DOH24-010 RFP Addendum 5 Attachments.pdf

Mission:

To protect, promote and improve the health of all people in Florida through integrated state, county and community efforts.

Ron DeSantis Governor

Joseph A. Ladapo, MD, PhD

State Surgeon General

Vision: To be the Healthiest State in the Nation

Florida Department of Health Division of Administration • Bureau of General Services 4052 Bald Cypress Way, Bin B-07 • Tallahassee, FL 32399

PHONE: 850-245-4199

FloridaHealth.gov

Accredited Health Department Public Health Accreditation Board

Addendum

RFP DOH24-010

Division of Emergency Preparedness and Community Support (DEPCS) IT Hosting Services

DATE: September 03, 2025

TO: Prospective Vendors

FROM: Voncelia Meeks, Procurement Officer

Florida Department of Health Central Purchasing Office

SUBJECT: Addendum 5

The purpose of this addendum is to modify Attachements in the Request for Proposal (RFP). This addendum serves as notice of the following change(s):

Deletions are indicated by “strikethrough” or reference. Additions, updates or replacements are indicated by highlighting.

A. Modifications: The following modifications are made to this RFP:

1. Attachment K, Application, Data Security and Confidentialty, is hereby deleted in its entirety and replaced with the Revised Attachment K, Application, Data Security and Confidentialty and attached herein.

2. Attachment L, HIPAA Business Associate Agreement is hereby deleted in its entirety and replaced with the Revised Attachment L, HIPAA Business Associate Agreement and attached herein.

3. Attachment M, Background Screening And Drug Screening Attestation is hereby deleted in its entirety and replaced with the Revised Attachment M, Background Screening And Drug Screening Attestation attached herein.

Failure to file a protest within the time prescribed in section 120.57(3), Florida Statutes, or failure to post the bond or other security required by law within the time allowed for filing a bond shall constitute a waiver of proceedings under Chapter 120, Florida Statutes.

REVISED

ATTACHMENT K

APPLICATION, DATA SECURITY, AND CONFIDENTIALITY

DOH24-010

Request for Proposal

(Respondent’s Name) _____________________

This attachment is for the purpose of ensuring that adequate information security protection is in place at all times during this contract between the Department of Health (hereinafter referred to as “the Department”), and service Respondents, vendors, and information trading partners, all referenced hereinafter together referred to as “Respondents” in this attachment. It is not comprehensive in its scope, but rather is supplemental guidance to standard contracts, purchase orders, and statements of work, to assure the confidentiality, integrity, and availability of information technology (IT) assets and adherence to statutory obligations at a summary level.

In this attachment, State Data means any electronic information including, but not limited to, records, files, computer programs, and databases owned by the state of Florida.

1. Hosting Data or Applications – This section applies to all contracts whereby a Respondent is hosting data, or hosting an application that processes data, on behalf of the Department. Respondent will comply with the following:

a. Respondent, its employees, subcontractors, and agents will comply with all Department security and administrative requirements in the performance of this contract. Respondent will provide immediate notice to the Department’s Information Security Manager (ISM), or their designee, in the event it becomes aware of any security breach and any unauthorized transmission of State Data as described below or of any allegation or suspected violation of security requirements of the Department.

b. Upon contract execution, produce a current security audit (no more than 12 months old) performed by a third party that is certified to perform such audits that demonstrate the use of sound security measures and practices by the Respondent hosting the data or application that is processing data, as defined by a nationally recognized security framework. Respondent will produce the status of any corrective action plans underway to address deficiencies found in the security audit. Respondent must provide an annual update on any open corrective action plans associated with the most recent audit’s noted deficiencies. The Department has the right to require the Respondent to produce a new or updated audit every three years or as deemed reasonably necessary by the Department, during the contract term, at Respondent’s expense.

c. At the request of the Department in lieu of or in combination with the requirements of 1.b. above, Respondent will obtain an American Institute of Certified Public Accountants (AICPA) “Standards for Attestation Engagements (SSAE) System and Organizations Controls (SOC) Report 2, Type 2” which shall have been performed within 12 months prior to the date of contract execution.

d. Data Loss Prevention: Respondent will perform periodic backups of all data (files, programs, databases, electronic records, etc.) hosted by Respondent on behalf of the Department sufficient to ensure no data loss occurs, and that data will be restored from backup when necessary, at the Respondent’s sole expense. In the event of loss of any State Data or records, where such loss is due to the negligence of Respondent or any of its subcontractors or agents, the Department may be entitled to sanctions by law or financial consequences per the Contract.

e. In the event of a breach of any State Data where such breach is due to the negligence of Respondent or any of its subcontractors or agents, the Department may be entitled to sanctions by law or financial consequences per the Contract. Respondent may be subject to administrative sanctions for failure to comply with section 501.171, Florida Statutes, for any breach of data, due to a failure to maintain adequate security, and responsible for any costs to the Department for the breach caused by Respondent. For purposes of this attachment, a breach is defined as a

Division of Emergency Preparedness and Community Support (DEPCS) IT Hosting Services confirmed event that compromises the confidentiality, integrity, or availability of information or data.

f. Data Protection: No State Data or information will be stored in, processed in, or shipped to offshore locations or outside of the United States of America, regardless of method, except as required by law or approved by the Department’s agency head or designee in writing. Respondent may request an exemption from the offshoring of State Data or information outside of the United States of America prohibition by submitting a request in writing to the Department’s agency head or designee, prior to the exemption being granted. Regardless of location, data storage technologies including encryption requirements must be reviewed and approved by the Department prior to State data being stored, processed, or transmitted by the Respondent.

g. Access to State Data will only be available to approved and authorized Respondent staff. Even when using approved technologies, requests for access from outside the United States will be submitted in accordance with the Department’s established processes and will only be allowed with express written approval from the Department’s Deputy Secretary of Operations. Third parties may be granted time-limited terminal or other remote service access to IT resources as necessary for the fulfillment of related responsibilities with prior written approval by the ISM.

When remote access needs to be changed, the ISM will be promptly notified in writing.

Regardless of location, data access and transmission technologies including encryption requirements must be reviewed and approved by the Department prior to State data being stored, processed, or transmitted by the Respondent.

h. Notice Requirement: Respondent will notify the Department upon detection of anomalous or malicious traffic that may compromise the confidentiality, integrity, or availability of the contracted services. To the extent applicable, failure to notify the Department of events or incidents that result in breach will subject Respondent to legal sanctions, financial consequences per the contract, and/or any costs to the Department of such breach of security.

i. Data Retention: Respondent must retain data as follows:

(1) Copies: At contract termination or expiration, submit copies of all finished or unfinished documents, data, studies, correspondence, reports, and other products prepared by or for Respondent under the contract; submit copies of all State Data to the Department in a format to be designated by the Department in accordance with section 119.0701, Florida Statutes; shred or erase parts of any retained duplicates containing personal information to make the personal information unreadable.

(2) Originals: At contract termination or expiration--retain its original records, and maintain, in confidence to the extent required by law, Respondent’s original records in un-redacted form, until the records retention schedule expires and to reasonably protect such documents and data during any pending investigation or audit.

(3) Both Copies and Originals: Upon expiration of all retention schedules and audits or investigations and upon notice to the Department, destroy all State Data from Respondent’s systems including, but not limited to, electronic data and documents containing personal information or other data that is confidential and exempt under Florida public records law.

(4) Return of State Data: In the event this contract is terminated for cause, Respondent shall return all State Data or information to the Department within 14 days from the date of termination unless a lesser period is agreed upon by the parties in writing.

2. Application Provisioning – This section applies to all contracts whereby a Respondent is making available a software application to be used by the Department for collecting, processing, reporting, and

Division of Emergency Preparedness and Community Support (DEPCS) IT Hosting Services storing data. Respondent’s software application used for the Department’s automation and processing must support, and not inhibit, each of the following Department security requirements:

a. Identity and Access Management must support the following accountability principles:

(1) Individual users must never share credentials. Service and utility accounts will be carefully provisioned and monitored.

(2) User sessions will automatically timeout after a maximum of 10 minutes of inactivity, requiring re-authentication.

(3) Passwords and Secrets must be encrypted or secured by other means when stored or in transit and will not be stored or passed in plain text.

(4) Audit records will allow actions of users and utility accounts to be uniquely traced by a minimum of account, action, and date.

(5) Allow role-based access or other methods to enforce least-privilege and authorized access principles based on system requirements.

(6) Support Azure Active Directory integration (normally OpenID Connect) for authentication of DOH end users.

(7) If provision (6) is not reasonably feasible, an exception may be granted by submitting a request in writing to the Department’s agency head or designee, prior to the exception being granted. If so, the following requirements must be met:

a) User accounts must be authenticated at a minimum by a complex password constructed as follows: a minimum of 10 characters to include an upper and lowercase letter, a number, and a special character.

b) Users must change their passwords at a maximum of every 90 days.

c) Accounts must be locked after a maximum of 10 incorrect attempts.

d) Multi-Factor (MFA) authentication will be enforced for any access to any system containing confidential and/or exempt data.

b. User accounts will be deactivated and archived for accountability purposes upon non-use of account for 60 consecutive days, or under direction of the Department if account self-management has not been provided to Department personnel.

3. Data Interchange – This section applies to contracts whereby the Department will be sending data transmissions to, or receiving data transmissions from, a Respondent for the purpose of independent processing. Examples include: sending laboratory orders to a laboratory, receiving laboratory results, sending billing information to a clearing house, receiving billing results or notification of payment, sending vital statistics to the Social Security Administration, sending physician licensing information to Florida’s Agency for Health Care Administration, receiving continuing education credit information for medical profession licensees, etc. Data interchange contracts must have a data-sharing agreement in place.

Respondent will comply with the following:

a. Follow all Department and State of Florida data encryption standards regarding the transmission of confidential or confidential and exempt information between the Department and the Respondent. The Respondent’s documented encryption standards will be provided upon request.

All transmission of confidential or confidential and exempt data must utilize protected protocols approved by the Department.

Division of Emergency Preparedness and Community Support (DEPCS) IT Hosting Services

b. Use of any connection to the Department’s network will be for retrieving information delivered by the Department, or sending data to the Department, and not for any other access to resources on the Department’s network.

c. Protect and maintain the confidentiality of all data, files, and records, classified by the Department as confidential or confidential and exempt, retrieved from the Department pursuant to this agreement. Respondent will immediately notify the Department’s ISM of any loss or breach of information originating from the Department and retrieved by Respondent.

4. All IT Services – This section applies to all contracts whereby a Respondent is providing IT services to the Department.

a. Respondent will protect and maintain the confidentiality of all data, files, and records, deemed to be confidential or confidential and exempt, acquired from the Department pursuant to this Contract.

b. Respondent will not divulge to third parties any confidential information obtained by the Respondent or its agents, distributors, resellers, subcontractors, officers, or employees while performing contract work, including, but not limited to, security design or architecture, business operations information, or commercial proprietary information in the possession of the state or the Department unless:

(1) Respondent is required by law or legal process to share such confidential information and written notice is provided to the Department prior to disclosure; or

(2) The Department submits a written request to the Respondent to share such confidential information with a department-designated third party.

Respondent’s Name: ___________________

Signature to Acknowledgement of Receipt: ____________________

ATTACHMENT L

HIPPA BUSINESS ASSOCIATE AGREEMENT

DOH24-010

Request for Proposal Division of Emergency Preparedness and Community Support (DEPCS) IT Hosting Services

Combined HIPAA Privacy Business Associate Agreement and Confidentiality Agreement and HIPAA Security Rule Addendum and HI-TECH Act Compliance Agreement and the Florida Information Protection Act of 2014

This Agreement is entered into between the State of Florida, Florida Department of Health (“Covered Entity”), and _____________ (“Business Associate”). The parties have entered into this Agreement for the purpose of satisfying the Business Associate contract requirements in the regulations at 45 CFR 164.502(e) and 164.504(e), issued under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Security Rule, codified at 45 Code of Federal Regulations (“C.F.R.”) Part 164, Subparts A and C; Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA), Pub. L. No. 111-5 (Feb. 17, 2009) and related regulations. This Agreement corresponds to the following contract #, purchase order, or memorandum of agreement

1.0 Definitions

Terms used but not otherwise defined in this Agreement shall have the same meaning as those terms in 45 CFR 160.103 and 164.501. Notwithstanding the above, "Covered Entity" shall mean the State of Florida Department of Health. “Individual” shall have the same meaning as the term “individual” in 45 CFR 164.501 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g); “Secretary” shall mean the Secretary of the U.S. Department of Health and Human Services or his designee; and “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

Part I: Privacy Provisions

2.0 Obligations and Activities of Business Associate

(a) Business Associate agrees to not use or further disclose Protected Health Information (“PHI”) other than as permitted or required by Sections 3.0 and 5.0 of this Agreement, or as required by Law.

(b) Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the

Protected Health Information other than as provided for by this Agreement.

(c) Business Associate agrees to take reasonable measures to protect and secure data in electronic form containing personal information as defined by §501.171, Florida Statutes.

(d) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to

Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement.

(e) Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware.

(f) Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information.

(g) Business Associate agrees to provide access, at the request of Covered Entity or an Individual, and in a prompt and reasonable manner consistent with the HIPAA regulations, to Protected Health Information in a designated record set, to the Covered Entity or directly to an Individual in order to meet the requirements under 45 CFR 164.524.

(h) Business Associate agrees to make any Amendment(s) to Protected Health Information in a designated record set that the Covered Entity or an Individual directs or agrees to pursuant to 45 CFR 164.526, in a prompt and reasonable manner consistent with the HIPAA regulations.

(i) Business Associate agrees to make its internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity

HIPPA BUSINESS ASSOCIATE AGREEMENT

DOH24-010

Request for Proposal Division of Emergency Preparedness and Community Support (DEPCS) IT Hosting Services available to the Covered Entity, or at the request of the Covered Entity, to the Secretary in a time and manner designated by the Covered Entity or the Secretary, for purposes of the Secretary determining Covered Entity's compliance with the Privacy Rule.

(j) Business Associate agrees to document disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

(k) Business Associate agrees to provide to Covered Entity or an Individual an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528, in a prompt and reasonable manner consistent with the HIPAA regulations.

(l) Business Associate agrees to satisfy all applicable provisions of HIPAA standards for electronic transactions and code sets, also known as the Electronic Data Interchange (EDI) Standards, at 45 CFR Part 162 no later than October 16, 2003. Business Associate further agrees to ensure that any agent, including a subcontractor, that conducts standard transactions on its behalf, will comply with the EDI Standards.

(m) Business Associate agrees to determine the Minimum Necessary type and amount of PHI required to perform its services and will comply with 45 CFR 164.502(b) and 514(d).

(n) Business Associate agrees to comply with all aspects of §501.171, Florida Statutes.

3.0 Permitted or Required Uses and Disclosures by Business Associate General Use and Disclosure.

(a) Except as expressly permitted in writing by Department of Health, Business Associate may use

Protected Health Information only to carry out the legal responsibilities of the Business Associate, but shall not disclose information to any third party without the expressed written consent of the Covered Entity.

(b) Except as otherwise limited in this Agreement, Business Associate may use Protected Health Information to provide data aggregation services to Covered Entity as permitted by 45 CFR 164.504(e)(2)(i)(B).

(c) Business Associate may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j) (1).

4.0 Obligations of Covered Entity to Inform Business Associate of Covered Entity’s Privacy Practices, and any Authorization or Restrictions.

(a) Covered Entity shall provide Business Associate with the notice of privacy practices that Covered

Entity produces in accordance with 45 CFR 164.520, as well as any changes to such notice.

(b) Covered Entity shall provide Business Associate with any changes in, or revocation of, Authorization by Individual or his or her personal representative to use or disclose Protected Health Information, if such changes affect Business Associate's uses or disclosures of Protected Health Information.

(c) Covered Entity shall notify Business Associate of any restriction to the use or disclosure of Protected Health Information that Covered Entity has agreed to in accordance with 45 CFR 164.522, if such changes affect Business Associate's uses or disclosures of Protected Health Information.

5.0 Confidentiality under State Law.

(a) In addition to the HIPAA privacy requirements and the data security requirements of §501.171, Florida

Statutes, Business Associate agrees to observe the confidentiality requirements of Chapter 381, Florida Statutes and any other Florida Statute relating to the confidentiality of information provided under this agreement.

(b) Receipt of a Subpoena. If Business Associate is served with subpoena requiring the production of Department of Health records or information, Business Associate shall immediately contact the Department of Health, Office of the General Counsel, (850) 245-4005. A subpoena is an official

HIPPA BUSINESS ASSOCIATE AGREEMENT

DOH24-010

Request for Proposal Division of Emergency Preparedness and Community Support (DEPCS) IT Hosting Services summons issued by a court or an administrative tribunal, which requires the recipient to do one or more of the following:

1. Appear at a deposition to give sworn testimony, and may also require that certain records be brought to be examined as evidence.

2. Appear at a hearing or trial to give evidence as a witness, and may also require that certain records be brought to be examined as evidence.

3. Furnish certain records for examination, by mail or by hand-delivery.

(c) Employees and Agents. Business Associate acknowledges that the confidentiality requirements herein apply to all its employees, agents and representatives. Business Associate assumes responsibility and liability for any damages or claims, including state and federal administrative proceedings and sanctions, against Department of Health, including costs and attorneys' fees, resulting from the breach of the confidentiality requirements of this Agreement.

6.0 Permissible Requests by Covered Entity.

Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by Covered Entity.

7.0 Term and Termination.

(a) Term.

The Term of this Agreement shall be coterminous with the underlying contract, purchase order, or memorandum of understanding giving rise to this agreement.

(b) Termination for Cause.

Without limiting any other termination rights the parties may have, upon Covered Entity's knowledge of a material breach by Business Associate of a provision under this Agreement, Covered Entity shall provide an opportunity for Business Associate to cure the breach or end the violation. If the Agreement of Business Associate does not cure the breach or end the violation within the time specified by Covered Entity, the Covered Entity shall have the right to immediately terminate the Agreement. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

(c) Effect of Termination.

1. Within sixty (60) days after termination of the Agreement for any reason, or within such other time period as mutually agreed upon in writing by the parties, Business Associate shall return to Covered Entity or destroy all Protected Health Information maintained by Business Associate in any form and shall retain no copies thereof. Business Associate also shall recover, and shall return or destroy with such time period, any Protected Health Information in the possession of its subcontractors or agents.

2. Within fifteen (15) days after termination of the Agreement for any reason, Business Associate shall notify Covered Entity in writing as to whether Business Associate elects to return or destroy such Protected Health Information. If Business Associate elects to destroy such Protected Health Information, it shall certify to Covered Entity in writing when and that such Protected Health Information has been destroyed. If any subcontractors or agents of the Business Associate elect to destroy the Protected Health Information, Business Associate will require such subcontractors or agents to certify to Business Associate and to Covered Entity in writing when such Protected Health Information has been destroyed. If it is not feasible for Business Associate to return or destroy any of said Protected Health Information, Business Associate shall notify Covered Entity in writing that Business Associate has determined that it is not feasible to return or destroy the Protected Health Information and the specific reasons for such determination. Business

3. Associate further agrees to extend any and all protections, limitations, and restrictions set forth in this Agreement to Business Associate’s use or disclosure of any Protected Health Information

HIPPA BUSINESS ASSOCIATE AGREEMENT

DOH24-010

Request for Proposal Division of Emergency Preparedness and Community Support (DEPCS) IT Hosting Services retained after the termination of this Agreement, and to limit any further uses or disclosures to the purposes that make the return or destruction of the Protected Health Information not feasible.

4. If it is not feasible for Business Associate to obtain, from a subcontractor or agent, any Protected Health Information in the possession of the subcontractor or agent, Business Associate shall provide a written explanation to Covered Entity and require the subcontractors and agents to agree to extend any and all protections, limitations, and restrictions set forth in this Agreement to the subcontractors’ or agents’ uses or disclosures of any Protected Health Information retained after the termination of this Agreement, and to limit any further uses or disclosures to the purposes that make the return or destruction of the Protected Health Information not feasible.

Part II: Breaches and Security Incidents

8.0 Privacy or Security Breach.

Business Associate will report to Covered Entity’s Privacy Officer or other department contact within 2 business days after the discovery, any unauthorized access, use, disclosure of Covered Entity’s protected health Information not permitted by the Business Associates Agreement along with any breach of Covered Entity’s unsecured protected health information. Business Associate will treat the breach as being discovered in accordance with 45 CFR §164.410. If a delay is requested by a law enforcement official in accordance with 45 CFR §164.412, Business Associate may delay notifying the Covered Entity for the applicable time period. Business Associates report will at a minimum:

(a) Identify the nature of the breach or other non-permitted use or disclosure, which will include a brief description of what happened, including the date of any breach and the date of discovery of the breach;

(b) Identify Covered Entity’s Protected Health Information that was subject to the non-permitted use or disclosure or breach (such as whether name, social security number, date of birth, home address, account number or other information was disclosed/accessed) on an individual basis;

(c) Identify who made the non-permitted use or disclosure and who received it;

(d) Identify what corrective or investigational action Business Associate took or will take to prevent further non-permitted uses or disclosures, to mitigate harmful effects and to protect against any further breaches;

(e) Identify what steps the individuals who were subject to a breach should take to protect themselves;

(f) Provide such other information, including a written report, as Covered Entity may reasonably request.

8.1 Security of Electronic Protected Health Information.

WHEREAS, Business Associate and Department of Health agree to also address herein the applicable requirements of the Security Rule, codified at 45 Code of Federal Regulations (“C.F.R.”) Part 164, Subparts A and C, issued pursuant to the Administrative Simplification provisions of Title II, Subtitle F of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA-AS”), and the Florida Information Protection Act (FIPA) §501.171, Florida Statutes, so that the Covered Entity may meet compliance obligations under HIPAA-AS and FIPA the parties agree:

(a) Business Associate will develop, implement, maintain, and use administrative, technical, and physical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic Protected Health Information (as defined in 45 C.F.R. § 160.103) and Personal Information (as defined in §501.171, Florida Statutes) that Business Associate creates, receives, maintains, or transmits on behalf of the Plans consistent with the Security Rule.

HIPPA BUSINESS ASSOCIATE AGREEMENT

DOH24-010

Request for Proposal Division of Emergency Preparedness and Community Support (DEPCS) IT Hosting Services

(b) Reporting Security Incidents. Business Associate will report to Covered Entity any successful (A) unauthorized access, use, disclosure, modification, or destruction of Covered Entity’s Electronic Protected Health Information or unauthorized access of data in an electronic form containing Personal Information as defined in §501.171, Florida Statute, or (B) interference with Business Associate’s system operations in Business Associate’s information systems, of which Business Associate becomes aware.

8.2 Corrective Action:

(a) Business Associate agrees to take prompt corrective action and follow all provisions required in state and federal law to notify all individuals reasonably believed to be potentially affected by the breach.

(b) Cure: Business Associate agrees to take prompt corrective action to cure any security deficiencies.

Part III

9.0 Miscellaneous

(a) Regulatory References. A reference in this Agreement to a section in the Privacy Rule or the Security

Rule means the section as in effect or as amended, and for which compliance is required.

(b) Amendment. Upon the enactment of any law or regulation affecting the use or disclosure of Protected

Health Information, Personal Information, Standard Transactions, the security of Health Information, or other aspects of HIPAA-AS or FIPA applicable or the publication of any decision of a court of the United States or any state relating to any such law or the publication of any interpretive policy or opinion of any governmental agency charged with the enforcement of any such law or regulation, either party may, by written notice to the other party, amend this Agreement in such manner as such party determines necessary to comply with such law or regulation. If the other party disagrees with such Amendment, it shall so notify the first party in writing within thirty (30) days of the notice. If the parties are unable to agree on an Amendment within thirty (30) days thereafter, then either of the parties may terminate the Agreement on thirty (30) days written notice to the other party.

(c) Survival. The respective rights and obligations of Business Associate under Section 7.0 of this Agreement shall survive the termination of this Agreement.

(d) Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits Covered Entity to comply with the Privacy Rule and the confidentiality requirements of the State of Florida.

(e) No third-party beneficiary. Nothing expressed or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than the parties and the respective successors or assignees of the parties, any rights, remedies, obligations, or liabilities whatsoever.

(f) Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the state of Florida to the extent not preempted by the Privacy Rules or other applicable federal law.

(g) The laws of the State of Florida shall apply to the interpretation of this Agreement or in case of any disagreement between the parties; the venue of any proceedings shall be the appropriate federal or state court in Leon County, Florida.

(h) Indemnification and performance guarantees. Business Associate shall indemnify, defend, and save harmless the State of Florida and Individuals covered for any financial loss as a result of claims brought by third parties and which are caused by the failure of Business Associate, its officers, directors or agents to comply with the terms of this Agreement. Additionally, Business Associate shall indemnify the State of Florida for any time and expenses it may incur from breach notifications that are necessary under either §501.171, Florida Statute or the HIPAA Breach Notification Rule, 45 CFR §§ 164.400-414, which are caused by the failure of Business Associate, its officers, directors or agents to comply with the terms of this Agreement.

HIPPA BUSINESS ASSOCIATE AGREEMENT

DOH24-010

Request for Proposal Division of Emergency Preparedness and Community Support (DEPCS) IT Hosting Services

(i) Assignment: Business Associate shall not assign either its obligations or benefits under this Agreement without the expressed written consent of the Covered Entity, which shall be at the sole discretion of the Covered Entity. Given the nature of this Agreement, neither subcontracting nor assignment by the Business Associate is anticipated and the use of those terms herein does not indicate that permission to assign or subcontract has been granted.

For: DEPARTMENT OF HEALTH

By:

Title:

Date:

For: (Name of Business Associate)_______________________

By:

Title:

Date:

ATTACHMENT M

BACKGROUND SCREENING AND DRUG SCREENING ATTESTATION

I hereby attest that all Respondent staff assigned to perform services under the resulting contract or purchase order will have completed the following prior to rendering services under the provided contract.

1. A Level 2 background and drug screening, which must not be older than 5 years.

2. A Level 2 background screening with results that did not reveal any disqualifying offense identified by section 435.04, Florida Statutes.

I certify I have full authority to legally bind Respondent to the provisions of this Proposal.

Signature of Authorized Representative* Date

*An authorized representative is an officer of the Respondent’s organization who has legal authority to bind the organization to the provisions of the Proposals. This usually is the President, Chairman of the Board, or owner of the entity. A document establishing delegated authority must be included with the Proposal if signed by someone other than the President, Chairman or owner.