ESBD_408498_1744229949869_Exhibit B - PCS 111_Contract Affirmations_wDUA.pdf

Health and Human Services Contract Affirmations v. 2.5 Effective November 2024

HEALTH AND HUMAN SERVICES

CONTRACT AFFIRMATIONS

For purposes of these Contract Affirmations, HHS includes both the Health and Human Services Commission (HHSC) and the Department of State Health Services (DSHS). System Agency refers to HHSC, DSHS, or both, that will be a party to this Contract. These Contract Affirmations apply to all Contractors and Grantees (referred to as “Contractor”) regardless of their business form (e.g., individual, partnership, corporation).

By entering into this Contract, Contractor affirms, without exception, understands, and agrees to comply with the following items through the life of the Contract:

1. Contractor represents and warrants that these Contract Affirmations apply to Contractor and all of Contractor's principals, officers, directors, shareholders, partners, owners, agents, employees, subcontractors, independent contractors, and any other representatives who may provide services under, who have a financial interest in, or otherwise are interested in this Contract and any related Solicitation.

2. Complete and Accurate Information Contractor represents and warrants that all statements and information provided to HHS are current, complete, and accurate. This includes all statements and information in this Contract and any related Solicitation Response.

3. Public Information Act Contractor understands that HHS will comply with the Texas Public Information Act (Chapter 552 of the Texas Government Code) as interpreted by judicial rulings and opinions of the Attorney General of the State of Texas. Information, documentation, and other material prepared and submitted in connection with this Contract or any related Solicitation may be subject to public disclosure pursuant to the Texas Public Information Act. In accordance with Section 2252.907 of the Texas Government Code, Contractor is required to make any information created or exchanged with the State pursuant to the Contract, and not otherwise excepted from disclosure under the Texas Public Information Act, available in a format that is accessible by the public at no additional charge to the State.

4. Contracting Information Requirements Contractor represents and warrants that it will comply with the requirements of Section 552.372(a) of the Texas Government Code. Except as provided by Section 552.374(c) of the Texas Government Code, the requirements of Subchapter J (Additional Provisions Related to Contracting Information), Chapter 552 of the Government Code, may apply to the Contract and the Contractor agrees that the Contract can be terminated if the Contractor knowingly or intentionally fails to comply with a requirement of that subchapter.

Effective November 2024

5. Assignment A. Contractor shall not assign its rights under the Contract or delegate the performance of its duties under the Contract without prior written approval from System Agency.

Any attempted assignment in violation of this provision is void and without effect.

B. Contractor understands and agrees the System Agency may in one or more transactions assign, pledge, or transfer the Contract. Upon receipt of System Agency’s notice of assignment, pledge, or transfer, Contractor shall cooperate with System Agency in giving effect to such assignment, pledge, or transfer, at no cost to System Agency or to the recipient entity.

6. Terms and Conditions Contractor accepts the Solicitation terms and conditions unless specifically noted by exceptions advanced in the form and manner directed in the Solicitation, if any, under which this Contract was awarded. Contractor agrees that all exceptions to the Solicitation, as well as terms and conditions advanced by Contractor that differ in any manner from HHS’ terms and conditions, if any, are rejected unless expressly accepted by System Agency in writing.

7. HHS Right to Use Contractor agrees that HHS has the right to use, produce, and distribute copies of and to disclose to HHS employees, agents, and contractors and other governmental entities all or part of this Contract or any related Solicitation Response as HHS deems necessary to complete the procurement process or comply with state or federal laws.

8. Release from Liability Contractor generally releases from liability and waives all claims against any party providing information about the Contractor at the request of System Agency.

9. Dealings with Public Servants Contractor has not given, has not offered to give, and does not intend to give at any time hereafter any economic opportunity, future employment, gift, loan, gratuity, special discount, trip, favor, or service to a public servant in connection with this Contract or any related Solicitation, or related Solicitation Response.

10. Financial Participation Prohibited Under Section 2155.004, Texas Government Code (relating to financial participation in preparing solicitations), Contractor certifies that the individual or business entity named in this Contract and any related Solicitation Response is not ineligible to receive this Contract and acknowledges that this Contract may be terminated and payment withheld if this certification is inaccurate.

11. Prior Disaster Relief Contract Violation Under Sections 2155.006 and 2261.053 of the Texas Government Code (relating to convictions and penalties regarding Hurricane Rita, Hurricane Katrina, and other disasters), the Contractor certifies that the individual or business entity named in this Contract and any related Solicitation Response is not ineligible to receive this Contract

Effective November 2024 and acknowledges that this Contract may be terminated and payment withheld if this certification is inaccurate.

12. Child Support Obligation Under Section 231.006(d) of the Texas Family Code regarding child support, Contractor certifies that the individual or business entity named in this Contract and any related Solicitation Response is not ineligible to receive the specified payment and acknowledges that the Contract may be terminated and payment may be withheld if this certification is inaccurate. If the certification is shown to be false, Contractor may be liable for additional costs and damages set out in 231.006(f).

13. Suspension and Debarment Contractor certifies that it and its principals are not suspended or debarred from doing business with the state or federal government as listed on the State of Texas Debarred Vendor List maintained by the Texas Comptroller of Public Accounts and the System for Award Management (SAM) maintained by the General Services Administration. This certification is made pursuant to the regulations implementing Executive Order 12549 and Executive Order 12689, Debarment and Suspension, 2 C.F.R. Part 376, and any relevant regulations promulgated by the Department or Agency funding this project. This provision shall be included in its entirety in Contractor’s subcontracts, if any, if payment in whole or in part is from federal funds.

14. Excluded Parties Contractor certifies that it is not listed in the prohibited vendors list authorized by Executive Order 13224, “Blocking Property and Prohibiting Transactions with Persons Who Commit, Threaten to Commit, or Support Terrorism,” published by the United States Department of the Treasury, Office of Foreign Assets Control.’

15. Foreign Terrorist Organizations Contractor represents and warrants that it is not engaged in business with Iran, Sudan, or a foreign terrorist organization, as prohibited by Section 2252.152 of the Texas Government Code.

16. Executive Head of a State Agency In accordance with Section 669.003 of the Texas Government Code, relating to contracting with the executive head of a state agency, Contractor certifies that it is not (1) the executive head of an HHS agency, (2) a person who at any time during the four years before the date of this Contract was the executive head of an HHS agency, or (3) a person who employs a current or former executive head of an HHS agency.

17. Human Trafficking Prohibition Under Section 2155.0061 of the Texas Government Code, Contractor certifies that the individual or business entity named in this Contract is not ineligible to receive this Contract and acknowledges that this Contract may be terminated and payment withheld if this certification is inaccurate.

Effective November 2024

18. Franchise Tax Status Contractor represents and warrants that it is not currently delinquent in the payment of any franchise taxes owed the State of Texas under Chapter 171 of the Texas Tax Code.

19. Debts and Delinquencies Contractor agrees that any payments due under this Contract shall be applied towards any debt or delinquency that is owed to the State of Texas.

20. Lobbying Prohibition Contractor represents and warrants that payments to Contractor and Contractor's receipt of appropriated or other funds under this Contract or any related Solicitation are not prohibited by Sections 556.005, 556.0055, or 556.008 of the Texas Government Code (relating to use of appropriated money or state funds to employ or pay lobbyists, lobbying expenses, or influence legislation).

21. Buy Texas Contractor agrees to comply with Section 2155.4441 of the Texas Government Code, requiring the purchase of products and materials produced in the State of Texas in performing service contracts.

22. Disaster Recovery Plan Contractor agrees that upon request of System Agency, Contractor shall provide copies of its most recent business continuity and disaster recovery plans.

23. Computer Equipment Recycling Program If this Contract is for the purchase or lease of computer equipment, then Contractor certifies that it is in compliance with Subchapter Y, Chapter 361 of the Texas Health and Safety Code related to the Computer Equipment Recycling Program and the Texas Commission on Environmental Quality rules in 30 TAC Chapter 328.

24. Television Equipment Recycling Program If this Contract is for the purchase or lease of covered television equipment, then Contractor certifies that it is compliance with Subchapter Z, Chapter 361 of the Texas Health and Safety Code related to the Television Equipment Recycling Program.

25. Cybersecurity Training A. Contractor represents and warrants that it will comply with the requirements of

Section 2054.5192 of the Texas Government Code relating to cybersecurity training and required verification of completion of the training program.

B. Contractor represents and warrants that if Contractor or Subcontractors, officers, or employees of Contractor have access to any state computer system or database, the Contractor, Subcontractors, officers, and employees of Contractor shall complete cybersecurity training pursuant to and in accordance with Government Code, Section 2054.5192.

Effective November 2024

26. Restricted Employment for Certain State Personnel Contractor acknowledges that, pursuant to Section 572.069 of the Texas Government Code, a former state officer or employee of a state agency who during the period of state service or employment participated on behalf of a state agency in a procurement or contract negotiation involving Contractor may not accept employment from Contractor before the second anniversary of the date the Contract is signed or the procurement is terminated or withdrawn.

27. No Conflicts of Interest A. Contractor represents and warrants that it has no actual or potential conflicts of interest in providing the requested goods or services to System Agency under this Contract or any related Solicitation and that Contractor’s provision of the requested goods and/or services under this Contract and any related Solicitation will not constitute an actual or potential conflict of interest or reasonably create an appearance of impropriety.

B. Contractor agrees that, if after execution of the Contract, Contractor discovers or is made aware of a Conflict of Interest, Contractor will immediately and fully disclose such interest in writing to System Agency. In addition, Contractor will promptly and fully disclose any relationship that might be perceived or represented as a conflict after its discovery by Contractor or by System Agency as a potential conflict. System Agency reserves the right to make a final determination regarding the existence of Conflicts of Interest, and Contractor agrees to abide by System Agency’s decision.

28. Fraud, Waste, and Abuse Contractor understands that HHS does not tolerate any type of fraud, waste, or abuse.

Violations of law, agency policies, or standards of ethical conduct will be investigated, and appropriate actions will be taken. Pursuant to Texas Government Code, Section 321.022, if the administrative head of a department or entity that is subject to audit by the state auditor has reasonable cause to believe that money received from the state by the department or entity or by a client or contractor of the department or entity may have been lost, misappropriated, or misused, or that other fraudulent or unlawful conduct has occurred in relation to the operation of the department or entity, the administrative head shall report the reason and basis for the belief to the Texas State Auditor’s Office (SAO).

All employees or contractors who have reasonable cause to believe that fraud, waste, or abuse has occurred (including misconduct by any HHS employee, Grantee officer, agent, employee, or subcontractor that would constitute fraud, waste, or abuse) are required to immediately report the questioned activity to the Health and Human Services Commission's Office of Inspector General. Contractor agrees to comply with all applicable laws, rules, regulations, and System Agency policies regarding fraud, waste, and abuse including, but not limited to, HHS Circular C-027.

A report to the SAO must be made through one of the following avenues:

● SAO Toll Free Hotline: 1-800-TX-AUDIT

● SAO website: http://sao.fraud.state.tx.us/

Effective November 2024

All reports made to the OIG must be made through one of the following avenues:

● OIG Toll Free Hotline 1-800-436-6184

● OIG Website: ReportTexasFraud.com

● Internal Affairs Email: InternalAffairsReferral@hhsc.state.tx.us

● OIG Hotline Email: OIGFraudHotline@hhsc.state.tx.us.

● OIG Mailing Address: Office of Inspector General

Attn: Fraud Hotline

MC 1300

P.O. Box 85200 Austin, Texas 78708-5200

29. Antitrust The undersigned affirms under penalty of perjury of the laws of the State of Texas that:

A. in connection with this Contract and any related Solicitation Response, neither I nor any representative of the Contractor has violated any provision of the Texas Free Enterprise and Antitrust Act, Tex. Bus. & Comm. Code Chapter 15;

B. in connection with this Contract and any related Solicitation Response, neither I nor any representative of the Contractor has violated any federal antitrust law; and

C. neither I nor any representative of the Contractor has directly or indirectly communicated any of the contents of this Contract and any related Solicitation Response to a competitor of the Contractor or any other company, corporation, firm, partnership or individual engaged in the same line of business as the Contractor.

30. Legal and Regulatory Actions Contractor represents and warrants that it is not aware of and has received no notice of any court or governmental agency proceeding, investigation, or other action pending or threatened against Contractor or any of the individuals or entities included in numbered paragraph 1 of these Contract Affirmations within the five (5) calendar years immediately preceding execution of this Contract or the submission of any related Solicitation Response that would or could impair Contractor’s performance under this Contract, relate to the contracted or similar goods or services, or otherwise be relevant to System Agency’s consideration of entering into this Contract. If Contractor is unable to make the preceding representation and warranty, then Contractor instead represents and warrants that it has provided to System Agency a complete, detailed disclosure of any such court or governmental agency proceeding, investigation, or other action that would or could impair Contractor’s performance under this Contract, relate to the contracted or similar goods or services, or otherwise be relevant to System Agency’s consideration of entering into this Contract. In addition, Contractor acknowledges this is a continuing disclosure requirement. Contractor represents and warrants that Contractor shall notify System Agency in writing within five (5) business days of any changes to the representations or warranties in this clause and understands that failure to so timely update System Agency shall constitute breach of contract and may result in immediate contract termination.

Effective November 2024

31. No Felony Criminal Convictions Contractor represents that neither Contractor nor any of its employees, agents, or representatives, including any subcontractors and employees, agents, or representative of such subcontractors, have been convicted of a felony criminal offense or that if such a conviction has occurred Contractor has fully advised System Agency in writing of the facts and circumstances surrounding the convictions.

32. Unfair Business Practices Contractor represents and warrants that it has not been the subject of allegations of Deceptive Trade Practices violations under Chapter 17 of the Texas Business and Commerce Code, or allegations of any unfair business practice in any administrative hearing or court suit and that Contractor has not been found to be liable for such practices in such proceedings. Contractor certifies that it has no officers who have served as officers of other entities who have been the subject of allegations of Deceptive Trade Practices violations or allegations of any unfair business practices in an administrative hearing or court suit and that such officers have not been found to be liable for such practices in such proceedings.

33. Entities that Boycott Israel Contractor represents and warrants that (1) it does not, and shall not for the duration of the Contract, boycott Israel or (2) the verification required by Section 2271.002 of the Texas Government Code does not apply to the Contract. If circumstances relevant to this provision change during the course of the Contract, Contractor shall promptly notify System Agency.

34. E-Verify Contractor certifies that for contracts for services, Contractor shall utilize the U.S.

Department of Homeland Security’s E-Verify system during the term of this Contract to determine the eligibility of:

1. all persons employed by Contractor to perform duties within Texas; and

2. all persons, including subcontractors, assigned by Contractor to perform work pursuant to this Contract within the United States of America.

35. Former Agency Employees – Certain Contracts

If this Contract is an employment contract, a professional services contract under Chapter 2254 of the Texas Government Code, or a consulting services contract under Chapter 2254 of the Texas Government Code, in accordance with Section 2252.901 of the Texas Government Code, Contractor represents and warrants that neither Contractor nor any of Contractor’s employees including, but not limited to, those authorized to provide services under the Contract, were former employees of an HHS Agency during the twelve (12) month period immediately prior to the date of the execution of the Contract.

Effective November 2024

36. Disclosure of Prior State Employment – Consulting Services If this Contract is for consulting services, A. In accordance with Section 2254.033 of the Texas Government Code, a Contractor providing consulting services who has been employed by, or employs an individual who has been employed by, System Agency or another State of Texas agency at any time during the two years preceding the submission of Contractor’s offer to provide services must disclose the following information in its offer to provide services.

Contractor hereby certifies that this information was provided and remains true, correct, and complete:

1. Name of individual(s) (Contractor or employee(s));

2. Status;

3. The nature of the previous employment with HHSC or the other State of Texas agency;

4. The date the employment was terminated and the reason for the termination; and

5. The annual rate of compensation for the employment at the time of its termination.

B. If no information was provided in response to Section A above, Contractor certifies that neither Contractor nor any individual employed by Contractor was employed by System Agency or any other State of Texas agency at any time during the two years preceding the submission of Contractor’s offer to provide services.

37. Abortion Funding Limitation Contractor understands, acknowledges, and agrees that, pursuant to Article IX of the General Appropriations Act (the Act), to the extent allowed by federal and state law, money appropriated by the Texas Legislature may not be distributed to any individual or entity that, during the period for which funds are appropriated under the Act:

1. performs an abortion procedure that is not reimbursable under the state’s Medicaid program;

2. is commonly owned, managed, or controlled by an entity that performs an abortion procedure that is not reimbursable under the state’s Medicaid program; or

3. is a franchise or affiliate of an entity that performs an abortion procedure that is not reimbursable under the state’s Medicaid program.

The provision does not apply to a hospital licensed under Chapter 241, Health and Safety Code, or an office exempt under Section 245.004(2), Health and Safety Code. Contractor represents and warrants that it is not ineligible, nor will it be ineligible during the term of this Contract, to receive appropriated funding pursuant to Article IX.

38. Funding Eligibility Contractor understands, acknowledges, and agrees that, pursuant to Chapter 2272 (eff.

Sept. 1, 2021, Ch. 2273) of the Texas Government Code, except as exempted under that Chapter, HHSC cannot contract with an abortion provider or an affiliate of an abortion provider. Contractor certifies that it is not ineligible to contract with HHSC under the terms of Chapter 2272 (eff. Sept. 1, 2021, Ch. 2273) of the Texas Government Code.

Effective November 2024

39. Gender Transitioning and Gender Reassignment Procedures and Treatments for Certain Children – Prohibited Use of Public Money; Prohibited State Health Plan Reimbursement.

Contractor understands, acknowledges, and agrees that, pursuant to Section 161.704 of the Texas Health and Safety Code (eff. Sept. 1, 2023), public money may not directly or indirectly be used, granted, paid, or distributed to any health care provider, medical school, hospital, physician, or any other entity, organization, or individual that provides or facilitates the provision of a procedure or treatment to a child that is prohibited under Section 161.702 of the Texas Health and Safety Code. Contractor also understands, acknowledges, and agrees that, pursuant to Section 161.705 of the Texas Health and Safety Code (eff. Sept. 1, 2023), HHSC may not provide Medicaid reimbursement and the child health plan program established under Chapter 62 may not provide reimbursement to a physician or health care provider for provision of a procedure or treatment to a child that is prohibited under Section 161.702 of the Texas Health and Safety Code. Contractor certifies that it is not ineligible to contract with System Agency under the terms of Chapter 161, Subchapter X, of the Texas Health and Safety Code.

40. Prohibition on Certain Telecommunications and Video Surveillance Services or Equipment (2 CFR 200.216)

Contractor certifies that the individual or business entity named in this Response or Contract is not ineligible to receive the specified Contract or funding pursuant to 2 CFR 200.216.

41. COVID-19 Vaccine Passports Pursuant to Texas Health and Safety Code, Section 161.0085(c), Contractor certifies that it does not require its customers to provide any documentation certifying the customer’s COVID-19 vaccination or post-transmission recovery on entry to, to gain access to, or to receive service from the Contractor’s business. Contractor acknowledges that such a vaccine or recovery requirement would make Contractor ineligible for a state-funded contract.

42. COVID-19 Vaccinations Contractor understands, acknowledges, and agrees that, pursuant to Article II of the General Appropriations Act, none of the General Revenue Funds appropriated to the Department of State Health Services (DSHS) may be used for the purpose of promoting or advertising COVID-19 vaccinations in the 2024-25 biennium. It is also the intent of the legislature that to the extent allowed by federal law, any federal funds allocated to DSHS shall be expended for activities other than promoting or advertising COVID-19 vaccinations. Contractor represents and warrants that it is not ineligible, nor will it be ineligible during the term of this Contract, to receive appropriated funding pursuant to Article II.

Effective November 2024

43. Entities that Boycott Energy Companies In accordance with Senate Bill 13, Acts 2021, 87th Leg., R.S., pursuant to Section

2274.002 (eff. Sept. 1, 2023, Section 2276.002, pursuant to House Bill 4595, Acts 2023, 88th Leg., R.S.) of the Texas Government Code (relating to prohibition on contracts with companies boycotting certain energy companies), Contractor represents and warrants that: (1) it does not, and will not for the duration of the Contract, boycott energy companies or (2) the verification required by Section 2274.002 (eff. Sept. 1, 2023, Section 2276.002, pursuant to House Bill 4595, Acts 2023, 88th Leg., R.S.) of the Texas Government Code does not apply to the Contract. If circumstances relevant to this provision change during the course of the Contract, Contractor shall promptly notify System Agency.

44. Entities that Discriminate Against Firearm and Ammunition Industries In accordance with Senate Bill 19, Acts 2021, 87th Leg., R.S., pursuant to Section

2274.002 of the Texas Government Code (relating to prohibition on contracts with companies that discriminate against firearm and ammunition industries), Contractor verifies that: (1) it does not, and will not for the duration of the Contract, have a practice, policy, guidance, or directive that discriminates against a firearm entity or firearm trade association or (2) the verification required by Section 2274.002 of the Texas Government Code does not apply to the Contract. If circumstances relevant to this provision change during the course of the Contract, Contractor shall promptly notify System Agency.

45. Security Controls for State Agency Data In accordance with Senate Bill 475, Acts 2021, 87th Leg., R.S., pursuant to Texas Government Code, Section 2054.138, Contractor understands, acknowledges, and agrees that if, pursuant to this Contract, Contractor is or will be authorized to access, transmit, use, or store data for System Agency, Contractor is required to meet the security controls the System Agency determines are proportionate with System Agency’s risk under the Contract based on the sensitivity of System Agency’s data and that Contractor must periodically provide to System Agency evidence that Contractor meets the security controls required under the Contract.

46. Cloud Computing State Risk and Authorization Management Program (TX-RAMP) In accordance with Senate Bill 475, Acts 2021, 87th Leg., R.S., pursuant to Texas Government Code, Section 2054.0593, Contractor acknowledges and agrees that, if providing cloud computing services for System Agency, Contractor must comply with the requirements of the state risk and authorization management program and that System Agency may not enter or renew a contract with Contractor to purchase cloud computing services for the agency that are subject to the state risk and authorization management program unless Contractor demonstrates compliance with program requirements. If providing cloud computing services for System Agency that are subject to the state risk and authorization management program, Contractor certifies it will maintain program compliance and certification throughout the term of the Contract.

Effective November 2024

47. Office of Inspector General Investigative Findings Expert Review In accordance with Senate Bill 799, Acts 2021, 87th Leg., R.S., if Texas Government Code, Section 531.102(m-1)(2) (eff. Apr. 1, 2025, Section 544.0106, pursuant to House Bill 4611, Acts 2023, 88th Leg., R.S.) is applicable to this Contract, Contractor affirms that it possesses the necessary occupational licenses and experience.

48. Contract for Professional Services of Physicians, Optometrists, and Registered Nurses In accordance with Senate Bill 799, Acts 2021, 87th Leg., R.S., if Texas Government Code, Section 2254.008(a)(2) is applicable to this Contract, Contractor affirms that it possesses the necessary occupational licenses and experience.

49. Foreign-Owned Companies in Connection with Critical Infrastructure If Texas Government Code, Section 2274.0102(a)(1) (eff. Sept. 1, 2023, Section 2275.0102(a)(1), pursuant to House Bill 4595, Acts 2023, 88th Leg., R.S.) (relating to prohibition on contracts with certain foreign-owned companies in connection with critical infrastructure) is applicable to this Contract, pursuant to Government Code Section

2274.0102 (eff. Sept. 1, 2023, Section 2275.0102, pursuant to House Bill 4595, Acts 2023, 88th Leg., R.S.), Contractor certifies that neither it nor its parent company, nor any affiliate of Contractor or its parent company, is: (1) majority owned or controlled by citizens or governmental entities of China, Iran, North Korea, Russia, or any other country designated by the Governor under Government Code Section 2274.0103 (eff. Sept. 1, 2023, Section 2275.0103, pursuant to House Bill 4595, Acts 2023, 88th Leg., R.S.), or (2) headquartered in any of those countries.

50. Critical Infrastructure Subcontracts For purposes of this Paragraph, the designated countries are China, Iran, North Korea, Russia, and any countries lawfully designated by the Governor as a threat to critical infrastructure. Pursuant to Section 117.002 of the Business and Commerce Code, Contractor shall not enter into a subcontract that will provide direct or remote access to or control of critical infrastructure, as defined by Section 117.001 of the Texas Business and Commerce Code, in this state, other than access specifically allowed for product warranty and support purposes to any subcontractor unless (i) neither the subcontractor nor its parent company, nor any affiliate of the subcontractor or its parent company, is majority owned or controlled by citizens or governmental entities of a designated country; and (ii) neither the subcontractor nor its parent company, nor any affiliate of the subcontractor or its parent company, is headquartered in a designated country. Contractor will notify the System Agency before entering into any subcontract that will provide direct or remote access to or control of critical infrastructure, as defined by Section 117.001 of the Texas Business & Commerce Code, in this state.

51. Enforcement of Certain Federal Firearms Laws Prohibited In accordance with House Bill 957, Acts 2021, 87th Leg., R.S., if Texas Government Code, Section 2.101 is applicable to Contractor, Contractor certifies that it is not ineligible to receive state grant funds pursuant to Texas Government Code, Section 2.103.

Effective November 2024

52. Prohibition on Abortions Contractor understands, acknowledges, and agrees that, pursuant to Article II of the General Appropriations Act, (1) no funds shall be used to pay the direct or indirect costs (including marketing, overhead, rent, phones, and utilities) of abortion procedures provided by contractors of HHSC; and (2) no funds appropriated for Medicaid Family Planning, Healthy Texas Women Program, or the Family Planning Program shall be distributed to individuals or entities that perform elective abortion procedures or that contract with or provide funds to individuals or entities for the performance of elective abortion procedures. Contractor represents and warrants that it is not ineligible, nor will it be ineligible during the term of this Contract, to receive appropriated funding pursuant to Article II.

53. Pursuant to Executive Order GA-48, relating to hardening of state government, issued November 19, 2024, Contractor certifies it is not and, if applicable, any of its holding companies or subsidiaries is not:

a. Listed in Section 889 of the 2019 National Defense Authorization Act (NDAA);

or

b. Listed in Section 1260H of the 2021 NDAA; or

c. Owned by the government of a country on the U.S. Department of Commerce’s foreign adversaries list under 15 C.F.R. § 791.4; or

d. Controlled by any governing or regulatory body located in a country on the U.S.

Department of Commerce’s foreign adversaries list under 15 C.F.R. § 791.4.

54. False Representation

Contractor understands, acknowledges, and agrees that any false representation or any failure to comply with a representation, warranty, or certification made by Contractor is subject to all civil and criminal consequences provided at law or in equity including, but not limited to, immediate termination of this Contract.

55. False Statements Contractor represents and warrants that all statements and information prepared and submitted by Contractor in this Contract and any related Solicitation Response are current, complete, true, and accurate. Contractor acknowledges any false statement or material misrepresentation made by Contractor during the performance of this Contract or any related Solicitation is a material breach of contract and may void this Contract.

Further, Contractor understands, acknowledges, and agrees that any false representation or any failure to comply with a representation, warranty, or certification made by Contractor is subject to all civil and criminal consequences provided at law or in equity including, but not limited to, immediate termination of this Contract.

56. Permits and License Contractor represents and warrants that it will comply with all applicable laws and maintain all permits and licenses required by applicable city, county, state, and federal rules, regulations, statutes, codes, and other laws that pertain to this Contract.

Effective November 2024

57. Equal Employment Opportunity Contractor represents and warrants its compliance with all applicable duly enacted state and federal laws governing equal employment opportunities.

58. Federal Occupational Safety and Health Law Contractor represents and warrants that all articles and services shall meet or exceed the safety standards established and promulgated under the Federal Occupational Safety and Health Act of 1970, as amended (29 U.S.C. Chapter 15).

HHS Data Use Agreement v.8.5 October 23, 2019

DATA USE AGREEMENT

BETWEEN THE

TEXAS HEALTH AND HUMAN SERVICES SYSTEM

AND

CONTRACTOR

This Data Use Agreement (“DUA”) is effective as of the date of the Base Contract into which it is incorporated (“Effective Date”), by and between the Texas Health and Human Services System, which includes the Texas Health and Human Services Commission and the Department of State Health Services

(“HHS”) and Contractor (the "Base Contract").

ARTICLE 1. PURPOSE; APPLICABILITY; ORDER OF PRECEDENCE

The purpose of this DUA is to facilitate access to, creation, receipt, maintenance, use, disclosure or transmission of Confidential Information with Contractor, and describe Contractor’s rights and obligations with respect to the Confidential Information and the limited purposes for which the Contractor may create, receive, maintain, use, disclose or have access to Confidential Information. This DUA also describes

HHS’s remedies in the event of Contractor’s noncompliance with its obligations under this DUA. This

DUA applies to both HHS business associates, as “business associate” is defined in the Health Insurance

Portability and Accountability Act (HIPAA), and contractors who are not business associates, who create, receive, maintain, use, disclose or have access to Confidential Information on behalf of HHS, its programs or clients as described in the Base Contract. As a best practice, HHS requires its contractors to comply with the terms of this DUA to safeguard all types of Confidential Information.

As of the Effective Date of this DUA, if any provision of the Base Contract conflicts with this

DUA, this DUA controls.

ARTICLE 2. DEFINITIONS

For the purposes of this DUA, capitalized, underlined terms have the following meanings:

“Authorized Purpose” means the specific purpose or purposes described in the Base Contract for

Contractor to fulfill its obligations under the Base Contract, or any other purpose expressly authorized by

HHS in writing in advance.

“Authorized User” means a person:

(1) Who is authorized to create, receive, maintain, have access to, process, view, handle, examine, interpret, or analyze Confidential Information pursuant to this DUA;

(2) For whom Contractor warrants and represents has a demonstrable need to create, receive, maintain, use, disclose or have access to the Confidential Information; and

(3) Who has agreed in writing to be bound by the disclosure and use limitations pertaining to the Confidential Information as required by this DUA.

“Breach” means an impermissible use or disclosure of electronic or non-electronic sensitive personal information by an unauthorized person or for an unauthorized purpose that compromises the security or privacy of Confidential Information such that the use or disclosure poses a risk of reputational harm, theft of financial information, identity theft, or medical identity theft. Any acquisition, access, use, disclosure or loss of Confidential Information other than as permitted by this

DUA shall be presumed to be a Breach unless Contractor demonstrates, based on a risk assessment, that there is a low probability that the Confidential Information has been compromised.

“Confidential Information” means any communication or record (whether oral, written, electronically stored or transmitted, or in any other form) provided to or made available to Contractor or that Contractor may create, receive, maintain, use, disclose or have access to on behalf of HHS that consists of or includes any or all of the following:

(1) Education records as defined in the Family Educational Rights and Privacy Act, 20 U.S.C.

§1232g; 34 C.F.R. Part 99

(2) Federal Tax Information as defined in Internal Revenue Code §6103 and Internal Revenue

Service Publication 1075;

(3) Personal Identifying Information (PII) as defined in Texas Business and Commerce Code, Chapter 521;

(4) Protected Health Information (PHI) in any form including without limitation, Electronic

Protected Health Information or Unsecured Protected Health Information as defined in 45

C.F.R. §160.103;

(5) Sensitive Personal Information (SPI) as defined in Texas Business and Commerce Code, Chapter 521;

(6) Social Security Administration Data, including, without limitation, Medicaid information means disclosures of information made by the Social Security Administration or the

Centers for Medicare and Medicaid Services from a federal system of records for administration of federally funded benefit programs under the Social Security Act, 42

U.S.C., Chapter 7;

(7) All privileged work product;

(8) All information designated as confidential under the constitution and laws of the State of

Texas and of the United States, including the Texas Health & Safety Code and the Texas

Public Information Act, Texas Government Code, Chapter 552.

“Destroy”, “Destruction”, for Confidential Information, means:

(1) Paper, film, or other hard copy media have been shredded or destroyed such that the

Confidential Information cannot be read or otherwise cannot be reconstructed. Redaction is specifically excluded as a means of data destruction.

(2) Electronic media have been cleared, purged, or destroyed consistent with NIST Special

Publication 800-88, "Guidelines for Media Sanitization," such that the Confidential Information cannot be retrieved.

“Discover, Discovery” means the first day on which a Breach becomes known to Contractor, or, by exercising reasonable diligence would have been known to Contractor.

“Legally Authorized Representative” of an individual, including as provided in 45 CFR 435.923

(authorized representative); 45 CFR 164.502(g)(1) (personal representative); Tex. Occ. Code § 151.002(6);

Tex. H. & S. Code §166.164 (medical power of attorney); and Texas Estates Code § 22.031 (representative).

“Required by Law” means a mandate contained in law that compels an entity to use or disclose

Confidential Information that is enforceable in a court of law, including court orders, warrants, subpoenas or investigative demands.

http://www.statutes.legis.state.tx.us/docs/GV/htm/GV.552.htm http://csrc.nist.gov/ http://csrc.nist.gov/

“Subcontractor” means a person who contracts with a prime contractor to work, to supply commodities, or to contribute toward completing work for a governmental entity.

“Workforce” means employees, volunteers, trainees or other persons whose performance of work is under the direct control of a party, whether or not they are paid by that party.

ARTICLE 3. CONTRACTOR'S DUTIES REGARDING CONFIDENTIAL INFORMATION

Section 3.01 Obligations of Contractor

Contractor agrees that:

(A) With respect to PHI, Contractor shall:

(1) Make PHI available in a designated record set if requested by HHS, if Contractor maintains

PHI in a designated record set, as defined in HIPAA.

(2) Provide to HHS data aggregation services related to the healthcare operations Contractor performs for HHS pursuant to the Base Contract, if requested by HHS, if Contractor provides data aggregation services as defined in HIPAA.

(3) Provide access to PHI to an individual who is requesting his or her own PHI, or such individual’s Legally Authorized Representative, in compliance with the requirements of HIPAA.

(4) Make PHI available to HHS for amendment, and incorporate any amendments to PHI that

HHS directs, in compliance with HIPAA.

(5) Document and make available to HHS, an accounting of disclosures in compliance with the requirements of HIPAA.

(6) If Contractor receives a request for access, amendment or accounting of PHI by any individual, promptly forward the request to HHS or, if forwarding the request would violate HIPAA, promptly notify HHS of the request and of Contractor’s response. HHS will respond to all such requests, unless Contractor is Required by Law to respond or HHS has given prior written consent for Contractor to respond to and account for all such requests.

(B) With respect to ALL Confidential Information, Contractor shall:

(1) Exercise reasonable care and no less than the same degree of care Contractor uses to protect its own confidential, proprietary and trade secret information to prevent Confidential Information from being used in a manner that is not expressly an Authorized Purpose or as Required by Law. Contractor will access, create, maintain, receive, use, disclose, transmit or Destroy Confidential Information in a secure fashion that protects against any reasonably anticipated threats or hazards to the security or integrity of such information or unauthorized uses.

(2) Establish, implement and maintain appropriate procedural, administrative, physical and technical safeguards to preserve and maintain the confidentiality, integrity, and availability of the

Confidential Information, in accordance with applicable laws or regulations relating to Confidential

Information, to prevent any unauthorized use or disclosure of Confidential Information as long as

Contractor has such Confidential Information in its actual or constructive possession.

(3) Implement, update as necessary, and document privacy, security and Breach notice policies and procedures and an incident response plan to address a Breach, to comply with the privacy, security and breach notice requirements of this DUA prior to conducting work under the Base Contract. Contractor shall produce, within three business days of a request by HHS, copies of its policies and procedures and records relating to the use or disclosure of Confidential Information.

(4) Obtain HHS’s prior written consent to disclose or allow access to any portion of the

Confidential Information to any person, other than Authorized Users, Workforce or Subcontractors of

Contractor who have completed training in confidentiality, privacy, security and the importance of promptly reporting any Breach to Contractor's management and as permitted in Section 3.01(A)(3), above. Contractor shall produce evidence of completed training to HHS upon request. HHS, at its election, may assist

Contractor in training and education on specific or unique HHS processes, systems and/or requirements.

All of Contractor’s Authorized Users, Workforce and Subcontractors with access to a state computer system or database will complete a cybersecurity training program certified under Texas Government Code Section

2054.519 by the Texas Department of Information Resources.

(5) Establish, implement and maintain appropriate sanctions against any member of its Workforce or Subcontractor who fails to comply with this DUA, the Base Contract or applicable law.

Contractor shall maintain evidence of sanctions and produce it to HHS upon request.

(6) Obtain prior written approval of HHS, to disclose or provide access to any Confidential Information on the basis that such act is Required by Law, so that HHS may have the opportunity to object to the disclosure or access and seek appropriate relief. If HHS objects to such disclosure or access, Contractor shall refrain from disclosing or providing access to the Confidential Information until HHS has exhausted all alternatives for relief.

(7) Certify that its Authorized Users each have a demonstrated need to know and have access to Confidential Information solely to the minimum extent necessary to accomplish the Authorized Purpose and that each has agreed in writing to be bound by the disclosure and use limitations pertaining to the

Confidential Information contained in this DUA. Contractor and its Subcontractors shall maintain at all times an updated, complete, accurate list of Authorized Users and supply it to HHS upon request.

(8) Provide, and shall cause its Subcontractors and agents to provide, to HHS periodic written confirmation of compliance with controls and the terms and conditions of this DUA.

(9) Return to HHS or Destroy, at HHS’s election and at Contractor’s expense, all Confidential Information received from HHS or created or maintained by Contractor or any of Contractor’s agents or

Subcontractors on HHS's behalf upon the termination or expiration of this DUA, if reasonably feasible and permitted by law. Contractor shall certify in writing to HHS that all such Confidential Information has been Destroyed or returned to HHS, and that Contractor and its agents and Subcontractors have retained no copies thereof. Notwithstanding the foregoing, Contractor acknowledges and agrees that it may not Destroy any Confidential Information if federal or state law, or HHS record retention policy or a litigation hold notice prohibits such Destruction. If such return or Destruction is not reasonably feasible, or is impermissible by law, Contractor shall immediately notify HHS of the reasons such return or Destruction is not feasible and agree to extend the protections of this DUA to the Confidential Information for as long as Contractor maintains such Confidential Information.

(10) Complete and return with the Base Contract to HHS, attached as Attachment 2 to this DUA, the HHS Security and Privacy Initial Inquiry (SPI) at https://hhs.texas.gov/laws-regulations/forms/miscellaneous/hhs-information-security-privacy-initial-inquiry-spi. The SPI identifies basic privacy and security controls with which Contractor must comply to protect Confidential Information.

Contractor shall comply with periodic security controls compliance assessment and monitoring by HHS as required by state and federal law, based on the type of Confidential Information Contractor creates, receives, maintains, uses, discloses or has access to and the Authorized Purpose and level of risk. Contractor's https://hhs.texas.gov/laws-regulations/forms/miscellaneous/hhs-information-security-privacy-initial-inquiry-spi https://hhs.texas.gov/laws-regulations/forms/miscellaneous/hhs-information-security-privacy-initial-inquiry-spi security controls shall be based on the National Institute of Standards and Technology (NIST) Special

Publication 800-53. Contractor shall update its security controls assessment whenever there are significant changes in security controls for HHS Confidential Information and shall provide the updated document to

HHS. HHS also reserves the right to request updates as needed to satisfy state and federal monitoring requirements.

(11) Comply with the HHS Acceptable Use Policy (AUP) and require each Subcontractor and

Workforce member who has direct access to HHS Information Resources, as defined in the AUP, to execute an HHS Acceptable Use Agreement.

(12) Only conduct secure transmissions of Confidential Information whether in paper, oral or electronic form. A secure transmission of electronic Confidential Information in motion includes secure

File Transfer Protocol (SFTP) or encryption at an appropriate level as required by rule, regulation or law.

Confidential Information at rest requires encryption unless there is adequate administrative, technical, and physical security as required by rule, regulation or law. All electronic data transfer and communications of

Confidential Information shall be through secure systems. Contractor shall provide proof of system, media or device security and/or encryption to HHS no later than 48 hours after HHS's written request in response to a compliance investigation, audit, or the…