HMO_Attachment H - Data Use Agreement.pdf

ITN No.: DMS-22/23-072 Attachment H: Data Use Agreement Page 1 of 4

Attachment H: Data Use Agreement

This Data Use Agreement (“Agreement”) is made this ____ day of ______ 2022, by and between ____________________________________ (“Vendor”), and the State of Florida, Department of Management Services (“Department”).

The Vendor warrants and represents that it intends to submit a Reply in response to the Department’s solicitation entitled ITN No.: DMS-22/23-072 Third Party Administrative Services for HMO Health Insurance (“ITN”). In order to respond to the ITN, the Department will provide Vendor with access to certain individually identifiable health information (“Protected Health Information”) contained in Attachment I: Census File and Attachment J – Scrubbed Claims Data. The Department will provide this Protected Health Information in a limited data set in accordance with 45 C.F.R. § 164.514(e)(1). See section 1.10, Notice of Intent to Submit a Reply and Data Use Agreement, of the ITN for instructions on how to obtain this file and data.

As a condition for its receipt and access to the Protected Health Information, Vendor agrees as follows:

1. Vendor shall comply with the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act of 2009, and all other applicable requirements of law relating to the Protected Health Information.

2. Vendor shall not use or disclose the Protected Health Information for any purposes other than to respond to this ITN.

3. Vendor must use appropriate safeguards to prevent the unauthorized use or disclosure of the Protected Health Information.

4. Vendor shall not disclose, publish, release, transfer, or disseminate any Protected Health Information except as authorized by law and permitted by this Agreement.

5. Vendor shall be liable for any violations by any of its employees who are provided or given access to Protected Health Information and for any access by unauthorized persons.

6. Vendor shall abide by the following procedures in handling the Department’s Protected Health Information:

a. Vendor will password protect the Protected Health Information upon receipt thereof.

b. Vendor shall only allow its authorized employees to access the Protected Health Information.

c. Vendor will inform all employees who have access to the Protected Health Information that:

i. The employee is not to share the password or the Department’s Protected

Health Information with any unauthorized person;

ii. If the Vendor does not submit a Reply to the ITN, the employee will, by the time Replies to the ITN are due, delete the Department’s Protected Health

Attachment H: Data Use Agreement Page 2 of 4

Information from any laptop, desktop, or any other electronic system under their control and will destroy any paper copies of the Protected Health Information;

iii. At the end of the solicitation process, the employee will delete the Department’s Protected Health Information from any laptop, desktop, or any other electronic system under their control and will destroy any paper copies of the Protected Health Information; and

iv. The employee must confirm to Vendor that he or she have so deleted or destroyed the Protected Health Information.

d. Files and passwords will be provided separately to each employee.

e. Vendor shall maintain a list of persons granted access (“Access List”) to the Department’s Protected Health Information. Persons expected to have access to the Department’s Protected Health Information are to be listed in the chart on page 4 of this attachment. If at any time the Vendor intends to provide access to a person not listed on the Access List provided to the Department, the Vendor must provide an updated Access List to the Department’s Procurement Officer, including the additional person to be provided access, prior to the provision of access to such person. Vendor has a continuing obligation to update the Access List.

7. Vendor must not identify, attempt to identify, nor contact the person who is the subject of the Protected Health Information.

8. Vendor shall report to the Department any unauthorized access, use, or disclosure of Protected Health Information within three (3) Calendar Days of discovery thereof.

9. Vendor shall make its internal practices, books, and records relating to its use and disclosure of the Protected Health Information available to the Secretary of the U.S.

Department of Health and Human Services or its authorized delegate for purposes of determining the Department’s compliance with applicable law. Vendor shall immediately notify the Department upon receipt by Vendor of any such request and shall provide the Department with copies of any such materials.

10. If Vendor submits a Reply in response to this ITN, Vendor shall destroy the Protected Health Information, including any copies, remaining in its possession within the later of five (5) Business Days of the Department’s notice of an intended award in connection with this solicitation or the conclusion of any legal proceeding or protest regarding the procurement. At that time, Vendor shall provide to the Procurement Officer a final Access List and a certification that it has complied with this destruction requirement.

If Vendor does not submit a Reply in response to this ITN, the Vendor shall destroy the Protected Health Information, including any copies, by the time Replies are due. At that time, the Vendor shall provide to the Procurement Officer a complete Access List and certification that the vendor has complied with this destruction requirement on or before the due date of Replies.

Attachment H: Data Use Agreement Page 3 of 4

11. Vendor's employees who access the Protected Health Information must agree to the restrictions set forth herein prior to obtaining access to the Protected Health Information.

12. In the event the Department suffers any losses, damages, liabilities, expenses or costs (including by way of example only, attorney’s fees and disbursements) that are attributable, in whole or in part, to any failure by Vendor or any employee of Vendor to comply with the requirements of this Agreement, Vendor shall hold harmless and indemnify the Department and the State of Florida from and against any such losses, damages, liabilities, expenses and/or costs.

13. Vendor acknowledges that the disclosure of the Protected Health Information may cause irreparable harm to the Department and agrees that the Department may obtain an injunction to prevent the disclosure, copying, or other impermissible use of the Protected Health Information. The Department’s rights and remedies hereunder are cumulative, and the Department expressly reserves any and all rights, remedies, claims, and actions that it may have now or in the future to protect the Protected Health Information and/or to seek damages for Vendor’s failure to comply with the requirements of this Agreement.

14. This Agreement shall be governed by the laws of the State of Florida. Vendor consents to personal jurisdiction in Florida state court, and exclusive venue shall be in Leon County, Florida.

15. The individual signing below warrants and represents that they are fully authorized to bind Vendor to the terms and conditions specified in this Agreement.

Legal Name of Vendor: _____________________________________________________

Name of Authorized Representative: __________________________________________ (Print Name)

Title of Authorized Representative: ____________________________________________

Signature of Authorized Representative: ___________________________________

Date: __________________________ Date of Signature

Address: _____________________________________ Enter Street or PO Address

Enter City, State and ZIP Code

Telephone No: (____) _____ - ______

E-mail Address (the individual who will receive the link to access the Protected Health Information):

Attachment H: Data Use Agreement Page 4 of 4

VENDOR’S EMPLOYEES WHO WILL BE GIVEN ACCESS TO THE PROTECTED HEALTH

INFORMATION

(Vendors may submit separate, scanned pages of employees’ signatures)

Printed Name, Address of Individual

Signature of Individual Date