Exhibit 6_2013 BAA_Appendix A_PBMRFP_01MAY2025.pdf

Appendix A

Name of Associate: __________________________________________ hereafter referred to as the PBM Vendor

Name of Agency: The West Virginia Public Employees Insurance Agency (PEIA)

Describe the PHI. If not applicable please indicate the same.

Per 45 CFR, Part 160.103

Health information means any information, whether oral or recorded in any form or medium, that:

(1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and

(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.

Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and:

(1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and

(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and

(i) That identifies the individual; or

(ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.

Protected health information means individually identifiable health information:

(1) Except as provided in paragraph (2) of this definition, that is:

(i) Transmitted by electronic media;

(ii) Maintained in electronic media; or

(iii) Transmitted or maintained in any other form or medium.

The information provided to the Associate and/or its agents, employees, and/or contract employees, pursuant to the Agreement for the purpose(s) of providing contracted Pharmacy

Benefit Management services and support will include the minimum necessary to perform the services thereunder and will specifically include, but may not be limited to:

a) PEIA member and/or covered dependent individually identifiable health information (IIHI) or protected health information (PHI), including but not necessarily limited to, name(s), names of dependent(s), specific identifying information, e.g. address(es), date(s) of birth, social security number(s), policy number(s), etc., claims information, eligibility information, and/or other PII/PHI necessary for performing the scope of work as defined in the Contract

b) Such PHI may contain what may be classified as sensitive PHI and/or restricted information such as information relating to mental health, substance abuse, communicable disease(s), reproductive health, genetic information, health and/or wellness information, and/or other information meriting special protections under State and/or Federal law(s).

c) PEIA member and/or covered dependent individually identifiable health information or protected health information necessary to allow the Covered Entities and the Associate to perform their statutory business function(s) in accordance with State and/or Federal law(s).

d) PEIA member and/or covered dependent individually identifiable health information protected health information used in relation to the conducting of the business operations of the Covered Entity(ies) by the agents, employees, and/or actors of the Associate.

e) Access to member and/or covered dependent prescriber information and/or diagnostic information that will or may contain personally identifiable information (PII) and/or protected health information (PHI) in electronic format(s) known as EPII and/or EPHI.

f) The Associate may have access to the Covered Entity’s member and/or covered dependent/dependent PII/PHI via access to information used, stored, and/or maintained by other Business Associates of the Covered Entity, including but not limited to: the Third Party Claims Administrator, the Specialty Pharmacy Benefits Manager, The Data “Warehouse” or repository, the Covered Entity’s Subrogation services provider, etc.

g) The PBM shall be required to disclose the name(s) of any and/or all subcontractor(s) who will have access to and/or use any State of West Virginia PII/PHI and shall ensure that the terms and conditions of the State of West Virginia Executive Branch Business Associate Agreement, including this Appendix A, are driven down to said subcontractor(s). This would include to any and/or all subcontractors of subcontractors at any and/or all layers, e.g. primary, secondary, tertiary, quaternary, etc., of service(s) provided under the scope of work of this Agreement.

h) Under no circumstances shall any State of West Virginia PII/PHI be permitted to be transmitted, accessed, used, viewed, and/or stored or otherwise leave the 48 contiguous Continental United States by any means, mode(s) or manner. This would include by any subcontractor and/or otherwise Business Associate of the

PBM.

i) The Associate shall comply with any and/or all provisions of Titles I & II of the Health Insurance Portability and Accountability Act of 1996, Pub.L. 104–191, 110 Stat. 1936, as amended, and the Health Information Technology for Economic and Clinical Health Act (HITECH) enacted as part of the American Reinvestment and Reauthorization Act of 2009 (ARRA), including the Final Omnibus Rule.

j) The information provided to the Associate and/or its agents, employees, and/or contract employees, pursuant to the Agreement is solely for the purpose(s) of providing contracted Pharmacy Benefit Management services and support and may not be used in an identified form nor any deidentified format(s) for any purpose outside the defined scope of work of the Contract and/or Agreement.

k) Nothing in this document shall relieve the Associate of the liability for the action(s), error(s) and/or omission(s) of its agents, employees, and/or contract employees.