Attachment-C.Contract-Draft.docx

ATTACHMENT C

DRAFT CONTRACT

FOR

COMPREHENSIVE SURGICAL AND MEDICAL BUNDLED SERVICES AND CANCER CARE COORDINATION

DMS-24/25-258

BETWEEN

STATE OF FLORIDA

DEPARTMENT OF MANAGEMENT SERVICES

AND

[INSERT CONTRACTOR NAME]

Table of Contents

ATTACHMENTS:

Attachment 1: Statement of Work Attachment 2: Department Selected Portions of the Vendor’s Best and Final Offer Attachment 3: Department Selected Portions of Attachment B, Technical Reply Attachment 4: List of Department Approved Subcontractors Attachment 5: Privacy, Security, and Confidentiality Business Associate Agreement

THIS SPACE INTENTIONALLY LEFT BLANK

4050 Esplanade Way Tallahassee, FL 32399-0950 850-488-2786

Ron DeSantis, Governor Pedro Allende, Secretary

Contract No.: DMS-24/25-258 Attachment C: Draft Contract Page 1 of 2

Contract This Contract is between the STATE OF FLORIDA, DEPARTMENT OF MANAGEMENT SERVICES (Department), an agency of the State of Florida with offices at 4050 Esplanade Way, Tallahassee, Florida 32399-0950, and {Insert Contractor Name} (Contractor), with offices at {Insert Contractor Address} each, a “Party” and collectively referred to herein as the “Parties”.

WHEREAS, the Contractor responded to the Department’s Invitation to Negotiate (ITN) No. DMS-24/25-258 for Comprehensive Surgical and Medical Bundled Services and Cancer Care Coordination and was selected for award; and WHEREAS, the Parties enter into this Contract in accordance with the terms and conditions of the solicitation.

NOW THEREFORE, in consideration of the premises and mutual covenants set forth herein, the Parties agree as follows:

DEFINITIONS

The following capitalized terms used in this Contract (including the Attachments and any attachments thereto) have the meanings ascribed below:

“Account Management Team” means the individuals employed by the Vendor who will have primary responsibility for the Department’s account.

“Active Communications” means communications except those identified as Passive Engagement herein.

“Benefits Document” means the document approved by the Florida Legislature in accordance with section 110.123(5), Florida Statutes (F.S.), describing the scope of coverage, benefits available, limitations, restrictions and exclusions of the plan, and the conditions under which Service Provider will pay claims. The Benefits Document is subject to modification by the Florida Legislature and the Department at any time. The covered and excluded services in the Benefits Document will be equivalent to those set forth in the Benefits Document, together with any additional services expressly approved by the Department. The Benefits Document in effect as of the date of this contract is listed on the DMS website: https://www.mybenefits.myflorida.com/health/resources “Bundled Service” means a surgical and/or medical procedure that is performed to treat a Member undergoing a specific episode of care for a single payment.

“Bundled Service Program” means the program established under this Contract that allows Members to select a Bundled Service and receive Reward Payments when eligible.

“Business Day” means Monday through Friday, inclusive, except for those holidays specified in section 110.117, F.S., from 8:00 a.m. to 5:00 p.m., Eastern Time..

“Calendar Day” means any day in a month, including weekends and holidays.

“Claim(s)” means an application for payment of or reimbursement for health care expenses incurred by Participants, which is filed in accordance with the Summary Plan Description, Contract, Vendor’s requirements, and/or the Department’s requirements.

“Confidential Information” means information in the possession or under control of the State or Vendor that is exempt from public disclosure pursuant to section 24, Article I of the Constitution of the State; the Public Records Law, Chapter 119, Florida Statutes; or to any other Florida law, federal law or regulation that serves to exempt information from public disclosure.

"Contract" means this agreement between the Department and Contractor consisting of, in order of precedence, the following documents:

1. This agreement and its attachments, in the following order of precedence:

a. Attachment 5: Privacy, Security, and Confidentiality Business Associate Agreement;

b. Attachment 1: Statement of Work;

c. Attachment 2: Department Selected Portions of the Vendor’s Best and Final Offer;

d. Attachment 3: Department Selected Portions of Attachment B, Technical Reply;

e. Attachment 4: List of Department Approved Subcontractors;

In the event of conflict between this document and the Attachments, this document will control.

2. The General Contract Conditions - PUR 1000 form, which is incorporated by reference, and available at the weblink listed below. The Parties agree that the following provisions of the PUR 1000 are not applicable to this Contract: 2-13, 17, 20-23, 26-29, 31-32, 34-35, 38-39, 42, 45.

https://www.dms.myflorida.com/content/download/2933/11777/PUR_1000_General_Contract_Conditions.pdf

“Contract Administrator” means the person designated pursuant to subsection 10.5 of this Contract.

“Contract Manager” means those persons designated pursuant to subsection 10.6 of this Contract.

"Contractor” or “Service Provider” means the business entity that enters into a contract with the Department for Bundled Services.

“Data” or “State of Florida Data” means a representation of information, knowledge, facts, concepts, computer software, or computer programs or instructions (including any that it is exempt; confidential; or Protected Health Information protected under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 45 C.F.R. §§ 160 and 164, the Health Information Technology for Economic and Clinical Health Act of 2009 (the “HITECH Act”), and the regulations promulgated thereunder, or section 110.123(9), Florida Statutes), that is received by the Contractor, or created by the Contractor, in the performance of the Services under the Contract. State of Florida Data may be in any form including, but not limited to, storage media, computer memory, in transit, presented on a display device, or in physical media such as paper, film, microfilm, or microfiche. State of Florida Data includes the original form of the State of Florida Data and all metadata associated with the State of Florida Data.

“Deliverables” mean those services, items and/or materials provided, prepared, and delivered to the Department in the course of performance under this Contract by the Contractor.

“Department” means the Florida Department of Management Services or its designee. The Department reserves the right to contract with a third-party contractor to assume responsibility for the Department’s administration of the Contract.

“Division” means the Department’s Division of State Group Insurance.

“Effective Date” means the date the Contract is fully executed by all Parties.

“Eligible Dependent” means a Dependent of a Subscriber, as defined by the Florida Administrative Code and statutes.

“Enrollee” or “Subscriber” means the enrolled employee, retiree, surviving spouse, or COBRA participant that is the primary insured, as defined in section 110.123(2)(c), F.S.

"Healthcare Provider” means any physician, hospital, or other institution, organization, or person that furnishes health care services and is licensed or otherwise authorized to practice in the state.

“Health plan member (Member)” or “Participant” means any person participating in a state group health insurance plan, a TRICARE supplemental insurance plan, or a health maintenance organization plan under the state group insurance program, including Enrollees and Eligible Dependents thereof, as defined in section 110.123(2)(g), F.S.

“High Quality Provider” means a healthcare Provider or facility that has been identified as being high quality based on Contractor’s quality rating methodology.

“Household” means all Members under a particular Enrollee’s policy.

“Implementation Date” means January 1, 2026, at 12:00 A.M., Eastern Time (ET).

“Implementation Plan” means the written description provided by Contractor, as approved by the Department, of the schedule of actions necessary to implement the services and begin fulfilling the Contract in a timely manner.

“Invoice” means a billing statement provided by the Contractor to the Department for reimbursement of Services.

“ITN” means Invitation to Negotiate No. DMS-24/25-258, Comprehensive Surgical and Medical Bundled Services and Cancer Care Coordination “Notice” means written notification from one Party to the other Party regarding performance under the Contract.

“Passive Engagement to Members” means communications by the Department, its agents, or its other stakeholders include a) a description of the services within the open enrollment guide, b) a summary description of the Vendor or its services on the State’s benefits website(s), c) the response to individual Member questions either to the contractor or to DMS, or d) any broad-based communication to individual Members, groups of Members, or the overall membership about the suite of benefits the Department provides in the ordinary course of State business.

“Performance Guarantees” means specific measurement indicators assigned to Contract tasks representing timeliness and quality of task output.

“Plan Year” means the calendar year from January 1 to December 31.

“Privacy Rule” means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

“Program” means the State Group Insurance Program defined in sections 110.123(3) and 110.12315, Florida Statutes.

“Protected Health Information” shall have the same meaning and effect as defined in 45 C.F.R. 160 and 164, limited to the information created, received, maintained or transmitted by the Contractor from or on behalf of the Department.

“Reward Payment” means the reward amount that shall be received by an Enrollee for utilizing the Contractor’s Services for the selection of a Rewardable Service.

“Run-Out Claims” means a Claim for medical expenses incurred by a Member during the term of the Contract which is received by the Service Provider after termination of the Contract and within sixteen (16) months from the date that the health care services relating to such Claim were rendered.

“Secretary” means the Secretary of the Department or his or her designee.

“Service Commencement Date” means January 1, 2026, at 12:01 A.M., Eastern Time, the first date Services are provided to Members.

“Services” means tasks to be performed by the Contractor as specified in the Contract. The term “Services” includes but is not limited to, any unspecified task that is inherent in proper delivery or administration of a specified Service..

“State” means the State of Florida.

“Subcontractor” means the Contractor’s subcontractors and agents that deliver the Services required by this Contract. The term “Subcontractor” does not include health care providers.

“Summary Plan Description” means the Bundled Services benefit plan as written by the awarded Contractor. The Summary Plan Description will outline the Services and conditional requirements to obtain the Services.

CONTRACT DOCUMENTS

0. Rules of Interpretation The following rules of interpretation shall apply, unless otherwise indicated:

a. Reference to, and the definition of, any document (including any attachments) shall be deemed a reference to such document as it may be amended, supplemented, revised or modified;

b. The table of contents and section headings and other captions are for the purpose of reference only and do not limit or affect the content, meaning or interpretation of the text;

c. Defined terms in the singular shall include the plural and vice versa and the masculine, feminine or neutral-genders shall include all genders;

d. The words “hereof,” “herein,” “hereunder,” and words of similar import, shall refer to this Contract as a whole and not to any particular provision of this Contract;

e. The words “include,” “includes” and “including” are deemed to be followed by the phrase “without limitation”;

f. Any reference to a governmental entity or person shall include the governmental entity’s or person’s authorized successors and assigns; and

g. The words “quarterly,” “on a quarterly basis,” “quarterly meeting” or other similar terms mean, unless otherwise stated herein, once every three (3) months, beginning <<mm/dd/yyyy>>.

TERM, SCOPE, AND PAYMENTS

0. Term Initial term The initial Contract term is four (4) years and Services will commence on the Effective Date and end <<mm/dd/yyyy>>, unless extended, terminated, or renewed as provided herein. The Parties acknowledge that the Plan will not be administered under this Contract until January 1, 2026.

Renewals At its sole option and discretion, the Department may renew the Contract for up to four (4) additional one (1) year renewal terms. Such renewal will be binding on the Contractor and may be in one (1) year or multiple year increments at the Department’s sole option. Renewal in whole or in part shall be at the sole discretion of the Department and shall be contingent upon the Department’s determination that Contractor has satisfactorily performed its obligations under the Contract. The Department shall also consider whether the Contractor has been subject to any performance violations, financial consequences, and/or liquidated damages in complying with any of the Contract requirements. Any renewal shall be in writing and signed by both Parties.

The Contractor shall not charge any fees and/or costs for renewing the Contract. The renewal is subject to appropriations by legislature and is contingent upon the availability of funds.

Pursuant to section 287.057(13), Florida Statutes, this Contract may be extended if the failure to meet the criteria set forth in the contract for completion of the Contract is due to events beyond the control of the Contractor, as determined by the Department.

0. Department’s Right to Terminate for Convenience The Department, by sixty (60) Calendar Days advanced written notice to Contractor, may terminate the Contract for any reason or no reason at all when the Department determines in its sole discretion that it is in the Department’s best interest to do so. The Contractor shall not perform any Services after the effective date of the termination, except as necessary to complete the continued portion of the Contract, if any. The Contractor will not be entitled to recover any lost profits, consequential, special, punitive, or indirect damages, or any other damages other than the payment amounts due for performance until the effective date of termination.

0. Scope of Work The Contractor will provide all labor, materials, and supplies necessary to provide the Services as described in Attachment 1, Statement of Work. The Contractor agrees to periodic reviews by the Department on Contractor’s performance to improve delivery of the scope of work.

Corrective work to comply with the requirements of this Contract will be performed by the Contractor at its expense, and the Contractor will not be entitled to any compensation for such corrective work.

0. Modifications and Changes The Department, by written change order, may unilaterally require changes altering, adding to, or deducting from the Services, products, or Contract specifications, provided that such changes are within the general scope of the Contract. If Services or products are added, the Contractor and the Department will negotiate a mutually agreed amendment to the Contract. The Department may make an equitable adjustment in the Contract price or delivery date if changes to Contract specifications affect the cost or time of performance. Such equitable adjustments require the written consent of the Contractor, which shall not be unreasonably withheld. If the Parties fail to agree to an equitable adjustment, such dispute must be resolved pursuant to the Dispute Resolution procedures identified in section 10.7.

The Contract, including its Attachments, contains all the terms and conditions agreed upon by the Parties, which shall govern all transactions under the Contract. Other than as specified above, the Contract may only be modified or amended upon mutual written agreement of the Department and Contractor. No oral agreements or representations shall be valid or binding upon the Department or Contractor. Contractor may not unilaterally modify the terms of the Contract by incorporating terms onto Contractor’s order or fiscal forms or other documents forwarded by Contractor for payment. The Department’s acceptance of Service or processing of documentation on forms furnished by Contractor for approval or payment will not constitute amendment to this Contract or waiver of a default.

0. Department’s Right to Suspend Work The Department may in its sole discretion suspend any or all Services under the Contract, at any time, when in the best interests of the Department to do so. The Department will provide Contractor written Notice outlining the particulars of suspension. Examples of the reason for suspension include, but are not limited to, budgetary constraints, declaration of emergency or other like circumstances. After receiving a suspension Notice, the Contractor will comply with the Notice.

0. Department’s Obligation to Supply Data to Contractor The Department shall supply all eligibility and personnel data and information necessary for Contractor to provide the Services.

0. Bills for Travel Bills for travel expenses are not permitted under this Contract.

0. Payments The Contractor agrees to perform all Services for the compensation and financial arrangements set forth in Attachment 2, Department Selected Portions of the Vendor’s Best and Final Offer. No additional compensation will be allowed.

0. Specific Appropriation The State of Florida’s performance and obligation to pay under this Contract is contingent upon an annual appropriation by the Legislature.

0. Non-Exclusive Contract Nothing herein is intended to assure the Contractor that it is the only vendor providing these Services to the State, nor does it prohibit the State from procuring these services from additional vendors during the term of the Contract.

CONTRACT ADMINISTRATION

0. Ownership of Deliverables and Retention of Records All Deliverables, papers, documents, materials, work, and other items prepared by the Contractor and provided to the State for purposes of the Contract are the property of the Department and shall be available to the Department at any time. The Department has the right to use the same without restriction and without payments to Contractor other than that specifically provided by the Contract. Data deemed proprietary, trade secret or confidential shall be subject to compliance with Florida Statutes and federal laws and regulations.

The Contractor shall retain sufficient documentation to substantiate Claims for payment under this Contract, and all other records, electronic files, papers, and documents, which were made for purposes of the Contract. Such records shall include magnetic tapes, CD-ROM, diskettes, or other electronic media files maintained by the Contractor directly relating to the Services, including file labels, complete file layouts, data element descriptions and detailed processing logic to assist the Department auditor in processing or utilizing files. The Contractor shall retain all such records, papers, and documentation in compliance with record retention schedules published by the State of Florida Department of State. Prior to the destruction of any such records, papers, or documentation, Service Provider will consult with and obtain the prior written approval of the Department. Additionally, in accordance with section 216.1366, F.S., the Department is authorized to inspect the: (a) financial records, papers, and documents of the Contractor that are directly related to the performance of the Contract or the expenditure of state funds; and (b) programmatic records, papers, and documents of the Contractor which the Department determines are necessary to monitor the performance of the Contract or to ensure that the terms of the Contract are being met. The Contractor shall provide such records, papers, and documents requested by the Department within ten (10) Business Days after the request is made.

Contractor Obligations General Contractor will provide any and all labor, materials and supplies necessary to perform the Services in the manner prescribed by this Contract. The Contractor will meet or exceed the Minimum Service Requirements set forth in Attachment 2: Performance Guarantees.

Major Organizational Changes The Parties agree that in order for efficient and effective communication to occur, clear lines of authority and areas of responsibility need to be identified for each Party. Each Party agrees to promptly notify the other in the event of any material change in personnel, address, or phone number.

The Contractor recognizes and agrees that award of the Contract was predicated upon features of Contractor’s business organization as represented by the Contractor in their response to the ITN. If the Contractor transfers or sells fifty percent (50%) or more of its equity shareholder interests (whether in a single transaction or series of transactions) or allows a sale of substantially all of its assets, the Contractor shall notify the Department in writing no less than thirty (30) Calendar Days prior to such transfer or sale.

Subcontractors Contractor is responsible for the acts or omissions of all Subcontractors, if any, it uses in the provision of the Services during the term of the Contract. The Department will have no liability of any kind for Subcontractor demands, loss, damage, negligence, or any expense relating, directly or indirectly, to Subcontractors.

Contractor will not subcontract any of the Services or enter into any subcontracts or change approved Subcontractors as listed in Attachment 6: List of Department approved Subcontractors (including their key personnel and/or location of processes for the Services) without providing the Department prior Notice of at least sixty (60) Calendar Days or, in case of an emergency, as soon as practicable and receiving approval from the Department. Each approved Subcontractor will be subject to the same terms and conditions as outlined in this Contract.

Background Screening and Record Retention All the Contractor’s employees, Subcontractors and agents performing work under the Contract must comply with all security and administrative requirements of the Department.

Background Screening In addition to any background screening required by the Contractor as a condition of employment, the Contractor warrants that it will conduct a criminal background screening of, or ensure that such a screening is conducted for each of its employees, Subcontractor personnel, independent contractors, leased employees, volunteers, licensees, or other person, hereinafter referred to as “Person” or “Persons,” operating under their direction who directly perform services under the Contract, whether or not the Person has access to State of Florida Data, as well as those who have access, including indirect access, to State of Florida Data, whether or not they perform services under the Contract. The Contractor represents and warrants that all Persons will have passed the background screening described herein prior to, but no longer than five (5) years before, they gain access to State of Florida Data or begin performing services under the Contract. The look-back period for such background screenings shall be for a minimum of six (6) years where six (6) years of historical information is available.

“Access” means to review, inspect, access, approach, instruct, communicate with, store data in, retrieve data from, transmit, or otherwise make use of any data, regardless of type, form, or nature of storage or the ability to review, inspect, approach, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any data, regardless of type, form, or nature of storage. Access to a computer system or network includes local and remote access.

“Data” or “State of Florida Data” is as defined in section 1 of this Contract.

The minimum background check process must include a check of the following databases through a law enforcement agency or a Professional Background Screener accredited by the National Association of Professional Background Screeners, the National Committee for Quality Assurance, or a comparable standard:

· Social Security Number Trace; and

· Criminal Records (Federal, State and County criminal felony and misdemeanor, national criminal database for all states which make such data available).

The Contractor agrees that each Person has been screened as a prior condition for performing services under the Contract or having access to State of Florida Data.

The Contractor is responsible for any and all costs and expenses in obtaining and maintaining the criminal background screening information for each Person described above. The Contractor will maintain, or cause to be maintained, documentation of the screening in the Person’s employment file. The Contractor will abide by all applicable laws, rules, and regulations including, but not limited to, the Fair Credit Reporting Act and/or any equal opportunity laws, rules, regulations, or ordinances. The Department may require the Contractor to exclude the Contractor’s employees, agents, representatives, or Subcontractors based on the background check results.

The Department may refuse access to, or require replacement of, any Contractor, employee, Subcontractor, or Subcontractor employee, or agent for cause, including, but not limited to, technical or training qualifications, quality of work, change in security status, or non-compliance with the Department’s security or other requirements. Such approval shall not relieve the Contractor of its obligation to perform all work in compliance with the Contract. The Department may reject and bar from any facility for cause any of the Contractor’s employees, subcontractors, or agents. In the event of unforeseen access by Contractor or Subcontractor employees who do not directly perform services under the Contract in the normal course of their duties and who have not been subject to background screenings in accordance with this section, the Department shall be notified of such access within thirty (30) Calendar Days; except that this requirement shall not apply when such access is not specifically limited to State of Florida Data and such access incidentally arises from legitimate business purposes that are wholly unrelated to the Services and work being performed under this Contract. Notification shall include the employee’s name, the date and time of access and the results of the employee’s most recent background screening, as allowed by law. This access and notification of access will not result in any financial consequences or liquidated damages unless such access occurred in the course of the commitment of, or the intention to commit, an illegal act.

Within five (5) Business Days of receipt of a written request from the Department, the Contractor shall provide copies of all documentation of the security screening of any Person, including Subcontractor personnel, as allowed under applicable state and federal law.

Disqualifying Offenses If at any time it is determined that a Person has a criminal misdemeanor or felony record regardless of adjudication (e.g., adjudication withheld, a plea of guilty or nolo contendere, or a guilty verdict) within the last six (6) years from the date of the court’s determination for the crimes listed below, or their equivalent in any jurisdiction, the Contractor is required to immediately remove that Person from any position with Access to State of Florida Data or directly performing services under the Contract. The disqualifying offenses are:

(a) Computer-related crimes;

(b) Information technology crimes;

(c) Fraudulent practices;

(d) False pretenses;

(e) Frauds;

(f) Credit card crimes;

(g) Forgery;

(h) Counterfeiting;

(i) Violations involving checks or drafts;

(j) Misuse of medical or personnel records;

(k) Felony theft; and

(l) Identity Theft.

If the Contractor finds a Disqualifying Offense for a Person within the last six (6) years from the date of the court’s disposition, it may obtain information regarding the incident and determine whether that Person should continue providing Services under the Contract or have Access to State of Florida Data. The Contractor will consider the following factors only in making the determination: i.) nature and gravity of the offense, ii.) the amount of time that lapsed since the offense, iii.) the rehabilitation efforts of the person and iv.) relevancy of the offense to the job duties of the Person. If the Contractor determines that the Person should be allowed Access to State of Florida Data, then Contractor shall maintain all criminal background screening information and the rationale for such Access in the Person’s employment file.

The Contractor shall require all Persons to self-report within three (3) Business Days of adjudication to the Contractor any adjudication of guilt as described above for the Disqualifying Offenses. The Contractor shall immediately disallow that Person Access to any State of Florida Data or from directly performing Services under the Contract. Additionally, the Contractor shall require that the Person complete an annual certification that he or she has not received an adjudication of guilt as described above for the Disqualifying Offenses and shall maintain that certification in the employment file.

Refresh Screening The Contractor will ensure that all background screening will be refreshed every five (5) years from the time initially performed for each Person during the term of the Contract.

Department’s Ability to Audit Screening Compliance and Inspect Locations The Department reserves the right to audit the Contractor’s background screening process upon two (2) days prior written Notice to the Contractor during the term of the Contract. Department will have the right to inspect the Contractor’s working area, computer systems, and/or location upon two (2) Business Days prior written notice to the Contractor to ensure that Access to the State of Florida Data is secure and in compliance with the Contract and all applicable state and federal rules and regulations. Upon notice of a security breach as defined in section 501.171, Florida Statutes, the Department shall have the right to audit the Contractor’s background screening process upon twenty-four (24) hours written Notice to the Contractor. This provision shall control over any conflicting provisions within the main Contract.

Record Retention The Contractor shall retain a list of all Persons with Access to State of Florida Data, including a statement confirming that each Person has passed the Background Screening required herein. Such a statement shall not include the substance of the screening results, only that the Person has passed the screening.

The Contractor shall create a written policy for the protection of State of Florida Data, including a policy and procedure for Access to State of Florida Data.

The Contractor shall document and record, with respect to each instance of Access to State of Florida Data:

1) The identity of all individual(s) who Accessed State of Florida Data in any way, whether those individuals are authorized Persons or not;

2) The duration of the individual(s)’ Access to State of Florida Data, including the time and date at which the Access began and ended;

3) The identity, form, and extent of State of Florida Data accessed, including, but not limited to, whether the individual Accessed partial or redacted versions of State of Florida Data, read-only versions of State of Florida Data, or editable versions of State of Florida Data; and

4) The nature of the Access to State of Florida Data, including whether State of Florida Data was edited or shared with any other individual or entity during the duration of the Access, and, if so, the identity of the individual or entity.

The Contractor shall retain the written policy and information required in this subsection for the duration of this Contract and a period of no less than five (5) years from the date of termination of this Contract and any Contract extensions. The written policy and information required in this subsection shall be included in the Department’s audit and screening abilities as defined in subsection 4.2.4 of this Contract. The written policy and information required in this subsection shall also be subject to immediate disclosure upon written or oral demand at any time by the Department or its designated agents or auditors.

Failure to compile, retain, and disclose the written policy and information as required in this subsection shall be considered a breach of the Contract. The resulting damages to the Department from a breach of this subsection are by their nature impossible to ascertain presently and will be difficult to ascertain in the future. The issues involved in determining such damages will be numerous, complex, and unreasonably burdensome to prove. The Parties acknowledge that these financial consequences are liquidated damages, exclusive of any other right to damages, not intended to be a penalty, and solely intended to compensate for unknown and unascertainable damages. The Contractor therefore agrees to credit the Department the sum of $10,000 per event, for each breach of this subsection.

Data Security Work Locations, No Offshoring of Data Contractor, including its employees, Subcontractors, Subcontractor personnel, independent contractors, leased employees, volunteers, licensees, or other persons operating under their direction, are prohibited from (i) performing any of the Services under the Contract outside of the U.S., or (ii) sending, transmitting, or accessing any State of Florida Data outside of the U.S. The Parties agree that a violation of this provision will:

The credits in subsection (b) are a reasonable approximation of the internal costs for investigations and audits from a violation. The credits are in the nature of liquidated damages and not intended to be a penalty on the Contractor. By executing this Contract, Contractor acknowledges and agrees the costs intended to be covered by subsection (b) are not readily ascertainable and will be difficult to prove. Contractor agrees that it will not argue, and is estopped from arguing, that such costs are a penalty or otherwise unenforceable. For purposes of determining the amount of credits due hereunder, a group of violations relating to a common set of operative facts (e.g., same location, same time period, same off-shore entity) shall be treated as a single violation. The credits will be applied against the monthly invoices submitted by the Contractor, and are exclusive of any other right to damages.

Contractor’s Responsibility to Notify Department for a Breach For purposes of subsection 4.2.5.3 of this Contract, the following definitions apply:

“Breach” means a confirmed event that compromises the confidentiality, integrity, or availability of information or State of Florida Data, or unauthorized access of State of Florida Data in electronic form containing personal information. Additional requirements related to breaches of HIPAA information are covered in Attachment 8: Privacy, Security, and Confidentiality Business Associate Agreement.

“Incident” means a violation or imminent threat of violation, whether such violation is accidental or deliberate, of information technology security policies, acceptable use policies, or standard security practices. An imminent threat of violation refers to a situation in which the state agency has a factual basis for believing that a specific incident is about to occur.

Notice of Breach Notwithstanding any provision of this Contract to the contrary, the Contractor shall notify the Department as soon as possible and in all events immediately upon discovering any Breach or Incident regarding State of Florida Data; any unauthorized access of State of Florida Data (even by persons or companies with authorized access for other purposes); any unauthorized transmission of State of Florida Data; or any credible allegation or suspicion of a material violation of the above. This notification is required whether the event affects one Member or the entire population. The notification shall be clear and conspicuous and include a description of the following:

Upon becoming aware of an alleged Breach or Incident, the Contractor shall set up a conference call (via a telephone call and email) with the Department’s Contract Manager and any necessary parties. The conference call invitation shall contain a brief description of the nature of the event. When possible, a thirty (30) minute notice shall be given to allow Department personnel to be available for the call. If the designated time is not practical for the Department, an alternate time for the call shall be scheduled. All available information shall be shared on the call. The Contractor shall answer all questions based on the information known at that time and shall answer additional questions as additional information becomes known. The Contractor shall provide the Department with final documentation of the incident including all actions that took place. If the Contractor becomes aware of a Breach or Incident outside of normal business hours, the Contractor shall notify the Department’s Contract Manager as soon as possible, and in all events, within twenty-four (24) hours.

The Contractor’s failure to perform the obligations in this subsection shall also be an Event of Default, and will entitle the Department to recover any other damages it incurs arising from a failure to perform the obligations in this subsection (including any actual out-of-pocket expenses incurred by the Department to investigate and remediate the violation) and/or to pursue injunctive relief.

Contractor’s Responsibility to Notify Members The Contractor shall, at Contractor’s sole expense, notify all Members whose State of Florida Data was accessed by any Breach, unauthorized access or transmission is determined by the Department to have been caused by the Contractor or its Subcontractors no later than thirty (30) Calendar Days after the determination of a Breach or reason to believe a Breach occurred. If the Contractor cannot identify the specific persons whose data may have been accessed, such notice shall be provided to all persons whose data reasonably may have been accessed. The Department shall pay all costs to notify such persons related to any Breach determined by the Department to not have been caused by the Contractor or its Subcontractors. Nothing in this subsection will alter or replace the application of section 501.171, Florida Statutes, as to the Contractor’s obligations and liability for Breaches concerning confidential personal information.

Credit Monitoring and Notification The Contractor shall include credit monitoring services at its own cost for those Members affected or potentially affected by an alleged Breach for no less than a period of one (1) year following the Breach.

The Contractor shall provide the Department of Legal Affairs written notice of a Breach that affects 500 or more Members as soon as practicable, but not later than thirty (30) Calendar Days after the determination of the Breach or reason to believe a Breach has occurred. The Contractor shall provide the Department a copy of the written notice to the Department of Legal Affairs. If a Breach impacts more than 1,000 Members at a single time, the Contractor shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in the Fair Credit Reporting Act, 15 U.S. Code Section 1681a (p), of the timing, distribution, and content of the notices required pursuant to Contract subsections 4.2.5.2 (“Contractor’s Responsibility to Notify Department”) and 4.2.5.3.1 (“Contractor’s Responsibility to Notify Members”) of this Contract.

Duty to Provide Secure Data The Contractor will maintain the security of State of Florida Data including, but not limited to, a secure area around any display of such State of Florida Data or State of Florida Data that is otherwise visible. The Contractor will also comply with all state and federal rules and regulations, as well as industry standards, related to security of information and cybersecurity . This includes, but is not limited to, Chapter 282, F.S., Rule Chapter 60GG-2, F.A.C., and all requirements set forth in the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act of 2009 and their implementing regulations, as amended. The Contractor agrees to cooperate with the Department and perform all actions necessary to assist with all tasks in furtherance of the Department’s efforts to comply with the obligations under Chapters 60FF and 60GG of the Florida Administrative Code, as applicable. State of Florida Data cannot be disclosed to any person or entity that is not directly approved to participate in this Contract.

Loss of Data In the event of loss of any State of Florida Data or record where such loss is due to the negligence of Contractor or any of its Subcontractors or agents, Contractor shall be fully responsible for recreating such lost State of Florida Data in the manner and on the schedule set by the Department, in addition to any other damages the Department may be entitled to by law or this Contract. Contractor shall bear the full cost for recreating any lost State of Florida Data and will not be entitled to any compensation by the Department for those costs. This subsection shall survive termination of this Contract.

E-Verify The Contractor (and its subcontractors) have an obligation to utilize the U.S. Department of Homeland Security’s (DHS) E-Verify system for all newly hired employees. By executing this Contract, the Contractor certifies that it is registered with, and uses, the E-Verify system for all newly hired employees. The Contractor must obtain an affidavit from its subcontractors in accordance with paragraph (2)(b) of section 448.095, Florida Statutes, and maintain a copy of such affidavit for the duration of the Contract. In order to implement this provision, the Contractor shall provide a copy of its DHS Memorandum of Understanding (MOU) to the Contract Manager within five (5) days of Contract execution.

This section serves as notice to the Contractor regarding the requirements of section 448.095, Florida Statutes, specifically sub-paragraph (5)(c)1, and the Department’s obligation to terminate the Contract if it has a good faith belief that the Contractor has knowingly violated section 448.09(1), Florida Statutes. If terminated for such reason, the Contractor will not be eligible for award of a public contract for at least one year after the date of such termination. The Department reserves the right to order the immediate termination of any contract between the Contractor and a subcontractor performing work on its behalf should the Department develop a good faith belief that the subcontractor has knowingly violated section 448.09(1), Florida Statutes.

Scrutinized Companies – Termination by the Department The Department may, at its option, terminate the Contract if the Contractor is found to have submitted a false certification as provided under subsection 287.135(5), F.S., or been placed on the Scrutinized Companies with Activities in Sudan List or the Scrutinized Companies with Activities in the Iran Terrorism Sectors List, or been engaged in business operations in Cuba or Syria, or to have been placed on the Scrutinized Companies that Boycott Israel List or is engaged in a boycott of Israel.

Employment of State Workers During the term of the Contract, Contractor shall not knowingly employ, subcontract with or sub-grant to any person (including any non-governmental entity in which such person has any employment or other material interest as defined by section 112.312(15), Florida Statutes) who is employed by the State or who has participated in the performance or procurement of this Contract, except as provided in section 112.3185, Florida Statutes.

Removal or Replacement of Employees and Subcontractors for Cause All Contractor employees, subcontractors, or agents performing work under the Contract shall be properly trained technicians who meet or exceed any specified training qualifications. Upon request, Contractor shall furnish a copy of technical certification or other proof of qualification. The Department may refuse access to or require replacement of any Contractor, employee, Subcontractor or Subcontractor employee, or agent for cause, including, but not limited to, technical or training qualifications, quality of work, change in security status, or noncompliance with the Department’s security or other requirements. Such action shall not relieve Contractor of its obligation to perform all work in compliance with the Contract. The Department may reject and bar from any of its facilities for cause any of Contractor’s employees, Subcontractors or Subcontractor employees, or agents.

Acceptance of Deliverables The Department will conduct its acceptance review in a manner so as to identify whether the Deliverables fail to conform to the Contract. The Department shall notify the Contractor in writing of failures of a Deliverable to conform to the Contract and specify how the Deliverable failed to meet the requirements of the…