CN-680000-HQA28-A1.pdf

AHCA CONTRACT NO. HQA028

AMENDMENT NO. 1

AHCA Contract No. HQA0028, Amendment No. 1, Page 1 of 2 April 2020

THIS CONTRACT, entered into between the STATE OF FLORIDA, AGENCY FOR HEALTH CARE ADMINISTRATION, hereinafter referred to as the "Agency" and CAPITOL BRIDGE, LLC, hereinafter referred to as the "Vendor," is hereby amended as follows:

1. Attachment 1, Scope of Services, is hereby deleted in its entirety and replaced with

Attachment 1-A, Scope of Services. All references in the Contract to Attachment I, shall hereinafter referred to Attachment 1-A, Scope of Services.

2. Attachment I, Exhibit II, Price Sheet, is hereby deleted in its entirety and replaced with Attachment 1-A, Exhibit II, Price Sheet. All references in the Agreement to Attachment 1, Exhibit II, Price Sheet, shall hereinafter referred to Attachment 1-A, Exhibit II, Price Sheet.

All provisions not in conflict with this Amendment are still in effect and are to be performed at the level specified in this Contract.

This Amendment and all its attachments are hereby made a part of this Contract.

This Amendment cannot be executed unless all previous Amendments to this Contract have been fully executed.

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK

DocuSign Envelope ID: F9DEBFB9-0FE1-43B3-9D11-74278A717676

AHCA CONTRACT NO. HQA028

AMENDMENT NO. 1

AHCA Contract No. HQA0028, Amendment No. 1, Page 2 of 2 April 2020

IN WITNESS WHEREOF, the Parties hereto have caused this twenty (20) page Amendment to be executed by their officials thereunto duly authorized. This Amendment is not valid until signed and dated by both Parties.

CAPITOL BRIDGE, LLC STATE OF FLORIDA, AGENCY FOR

HEALTH CARE ADMINISTRATION

SIGNED

BY:

SIGNED

BY:

NAME: NAME:

TITLE: TITLE:

DATE: DATE:

List of Attachments included as part of this Amendment:

Specify Type Number Description Attachment 1-A Scope of Services (17 Pages) Exhibit II, Price Sheet (1 Page)

Kara Volk

4/22/2024

Contracts Secretary

Jason Weida

6/13/2024

ACHA CONTRACT NO. HQA028

ATTACHMENT I

SCOPE OF SERVICES

AHCA Contract No. HQA028, Attachment I, Page 1 of 17

Table of Contents

1. Service(s) to be Provided

1.1 Background

1.2 Overview/Purpose

1.3 Order of Precedence

2. Manner of Service (s) Provision

2.1 Services Provided by the Agency

2.2 Services Provided by the Vendor

2.3 Deliverables

2.4 Reporting

3. Method of Payment

3.1 Financial Consequences as Liquidated Damages

4. Attorney’s Fees

5. Legal Action Notification

6. Damages for Failure to Meet Contract Requirements

7. Corrective Action Plan (CAP)

8. Contract Transition

9. System Functionality

10. Information Technology

11. Disaster Recovery

12. Smartphone Applications

13. Social Networking

14. Definitions and Acronyms

AHCA Contract No. HQA028, Attachment I, Page 2 of 17

1. Service(s) to be Provided

1.1 Background

The Agency for Health Care Administration (Agency) is responsible for administering the Statewide Provider and Health Plan Claims Dispute Resolution Program. In 2001 the Legislature created the program to assist health care providers and health insurance plans to resolve health care claims disputes. In 2022 the Legislature further expanded the program to include pharmacies.

Pursuant to Section 408.7507, Florida Statutes, the Agency shall contract with a “qualified independent third-part claim dispute-resolution-entity”, hereinafter referred to as the “Vendor” to provide assistance to contracted and non-contracted health care providers (including pharmacies per 624.491(4), Florida Statutes) and health care plans for resolution of claims disputes within the parameters of Section 408.7507, Florida Statutes and Rule 59A-12.030, Florida Administrative Codes.

1.2 Overview/Purpose

The purpose of this is to contract with a vendor to provide assistance to contracted and non-contracted health care providers and health care plans for resolution of claims disputes within the parameters of Section 408.7507, Florida Statutes and Rule 59A-12.030, Florida Administrative Codes.

1.3 Order of Precedence

Services provided under this Contract shall be provided in accordance with the terms of this Contract, AHCA RFQ 009-23/24, and the Vendor’s response to AHCA RFQ 009-23/24. In the event of any conflict between any provision of this Contract, AHCA RFQ 009-23/24, or the order of precedence shall be as follows:

1. This Contract, including all attachments, exhibits and any subsequent amendments;

2. AHCA RFQ 009-23/24; and

3. The Vendor’s response to AHCA RFQ 009-23/24.

2. Manner of Service (s) Provision

2.1 Services Provided by the Agency

The Agency shall be responsible for the following:

2.1.1 Assigning and dedicating an Agency Contract Manager to coordinate all contract activities between the Agency and the Vendor

2.1.2 Maintaining continuous and regular oversight of contract requirements

2.1.3 Providing the Vendor access to, policies, procedures, historical project documents and other documentation and other databases, as deemed appropriate by the Agency and as needed by the Vendor to provide services under this Contract; and coordinate to provide access to training as needed

AHCA Contract No. HQA028, Attachment I, Page 3 of 17

2.1.4 Maintaining an up-to-date list of health plan contacts for the vendor

2.1.5 Providing clarification and interpretation of terms and condition of the Contract resulting from this RFQ

2.1.6 Providing clarification and interpretation of Medicaid policies and procedures and, as needed

2.1.7 Providing clarification and interpretation of the Agency’s Information Technology Security

Plan, as needed

2.1.8 Performing timely review of all documents submitted by the Vendor.

2.1.9 At a minimum, monitoring the Contract by requiring the submission of an Agency developed spreadsheet, to be submitted on a weekly and monthly basis to ensure Vendor is in compliance with contract requirements. The Agency reserves the right to monitor the Vendor on a more frequent basis if deemed necessary by the Agency

2.1.10 Receiving petitions for hearings through the Agency Clerk’s office and provide legal staff, as determined necessary by the Agency, in cooperation with the Vendor

2.1.11 Reserving the right to direct the Vendor to cease pursuit of a case or project at any time at the sole discretion of the Agency

2.1.12 Monitoring the Contract resulting from this RFQ to ensure Vendor compliance

2.1.13 Determining whether the Vendor has violated a contractual obligation and assess liquidated damages as deemed appropriate by the Agency

2.1.14 Amending timelines specified in the Contract resulting from this RFQ in accordance with the best interest of the Agency

2.1.15 Final Order: The Agency shall issue a final order within thirty (30) days after receipt of the recommendations issued by the Vendor. The Agency will enforce the final order as authorized under Subsection 641.52(1)(e), Florida Statutes.

The Agency’s final order is subject to notice of appeal rights and judicial review pursuant to Section 120.0368, Florida Statutes.

2.2 Services Provided by the Vendor

2.2.1 Review and Recommendations

The Vendor shall review all requests for claim(s) dispute resolution within ten (10) days after receipt, to determine whether the request meets the statutory and rule criteria for submission as specified in Section 408.7057(2)(b)1-7 and (d), Florida Statutes, and meet the claim threshold requirements specified in Rule 59A-12.030, Florida Administrative

AHCA Contract No. HQA028, Attachment I, Page 4 of 17

Code. The Vendor shall notify the entity filing the request, the responding party, the Agency Contract Manager of the determination within three (3) days of such decision.

The Vendor’s procedure shall include a review of the documentation provided and any additional information requested by the resolution organization. The Vendor shall research the claim dispute submission and make a recommendation to the Agency based on findings of fact.

2.2.2 Status Updates

Pursuant to Section 408.7057(3)(f), Florida Statutes the Vendor shall issue a recommendation, based on findings of fact, within sixty (60) days after the initial claim(s) dispute submission and other prudent information was received by the Vendor. In no event shall the review time exceed 90 days following receipt of the initial claim(s) dispute submission by the health plan or provider.

2.4.1. The Vendor must have available a toll-free assistance line capable of handling the expected volume of calls and access to interpreter services for non-English speaking providers. The Vendor does not need to establish a Florida Provider Appeals assistance line if they can manage the call volume through their existing phone system.

2.2.3 The Vendor shall staff the Florida Provider Appeals assistance line Monday through Friday from 8:00 A.M. to 5:00 P.M., EST.

2.2.4 The Vendor shall provide information to agents/operators on how to conduct various tasks and procedures for processing arbitration inquiries, such as call scripts, call-handling procedures and escalation protocols.

2.2.5 The Vendor may use a voice mail option in an automated phone tree system for callers to leave messages between the hours of 5:00 PM and 8:00 AM, EST, Monday through Friday and at all hours on weekends and holidays.

2.2.6 If the Vendor utilizes a voice mailbox option, the Vendor shall ensure that the voice mailbox has adequate capacity to receive all messages. A Vendor’s representative shall respond to all messages on the next business day.

2.2.7 The Vendor shall have an emergency operations plan ready to be implemented for any interruptions in service of eight (8) hours or more during normal business hours. The emergency operations plan shall also be implemented for service(s) interruptions of eight

(8) hours. The Vendor shall also let the Agency know of any interruptions of service(s).

2.2.8 Vendor Staffing and Subcontracting

The Vendor and its proposed subcontractors shall:

2.2.9.1 Conduct all aspects of the resulting Contract in a timely, efficient, productive, consistent, courteous, and professional manner as representatives of the Agency. The Vendor shall recruit highly qualified staff to provide all aspects of the services required by the resulting Contract.

2.2.9.2 In the event the Agency determines the Vendor’s staff or staffing levels are not sufficient to properly complete the services specified in this Contract or are

AHCA Contract No. HQA028, Attachment I, Page 5 of 17 inappropriately allocated across the requirements of this Contract, it shall advise the Vendor in writing, upon which the Vendor shall have ten (10) business days to remedy identified staffing deficiencies.

2.2.9.3 Make its staff available to meet with Agency staff, as agreed to by the Agency and the Vendor, to review reports and all other obligations under the resulting Contract as requested by the Agency. The Vendor may meet at the request of the Agency, to discuss the status of the resulting Contract, Vendor performance, benefits to the Agency, necessary revisions, reviews, reports, and planning.

2.2.9.4 Notify the Agency in writing of any resignations, dismissals, or personnel changes with respect to key staff within three (3) business days of the occurrence.

2.2.9.5 Have staff available during normal business hours. Normal business hours are defined as 8:00 AM to 5:00 PM, ET, Monday through Friday, excluding State of Florida observed holidays.

2.2.9.6 Ensure that all professional audit staff minimally have one year of auditing, investigations, enforcement, health care, or oversight setting; and, hold a bachelor’s degree or higher-level degree from an accredited college or university, particularly in a related field such as: health law, health science, criminology, criminal justice, or a substantially similar discipline:

2.3 Deliverables

Deliverables are included as Exhibit I, Deliverables, to this Attachment.

2.3.1 The Vendor shall provide case status reports/spreadsheet.

2.3.2. The Vendor shall provide Cost Estimates to the requesting parties.

2.3.3. The Vendor shall provide the Rationale, Invoice and Cover Letter documents for Agency recommendations (Final Order Issuance)

2.3.4 The Vendor shall provide case acceptance letters for both the health plans and providers.

2.3.5 The Vendor shall provide closure letters for cases that withdrawal, opt-out, and/or are dismissed.

The Agency reserves the right to include additional deliverables based on the Agency’s review of the Vendor’s response to AHCA RFQ 005-23/24 and finalization of Contract requirements.

Due dates may be modified if approved in writing, in advance by the Agency.

2.4 Reporting

2.4.1 General Reporting Requirements

The Vendor shall adhere to reporting requirements included in this Section. The Agency reserves the right to direct the Vendor to amend or update its reports and/or report formats in accordance with the best interests of the Agency and at no cost to the Agency.

The Agency will notify the Vendor of such modification, in writing.

AHCA Contract No. HQA028, Attachment I, Page 6 of 17

All electronic transmission of reports and supporting documentation containing Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA) must be encrypted to meet the HIPAA privacy standards. Unless otherwise directed by the Agency, all electronic reports shall be formatted utilizing Microsoft Word or Excel, version 2013 or greater. Supporting documentation may be submitted in Adobe PDF format. The Vendor shall maintain the capability to upgrade its electronic report format as directed by the Agency.

The Vendor shall submit reports, using spreadsheets approved in advance by the Agency. The Agency shall provide the Vendor with instructions and submission timetables. The Agency reserves the right to modify reporting formats and submission timetables resulting from changing priorities or management direction.

All reports shall be developed and produced at no cost to the Agency.

2.4.2 Weekly Reporting

The Vendor shall submit weekly reports noting the status of claims currently under review to the Agency’s Contract Manager. At a minimum, weekly reports shall include the following:

• Status of any new and ongoing cases

• Case number

• Date claim was received

• Number of claims submitted

• Date case acknowledgment was sent to the provider date response is due from the provider Date the provider responded

• Date case acknowledgment was sent to the health plan

• Date the health plan responded

• Is the claim by an out of network provider

2.4.3 Monthly Reporting

The Vendor shall submit a monthly report electronically to the Agency Contract Manger within ten (10) calendar days after the end of each month (if a reporting due date falls on a weekend or state holiday, the report shall be due to the Agency on the following business day) and must be a running report i.e. include all prior months for the reporting year. At a minimum, monthly reports shall include the following data:

• Claim numbers

• Status of claims

• Date received

• Provider Organization

• Provider contact person

• Providers address

• Health Plan

• Health Plans line of business i.e. Commercial or Medicaid

• Dispute Issue

• Disputed Amount

• Case Status

• Decision Type

AHCA Contract No. HQA028, Attachment I, Page 7 of 17

• Decision Letter Date Sent

• Final Award Amount

• Date Case was Accepted

• Party Billed

• Invoice Number

• Reason for Dismissed/Withdrawal

• Review Fee Payment Information

• Review Fee Payment Amount

• Review Fee Payment Date

• Health Plan Payment

• Health Plan Review Fee Amount

• Health Plan Review Fee Payment Date

• Provider Payment

• Provider Review Fee Amount

• Provider Review Fee Payment Date

The Agency reserves the right to modify the reporting requirements with a ninety (90) day notice to allow the Vendor to complete implementation, unless otherwise required by law.

The Agency shall provide the Vendor with written notification of any modifications to the reporting requirements. Information shall be provided to the contract manager (or designee during absences) via email.

2.4.4 Ad Hoc Analysis and Reports

2.4.4.1 The Agency reserves the right to request the Vendor to conduct ad hoc analyses and provide ad hoc reports. In such instances, the Agency will make the request in writing and will establish a deadline for submission. At the Agency’s request, the variables calculated as part of ad hoc reports may be required for inclusion in standard reports.

2.4.4.2 Ad hoc analyses and reporting shall be provided at no cost to the Agency.

2.4.4.3 The Vendor shall provide ad hoc reports on an as needed basis at no additional cost to the Agency. Ad hoc reports may be requested on any aspect of the data collected by the Vendor.

2.4.4.4 Ad hoc reports shall be submitted to the Agency within ten (10) business days from the time of the request, unless otherwise specified by the Agency.

2.4.5 Final Report

The Vendor shall submit a final report no later than the thirty (30) business days after the end of the Contract resulting from this RFQ. At a minimum, the final report shall include the following:

• Summary of the entire project

• Proposed plans for future enhancements

• An analysis of what was learned during the process.

3. Method of Payment

AHCA Contract No. HQA028, Attachment I, Page 8 of 17

This is a no cost Contract. The Agency shall not compensate the Vendor for any services provided under this Contract. The initial review fee is a flat fee required by the Vendor to determine eligibility. The fee is retained by the Vendor whether or not the case qualifies for review. Once eligibility has been determined by the Vendor, the fees will vary based on the complexity of the case.

If requested, the Vendor will provide a fee schedule/cost estimate (the hourly fees of professionals and any additional costs including an evidentiary hearing) to both the health plan and the provider prior to beginning any review of the case. The Vendor shall allow for 15 calendar days for either or both parties to opt out (with the exception of Medicaid Managed Care Plans) based upon the fee schedule prior to beginning a review where fees will be incurred. All review fees incurred by the Vendor are paid by the party that does not prevail or both parties if the recommendation and final order provide for an apportionment of the review fees in cases in which both parties prevail in part. All review fees must be paid directly to the Vendor.

Service rates and hourly rates of professionals shall not exceed the established rates in Exhibit II, Price Sheet.

3.1 Financial Consequences as Liquidated Damages

3.3.1 Performance Standards and Liquidated Damages

3.3.1.1 The Vendor shall comply with all requirements and performance standards set forth in the Contract.

3.3.1.2 The Agency’s Contract Manager will monitor the Vendor’s performance in accordance with the monitoring requirements of the Contract. Failure by the Vendor to meet the established minimum performance standards may result in the Agency, in its sole discretion, finding the Vendor to be out of compliance, and all remedies provided in the Contract and under law, shall become available to the Agency.

3.3.1.3 The Agency reserves the right to impose liquidated damages upon the Vendor for failure to comply with the performance standard requirements set forth in Table 1, Performance Standards and Liquidated Damages, below.

TABLE 1

PERFORMANCE STANDARDS AND LIQUIDATED DAMAGES

No. Performance Standard Requirement Liquidated Damages to be Imposed

HIPAA

1.

The Vendor shall comply with provisions of Health Insurance Portability and Accountability Act (HIPAA) / Health Information Technology for Economic and Clinical Health (HITECH).

$500.00 to $5,000.00, per incident, per occurrence, depending upon the severity. In addition, Federal penalties may apply in accordance with the HIPAA Act of 1996.

2. The Vendor shall not inappropriately release PHI.

$500.00 to $5,000.00, per incident, per

AHCA Contract No. HQA028, Attachment I, Page 9 of 17

3.3.2 Disputes

3.3.3.1 To dispute liquidated damages, or contract interpretations, the Vendor must request that the Agency’s Deputy Secretary for Health Care Policy and Oversight (HCPO) or designee, hear and decide the dispute.

3.3.3.2 The Vendor must submit a written dispute directly to the Deputy Secretary, listed below, or designee by U.S. mail and/or commercial courier service (hand delivery will not be accepted). This submission must be received by the Agency within twenty-one (21) calendar days after the issuance of liquidated damages, sanctions and/or contract interpretations and shall include all arguments, materials, data, and information necessary to resolve the dispute (including all evidence, documentation and exhibits). The Vendor submitting such written requests for appeal or dispute as allowed under the Contract by U.S. mail and/or commercial courier service, shall submit such appeal or dispute to the following mailing address:

Deputy Secretary for HCPO Agency for Health Care Administration 2727 Mahan Drive MS#2 Tallahassee, FL 32308

Regardless of whether delivered by U.S. mail or commercial courier service, appeals or disputes not delivered to the address above will be denied.

TABLE 1

PERFORMANCE STANDARDS AND LIQUIDATED DAMAGES

No. Performance Standard Requirement Liquidated Damages to be Imposed occurrence, depending upon the severity.

Records

3.

The Vendor shall comply with public records laws, in accordance with Section 119.0701, F.S.

$5,000.00 for each incident in which the Vendor does not comply with a public records request.

Background Screening

4.

Submit policies and procedures within thirty (30) calendar days of Contract execution.

$250.00 per calendar day beyond the due date.

Services

5.

Implement the approved Corrective Action Plan (CAP) by the Agency specified date.

$500.00 per calendar day for each calendar day that the approved CAP is not implemented to the satisfaction of the Agency.

AHCA Contract No. HQA028, Attachment I, Page 10 of 17

3.3.3.3 The Vendor waives any dispute not raised within twenty-one (21) calendar days of issuance of liquidated damages, sanctions and/or contract interpretations. It also waives any arguments it fails to raise in writing within twenty-one (21) calendar days of receiving the liquidated damages, sanctions and/or contract interpretations, and waives the right to use any materials, data, and/or information not contained in or accompanying the Vendor’s submission submitted within the twenty-one (21) calendar days following its receipt of the liquidated damages, sanctions and/or contract interpretations in any subsequent legal, equitable, or administrative proceeding (to include Circuit Court, Federal court and any possible administrative venue).

3.3.3.4 The Deputy Secretary or his/her designee will decide the dispute under the reasonableness standard, reduce the decision to writing and serve a copy to the Vendor. This written decision will be final.

3.3.3.5 The exclusive venue of any legal or equitable action that arises out of or relating to the Contract, including an appeal of the final decision of the Deputy Secretary or his/her designee, will be Circuit Court in Leon County, Florida. In any such action, the Vendor agrees to waive its right to a jury trial, and that the Circuit Court can only review the final decision for reasonableness, and Florida law shall apply. In the event the Agency issues any action under Florida Statutes or Florida Administrative Code apart from the Contract, the Agency will notice the Vendor of the appropriate administrative remedy.

4. Attorney’s Fees

In the event of a dispute, each party to this Contract shall be responsible for its own attorneys’ fees, except as otherwise provided by law.

5. Legal Action Notification

The Vendor shall give the Agency, by certified mail, immediate written notification (no later than thirty

(30) calendar days after service of process) of any action or suit filed or of any claim made against the Vendor by any subcontractor, vendor, or other party that results in litigation related to this Contract for disputes or damages exceeding the amount of $50,000.00. In addition, the Vendor shall immediately advise the Agency of the insolvency of a subcontractor or of the filing of a petition in bankruptcy by or against a principal subcontractor.

6. Damages for Failure to Meet Contract Requirements

In addition to remedies available through this Contract, in law or equity, the Vendor shall reimburse the Agency for any Federal disallowances or sanctions imposed on the Agency as a result of the Vendor’s failure.

7. Corrective Action Plan (CAP)

7.1 If the Agency determines that the Vendor is out of compliance with any of the provisions of this

Contract, the Agency may require the Vendor to submit a Corrective Action Plan (CAP) within a specified timeframe. The CAP shall provide an opportunity for the Vendor to resolve deficiencies without the Agency invoking more serious remedies, up to and including contract termination.

AHCA Contract No. HQA028, Attachment I, Page 11 of 17

7.2 In the event the Agency identifies a violation of this Contract, or other non-compliance with this Contract, the Agency shall notify the Vendor of the occurrence in writing. The Agency shall provide the Vendor with a timeframe for corrections to be made.

7.3 The Vendor shall respond by providing a CAP to the Agency within the timeframe specified by the Agency.

7.4 The Vendor shall implement the CAP only after Agency approval.

7.5 The Agency may require changes or a complete rewrite of the CAP and provide a specific deadline.

7.6 If the Vendor does not meet the standards established in the CAP within the agreed upon timeframe, the Vendor shall be in violation of the provisions of this Contract and the Contract may be terminated.

8. Contract Transition

8.1 At the time of this Contract’s completion, the Vendor shall cooperate with the Agency in transitioning responsibilities of this Contract to the Agency or another Vendor.

8.2 The Vendor shall deliver to the Agency, or its authorized representative, all Contract-related records and data in a format specified by the Agency, within sixty (60) calendar days from the expiration or termination of this Contract. This obligation survives termination of this Contract.

8.3 Prior to the ending or termination of this Contract, the Vendor shall meet with the new Vendor or the Agency’s designated representative(s) to develop a HIPAA compliant, written agreement that sets forth how the entities will cooperate to ensure an effortless transition. The agreement must be approved by the Agency prior to execution and shall include at a minimum the following:

• Designated point of contact for each entity;

• A calendar of regularly scheduled meetings;

• A detailed list of data that will be shared;

• A mechanism and timeframe for transmitting records and data from the Vendor’s system;

• A mechanism and timeframe for transmitting documents produced under this Contract, as requested by the Agency;

• A clear description of the mutual needs and expectations of both entities; and

• Identification of risks and barriers associated with the transition of services to a new Vendor and solutions for overcoming them.

9. System Functionality

9.1 The Vendor shall have the capacity (hardware, software, and personnel) sufficient to access and generate all data and reports needed for this Contract.

AHCA Contract No. HQA028, Attachment I, Page 12 of 17

9.2 The Vendor shall comply with HIPAA and the HITECH Act.

9.3 The Vendor shall have protocols and internal procedures for ensuring system security and the confidentiality of recipient identifiable data.

10. Information Technology

10.1 The Vendor shall have the necessary information technology (IT) resources needed to fully manage the product required in this Contract.

10.2 The Vendor must adhere to the Driver Privacy Protection Act (DPPA) rules that address a memorandum of understanding and security requirements as well as other requirements contained in Rule.

10.3 The Vendor, its employees, subcontractors and agents shall provide immediate notice to the

Agency Information Security Manager (“ISM”) in the event it becomes aware of any security breach and any unauthorized transmission or loss of any or all of the data collected or created for or provided by the Agency (“State Data”) or, to the extent the Vendor is allowed any access to the Agency’s information technology (“IT”) resources, provide immediate notice to the ISM, of any allegation or suspected violation of security procedures of the Agency. Except as required by law and after notice to the Agency, the Vendor shall not divulge to third parties any confidential information obtained by the Vendor or its agents, distributors, resellers, subcontractors, officers or employees in the course of performing this Contract work according to applicable rules, including, but not limited to, Rule 74-2, Florida Administrative Code (FAC) and its successor regulation, security procedures, business operations information, or commercial proprietary information in the possession of the State or the Agency. After the conclusion of this Contract unless otherwise provided herein, the Vendor shall not be required to keep confidential information that is publicly available through no fault of the Vendor, material that the Vendor developed independently without relying on the State’s confidential information, or information that is otherwise obtainable under State law as a public record.

10.4 In the event of loss of any State Data or record where such loss is due to the negligence of the

Vendor or any of its subcontractors or agents, the Vendor shall be responsible for recreating such lost data in the manner and on the schedule set by the Agency at the Vendor’s sole expense, in addition to any other damages the Agency may be entitled to by law or this Contract.

In the event lost or damaged data is suspected, the Vendor will perform due diligence and report findings to the Agency and perform efforts to recover the data. If it is unrecoverable, the Vendor shall pay all the related costs associated with the remediation and correction of the problems engendered by any given specific loss. Further, failure to maintain security that results in certain data release will subject the Vendor to the administrative sanctions for failure to comply with Section 501.171, F.S., together with any costs to the Agency of such breach of security caused by the Vendor. If State Data will reside in the Vendor’s system, the Agency may conduct, or request the Vendor conduct at the Vendor’s expense, an annual network penetration test or security audit of the Vendor’s system(s) on which State Data resides. All Vendor personnel who will have access to State-owned Data will undergo the background checks and screenings described in this Contract.

10.5 The Vendor shall ensure that call centers, Information Technology (IT) help desks or any other type of customer support provided directly under this Contract, shall be located only in the forty-eight (48) contiguous United States.

AHCA Contract No. HQA028, Attachment I, Page 13 of 17

10.6 The Vendor must conform to current and updated publications of the principles, standards, and guidelines of the Federal Information Processing Standards (FIPS), the National Institute of Standards and Technology (NIST) publications, including but not limited to Cybersecurity- Framework and NIST.SP.800-53r4.

10.7 The Vendor must employ traffic and network monitoring software and tools on a continuous basis to identify obstacles to optimum performance.

10.8 The Vendor must employ traffic and network monitoring software and tools on a continuous basis to identify email and Internet spam and scams and restrict or track user access to appropriate websites.

10.9 The Vendor must employ traffic and network monitoring software and tools on a continuous basis to identify obstacles to detect and prevent hacking, intrusion and other unauthorized use of the Vendor’s resources.

10.10 The Vendor must employ traffic and network monitoring software and tools on a continuous basis to prevent adware or spyware from deteriorating system performance.

10.11 The Vendor must employ traffic and network monitoring software and tools on a continuous basis to update virus blocking software daily and aggressively monitor for and protect against viruses.

10.12 The Vendor must employ traffic and network monitoring software and tools on a continuous basis to monitor bandwidth usage and identify bottlenecks that impede performance.

10.13 The Vendor must employ traffic and network monitoring software and tools on a continuous basis to provide methods to flag recipient data to exclude Protected Health Information (PHI) from data exchanges as approved by the State, and to comply with recipient rights under the HIPAA privacy law for: 1) Requests for restriction of the uses and disclosures on PHI (45 Code of Federal Regulations (CFR) 164.522(a)); 2) Requests for confidential communications (45 CFR 164.522(b)); and 3) Requests for amendment of PHI (45 CFR 164.526). The Vendor must also enter into a Business Associate Agreement (“BAA”) with the Agency. The provisions of the BAA apply to HIPAA requirements and in the event of a conflict between the BAA and the provisions of this Sub-Section, the BAA shall control. (See Attachment II, Business Associate Agreement).

10.14 The Vendor shall conduct all activities in compliance with 45 CFR 164 Subpart C to ensure data security, including, but not limited to encryption of all information that is confidential under Florida or Federal law, while in transmission and while resident on portable electronic media storage devices. Encryption is required and shall be consistent with Federal Information Processing Standards (FIPS), and/or the National Institute of Standards and Technology (NIST) publications regarding cryptographic standards.

10.15 In order to enable the Agency to effectively measure and mitigate the Vendor’s security risks, the Agency may conduct an initial IT security risk score scan on the Vendor, as well as periodic or continuous security monitoring through an information security rating service, at the Agency's expense, to enable the Agency to effectively measure and mitigate the Vendor’s security risks.

The Vendor will work with the Agency’s Security Rating Score Provider to define the relevant Vendor assets providing Agency services. If the Vendor does not maintain a top tier security rating score, the Agency will impose liquidated damage(s) and/or other applicable sanction(s).

http://www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.pdf http://www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

AHCA Contract No. HQA028, Attachment I, Page 14 of 17

11. Disaster Recovery

11.1 The Vendor shall develop and maintain a disaster recovery plan for restoring the application of software and current master files and for hardware backup in the event the production systems are disabled or destroyed. The disaster recovery plan shall limit service interruption to a period of twenty-four (24) clock hours and shall ensure compliance with all requirements under this Contract. The records backup standards and a comprehensive disaster recovery plan shall be developed and maintained by the Vendor for the entire period of this Contract and submitted for review annually by the anniversary date of this Contract.

11.2 The Vendor shall maintain a disaster recovery plan for restoring day-to-day operations including alternative locations for the Vendor to conduct the requirements of this Contract. The disaster recovery plan shall limit service interruption to a period of twenty-four (24) clock hours and shall ensure compliance with all requirements of this Contract.

11.3 The Vendor shall maintain database backups in a manner that shall eliminate disruption of service or loss of data due to system or program failures or destruction.

11.4 The disaster recovery plan shall be finalized no later than thirty (30) calendar days prior to this

Contract effective date. The Agency shall review the Vendor’s disaster recovery plan during the readiness review.

11.5 The Agency, at its discretion, reserves the right to direct the Vendor to amend or update its disaster recovery plan in accordance with the best interests of the Agency and at no additional cost to the Agency.

11.6 The Vendor shall make all aspects of the disaster recovery plan available to the Agency at all times.

11.7 The Vendor shall conduct an annual Disaster Recovery Plan test and submit results for review to the Agency in the annual plan submitted in compliance with Section 12, Disaster Recovery.

12. Smartphone Applications

The Vendor shall receive written approval from the Agency Division of Information Technology before implementation of a smartphone application. If the Vendor uses smartphone applications (apps) to allow providers direct access to Agency-approved documents and/or content, the Vendor shall comply with the following:

12.1 The smartphone application shall disclaim that the application being used is not private and that no PHI or Personally Identifiable Information (PII) should be published on this application by the Vendor or provider; and

12.2 The Vendor shall ensure that software applications obtained, purchased, leased, or developed are based on secure coding guidelines; for example:

• OWASP [Open Web Application Security Project] Secure Coding Principles – http://www.owasp.org/index.php/Secure_Coding_Principles;

• CERT Security Coding - http://www.cert.org/secure-coding/; and http://www.owasp.org/index.php/Secure_Coding_Principles http://www.cert.org/secure-coding/

AHCA Contract No. HQA028, Attachment I, Page 15 of 17

• Top10SecuritycodingPractices – https://www.securecoding.cert.org/confluence/display/seccode/Top+10+Secure+Coding +Practices

13. Social Networking

13.1 Social Networking

All social networking applications, tools or media interactions and communications must be approved in writing by the Agency, prior to use. Any vendor using social networking applications is responsible and accountable for the safeguarding of PHI and all HIPAA Privacy Rule related information must be maintained and monitored.

In addition to all other review and monitoring aspects of this Contract, the Agency, at its discretion, reserves the right to monitor or review the Vendor’s monitoring of all social networking activity without notice.

The Vendor shall not conduct business relating to this Contract that involves the exchange of personally identifying, confidential or sensitive information on the Vendor’s social network application. The Vendor shall not post information, photos, links/URLs or other items online that would reflect negatively on any individual(s), its enrollees, the Agency or the State.

Any violations of this provision shall subject the Vendor to administrative action by the Agency as determined by the Agency.

14. Definitions and Acronyms

14.1 Definitions

Ad Hoc – A report designed for a specific purpose, case, or situation.

Agency — State of Florida, Agency for Health Care Administration (AHCA), its employees acting in their official capacity, or its designee.

Agency Information Technology (IT) Enterprise – Any interconnected system(s) or subsystem(s) or equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the Agency.

Business Day – Traditional workday, including Monday, Tuesday, Wednesday, Thursday, and Friday. State holidays are excluded.

Calendar Day – All seven days of the week. A twenty-four (24) hour period between midnight and midnight, regardless of whether or not it occurs on a weekend or holiday.

Calendar Year — A twelve (12) month period of time beginning on January 1 and ending on December 31.

Contract – The written agreement between the Agency and the Vendor comprised of the Contract, any addenda, appendices, attachments, or amendments thereto.

https://www.securecoding.cert.org/confluence/display/seccode/Top+10+Secure+Coding+Practices https://www.securecoding.cert.org/confluence/display/seccode/Top+10+Secure+Coding+Practices

AHCA Contract No. HQA028, Attachment I, Page 16 of 17

Contract Amendment – Any written alteration in the specifications, delivery point, rate of delivery, Contract period, price, quantity, or other Contract provisions of any existing Contract.

Contract Manager – An individual designated to act as liaison between the Agency and the Vendor and is responsible for the management of this Contract.

Interoperability – The ability of a system to work with or use the parts or equipment of another system, and characterized by seamless coordination and integration with other systems.

Vendor – The entity that contracts directly with the Agency for the work specified within this Contract.

14.2 Acronyms

Apps Applications

BAA Business Associate Agreement

CAP Corrective Action Plan

CFR Code of Federal Regulations

CJIS Criminal Justice Information System

DPPA Driver Privacy Protection Act

EEO Equal Employment Opportunity

FIPS Federal Information Processing Standards

FAC Florida Administrative Code

FS Florida Statutes

HIPAA Health Insurance Portability and Accountability Act

HITECH Health Information Technology for Economic and Clinical Health

ISM Information Security Manager ()

IT Information Technology

MVC Model View Controller

NIEM National Information Exchange Model

NIST National Institute for Standards and Technology

PHI Protected Health Information

PII Personally Identifiable Information

AHCA Contract No. HQA028, Attachment I, Page 17 of 17

PL Public Law

SFTP Secure File Transfer Protocol

SOC Service Organization Controls

SQL Structured Query Language

SSL Secure Sockets Layer

SSRS SQL Server Report Services

TFS Team Foundation Server

TLS Transport Layer Security

URL Uniform Resource Locator

US United States

USC United States Code

W3C World Wide Web Consortium

ATTACHMENT I-A

EXHIBIT II

PRICE SHEET

AHCA Contract No. HQA028, Attachment I-A, Exhibit II, Page 1 of 1

Table 1: Rates

No. Service/Position Title Rate

1. Physician Expert $235.00 / Hour

2. Utilization Nursing Review $100.00 / Hour

3. Medical Claims Coding Expert $130.00 / Hour

4. Legal Expert Review $175.00 / Hour

5. Initial Eligibility Determination Filing Fee of $85.00 plus a Credit Card Transaction Fee $2.85.

$87.85 (Per Dispute)

6. Late Fee Charge for Review Fee Not Paid within 35 days of the Final Order. Late fees will start on day 36 and will accrue every 30 days. An additional $50 late charge will accrue every 30 days until the invoice is paid.

$50.00

HQA028 - Attachment I-A Exhibit II Price Sheet (3)