CN-680000-EX100-A4.pdf

AHCA CONTRACT NO. EXD100

AMENDMENT NO. 4

AHCA Contract No. EXD100, Amendment No. 4, Page 1 of 2 April 2020

THIS CONTRACT, entered into between the STATE OF FLORIDA, AGENCY FOR HEALTH CARE ADMINISTRATION, hereinafter referred to as the "Agency," and SHUTTS & BOWEN, LLP, hereinafter referred to as the "Vendor," is hereby amended as follows:

1. Standard Contract, Section II., The Agency Hereby Agrees, Sub-Section A., Contract

Amount, the first sentence is hereby amended to change the total amount of this Contract from $50,000.00 to $144,000.00 (an increase of $94,000.00 for legal services).

2. Attachment I, Office of the Attorney General, Private Attorney Services, Section B., Compensation-Fees, Sub-Section 1., is hereby amended to now read as follows:

1. The Agency shall be billed in accordance with Exhibit A., Fee Schedule. Fees shall not exceed $139,000.00 and fees in excess of such amount shall not be compensable. The Vendor shall notify the Agency, in writing when fees for billable services reach, $100,000.00. Said notification shall be made in writing and as soon as is practicable and prior to the next monthly invoice. Failure to comply with these provisions will result in non-payment.

3. Attachment I, Office of the Attorney General, Private Attorney Services, Section C., Compensation-Costs, Sub-Section 5., is hereby amended to now read as follows:

5. Reimbursable costs shall not exceed $5,000.00. The Vendor shall notify the Agency in writing when costs reach $2,500.00. Said notification shall be made as soon as is practicable and prior to the next monthly invoice.

4. Attachment II, Business Associate Agreement, is hereby deleted in its entirety and replaced with Attachment II-A, Business Associate Agreement. All references to Attachment II, Business Associate Agreement, shall hereinafter refer to Attachment II- A, Business Associate Agreement.

All provisions not in conflict with this Amendment are still in effect and are to be performed at the level specified in this Contract.

This Amendment and all its attachments are hereby made a part of this Contract.

This Amendment cannot be executed unless all previous Amendments to this Contract have been fully executed.

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK

Docusign Envelope ID: 632050B6-7059-47BB-BC9A-555958FB2824

AHCA CONTRACT NO. EXD100

AMENDMENT NO. 4

AHCA Contract No. EXD100, Amendment No. 4, Page 2 of 2 April 2020

IN WITNESS WHEREOF, the Parties hereto have caused this seven (7) page Amendment to be executed by their officials thereunto duly authorized. This Amendment is not valid until signed and dated by both Parties.

SHUTTS & BOWEN, LLP STATE OF FLORIDA, AGENCY FOR

HEALTH CARE ADMINISTRATION

SIGNED

BY:

SIGNED

BY:

NAME: NAME:

TITLE: TITLE:

DATE: DATE:

NAME:

General Counsel, TITLE: Approved as to form and legality

DATE:

List of Attachments included as part of this Amendment:

Specify Type Number Description

Attachment II-A Business Associate Agreement (5 pages)

Joseph Goldstein

2/13/2025

Partner

Andrew Sheeran

2/19/2025

Kimberly Smoak

Deputy Secretary HQA

2/25/2025

ATTACHMENT II-A

BUSINESS ASSOCIATE AGREEMENT

AHCA Contract No. EXD100, Attachment II-A, Page 1 of 5

AHCA Form 2100-0017, Revised (SEP 2024)

The parties to this Attachment agree that the following provisions constitute a business associate agreement for purposes of complying with the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This Attachment is applicable if the Vendor is a business associate within the meaning of the Privacy and Security Regulations, 45 C.F.R. 160 and 164.

The Vendor certifies and agrees as to abide by the following:

1. Definitions. Unless specifically stated in this Attachment, the definition of the terms contained herein shall have the same meaning and effect as defined in 45 C.F.R. 160 and 164.

a. Protected Health Information. For purposes of this Attachment, protected health information shall have the same meaning and effect as defined in 45 C.F.R. 160 and 164, limited to the information created, received, maintained or transmitted by the Vendor from, or on behalf of, the Agency.

b. Electronic Protected Health Information (e-PHI). For purposes of this Attachment, electronic protected health information shall have the same meaning and effect as defined in 45 C.F.R. 160 and 164 (The Security Rule), limited to the electronic information created, received, maintained or transmitted by the Vendor from, or on behalf of, the Agency.

c. Security Incident. For purposes of this Attachment, security incident means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system and includes any event resulting in computer systems, networks, or data being viewed, manipulated, damaged, destroyed or made inaccessible by an unauthorized activity.

d. Confidentiality. For the purposes of this Attachment, confidentiality refers to when electronic protected health information is not made available or disclosed to unauthorized persons or processes.

e. Integrity. For the purposes of this Attachment, integrity means that electronic protected health information has not been altered or destroyed in an unauthorized manner.

f. Availability. For the purposes of this Attachment, availability refers to electronic health information remaining accessible and usable upon demand by an authorized person.

2. Applicability of HITECH and HIPAA Privacy Rule and Security Rule Provisions. As provided by federal law, Title XIII of the American Recovery and Reinvestment Act of 2009 (ARRA), also known as the Health Information Technology Economic ad Clinical Health (HITECH) Act, requires a Business Associate (Vendor) that contracts with the Agency, a HIPAA covered entity, to comply with the provisions of the HIPAA Privacy and Security Rules (45 C.F.R. 160 and 164) and comply with 45 C.F.R. 162 as applicable.

3. Use and Disclosure of Protected Health Information. The Vendor shall comply with the provisions of 45 CFR 164.504(e)(2)(ii). The Vendor shall not use or disclose protected

AHCA Contract No. EXD100, Attachment II-A, Page 2 of 5 health information other than as permitted by this Contract or by federal and state law. The sale of protected health information or any components thereof is prohibited except as provided in 45 CFR 164.502(a)(5). The Vendor will use appropriate safeguards to prevent the use or disclosure of protected health information for any purpose not in conformity with this Contract and federal and state law. The Vendor will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic protected health information the Vendor creates, receives, maintains, or transmits on behalf of the Agency.

4. Use and Disclosure of Information for Management, Administration, and Legal Responsibilities. The Vendor is permitted to use and disclose protected health information received from the Agency for the proper management and administration of the Vendor or to carry out the legal responsibilities of the Vendor, in accordance with 45 C.F.R.

164.504(e)(4). Such disclosure is only permissible where required by law, or where the Vendor obtains reasonable assurances from the person to whom the protected health information is disclosed that: (1) the protected health information will be held confidentially,

(2) the protected health information will be used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and (3) the person notifies the Vendor of any instance of which it is aware in which the confidentiality of the protected health information has been breached.

5. Disclosure to Third Parties. The Vendor will not divulge, disclose, or communicate protected health information to any third party for any purpose not in conformity with this Contract without prior written approval from the Agency. The Vendor shall ensure that any agent, including a subcontractor, to whom it provides protected health information received from, or created or received by the Vendor on behalf of the Agency, agrees to the same terms, conditions, and restrictions that apply to the Vendor with respect to protected health information. The Vendor’s subcontracts shall fully comply with the requirements of 45 CFR 164.314(a)(2)(iii).

6. Access to Information. The Vendor shall make protected health information available in accordance with federal and state law, including providing a right of access to persons who are the subjects of the protected health information in accordance with 45 C.F.R.164.524.

7. Amendment and Incorporation of Amendments. The Vendor shall make protected health information available for amendment and to incorporate any amendments to the protected health information in accordance with 45 C.F.R. 164.526.

8. Accounting for Disclosures. The Vendor shall make protected health information available as required to provide an accounting of disclosures in accordance with 45 C.F.R. 164.528.

The Vendor shall document all disclosures of protected health information as needed for the Agency to respond to a request for an accounting of disclosures in accordance with 45 C.F.R. 164.528.

9. Privacy Protection. The Vendor shall permit an individual to request a restriction on the use and disclosure of protected health information about the individual to carry out treatment, payment, or health care operations; and disclosures permitted under 164.510(b) in accordance with 45 C.F.R. 164.522. The Vendor shall permit an individual

AHCA Contract No. EXD100, Attachment II-A, Page 3 of 5 to request to receive communications of protected health information from the Vendor by alternative means or at alternative locations in accordance with 45 C.F.R. 164.522.

10. Access to Books and Records. The Vendor shall make its internal practices, books, and records relating to the use and disclosure of protected health information received from, or created or received by the Vendor on behalf of the Agency, available to the Secretary of the Department of Health and Human Services (“HHS”) or the Secretary’s designee for purposes of determining compliance with the HHS Privacy Regulations.

11. Reporting. The Vendor shall make a good faith effort to identify any use or disclosure, or loss of confidentiality, integrity, or availability, of protected health information, or e-PHI, not provided for in this Contract.

a. To Agency. The Vendor will report to the Agency in the manner and format obtained from the Contract Manager or Agency contact, within ten (10) business days of discovery, any use or disclosure, or loss of confidentiality, integrity, or availability, of protected health information, or e-PHI, not provided for in this Contract of which the Vendor is aware. The Vendor will report to the Agency in the manner and format obtained from the Contract Manager or Agency contact, within twenty-four (24) hours of discovery, any security incident of which the Vendor is aware. A violation of this paragraph shall be a material violation of this Contract. Such notice shall include the identification of each individual whose unsecured protected health information has been or is reasonably believed by the Vendor to have been, accessed, acquired, used, or disclosed during such breach.

b. To Individuals. In the case of a breach of protected health information discovered by the Vendor, the Vendor shall first notify the Agency of the pertinent details of the breach and upon prior review by the Agency shall notify each individual whose unsecured protected health information has been or is reasonably believed by the Vendor to have been, accessed, acquired, used or disclosed as a result of such breach. Such notification shall be in writing by first-class mail to the individual (or the next of kin if the individual is deceased) at the last known address of the individual or next of kin, respectively, or, if specified as a preference by the individual, by electronic mail. Where there is insufficient, or out-of-date contact information (including a phone number, email address, or any other form of appropriate communication) that precludes written (or, if specifically requested, electronic) notification to the individual, a substitute form of notice shall be provided, including, in the case that there are 10 or more individuals for which there is insufficient or out-of-date contact information, a conspicuous posting for a period of at least 90 days on the Web site of the covered entity involved or notice in major print or broadcast media, including major media in the geographic areas where the individuals affected by the breach likely reside. In any case deemed by the Vendor to require urgency because of possible imminent misuse of unsecured protected health information, the Vendor may also provide information to individuals by telephone or other means, as appropriate.

c. To Media. In the case of a breach of protected health information discovered by the Vendor where the unsecured protected health information of more than 500 persons is reasonably believed to have been, accessed, acquired, used, or disclosed, after prior review by the Agency, the Vendor shall provide notice to

AHCA Contract No. EXD100, Attachment II-A, Page 4 of 5 prominent media outlets serving the State, relevant portion of the State, or jurisdiction involved.

d. To Secretary of Health and Human Services (HHS). The Vendor shall cooperate with the Agency to provide notice to the Secretary of HHS of unsecured protected health information that has been acquired or disclosed in a breach.

i. Vendors Who Are Covered Entities. In the event of a breach by the Vendor, or a contractor or subcontractor of the Vendor, and the Vendor is a HIPAA covered entity, the Vendor, not the Agency, shall be considered the covered entity for purposes of notification to the Secretary of HHS pursuant to 45 CFR 164.408. The Vendor shall be responsible for filing the notification to the Secretary of HHS and will identify itself as the covered entity in the notice. If the breach was with respect to 500 or more individuals, at least 5 business days prior to filing notice with the Secretary of HHS the Vendor shall provide a copy of the notice and breach risk assessment to the Agency for review. Upon prior review by the Agency of the notice and breach risk assessment, the Vendor shall file the notice with the Secretary of HHS within the notification timeframe imposed by 45 C.F.R. 164.408(b) and contemporaneously submit a copy of said notification to the Agency. If the breach was with respect to less than 500 individuals, the Vendor shall notify the Secretary of HHS within the notification timeframe imposed by 45 C.F.R. 164.408(c) and shall contemporaneously submit a copy of said notification to the Agency.

e. Content of Notices. All notices required under this Attachment shall include the content set forth in 42 U.S.C. 17932(f) and 45 C.F.R. 164 Subpart D, except that references therein to a “covered entity” shall be read as references to the Vendor.

f. Financial Responsibility. The Vendor shall be responsible for all costs related to the notices required under this Attachment.

g. Other Reporting. The Vendor shall comply with any other applicable reporting requirements in conformity with federal and state laws. If notifications are made under any such laws, copies of said notifications shall be provided contemporaneously to the Agency.

12. Mitigation. Vendor shall mitigate, to the extent practicable, any harmful effect that is known to the Vendor of a use or disclosure of protected health information in violation of this Attachment.

13. Termination. Upon the Agency’s discovery of a material breach of this Attachment, the Agency shall have the right to assess liquidated damages as specified elsewhere in the contract to which this Attachment is included, and/or to terminate this Contract.

14. Effect of Termination. At the termination of this Contract, the Vendor shall return all protected health information that the Vendor still maintains in any form, including any copies or hybrid or merged databases made by the Vendor; or with prior written approval of the Agency, the protected health information may be destroyed by the Vendor after its use. If the protected health information is destroyed pursuant to the Agency’s prior written

AHCA Contract No. EXD100, Attachment II-A, Page 5 of 5 approval, the Vendor must provide a written confirmation of such destruction to the Agency. If return or destruction of the protected health information is determined not feasible by the Agency, the Vendor agrees to protect the protected health information and treat it as strictly confidential.

The Vendor has caused this Attachment to be signed and delivered by its duly authorized representative, as of the date set forth below.

VENDOR NAME

DATE:

NAME:

TITLE:

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK

2/13/2025

PartnerJoseph Goldstein

Attachment II-A- Business Associate Agreement