Attachment-J.Data-Use-Agreement.pdf

ITN No.: DMS-24/25-232

Attachment J: Data Use Agreement Page 1 of 4

Attachment J: Data Use Agreement

This Data Use Agreement (“Agreement”) is made this ____ day of ______ 2025, by and between

____________________________________ (“Vendor”), and the State of Florida, Department of

Management Services (“Department”).

The Vendor warrants and represents that it intends to submit a Reply in response to the

Department’s solicitation entitled ITN No.: DMS-24/25-232, Group Term Life Insurance

(“ITN”). In order to respond to the ITN, the Department will provide Vendor with access to the

Revised Attachment F: Revised Census File dated April 2025 (“Revised Census File”), which contains certain personal identifying or protected information relating to Enrollees, as defined in section 110.123(2)(c), F.S. (collectively, “Protected Information”).

Section 1.9, Notice of Intent to Submit a Reply and Data Use Agreement, of the ITN sets forth the instructions on how potential respondents to the ITN may obtain the Revised Census File.

As a condition for its receipt of and access to the Protected Information, Vendor agrees as follows:

1. Vendor shall comply with the Health Insurance Portability and Accountability Act of 1996

(as amended), the Health Information Technology for Economic and Clinical Health Act of

2009 (as amended), section 110.123(10), F.S., and all applicable regulations and requirements of law relating to the Protected Information.

2. Vendor shall not use or disclose the Protected Information for any purposes other than to respond to the ITN.

3. Vendor shall use appropriate safeguards to prevent the unauthorized use or disclosure of the Protected Information.

4. Vendor shall not disclose, publish, release, transfer, or disseminate any Protected

Information except as authorized by law and permitted by this Agreement.

5. Vendor shall be liable for any violations of law or this Agreement caused by any of its employees, officers, directors, managers, agents, contractors of any tier, consultants, and representatives (collectively, “Vendor Representatives”) who are provided or given access to Protected Information and for any access by persons not listed on the Access List

(defined below) caused by the acts or omissions of Vendor or any Vendor

Representatives.

6. Vendor shall abide by the following procedures in handling the Protected Information:

a. Vendor will ensure the Protected Information is only accessible on a password protected system(s) that is reasonably secure from unauthorized access and misuse.

b. Vendor shall only allow Vendor Representatives on the Access List to access the

Protected Information.

c. Vendor will inform all Vendor Representatives who have access to the Protected

Information that:

Attachment J: Data Use Agreement Page 2 of 4

i. The Vendor Representative is not to share the Protected Information with any unauthorized person;

ii. If the Vendor does not submit a Reply to the ITN, the Vendor

Representative will, by the time Replies to the ITN are due, delete all

Protected Information from any hard drive, solid-state drive, optical disc, or other storage medium under their control and will destroy any copies, including paper copies, of the Protected Information that they made or are under their control. The Vendor Representative will, upon request, confirm to Vendor that they have deleted or destroyed all Protected Information;

and

iii. At the end of the ITN solicitation process, the Vendor Representative will delete the Protected Information from any hard drive, solid-state drive, optical disc, or other storage medium under their control and will destroy any copies, including paper copies, of the Protected Information that they made or are under their control. The Vendor Representative will, upon request, confirm to Vendor that they have deleted or destroyed all

Protected Information.

d. Vendor shall maintain and provide to the Department a list of persons granted access to the Protected Information (“Access List”). Persons expected to have access to the Protected Information are to be listed in the Access List chart on the last page of this attachment. If at any time the Vendor intends to provide access to a person not listed on the Access List provided to the Department, the Vendor shall provide an updated Access List to the Department’s Procurement Officer, including the additional person to be provided access, prior to the provision of access to such person. Vendor has a continuing obligation to update the Access List.

7. Vendor shall not identify or attempt to identify the person who is the subject of the

Protected Information.

8. Vendor shall report to the Department any unauthorized access, use, or disclosure of

Protected Information within three (3) calendar days of discovery thereof.

9. If Vendor submits a Reply in response to the ITN, Vendor shall destroy the Protected

Information, including any copies, remaining in its possession within the later of five (5) business days of the Department’s notice of an intended award in connection with the ITN or the conclusion of any legal proceeding or protest regarding same. At that time, Vendor shall provide to the Procurement Officer a final Access List and a certif ication that it has complied with this destruction requirement.

If Vendor does not submit a Reply in response to the ITN, the Vendor shall destroy the

Protected Information, including any copies, by the time Replies are due. At that time, the

Vendor shall provide to the Procurement Officer a complete Access List and certif ication that the vendor has complied with this destruction requirement on or before the due date of Replies.

Attachment J: Data Use Agreement Page 3 of 4

10. Vendor Representatives who access the Protected Information must agree to the restrictions set forth herein prior to obtaining access to the Protected Information.

11. Vendor acknowledges that the disclosure of the Protected Information may cause irreparable harm to the Department and agrees that the Department may obtain an injunction to prevent the disclosure, copying, or other impermissible use of the Protected

Information. The Department reserves all rights, remedies, claims, and actions that it may have now or in the future to protect the Protected Information and to seek damages for

Vendor’s failure to comply with the requirements of this Agreement.

12. Vendor agrees that the Protected Information and all of Vendor’s obligations hereunder with respect to the Protected Information will be deemed to include all forms of the Census

File that the Department heretofore or hereafter uploads to the Vendor Information Portal in connection with the ITN.

13. This Agreement shall be governed by the laws of the State of Florida. As the exclusive means of bringing adversarial proceedings to resolve any dispute arising out of this

Agreement, a party may bring such a proceeding in a federal or state court located in Leon

County, Florida.

14. The individual signing below warrants and represents that they are fully authorized to bind

Vendor to the terms of this Agreement.

Legal Name of Vendor: _____________________________________________________

Name of Authorized Representative: ___________________________________________

(Print Name)

Title of Authorized Representative: ____________________________________________

Signature of Authorized Representative: ________________________________________

Date: __________________________

Date of Signature

Address: _____________________________________

Enter Street or PO Address

Enter City, State and ZIP Code

Telephone No: (____) _____ - ______

E-mail Address

(the individual who will receive the link to access the Protected Information):

Attachment J: Data Use Agreement Page 4 of 4

VENDOR REPRESENTATIVES WHO WILL BE GIVEN ACCESS TO THE PROTECTED

INFORMATION (ACCESS LIST)

(Vendors may submit separate, scanned pages of Vendor Representative signatures)

By signing below, the undersigned Vendor Representative agrees not to use the Protected

Information for any purpose other than to respond to the ITN and not to disclose or disseminate any Protected Information unless such disclosure or dissemination is to an individual listed below for the purpose of responding to the ITN.

Printed Name, Title/Position & Employer

Signature of Individual Date