope of Work

For the term of the Contract and any renewal period (if the right to renew is exercised by the Department), Contractor shall provide Group Term Life Insurance as detailed in this Contract.

The Contractor will provide all labor, materials, and supplies necessary to provide the Services as described in this Contract and the Attachments, including but not limited to, providing all reports listed in Attachment 2: Administrative Requirements in the prescribed format and frequency, as well as to the intended recipient by the due date. The Contractor agrees to periodic reviews by the Department on Contractor’s performance to improve delivery of the Services. Corrective work to comply with the requirements of this Contract will be performed by the Contractor at its expense, and Contractor will not be entitled to any compensation for such corrective work.

3.4 Modifications and Changes

The Department, by written change order, may unilaterally require changes altering, adding to, or deducting from the Services, products, or Contract specifications, provided that such changes are within the general scope of the Contract. If Services or products are added, the Contractor and the Department will negotiate a mutually agreed amendment to the Contract.

The Department may make an equitable adjustment in the Contract price or delivery date if changes to Contract specifications affect the cost or time of performance. Such equitable adjustments require the written consent of the Contractor, which shall not be unreasonably withheld. If the Parties fail to agree to an equitable adjustment, such dispute must be resolved pursuant to the Dispute Resolution procedures identified in section 12.7.

The Contract, including its Attachments, contains all the terms and conditions agreed upon by the Parties, which shall govern all transactions under the Contract. Other than as specified above, the Contract may only be modified or amended upon mutual written agreement of the Department and Contractor. No oral agreements or representations shall be valid or binding upon the Department or Contractor. Contractor may not unilaterally modify the terms of the Contract by incorporating terms onto Contractor’s order or fiscal forms or other documents forwarded by Contractor for payment. The Department’s acceptance of Service or processing of documentation on forms furnished by Contractor for approval or payment will not constitute amendment to this Contract or waiver of a default.

3.5 Department’s Right to Suspend Work

The Department may in its sole discretion suspend any or all Services under the Contract, at any time, when in the best interests of the Department to do so. The Department will provide

Attachment A: Draft Contract Page 11 of Page 47

Contractor written Notice outlining the particulars of suspension. Examples of the reason for suspension include, but are not limited to, budgetary constraints, declaration of emergency, or other like circumstances. After receiving a suspension Notice, the Contractor will comply with the Notice.

3.6 Department’s Obligation to Supply Data to Contractor

The Department shall supply all eligibility and personnel data and information necessary for Contractor to provide the Services.

3.7 Bills for Travel

Bills for travel expenses are not permitted under this Contract.

3.8 Payments

The Contractor agrees to perform all the Services for the compensation and financial arrangements set forth in this Contract and Attachment 6: Pricing. No additional compensation will be allowed. The Parties agree that payments under this Contract shall be made in accordance with this section of the Contract, and section IX: Payment Specifications of Attachment 2.

The Parties agree that payments under this Contract shall be made monthly in accordance with the enrollment information maintained by People First, the State’s self-service, secure, web-based human resource information system and enterprise-wide suite of human resource services. Contractor shall not invoice or bill the Department. Payments will be made to Contractor via electronic funds transfer (EFT) and by State-determined due dates. Contractor must complete a direct deposit authorization form. Payments from Contractor to the State shall be made via EFT and by State-determined due dates.

On a monthly basis, DSGI will verify the calculation of premium payments due to Contractor based on contracted premium rates and Member enrollment. People First maintains and updates the State’s system of records and will calculate the premium due using its eligibility and enrollment system. People First will make adjustments based on updated information.

Upon conclusion of the annual open enrollment period, People First will provide Contractor with enrollment data for all Members enrolled at that time for the next Plan Year’s coverage to allow Contractor to meet all necessary Service requirements and Performance Guarantees.

All payments to the State shall be made separately by EFT from any payment balances due from the State. The netting of payments related to the Contract is prohibited.

Employee-paid premiums are generally deducted from the Participant’s paychecks. Payroll deductions must be processed as even-numbered premium amounts. If a Participant’s calculated monthly premium is odd, the system will add or subtract one (1) penny from the premium deducted. Disregarding the dollar amount, if the odd numbered premium is more than fifty (50) cents per month, one (1) penny is added to the amount deducted. Disregarding the dollar amount, if the odd numbered premium is less than fifty (50) cents per month, one

(1) penny is subtracted from the amount deducted. Amounts resulting from this addition or reduction will not be considered an overpayment or underpayment. Neither Contractor nor the

Attachment A: Draft Contract Page 12 of Page 47

State nor the Participant will collect any amount of excess premium that may accumulate from this process.

Rate increases are subject to the approval of the Department. An appropriate premium rate adjustment may be made via Contract amendment. Without the Department’s approval, the premium rates shall not be different than those specified in Attachment 6: Pricing of the Contract.

In consideration of the Department’s internal requirements and open enrollment, premium rate changes must be approved by the Department prior to July 1st of any Plan Year. Premium rate changes submitted after this date or submitted prior to this date but without time for a reasonable review period will not be considered.

3.9 Appropriations

The State of Florida’s performance and obligation to pay under this contract is contingent upon an annual appropriation by the Legislature. No Department funds will be expended on this Contract.

3.10 Non-Exclusive Contract

Nothing herein is intended to assure the Contractor that it is the only vendor providing these Services to the State, nor does it prohibit the State from procuring these services from additional vendors during the term of the Contract.

CONTRACT ADMINISTRATION

4.1 Ownership of Deliverables and Retention of Records

All Deliverables, papers, documents, materials, work and other items prepared by Contractor and provided to the State for purposes of the Contract are the property of the Department and shall be available to the Department at any time. The Department has the right to use the same without restriction and without any additional payments to Contractor other than that specifically provided by the Contract. The Contractor does not waive its rights in any Deliverables not prepared specifically for the Department that are also provided to other clients of Contractor for substantially the same purpose as they are provided to the Department, however, Contractor hereby grants a license to the Department to use such documents. Data deemed proprietary, trade secret, or otherwise confidential may be subject to further restrictions in compliance with Florida Statutes and federal laws and regulations.

Contractor shall retain sufficient documentation to substantiate claims for payment under the Contract, and all other records (including electronic files), papers, and documents, which were made for purposes of the Contract. Such records shall include all records in all types of media and all formats maintained by the Contractor directly relating to the Services. Contractor shall retain all such records, papers, and documentation in compliance with record retention schedules published by the State of Florida Department of State. Prior to the destruction of any such records, papers, or documentation, Service Provider will consult with and obtain the prior written approval of the Department.

Attachment A: Draft Contract Page 13 of Page 47

Additionally, in accordance with section 216.1366, F.S., the Department is authorized to inspect the: (a) financial records, papers, and documents of the Contractor that are directly related to the performance of the Contract or the expenditure of state funds; and (b) programmatic records, papers, and documents of the Contractor which the Department determines are necessary to monitor the performance of the Contract or to ensure that the terms of the Contract are being met. The Contractor shall provide such records, papers, and documents requested by the Department within ten (10) Business Days after the request is made.

4.2 Contractor Obligations

4.2.1 General

Contractor will provide any and all labor, materials, and supplies necessary to perform the Services in the manner prescribed by this Contract. Contractor will meet or exceed the Service requirements set forth in Attachment 2: Administrative Requirements and Attachment 3: Performance Guarantees.

Contractor’s sole remuneration shall be the premiums paid.

4.2.2 Major Organizational Changes

The Parties agree that in order for efficient and effective communication to occur, clear lines of authority and areas of responsibility need to be identified for each Party. Each Party agrees to promptly notify the other in writing in the event of any material change in personnel, address, or phone number.

Contractor recognizes and agrees that award of the Contract was predicated upon features of Contractor's business organization as represented by Contractor in their response to the RFP. If Contractor transfers or sells fifty percent (50%) or more of its equity shareholder interests or allows a sale of substantially all of its assets, the Contractor shall notify the Department in writing no less than thirty (30) Calendar Days prior to such transfer or sale.

4.2.3 Subcontractors

Contractor is responsible for the acts or omissions of all Subcontractors, if any, it uses in the provision of the Services during the term of the Contract. The Department will have no liability of any kind for Subcontractor demands, loss, damage, negligence, or any expense relating, directly or indirectly, to Subcontractors.

Contractor will not subcontract any of the Services or enter into any subcontracts or change approved Subcontractors set forth in Attachment 8: Approved Subcontractors (including their key personnel and/or location of processes for the Services) without the express written consent of the Department. In seeking such consent, the Contractor will provide the Department prior notice of at least sixty (60) Calendar Days or, in case of an emergency, as soon as practical. Each approved Subcontractor will be subject to the same terms and conditions as outlined in this Contract. For purposes of this section, term insurance providers are not considered to be Subcontractors. The Contractor shall not utilize any volunteers in the performance of Services.

Attachment A: Draft Contract Page 14 of Page 47

4.2.4 Background Screening, Record Retention, and Warranty of Security

All of Contractor employees, Subcontractors and agents performing work under the Contract must comply with all security and administrative requirements of the Department.

4.2.4.1 Group Term Life Coverage for Retired Employees

In addition to any background screening required by the Contractor as a condition of employment, the Contractor warrants that it will conduct a criminal background screening of, or ensure that such a screening is conducted for, each of its employees, subcontractor personnel, independent Contractors, leased employees, volunteers, licensees, or other person, hereinafter referred to as “Person” or “Persons,” operating under their direction who directly perform Services under the Contract, whether or not the Person has access to State of Florida Data, as well as those who have access, including indirect access, to State of Florida Data, whether or not they perform services under the Contract.

The Contractor warrants that all Persons will have passed the Background Screening described herein prior to, but no longer than five (5) year’s before, they gain access to State of Florida Data or begin performing services under the Contract. The look-back period for such background screenings shall be for a minimum of six (6) years where six (6) years of historical information is available.

“Access” means to review, inspect, approach, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any data, regardless of type, form, or nature of storage or the ability to review, inspect, approach, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any data, regardless of type, form, or nature of storage. Access to a computer system or network includes local and remote access.

“Data” or “State of Florida Data” is as defined in Section 1.1. The minimum background check process must include a check of the following databases through a law enforcement agency or a Professional Background Screener accredited by the National Association of Professional Background Screeners, or a comparable standard:

Social Security Number Trace; and Criminal Records (Federal, State and County criminal felony and misdemeanor, national criminal database for all states which make such data available); The Contractor agrees that each Person has been screened as a prior condition for performing services or having access to State of Florida Data.

“Person” or “Persons” means employees, temporary employees or other individuals directly performing Services under the Contract with access to State of Florida Data. The term Person or Persons also means those Persons who are not performing Services under the Contract but have access, including indirect access, to State of Florida Data.

Attachment A: Draft Contract Page 15 of Page 47

The Contractor is responsible for any and all costs and expenses in obtaining and maintaining the criminal background screening information for each Person described above. The Contractor will maintain, or cause to be maintained, documentation of the screening in the Person’s employment file. The Contractor will abide by all applicable laws, rules, and regulations including, but not limited to, the Fair Credit Reporting Act and/or any equal opportunity laws, rules, regulations, or ordinances. The Department may require the Contractor to exclude the Contractor’s employees, agents, representatives, or subcontractors based on the background check results.

The Department may refuse access to, or require replacement of, any Contractor, employee, Subcontractor, or Subcontractor employee, or agent for cause, including, but not limited to, technical or training qualifications, quality of work, change in security status, or non-compliance with the Department’s security or other requirements. Such approval shall not relieve the Contractor of its obligation to perform all work in compliance with the Contract. The Department may reject and bar from any facility for cause any of the Contractor’s employees, subcontractors, or agents.

In the event of unforeseen access by Contractor or Subcontractor employees who do not directly perform services under the Contract in the normal course of their duties and who have not been subject to background screenings in accordance with this section, the Department shall be notified of such access within thirty (30) Calendar Days; except that this requirement shall not apply when such access is not specifically limited to State of Florida Data and such access incidentally arises from legitimate business purposes that are wholly unrelated to the Services and work being performed under this Contract.

Notification shall include the employee’s name, the date and time of access and the results of the employee’s most recent background screening, as allowed by law. This access and notification of access will not result in any financial consequences or liquidated damages unless such access occurred in the course of the commitment of, or the intention to commit, an illegal act.

Within five (5) Business Days of receipt of a written request from the Department, the Contractor shall provide copies of all documentation of the security screening of any Person, including Subcontractor personnel, as allowed under applicable state and federal law.

The initial screenings shall be completed on all Persons no later than the Effective Date.

4.2.4.2 Disqualifying Offenses

If at any time it is determined that a Person has been found guilty of a misdemeanor or felony offense as a result of a trial or has entered a plea of guilty or nolo contendere, regardless of whether adjudication was withheld, within the last six (6) years from the date of the court’s determination for the crimes listed below, or their equivalent in any jurisdiction, the Contractor is required to immediately remove that person from any position with Access to State of Florida

Attachment A: Draft Contract Page 16 of Page 47

Data or directly performing services under the Contract. The disqualifying offenses are:

(a) Computer-related crimes;

(b) Information Technology crimes;

(c) Fraudulent practices;

(d) False pretenses;

(e) Frauds;

(f) Credit card crimes;

(g) Forgery;

(h) Counterfeiting;

(i) Violations involving checks and drafts;

(j) Misuse of medical or personnel records;

(k) Felony theft; and

(l) Identity Theft.

If the Contractor finds a Disqualifying Offense for a Person within the last six (6) years from the date of the court’s disposition, it may obtain information regarding the incident and determine whether that Person should continue providing Services under the Contract or have Access to State of Florida Data. The Contractor will consider the following factors only in making the determination: i.)

nature and gravity of the offense, ii.) the amount of time that lapsed since the offense, iii.) the rehabilitation efforts of the person and iv.) relevancy of the offense to the job duties of the Person. If the Contractor determines that the Person should be allowed Access to State of Florida Data, then Contractor shall maintain all criminal background screening information and the rationale for such Access in the Person’s employment file.

The Contractor shall require all Persons to self-report within three (3) Business Days of adjudication to the Contractor any adjudication of guilt as described above for the Disqualifying Offenses. The Contractor shall immediately disallow that Person Access to any State of Florida Data or Services under the Contract.

Additionally, the Contractor shall require that the Person complete an annual certification that he or she has not received an adjudication of guilt as described above for the Disqualifying Offenses and shall maintain that certification in the employment file.

4.2.4.3 Refresh Screening

The Contractor will ensure that all background screening will be refreshed every five (5) years from the time initially performed for each Person during the Term of the Contract.

4.2.4.4 Annual Certification

The Contractor is required to submit the attached Affidavit of Warranty of Security to the Department by December 31st of each Contract year.

Attachment A: Draft Contract Page 17 of Page 47

4.2.4.5 Duty to Provide Secure Data

The Contractor will maintain the security of State of Florida Data including, but not limited to, a secure area around any display of such State of Florida Data or State of Florida Data that is otherwise visible. The Contractor will also comply with all Gramm-Leach-Bliley Act, all HIPAA and Rule Chapter 60GG-2, F.A.C., requirements and any other state and federal rules and regulations, as well as industry standards, regarding security of information. State of Florida Data cannot be disclosed to any person or entity that is not directly approved to participate in the Services provided under this Contract.

The Contractor shall not use, or otherwise disseminate, sell, copy or make available to any person or entity, Data relating to any aspect of performance of the Services, without prior written authorization of the Department. This requirement shall survive the termination of the Contract.

4.2.4.6 Department’s Ability to Audit Screening Compliance and Inspect Locations

The Department reserves the right to audit the Contractor’s background screening process upon two (2) Business Days’ prior written notice to the Contractor during the Term of the Contract. The Department will have the right to inspect the Contractor’s working area, computer systems, and/or location upon five (5) Business Days’ prior written notice to the Contractor to ensure that Access to the State of Florida Data is secure and in compliance with the Contract and all applicable state and federal rules and regulations.

Upon notice of a security breach as defined in section 501.171, Florida Statutes, the Department shall have the right to audit the Contractor’s background screening process upon twenty-four (24) hours written notice to the Contractor.

This provision shall control over any conflicting provisions within the main Contract.

4.2.4.7 Record Retention

The Contractor shall retain a list of all Persons with Access to Data, including a statement confirming that each Person has passed the Background Screening required herein. Such a statement shall not include the substance of the screening results, only that the Person has passed the screening.

The Contractor shall create a written policy for the protection State of Florida Data, including a policy and procedure for Access to State of Florida Data.

The Contractor shall document and record, with respect to each instance of Access to State of Florida Data:

1) The identity of all individual(s) who Accessed State of Florida Data in any way, whether those individuals are authorized Persons or not;

2) The duration of the individual(s)’ Access to State of Florida Data, including the time and date at which the Access began and ended;

Attachment A: Draft Contract Page 18 of Page 47

3) The identity, form, and extent of State of Florida Data accessed, including, but not limited to, whether the individual Accessed partial or redacted versions of State of Florida Data, read-only versions of State of Florida Data, or editable versions of State of Florida Data; and

4) The nature of the Access to State of Florida Data, including whether State of Florida Data was edited or shared with any other individual or entity during the duration of the Access, and, if so, the identity of the individual or entity.

The Contractor shall retain the written policy and information required in this section for the duration of this Contract and a period of no less than five (5) years from the date of termination of this Contract and any Contract extensions. The written policy and information required in this section shall be included in the Department’s audit and screening abilities as defined in section

4.2.4.6. The written policy and information required in this section shall also be subject to immediate disclosure upon written or oral demand at any time by the Department or its designated agents or auditors.

Failure to compile, retain, and disclose the written policy and information as required in this section shall be considered a breach of the Contract. The resulting damages to the Department from a breach of this section are by their nature impossible to ascertain presently and will be difficult to ascertain in the future. The issues involved in determining such damages will be numerous, complex, and unreasonably burdensome to prove. The Parties acknowledge that these financial consequences are liquidated damages, exclusive of any other right to damages, not intended to be a penalty, and solely intended to compensate for unknown and unascertainable damages. The Contractor therefore agrees to credit the Department the sum of $5,000 per event, for each breach of this section.

4.2.4.8 Indemnification

The Contractor agrees to defend, indemnify, and hold harmless the Department, the State of Florida, its officers, directors, and employees for any claims, suits, or proceedings related to a breach of section 4 of this Contract. The Contractor will include credit monitoring services at its own cost for those individuals affected or potentially affected by a breach of this section for a period of one (1) year following the breach.

4.2.5 Work Locations, No Offshoring of Data

Contractor, including its employees, subcontractor personnel, independent contractors, leased employees, volunteers, licensees, or other persons operating under their direction, are prohibited from (i) performing any Services under the Contract outside of the U.S., or (ii) sending, transmitting, or accessing any State of Florida Data, outside of the U.S. The Parties agree that a violation of this provision will:

(a) result in immediate and irreparable harm to the Department, entitling the Department to immediate injunctive relief, provided, however, this shall not constitute an admission by the Contractor to any liability for damages under

Attachment A: Draft Contract Page 19 of Page 47 subsection (c) below or any claims, liability, or damages to a third party, and is without prejudice to the Contractor in defending such claims.

(b) entitle the Department to a credit of $50,000 per violation, with a cumulative total cap of $500,000 per event. This credit is intended only to cover the Department’s internal staffing and administrative costs of investigations and audits of the transmittal of State of Florida Data outside the U.S.

(c) entitle the Department to recover damages, if any, arising from a breach of this section and beyond those covered under subsection (b).

(d) constitute an Event of Default not subject to the dispute resolution provisions in section 12.7 (“Dispute Resolution, Governing Law and Venue”) of this Contract.

The credits in subsection (b) are a reasonable approximation of the internal costs for investigations and audits from a violation. The credits are in the nature of liquidated damages and not intended to be a penalty on the Contractor. By executing this Contract, Contractor acknowledges and agrees the costs intended to be covered by subsection

(b) are not readily ascertainable and will be difficult to prove. Contractor agrees that it will not argue, and is estopped from arguing, that such costs are a penalty or otherwise unenforceable. For purposes of determining the amount of credits due hereunder, a group of violations relating to a common set of operative facts (e.g., same location, same time period, same offshore entity) shall be treated as a single violation. The credits will be paid to the Department as prescribed by the Department, and are exclusive of any other right to damages.

4.2.5.1 Contactor’s Responsibility to Notify Department

For purposes of sections 4.2.5.1 through 4.2.5.3, the following definitions apply:

“Breach” means a confirmed event that compromises the confidentiality, integrity, or availability of information or State of Florida Data, or unauthorized access of State of Florida Data in electronic form containing personal information. Additional requirements related to breaches of HIPAA information are covered in Attachment 7: Privacy, Security, and Confidentiality Business Associate Agreement.

“Incident” means a violation or imminent threat of violation, whether such violation is accidental or deliberate, of information technology security policies, acceptable use policies, or standard security practices. An imminent threat of violation refers to a situation in which the state agency has a factual basis for believing that a specific incident is about to occur.

Notwithstanding any provision of this Contract to the contrary, the Contractor shall notify the Department as soon as possible and in all events immediately upon discovering any Breach or Incident regarding State of Florida Data; any unauthorized access of State of Florida Data (even by persons or companies with authorized access for other purposes); any unauthorized transmission of State of Florida Data; or any credible allegation or suspicion of a material violation of the above. This notification is required whether the event affects

Attachment A: Draft Contract Page 20 of Page 47 one Participant or the entire population. The notification shall be clear and conspicuous and include a description of the following:

(a) The incident in general terms.

(b) The type of personal information that was subject to the unauthorized

Access and acquisition.

(c) The number of individuals who were, or potentially have been, affected by the Breach or Incident.

(d) The actions taken by the Contractor to protect the State of Florida Data information from further unauthorized Access. However, the description of those actions in the written notice may be general so as not to further increase the risk or severity of the Breach.

Upon becoming aware of an alleged Breach or Incident, the Contractor shall set up a conference call (via a telephone call and email) with the Department’s Contract Manager and any necessary parties. The conference call invitation shall contain a brief description of the nature of the event. When possible, a thirty (30) minute notice shall be given to allow Department personnel to be available for the call. If the designated time is not practical for the Department, an alternate time for the call shall be scheduled. All available information shall be shared on the call. The Contractor shall answer all questions based on the information known at that time and shall answer additional questions as additional information becomes known. The Contractor shall provide the Department with final documentation of the incident including all actions that took place. If the Contractor becomes aware of a Breach or Incident outside of normal business hours, the Contractor shall notify the Department’s Contract Manager as soon as possible, and in all events, within twenty-four (24) hours.

The Contractor’s failure to perform the obligations in this section shall also be an Event of Default, and will entitle the Department to recover any other damages it incurs arising from a failure to perform the obligations in this section (including any actual out-of-pocket expenses incurred by the Department to investigate and remediate the violation) and/or to pursue injunctive relief.

4.2.5.2 Contractor’s Responsibility to Notify Participants

The Contractor shall, at its sole expense, notify all Participants whose information was contained in the State of Florida Data that was accessed in the Breach, unauthorized access or transmission caused by the Contractor or its Subcontractors no later than thirty (30) Calendar Days after the determination of a Breach or reason to believe a Breach occurred. If the Contractor cannot identify the specific persons whose data may have been accessed, such notice shall be provided to all persons whose data reasonably may have been accessed. Nothing in this section will alter or replace the application of section 501.171, F.S., as to the Contractor’s obligations and liability for Breaches concerning personal information.

Attachment A: Draft Contract Page 21…