Exhibit_1-_Audit_Services_Technical_Proposal.docx

Exhibit 1 – Technical Proposal Bid Event # EVT0010856_ Audit Services RFP Plan Years 2027, 2028, 2029

Section 3 Contract to Provide Auditor Services State of Kansas Employee Health Plan 2027, 2028, and 2029

THIS CONTRACT is made and entered into this ______ day of _____________,20_____, by and between the Kansas State Employees Health Care Commission (hereinafter referred to as “HCC”) and _________________________________ (hereinafter referred to as “Contractor”).

WHEREAS, the HCC is seeking auditor services for the Kansas State Employee Health Plan (hereinafter referred to as “Plan”);

WHEREAS, the State Employee Health Benefits Plan Staff within the Kansas Department of Administration (hereinafter referred to as “SEHP”) has been designated by the HCC to direct the day-to-day operations of the Plan;

WHEREAS, Contractor is a company holding itself out as having expertise in auditor services and desires to provide its services and expertise to the HCC;

WHEREAS, it has been determined by the HCC that the best interest of the HCC will be served by awarding a contract to Contractor to provide these services.

THEREFORE, in consideration of the mutual agreements contained below, the HCC and Contractor agree as follows:

1. Acceptance: Subject to the terms and conditions of this Contract, the HCC hereby accepts the offer of Contractor as expressed by:

0. Contractor’s Response to Request for Proposal #_______;

0. Contractor’s technical proposal; and,

0. Contractor’s Response to Request for Proposal #_______ involving pricing, as set forth in Exhibit A, submitted to the HCC in response to Request for Proposal #_______ (hereinafter referred to as “RFP”).

1. Contract Documents:

1. This Contract consists of the following documents, incorporated herein by direct or indirect reference and in the following precedential order:

0. The DA146a;

0. The Business Associate Agreement;

0. The terms of this Contract;

0. The Addenda to the RFP, if any;

0. The RFP, which includes all Exhibits and Attachments; and

0. The Contractor’s Technical and Cost Proposal(s), including pricing schedules and clarifications.

1. In the event of a conflict between or among the terms of the Contract Documents, the term in the Contract Document with the highest precedence will prevail. For example, the DA146a will have the highest precedence in relation to the other listed documents.

1. The documents identified in Section 2a above constitute the entire agreement between the parties and supersede all prior oral or written statements or agreements.

1. Term: The term of this Contract shall be three years, beginning on January 1, 2027, and ending on December 31, 2029.

1. Deliverables: Contractor will provide ___________________ as specified by this Contract and the documents noted in Section 2 above. Pursuant to the RFP and documents noted in Section 2 above, Contractor will:

3. ____________________________________________;

3. __________________________________________;

3. (as many as needed to describe deliverables);

1. Deliverable Options: Contractor may have provided several options of deliverables to the HCC for services under this Contract in the cost proposal. The HCC reserves the option to select or deselect any of the proposed deliverables contained within the cost proposal during the term of the Contract.

1. Fees:

a. For services provided by the Contractor under this Contract, the payment to the Contractor shall be based on the Contractor’s Best and Final Offer that was presented to and accepted by the HCC and documented by the documents noted in Section 2 of this Contract.

b. The HCC agrees to pay the amount billed by the Contractor that is in conformance with this Contract and fee schedule subject to subsections c and d below.

c. Payment will be made in response to a monthly receipt of an invoice setting forth the total monthly fees and any retroactive adjustments, credits or fees and transmitted by a mutually agreeable method to an address designated by the HCC.

d. Contractor shall also provide the HCC or its delegee, SEHP, the billing data specified by the RFP and/or documents noted in Section 2 of this Contract in a mutually agreeable electronic format. Payment will not be made to the Contractor until the electronic data is submitted in the agreed-upon format to and received by the HCC or its delegee, SEHP.

e. Payment will be made as soon as possible after the receipt of an invoice that meets the requirements of subsections b, c, and d above. The HCC will follow the Kansas Prompt Payment Act (K.S.A. 75-6401 et seq.).

1. Overpayment:

a. HCC assumes that the Contractor shall perform its duties and obligations under this Contract in a timely, careful and reasonable manner.

b. In the event of an overpayment of fees, Contractor shall indemnify the Plan. As used in this Contract, “overpayment” means any amount which has been mistakenly or wrongly paid from the Plan, including duplicate payments, mistaken payments, payments in excess of that actually owed, and any other amount not required to be paid under the terms of the Plan.

c. The HCC and Contractor will cooperate in efforts to recover overpayments when they are as a result of a third-party. Contractor shall not seek legal action against a Plan participant to collect an overpayment without the HCC’s prior consent.

d. In the case of a dispute on an overpayment between the SEHP and Contractor, there should be an attempt to resolve the dispute by trying to reach an agreement. If the SEHP and Contractor cannot reach agreement, the dispute may be resolved through alternative dispute resolution. The intent is to resolve the dispute at the lowest level possible.

e. Contractor shall not be allowed to collect any overpayment due to its misapplication of the plan’s deductible, co-payment or co-insurance requirements unless it explains the reason for the overpayment in writing to the participant within a reasonable time after the date of service, but not to exceed 15 months after the date of service.

f. The provisions of this section will survive termination of this Contract.

1. Quality and Innovation: The HCC is interested in quality health care and innovative plan designs and projects. During the course of this Contract, the Contractor agrees to work with the HCC in the development, implementation, and evaluation of quality improvement projects and innovative plan designs or projects as authorized by the HCC. Contractors are encouraged to bring ideas on improving the quality of health care and innovative plan design ideas to the HCC for consideration. The HCC may negotiate with Contractors with regard to any expense related to or resulting from pursuit of these projects.

1. Reports: Contractor will work with the SEHP to develop meaningful management reports, making modifications to report structures and contents as necessary to meet the needs of the HCC and SEHP.

1. Retention of Records:

9. Unless the HCC specifies in writing a shorter period of time, the Contractor agrees to preserve and make available all of its books, documents, papers, records and other evidence involving transactions related to this Contract for a period of five (5) years from the date of the expiration or termination of this Contract.

9. In accordance with State of Kansas-Department of Administration retention schedules, matters involving litigation shall be kept for five (5) years following the termination of any litigation, including any appeal.

9. The Contractor agrees that authorized federal and state representatives, including but not limited to, personnel of the using agency and independent auditors acting on behalf of state and/or federal agencies shall have access to and the right to examine records during the Contract period and during the five (5) year post-Contract period. Delivery of and access to the records shall be at no cost to the HCC.

9. State and/or federal law may require the retention of records for longer periods. In which case Contractor will follow applicable law.

1. Review and Hearings: The Contractor agrees to advise the HCC of the number and type of complaints made known to the Contractor for services provided under this Contract. The HCC has the discretion to require the Contractor to participate in any review, appeal, hearing, or litigation involving issues related to this Contract.

1. Solicitation of Members: The Contractor shall not use the names, home addresses or any other information obtained about participants of this plan for the purpose of offering for sale any property or services which are not directly related to services negotiated in this bid event without the express written consent of the HCC.

1. Performance Standards: Service performance standards set forth in the RFP establish expectations regarding certain areas of the Contract between Contractor and the HCC. These performance standards are designed to assure that all parties involved in providing services know what the standards are, and that Contractor will provide guarantees based on these standards. Contractor accepts these standards as agreed upon in the RFP, attached hereto.

1. Acceptance of RFP Terms & Conditions: All proposals are subject to the terms and conditions outlined in the RFP. All responses will be controlled by such terms and conditions and the submission of other terms and conditions, price lists, catalogs, or other documents or exceptions as part of Contractor’s response are waived and have no effect either on the Request for Proposal or this Contract. By submitting an executed response, the Contractor specifically agreed to the conditions set forth in this paragraph.

1. Warranties: Contractor represents and warrants to the HCC that (a) services shall be rendered in a professional manner consistent with standards of professionals in Contractor’s industry; (b) services will be delivered in compliance with all standards and conditions presented by HCC to Contractor; and (c) Contractor is under no obligation or restriction, nor will it assume any obligation or restrictions that would in any way interfere or be inconsistent with the performance of the services.

1. Conflict Resolution:

15. Intent: In the event that there is a dispute between the parties to this Contract, the intent of the parties is to resolve the dispute at the earliest and lowest level possible. The lowest level would be a mutual agreement between the parties resolving the dispute. If the SEHP and Contractor cannot reach agreement, the dispute may be escalated to the HCC and the Contractor’s executive designee, and then if an agreement is not reached, resolved through alternative dispute resolution. A last resort would be litigation in court.

15. HCC authority on deliverables: In the event the parties cannot mutually agree to a resolution of any controversies or claims between the parties regarding the provision of services and completion of deliverables, the HCC, at its sole discretion and judgment, will make the final determination as to whether deliverables have been satisfactorily completed or other services provided in accordance with the Contract.

15. Jurisdiction:

2. Should legal proceedings be required between the parties as a result of this Contract, the jurisdiction for the legal proceeding will be in the State of Kansas. If the venue would be a state court, the legal proceeding would be in the District Court of Shawnee County, Kansas. The United States District Court for the State of Kansas sitting in Topeka, Shawnee County, Kansas, would be the venue for any appropriate federal action or proceeding arising hereunder.

2. Contractor waives all defenses of lack of personal jurisdiction and Forum non conveniens to any legal matters that arise between the parties as a result of this Contract. Process may be served on Contractor in the manner authorized by applicable Kansas law or court rule.

15. Eleventh Amendment: The Eleventh Amendment of the United States Constitution is an inherent and incumbent protection held by the State of Kansas and need not be reserved, but prudence requires the HCC to reiterate that nothing related to this Contract shall be deemed a waiver by the HCC or SEHP of the protections accorded a state entity under the Eleventh Amendment.

1. Employment of Counsel and Resolution of Litigation and Legal Fees:

a. In the event of litigation involving the services under this Contract not covered by Section 16 above and where the HCC, SEHP, State of Kansas, or the Contractor are named as a party to the litigation (“Litigation” hereafter), the HCC and Contractor each:

1. Reserve the right to select and retain counsel at its own expense to protect its interests;

2. Will promptly notify the other party to this Contract after learning of the Litigation;

3. Will cooperate fully by providing the other party with all nonconfidential relevant information and documents within its control as requested; and

4. Will reasonably assist the other party in the defense of the Litigation.

b. In the event the HCC, the State of Kansas or any of its staff, or Contractor is the sole named defendant in Litigation related to the services provided under this Contract, such party shall have discretion to defend, settle, compromise or otherwise resolve such Litigation consistent with the terms of this Contract and of the SEHP. Such party shall keep the other party informed of the status of the Litigation and any decision to settle, compromise or otherwise resolve the Litigation shall be communicated to and discussed with the other party prior to any such settlement, compromise or other resolution.

c. In the event the HCC, the State of Kansas or any of its staff and Contractor are codefendants in Litigation, the parties will cooperate fully with each other to defend, settle, compromise or otherwise resolve such Litigation consistent with the terms of this Contract and the SEHP.

d. In the event any entity other than the HCC, the State of Kansas, any of its staff or Contractor, is named as a defendant in Litigation, the HCC can elect to defend, settle, compromise or otherwise resolve such Litigation with respect to those other entities consistent with the terms of this Contract and of the SEHP.

e. The provisions of this section will survive termination of this Contract.

1. Conformance with Law: Contractor shall comply with all applicable federal, state and local laws, rules and regulations as they exist or as they may be amended, including those not specifically mentioned in this Contract.

1. Contractor: The Contractor shall be deemed the sole source of contact for the Contract. Contractor shall include all subcontractors, subsidiaries, affiliates, partners and sister corporations, etc. Contractor is solely responsible for all actions and work performed by other entities involved in performing work under this Contract. All terms, conditions and requirements of the Contract shall apply without qualification to any services and work performed on behalf of the Contractor under this Contract. It is the responsibility of the Contractor to disclose all relationships with subcontractors, subsidiaries, affiliates, partners and sister corporations or any other entity, which is involved in providing services under this contract. HCC must be provided the opportunity to review and approve any subcontractor, subsidiary, affiliate, partner and sister corporation or any other entity, which is involved in providing services under this contract, on behalf of or assisting the Contractor, to the HCC. Failure to do so could be grounds for breach of this agreement.

1. Kansas Open Records Act: The laws of the State of Kansas require public information be placed in the public domain at the conclusion of the selection process, and be available for examinations by all interested parties. Contractor acknowledges that its response to the RFP under this Contract is considered an open record under the Kansas Open Records Act, K.S.A. 45-215 et seq.

1. Banking: The Contractor shall not open a bank account in the name of the State of Kansas, the HCC, or the Kansas State Employee Health Plan. Any bank account that the Contractor opens for the administration of this program or under this Contract shall be in the name of the Contractor only and solely the responsibility of the Contractor.

1. Duty to Mitigate: The parties to this Contract acknowledge their duty to mitigate damages when appropriate and reasonable.

1. Electronic Accessibility Protocols: The State policy on accessibility standards can be found at: https://ebit.ks.gov/itec/resources/policies/policy-1210. All web and print based services available to Plan Participants must be handicap accessible and meet the state accessibility policy.

1. Advertising: The Contractor will not use the award of a contract as part of any news release or commercial advertising without the HCC’s prior written permission.

1. Implied Requirements: All products and services not specifically mentioned in the RFP response and this Contract, but which are necessary to provide the functional capabilities described by the specifications, shall be included.

1. Off-Shore Sourcing: If, during the term of the contract, the Contractor or any state approved subcontractor plans to move work previously performed in the United States to a location outside of the United States, the Contractor or state approved subcontractor shall immediately notify the HCC in writing, indicating the desired new location, the nature of the work to be moved and the percentage of work that would be relocated. The HCC or its designee, must approve any changes prior to work being relocated. Failure to obtain the approval may be grounds to terminate the contract for cause.

1. Criminal or Civil Offense by Contractor: Any conviction for a criminal or civil offense that indicates a lack of business integrity or business honesty must be disclosed to the HCC. This includes:

26. Conviction of a criminal offense as an incident to obtaining or attempting to obtain a public or private contract or subcontract or in the performance of such contract or subcontract;

26. Conviction under state or federal statutes of embezzlement, theft, forgery, bribery, falsification or destruction of records, or receiving stolen property;

26. Conviction under state or federal antitrust statutes; and

26. Any other offense that reasonably would be expected to affect the ability to function as a State Contractor.

e. For the purpose of this section, an individual or entity shall be presumed to have control of a company or organization if the individual or entity directly or indirectly, or acting in concert with one or more individuals or entities, owns or controls 25 percent or more of its equity, or otherwise controls its management or policies. Failure to disclose an offense may result in termination of the Contract.

1. Confidentiality and Access: Contractor shall not disclose to any other person, firm, or corporation or entity (other than to the HCC) or use for its own benefit, except as provided in this Contract and the Business Associate Agreement, any data, Protected Health Information (hereinafter referred to as “PHI”) and/or other confidential information it receives from the HCC. Notwithstanding the Business Associate Agreement, such data and information may be disclosed to contract workers, employees, consultants and agents of the Contractor who have a need to know or have access to such data or information in the performance of this Contract and who have executed written agreements with the Contractor obligating them to treat such information in a manner consistent with the terms of this Contract. Contractor shall return any and all data furnished by the HCC promptly at the request of the HCC in whatever form required by the HCC. On the termination of this Contract, Contractor will not use any of such data or any material derived from the data for any purpose and, where so instructed by the HCC, will destroy or render such data or material unreadable. In the event Contractor discloses any of the HCC’s proprietary and/or personal identifiable information, the HCC may immediately terminate the Contract and pursue legal action recourse. The restrictions and obligations contained herein shall continue in perpetuity from the date of this Contract unless the HCC provides a written release to Contractor.

1. Data Ownership: The Contractor understands and agrees that all data provided by the HCC, or by the HCC’s contracted vendors authorized by the HCC, is owned by the HCC and will be used by the Contractor solely for the purposes described in this Contract. All data created in any form as part of this Contract will be the property of the HCC and will be available to the HCC at all times. Upon termination of the Contract, and to the extent feasible, all data associated with this Contract will be transferred to and accepted by the HCC prior to final payment to the Contractor. Under no circumstances will the Contractor share the data with any other entity without the HCC’s prior written authorization.

1. Copyrights: All deliverable items produced pursuant to this Contract that are produced solely and exclusively for the HCC are the exclusive property of the HCC. The Contractor will not assert a claim of copyright or other property interest in such deliverables. The Contractor shall indemnify the HCC against any and all claims for infringement of any copyright or patent occurring in connection with or in any way incidental to or arising out of the occupancy, use, service, operations or performance of work under this Contract.

1. Termination Right:

a. Notwithstanding any other provisions of this Contract, the HCC reserves the right to terminate this Contract at the end of any month by giving thirty (30) days advance notice thereof in writing to Contractor.

b. In the event of termination of this Contract, Contractor will, unless the HCC directs, and Contractor otherwise agrees:

1. Complete the pricing of all deliverables incurred prior to the effective date of termination and the HCC shall pay Contractor for all applicable fees in respect to such deliverables priced.

2. Release to the HCC, in a format acceptable to the HCC, all records and files relating to deliverables priced under the SEHP health plan pursuant to this Contract.

c. If Contractor uses any patented, trademarked, or copyrighted designs, devices, materials or other property, tangible or intangible in connection with its performance of its obligations under this Contract, it shall provide for such use in an approved legal manner by making a proper agreement with the patentee or owner of such trademark or copyright and shall defend and hold the HCC harmless on any claim relating to such items. Contractor also grants the State of Kansas, and its departments, agencies, affiliates, agents, employees and licensees a non-exclusive, royalty-free, non-revocable perpetual license to use and copy for any reason Contractor’s bid and proposal and any other document(s) submitted to the HCC that may be related to this Contract.

1. Independent Contractor: Both Contractor and the HCC, in the performance of this Contract, are and shall be acting in an individual capacity and not as agents, employees, partners, joint ventures or associates of one another. The employees or agents of one party shall not be deemed or construed to be the employees or agents of the other party for any purpose whatsoever except the Contractor's employees shall be deemed agents of the State of Kansas for the purpose of maintaining confidentiality of private or confidential data, software and equipment maintained by the HCC.

1. Indemnification: The Contractor will hold and save the State, its officers, agents, and employees acting within the scope of their employment, harmless from liability of any kind, including all claims and losses accruing or resulting to any other person, firm, or corporation furnishing or supplying work, services, materials, or supplies in connection with the performance of this Contract, and from any and all claims and losses accruing or resulting to any person, firm or corporation that may be injured or damaged by the Contractor in the performance of this Contract. The Contractor acknowledges that any liability of the State’s agents or employees while acting within the scope of their employment is covered by the Kansas Tort Claims Act, K.S.A. 75-6101 et seq.

1. Accounts Receivable Set-Off Program: If, during the course of this Contract, the Contractor is found to owe a debt to the State of Kansas, agency payments to the Contractor may be intercepted/set off by the State of Kansas. Notice of the set-off action will be provided to the Contractor. Pursuant to K.S.A. 75-6201 et seq., Contractor shall have the opportunity to challenge the validity of the debt. If the debt is undisputed, the Contractor shall credit the account of the agency making the payment in an amount equal to the funds intercepted. K.S.A. 75-6201 et seq. allows the Director of Accounts and Reports to set off funds the State of Kansas owes Contractors against debts owed by the Contractors to the State of Kansas. Payments set off in this manner constitute lawful payment for services or goods received. The Contractor benefits fully from the payment because its obligation to the State is reduced by the amount subject to set-off.

1. Liability: Subject to the limitations set forth below, Contractor shall assume full responsibility for damage, including mitigation expenses, security breaches, or misuse of all State and Contractor property, including any private or confidential data, software and equipment maintained by Contractor and any equipment, supplies, accessories, software or parts furnished by Contractor while such property is in Contractor’s care. Contractor shall also assume full responsibility for compliance with the standards for security of privacy of confidential records, data, software, software code, or equipment used or maintained by the Contractor, as set forth in federal and State statutes which mandate implementation of strict measures to ensure physical and electronic security of the same.

1. Hold Harmless: Contractor shall save, hold harmless and indemnify the HCC against any and all liability, claims for injury to, or death of any persons and for loss or damage to any property and for infringement of any copyright or patent occurring in connection with or in any way incidental to or arising out of Contractor’s performance under the terms of this Contract.

1. Survival of Promises: All promises, requirements, terms, conditions, provisions, representations, guarantees, and warranties contained herein will survive the Contract expiration or termination date unless specifically provided otherwise herein, or unless superseded by applicable federal or state statutes of limitation.

1. Waiver: In the event of breach of this Contract, or any provision hereof, failure of the HCC to exercise any of its rights or remedies under the Contract shall not be construed as a waiver of any such provision of the Contract breached or as acquiescence in the breach. The remedies herein reserved shall be cumulative and in addition to any other remedies at law or in equity.

1. Legislative Requests: Contractor will provide support to the HCC in response to information requests and fiscal notes or impact statements needed by the Legislature. Responses shall be given within two (2) business days.

1. Audits and Access to Records: The HCC reserves the right to conduct annual, or more frequently if needed, audits of Contractor’s records and files related to the performance or cost of this Contract. The Contractor will make available to the HCC any person, record or file deemed necessary by the HCC to validate either performance or cost. The Legislative Division of Post Audit will have access to persons and records as a result of all contracts or grants entered into by State agencies or political subdivisions. There will be no fee from the Contractor to complete such audits. All third-party auditors will enter into a confidentiality agreement reasonably acceptable to Contractor and will be presented to the State Employee Health Plan staff for review and approval prior to execution by the parties. All confidentiality agreements will be in compliance with the requirements of the Kansas Open Records Act and permit the HCC to fulfill its responsibilities for disclosure, to include, but not limited to, the publishing of any audit report generated.

1. Beneficiaries: Except as herein specifically provided otherwise, this Contract will inure to the benefit of and be binding upon the parties hereto and their respective successors. It is expressly understood and agreed that the enforcement of the terms and conditions of this Contract, and all rights of action relating to such enforcement, will be strictly reserved to the HCC and the named Contractor. Nothing contained in this document will give or allow any claim or right of action whatsoever by any other third person. It is the express intention of the HCC and Contractor that any such person or entity, other than the HCC or the Contractor, receiving services or benefits under this Contract will be deemed an incidental beneficiary only.

1. Amendment: This Contract shall be amended only by the written agreement of the parties. No alteration or variation of the terms and conditions of this Contract shall be valid unless made in writing and signed by the parties. Every amendment shall specify the date on which its provisions shall be effective.

1. Option to Renew: The HCC shall have the option, by mutual written agreement of the HCC and Contractor, to renew this Contract in such a manner mutually agreed upon, in writing, by the parties.

1. Joint Drafting: No provision of this Contract shall be construed more harshly or unfavorably against any party hereto regardless of which party drafted the provision or for whose benefit the provision was included.

1. Captions: The captions or heading in this Contract are for reference only and do not define, describe, extend or limit the scope or intent of this Contract.

1. Validity and Waiver: The invalidity in whole or in part of any provision of this Contract shall not affect the validity of other provisions. A waiver of a breach of any provision or performance guaranty of this Contract shall not constitute a waiver of any subsequent breach of that provision or a breach of any other provision of this Contract. The failure of the HCC to enforce at any time or from time to time any provision of this Contract shall not be construed as a waiver thereof.

1. Force Majeure: The Contractor or the HCC shall not be held liable for acts they are to perform, if the failure to perform under this contract arises out of causes beyond the control of the Contractor or HCC. Causes may include, but are not limited to, acts of nature, fires, tornadoes, quarantine, strikes other than by Contractor's employees, and freight embargoes.

1. Travel Expenses: Contractor will be responsible for all expenses, including travel mileage, meals, lodging and other travel expenses incurred in the performance of this Contract.

1. Notices: The notice addresses of the parties are as follows:

HCC:

Director of the State Employee Health Plan 109 SW 9th St #600 Topeka, KS 66612

Contractor:

(Name of Contractor) ___________________________ (Address of Contractor) ___________________________

1. Transition Assistance: In the event of Contract termination or expiration, Contractor shall provide all reasonable and necessary assistance to the State to allow for a functional transition to another vendor.

1. Signatures: Signatures herein shall serve to bind the parties to this Contract. The parties represent and warrant that they have read and thoroughly understand the terms and conditions and they are represented by counsel and the terms and conditions of the RFP and Contract have been fully explained to them by counsel. This Contract shall be binding on any person or entity that is a successor or purchaser of Contractor.

SIGNATURES ON NEXT PAGE

CONTRACTOR - (Name of Contractor)

By: ________________________________Date: ___________________________________________

Printed Name: ______________________________________________________________________

Title: _______________________________________________________________________________

KANSAS STATE EMPLOYEES HEALTH CARE COMMISSION

By: ____________________________________Date: _______________________________________

Printed Name: ______________________________________________________________________

Title: _______________________________________________________________________________

ACKNOWLEDGE AND ACCEPT

The State Employee Health Plan (SEHP) is providing its standard contract for review. It is the intent of the SEHP to use this contract, and vendors are encouraged to accept the contract without any changes. However, if a vendor proposes changes, they must be done in redline and submitted as part of your bid. Contract language changes must be accompanied by a written explanation for the suggested change. Contract deviations will be considered as part of the vendor evaluation of this RFP for consideration and negotiation. The responding vendor should understand that previous acceptance of any contract language changes in a previous bid event is not binding upon the State of Kansas or the SEHP. The vendor acknowledges that the DA-146A is incorporated into all State of Kansas contracts and may not be altered.

The Contract has been reviewed by the undersigned and all requested changes have been highlighted in redline, along with a full explanation for the request, for consideration by the State of Kansas. I hereby acknowledge that the State has the right to reject these changes and that these may be points of further negotiation with the State. I accept all the provisions, requirements, and conditions stated in this section of RFP, subject to the modifications, conditions, and limitations I have made in redline format above.

Authorized Signature of Vendor

Printed Name of Signatory

Title

Date

BUSINESS ASSOCIATE AGREEMENT

THIS AGREEMENT is made and entered into by and between the Kansas State Employee Health Care Commission (hereinafter referred to as “HCC”) and _______________________ (hereinafter referred to as “Business Associate”).

Notwithstanding Section V of this Business Associate Agreement (hereinafter referred to as “BAA”), the term of this BAA shall run concurrently with the Underlying Contract between the parties and shall have the same effective date and termination date as the Underlying Contract created through Bid Event #________.

RECITALS

The Parties to this BAA have a relationship whereby HCC may provide the Business Associate access to Protected Health Information (hereinafter referred to as “PHI”), which may include electronic Protected Health Information, that Business Associate will use to fulfill its contractual obligations to HCC.

HCC and Business Associate acknowledge that each party has certain obligations under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended, including those provisions of the American Recovery and Reinvestment Act of 2009 (“ARRA”), specifically the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and the statutes implementing regulations to maintain the privacy and security of PHI, and the parties intend this BAA to satisfy those obligations, including, without limitation, the requirements of 45 CFR 164.504(e).

Business Associate acknowledges that, for the purposes of this BAA, Business Associate is a “business associate” as that term is defined in 45 CFR § 160.103, and therefore, the requirements of HIPAA apply to Business Associate in the same manner that they apply to HCC pursuant to 42 USC § 17931(a).

NOW THEREFORE, in consideration of the mutual promises below and other good and valuable consideration, the parties agree as follows:

I. DEFINITIONS

1. “Administrative Safeguards” shall mean the administrative actions, policies and procedures to manage the selection, development, implementation and maintenance of security measures to protect PHI and to manage the conduct of Business Associate’s workforce in relation to the protection of that PHI.

1. “Attestation” shall mean a signed attestation that complies with the requirements in 45 CFR 164.509.

1. “Breach” shall mean any disclosure which compromises an individual’s protected health information (PHI) in a way that creates risk of harm to the individual.

1. “Business Associate” shall have the same meaning as the term “Business Associate” as defined in 45 CFR 160.103.

1. “Data Aggregation Services” shall mean, with respect to PHI created or received by Business Associate in its capacity as a Business Associate of HCC, the combining of such PHI by the Business Associate with the PHI received by the Business Associate in its capacity as a business associate of another covered entity, to permit data analyses that relate to the health care operations of the respective covered entities, as defined in 45 CFR § 164.501 and as such term may be amended from time to time in this cited regulation.

1. “Designated Record Set” shall mean a group of records maintained by or for HCC that consists of the following:

5. medical records and billing records about Individuals maintained by or for a health care provider;

5. enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or

5. records used in whole or in part, by or for HCC to make decisions about Individuals. For these purposes, the term “record” means any item, collection, or group of information that includes PHI and is maintained, collected, used, or disseminated by or for HCC.

1. “Disclosure” shall mean the release, transfer, provision of, access to, or divulging in any other manner of PHI outside the entity holding the information.

1. “HIPAA” shall mean the Health Insurance Portability and Accountability Act of 1996, the implementation regulations promulgated thereunder by the U.S. Department of Health and Human Services, the HITECH (as defined below) and any future regulations promulgated thereunder, all as may be amended from time to time.

1. “Individual” shall have the same meaning as the term “individual” as defined in 45 CFR 160.103, and any amendments thereto, and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

1. “Physical Safeguards” shall mean the physical measures, policies and procedures to protect HCC’s electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion.

1. “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164.

1. “Protected Health Information” shall have the same meaning as the term “protected health information,” as defined in 45 CFR 160.103 and any amendments thereto, limited to the information created or received by Business Associate from or on behalf of HCC.

1. “Reproductive Health Care” shall have the same meaning as the term “reproductive health care” in 45 CFR 160.103.

1. “Required by Law” shall have the same meaning as the term “required by law” in 45 CFR 164.103.

1. “Secretary” shall mean the Secretary of the United States Department of Health and Human Services or his/her designee.

1. “Security Incident” shall mean the attempted or successful unauthorized access, use, disclosure, modification or destruction of information or interference with system operations in an information system.

1. “Security Rule” shall mean the Standards for Security of Electronic Protected Health Information at 45 CFR Parts 160, 162 and 164.

1. “Technical Safeguards” shall mean the technology and the policy and procedures for its use that protect PHI and control access to it.

1. “Underlying Contract” means any written contract for services between HCC and Business Associate.

1. “Use” shall mean, with respect to PHI, the sharing, employment, application, utilization, examination, or analysis of such information within any entity that maintains such information.

1. Capitalized terms used, but not otherwise defined, in this BAA shall have the same meaning ascribed to them in HIPAA, the Privacy Rule, the Security Rule, or HITECH or any future regulations promulgated or guidance issued by the Secretary.

II. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE

1. Use and Disclosure. Business Associate agrees to not use or disclose PHI other than as permitted or required by this BAA or as Required by Law.

1. Safeguards to be in Place. Business Associate agrees to use appropriate safeguards to prevent the use or disclosure of PHI other than as provided for by this BAA. Additionally, Business Associate shall implement Administrative, Physical and Technical Safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the PHI that it creates, receives, maintains or transmits on behalf of HCC as required by the Security Rule.

1. HIPAA Training. Business Associate agrees to ensure all members of its workforce, including subcontractor workforce members, that will or potentially will provide services pursuant to the Underlying Contract will be appropriately trained on the requirements of HIPAA.

1. Duty to Mitigate. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this BAA or the Privacy Rule and to communicate in writing, such procedures to HCC.

1. Duty to Obtain Attestation. Business Associate agrees to obtain an Attestation, as defined in Section I. b. for any PHI request it receives potentially relating to Reproductive Health Care, as defined in Section I. m., before releasing any PHI.

1. Business Associate’s Agents and Subcontractors. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides PHI received from, or created or received by Business Associate on behalf of HCC agrees, in writing in the form of a Business Associate Agreement, to the same restrictions and conditions that apply through this BAA to Business Associate with respect to such information, including implementation of reasonable and appropriate safeguards to protect PHI. Business Associate agrees that it is directly liable for any actions of its subcontractors that result in a violation of this Agreement. Business Associate also agrees to make available to HCC any contracts or agreements Business Associate has with any subcontractors to whom Business Associate provides PHI under this BAA. Business Associate may redact proprietary and financial information from said contracts before providing them to HCC.

1. Duty to Provide Access. To the extent Business Associate has PHI in a Designated Record Set, Business Associate agrees to provide access, at the request of HCC, to the PHI in the Designated Record Set to HCC or, as directed by HCC, to the Individual, in order to meet the requirements under 45 CFR 164.524. Any denial by Business Associate of access to PHI shall be the responsibility of, and sufficiently addressed by, Business Associate, including, but not limited to, resolution of all appeals and/or complaints arising therefrom.

1. Amendment of PHI. Business Associate agrees to make any amendment(s) to PHI in its possession contained in a Designated Record Set that HCC directs or agrees to pursuant to 45 CFR 164.526 at the request of HCC or an Individual, and within a reasonable time and manner.

1. Duty to Make Internal Practices Available. Business Associate agrees to make its internal practices, books and records, including policies and procedures relating to the use and disclosure of PHI, and any PHI received from, or created or received by Business Associate on behalf of HCC, available to the Secretary, in a time and manner designated by the Secretary, for purposes of the Secretary determining HCC’s compliance with the Privacy Rule.

1. Documenting Disclosures/Accounting. Business Associate agrees to document any disclosures of PHI and information in its possession related to such disclosures as would be required for HCC to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR 164.528. Business Associate agrees to provide to HCC information collected in accordance with Section II(f) of this BAA, to permit HCC to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR 164.528.

1. Reporting Breaches and Security Incidents to HCC. In addition to the duty to mitigate under Section II(d), Business Associate agrees to report to HCC any use or disclosure which compromises PHI and creates risk of harm, including any Security Incident of which it becomes aware, as soon as practicable but no longer than five (5) business days after the discovery of such event(s). Notice to HCC shall consist of notifying the HCC Privacy Officer by phone or email of the occurrence of an unauthorized use, disclosure or security incident.

1. Notification of Breach. Business Associate shall notify Covered Entity within three (3) business days after it, or any of its employees, subcontractors, or agents, reasonably suspects that a breach of unsecured PHI as defined by 45 CFR 164.402 may have occurred, irrespective of any occurrence or non-occurrence of harm. Notice to HCC shall consist of notifying the HCC Privacy Officer by phone or email of the occurrence of a Breach or suspected occurrence of a Breach. Business Associate shall exercise reasonable diligence to become aware of whether a breach of unsecured PHI may have occurred and, except as stated to the contrary in this Section, shall otherwise comply with 45 CFR 164.410 in making the required notification to Covered Entity. Business Associate shall cooperate with Covered Entity in the determination as to whether a breach of unsecured PHI has occurred and whether notification to affected individuals of the breach of unsecured PHI is required by 45 CFR 164.400 et seq., including continuously providing the Covered Entity with additional information related to the suspected breach as it becomes available.

In the event that Covered Entity informs Business Associate that

(i) Covered Entity has determined that the affected individuals must be notified because a breach of unsecured PHI has occurred and

(ii) Business Associate is in the best position to notify the affected individuals of such breach, Business Associate shall immediately provide the required notice

1) within the time frame defined by 45 CFR 164.404(b),

2) in a form and containing such information reasonably requested by Covered Entity,

3) containing the content specified in 45 CFR 164.404(c), and

4) using the method(s) prescribed by 45 CFR 164.404(d).

In addition, in the event that Covered Entity indicates to Business Associate that Covered Entity will make the required notification, Business Associate shall promptly take all other actions reasonably requested by Covered Entity related to the obligation to provide a notification of a breach of unsecured PHI under 45 CFR 164.400 et seq. Business Associate shall indemnify and hold Covered Entity harmless from all liability, costs, expenses, claims or other damages that Covered Entity, its related corporations, or any of its or their directors, officers, agents, or employees, may sustain as a result of Business Associate’s breach, or Business Associate’s subcontractor’s or agent’s breach, of its obligations under this Agreement.

III. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE

1. General Use and Disclosure Provisions. Except as otherwise limited in this Agreement, Business Associate may use or disclose PHI on behalf of, or to provide services to, Covered Entity for the purposes set forth in III(b), if such use or disclosure of PHI would not violate the Privacy Rule if done by Covered Entity.

1. Specific Use and Disclosure Provisions.

1. Business Associate may use and disclose PHI to perform services for Covered Entity, including specific services, as set out in the Underlying Contract, and any additional services necessary to carry out those specific services in the Underlying Contract.

1. Business Associate may use PHI in its possession for the proper management and administration of Business Associate and to carry out the legal responsibilities of Business Associate.

1. Business Associate may disclose PHI in its possession for the proper management and administration of Business Associate, provided that disclosures are Required by Law.

1. Business Associate may only de-identify PHI in its possession obtained from Covered Entity with Covered Entity’s prior written consent, in accordance with all de-identification requirements of the Privacy Rule.

1. Business Associate may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 CFR 164.502(j)(1). Covered Entity shall be furnished with a copy of all correspondence sent by Business Associate to a federal or state authority.

1. Except as otherwise limited in this Agreement, Business Associate may use PHI to provide Data Aggregation Services to Covered Entity.

1. Any use or disclosure of PHI by Business Associate shall be in accordance with the minimum necessary policies and procedures of Covered Entity and the regulations and guidance issued by the Secretary on what constitutes the minimum necessary for Business Associate to perform its obligations to Covered Entity under this Agreement and the Underlying Contract.

IV. OBLIGATIONS OF COVERED ENTITY

11. Covered Entity shall notify Business Associate of any limitation(s) in its Notice of Privacy Practices of Covered Entity in accordance with 45 CFR 164.520, to the extent that such limitation(s) may affect Business Associate’s use or…