NE MDR Addendum A_CMS.docx

ADDENDUM A - DATA USE AGREEMENT (DUA) PROVISIONS

RFP #124528 ON

Medicaid Drug Rebate (MDR) System State of Nebraska, Department of Health and Human Services

1. PURPOSE; APPLICABILITY

1.1. The purpose of this DUA is to facilitate access to, creation, receipt, maintenance, use, disclosure, or transmission of Confidential Information with Contractor, and set forth Contractor’s rights and obligations with respect to the Confidential Information and the limited purposes for which the Contractor may create, receive, maintain, use, disclose, or have access to Confidential Information. This DUA includes removing Confidential Information from the Nebraska Department of Health and Human Services (DHHS) systems provided for data use, and the creation of new data used outside those systems. This DUA describes DHHS’ remedies in the event of Contractor’s noncompliance with its obligations under this DUA. DHHS also requires all Contractors’ Subcontractors to comply with the terms of this DUA to safeguard all Confidential Information.

2. DEFINITIONS

For the purposes of this DUA, capitalized terms have the following meanings:

2.1. “Authorized Purpose” means the specific purpose or purposes described in the Contract for Contractor to fulfill its obligations under the Contract, or any other purpose expressly authorized by DHHS, in writing, in advance.

2.2. “Authorized User” means a person:

2.2.1. Who is authorized to create, receive, maintain, access, process, view, handle, examine, interpret, or analyze Confidential Information pursuant to this DUA;

2.2.2. Who has a demonstrable need to create, receive, maintain, use, disclose, or have access to the Confidential Information; and

2.2.3. Who has agreed in writing to be bound by the disclosure and use limitations pertaining to the Confidential Information as required by this DUA.

2.3. “Breach” means an impermissible use or disclosure of electronic or non-electronic Confidential Information by an unauthorized person or for an unauthorized purpose that compromises the security or privacy of Confidential Information such that the use or disclosure poses a risk of reputational harm, theft of financial information, identity theft, or medical identity theft. Any acquisition, access, use, disclosure, or loss of Confidential Information other than as permitted by this DUA shall be presumed to be a Breach unless Contractor demonstrates, based on a risk assessment, that there is a low probability that Confidential Information has been compromised.

2.4. “Confidential Information” means any communication or record (whether oral, written, electronically stored or transmitted, or in any other form) provided to or made available to Contractor or that Contractor may create, receive, maintain, use, disclose, or have access to on behalf of DHHS in connection with the Contract, that is protected under Federal or State security, privacy, or confidentiality laws or regulations.

2.5. “Contract” includes the Grant Agreement, and collectively, the Request for Proposal (or Request for Qualifications, as applicable), the Contractor’s proposal, as well as any addenda, appendices, and attachments.

2.6. “Contractor” includes the “grantee” under a Grant Agreement and the “contractor” under the Request for Proposal (or Request for Qualifications, as applicable), the Contractor’s proposal, as well as any addenda, appendices, and attachments.

2.7. “Destroy” or “Destruction”, for Confidential Information, means:

2.7.1. Paper, film, or other hard copy media have been shredded or destroyed such that the Confidential Information cannot be read or otherwise reconstructed. Redaction is specifically excluded as a means of data destruction.

2.7.2. Electronic media have been cleared, purged, or destroyed consistent with National Institute of Standards and Technology (NIST) Special Publication 800-88, “Guidelines for Media Sanitization,” such that the Confidential Information cannot be retrieved.

2.8. “Discover” or “Discovery” means the first day on which a Breach becomes known to Contractor, or, by exercising reasonable diligence would have been known to Contractor.

2.9. “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, including the specific requirements in the “Privacy Rule” or “HIPAA Privacy Rule” and the “Security Rule” or “HIPAA Security Rule” at 45 CFR §§ 160, 162, and 164.

2.10. “Legally Authorized Representative” of an individual means any individual as defined in 42 CFR § 435.923 (authorized representative), or any individual legally authorized to act on behalf of another individual under Nebraska law.

2.11. “Protected Health Information” (PHI) has the same meaning as defined in 45 C.F.R. §160.103.

2.12. “Required by Law” means a mandate contained in law that compels an entity to use or disclose Confidential Information that is enforceable in a court of law and is consistent with 42 CFR § 431, Subpart F, including court orders, warrants, subpoenas, or investigative demands.

2.13. “Subcontractor” means a person who contracts with a prime contractor to work, to supply commodities, or contribute toward completing work for a governmental entity.

2.14. “Workforce” means employees, volunteers, trainees, or other persons whose performance of work is under the direct control of the Contractor, whether or not they are paid by that party.

3. CONTRACTOR'S DUTIES REGARDING CONFIDENTIAL INFORMATION

3.1. With respect to PHI, Contractor shall:

3.1.1. Make PHI available if requested by DHHS, if Contractor maintains PHI.

3.1.2. Provide DHHS data aggregation services related to the healthcare operations Contractor performs for DHHS pursuant to the Contract, if requested by DHHS, if Contractor provides data aggregation services as defined in HIPAA.

3.1.3. Provide access to PHI to an individual who is requesting their PHI, or such individual’s Legally Authorized Representative, in compliance with the requirements of HIPAA.

3.1.4. Make PHI available to DHHS for amendment, and incorporate any amendments to PHI that DHHS directs, in compliance with HIPAA.

3.1.5. Document and make available to DHHS, an accounting of use and disclosures in compliance with the requirements of HIPAA.

3.1.6. If Contractor receives a request for access, amendment, or accounting of PHI by any individual, promptly forward the request to DHHS or, if forwarding the request would violate HIPAA, promptly notify DHHS of the request and of Contractor’s response. DHHS will respond to all such requests, unless Contractor is Required by Law to respond or DHHS has given prior written consent for Contractor to respond to and account for all such requests.

3.2. With respect to ALL Confidential Information, Contractor shall:

3.2.1. Exercise reasonable care to the same degree of care Contractor uses to protect its own confidential, proprietary, and trade secret information to prevent Confidential Information from being used in a manner that is not expressly an Authorized Purpose or Required by Law. Contractor must access, create, maintain, receive, use, disclose, transmit, or Destroy Confidential Information in a secure fashion that protects against any reasonably anticipated threats or hazards. Contractor may be required to sign and submit a Statement of Destruction attesting to the same.

3.2.2. Establish, implement, and maintain appropriate administrative, physical, and technical safeguards (for the purpose of this paragraph, “Safeguards”) to preserve and maintain the confidentiality, integrity, and availability of Confidential Information, in accordance with applicable laws or regulations. Contractor authorizes DHHS, or a third party designated by DHHS, to review the Safeguards, in the sole discretion of DHHS, prior to granting Contractor actual or constructive possession of Confidential Information.

3.2.3. Implement and document privacy, security, and breach notification policies and procedures and an incident response plan to address a Breach, to comply with the notice requirements of this DUA prior to conducting work under the Contract. Contractor shall produce, within three business days of a request by DHHS, copies of its policies, procedures, and records relating to the use or disclosure of Confidential Information.

3.2.4. Obtain DHHS’ prior written consent to disclose or allow access to any portion of the Confidential Information to any person, other than Authorized Users, Workforce or Subcontractors of Contractor. All Authorized Users, Workforce or Subcontractors must execute, individually, an acknowledgement noting their obligations and referencing this DUA. Additional requirements set forth below pertaining to Subcontractors dictate further requirements before disclosure.

3.2.5. Establish, implement, and maintain appropriate sanctions against any Workforce member or Subcontractor who fails to comply with this DUA, the Contract, or applicable law. Contractor must maintain a record of sanctions and produce it to DHHS upon request.

3.2.6. Obtain prior written approval of DHHS to disclose or provide access to any Confidential Information that is Required by Law, so that DHHS may have the opportunity to object to the disclosure or access.

3.2.7. Ensure that its Authorized Users each have a demonstrated need to access Confidential Information to the minimum extent necessary to accomplish the Authorized Purpose and that each has agreed in writing to be bound by the disclosure and use limitations pertaining to Confidential Information contained in this DUA. Contractor and any previously authorized Subcontractors shall maintain at all times an updated, complete, and accurate list of Authorized Users and supply it to DHHS upon request.

3.2.8. Provide, and require Subcontractors to provide, periodic written confirmation of compliance with the terms of this DUA to DHHS.

3.2.9. Return to DHHS, at DHHS’ election and Contractor’s expense, or destroy, at DHHS’ election and Contractor’s expense, all Confidential Information received from DHHS or created or maintained by Contractor or any of Contractor’s Subcontractors on DHHS' behalf upon the termination or expiration of this DUA, if reasonably feasible and permitted by law. Contractor shall certify in writing to DHHS that all such Confidential Information has been Destroyed or returned to DHHS, and that Contractor and Subcontractors have retained no copies thereof. Notwithstanding the foregoing, Contractor acknowledges and agrees that it may not Destroy Confidential Information if prohibited by federal or state law, DHHS record retention policy, or a litigation hold notice. If such return or Destruction is not reasonably feasible, or is prohibited, Contractor shall immediately notify DHHS of the reasons such return, or Destruction is not feasible and agree to extend the protections of this DUA to the Confidential Information while Contractor maintains such Confidential Information.

3.2.10. Only conduct secure transmissions of Confidential Information whether in paper, oral, or electronic form. DHHS may approve the method of secure transmission before any Confidential Information is transmitted by Contractor. A secure transmission of electronic Confidential Information in motion includes secure File Transfer Protocol (SFTP) or encryption at an appropriate level as required by rules, regulation, or law. Confidential Information at rest requires encryption unless there is adequate administrative, technical, and physical security or as required by rules, regulation, or law. All electronic data transfer and communications of Confidential Information shall be completed through a secure system. Contractor shall provide proof of system, media, or device security and/or encryption to DHHS no later than 48 hours after DHHS' written request. De-identification of Confidential Information in accordance with HIPAA de-identification standards is deemed secure.

3.2.11. Designate and identify a person or persons, as Privacy Official and Information Security Official, each of whom is authorized to act on behalf of Contractor and is responsible for the development and implementation of the privacy and security requirements in this DUA. Contractor shall provide name and current address, phone number, and e-mail address for such designated officials to DHHS no later than 48 hours after DHHS’ written request.

3.2.12. Make available to DHHS any information required to fulfill DHHS' obligations to Confidential Information in accordance with applicable laws, regulations, or demands of a regulatory authority relating to Confidential Information. Contractor shall provide such information in a time and manner reasonably agreed upon or as designated by the applicable law or regulatory authority.

3.2.13. Comply with laws and standards applicable to the type of Confidential Information and Contractor's Authorized Purpose.

3.2.14. Comply with DHHS Information Technology Security Policies and Standards, found at: https://dhhs.ne.gov/Documents/Information%20Technology%20(IT)%20Security%20Policies%20and%20Standards.pdf

3.3. With respect to ALL Confidential Information, Contractor and Subcontractor shall NOT:

3.3.1. Attempt to re-identify or further identify Confidential Information that has been de-identified or attempt to contact any persons whose records are contained within, except for an Authorized Purpose, without express written authorization from DHHS.

3.3.2. Engage in marketing or sale of Confidential Information.

3.3.3. Permit, or enter into any agreement with a Subcontractor to, create, receive, maintain, use, disclose, have access to, or transmit Confidential Information, on behalf of DHHS without requiring that Subcontractor first gain approval from DHHS and execute the Form Subcontractor Agreement, Appendix 1. Contractor is directly responsible for its Subcontractors’ compliance with, and enforcement of, this DUA. If Subcontractor requires Medicaid Client information access, the Contractor shall specifically identify as such in its request to DHHS.

4. BREACH NOTICE, REPORTING AND CORRECTION REQUIREMENTS

4.1. Cooperation and Financial Responsibility

4.1.1. Contractor shall, at Contractor’s expense, cooperate fully with DHHS in investigating, mitigating to the extent practicable, issuing notifications, and reporting as directed by DHHS, for any Breach of Confidential Information.

4.1.2. Contractor shall make Confidential Information in Contractor’s possession available pursuant to the requirements of HIPAA or other applicable law upon a determination of a Breach.

4.1.3. Contractor’s obligation begins at the Discovery of a Breach and continues as long as related activity continues, until all effects of the Breach are mitigated (the "incident response period"). Effects will be considered fully mitigated upon notification from DHHS and will include, at a minimum, a completed investigation summary report and risk assessment.

4.2. Initial Breach Notice

4.2.1. For federal information obtained from a federal system of records, including Federal Tax Information and Social Security Administration Data (which includes Medicaid and other governmental benefit program Confidential Information), Contractor shall notify DHHS of the Breach within the first hour of Discovery. The Contract shall specify whether Confidential Information is obtained from a federal system of records. For all other types of Confidential Information, Contractor shall report to DHHS within fifteen (15) days of which the Contractor becomes aware of Breach. Contractor shall initially report to DHHS' Privacy and Security Officers via email at:

· DHHS.InformationSecurityOffice@nebraska.gov; and

· DHHS.HIPAAOffice@nebraska.gov.

Notification shall also be provided via email to the DHHS Contract Manager.

4.2.2. Contractor shall report all information reasonably available to Contractor about the Breach. This shall include, at a minimum:

a. Date and time of the incident;

b. Date and time the incident was discovered;

c. Description of the incident and the data involved, including specific data elements, if known;

d. Potential number of records involved, or an estimated range if unknown;

e. Address where the incident occurred;

f. Information technology involved (e.g., laptop, server, mainframe etc.).

g. Mitigation efforts; and

h. Investigation information or anticipated third party involvement in any investigation efforts.

4.2.3. Contractor shall provide contact information to DHHS for Contractor's single point of contact who will communicate with DHHS during the incident response period.

4.3. Weekly Updates. Contractor shall provide weekly updates during the incident response period. Updates must include the status of any ongoing investigation, anticipated conclusion date of investigation, and any additional information ascertained from the investigation.

4.4. Investigation Completion. At the conclusion of the investigation, Contractor shall provide the following:

4.4.1. Contractor shall provide a complete investigation report to DHHS with all available information about the Breach, and Contractor's investigation, including:

a. The date the Breach occurred;

b. The date of Contractor's and, if applicable, Subcontractor's Discovery;

c. A brief description of the Breach, including a root causes analysis of how it occurred and who is responsible;

d. A description of Contractor's investigation and the results of the investigation;

e. A description of the Confidential Information involved;

f. Identification of and number of all individuals affected, including first and last name of the individual(s) and if applicable, the Legally Authorized Representative, last known address, age, telephone number, and email address and their preferred contact method;

g. The steps Contractor has taken to mitigate the harm or potential harm caused (including without limitation the provision of sufficient resources to mitigate);

h. The steps Contractor has taken, or will take, to prevent or reduce the likelihood of recurrence of a similar Breach;

i. Identify, describe, or estimate of the persons, Workforce, Subcontractor, individuals or law enforcement that may be involved in the Breach; and

j. Any reasonably available pertinent information, documents, or reports related to a Breach that DHHS requests following Discovery.

4.4.2. Contractor shall provide a completed risk assessment, demonstrating whether a Breach requiring notification has occurred or an analysis as to whether there is a low probability of compromise.

4.5. Breach Notification to Individuals and Reporting to Authorities.

4.5.1. Based on the results of the completed risk assessment, DHHS may direct Contractor to provide Breach notification to individuals, regulators, or third parties, as specified by DHHS following a Breach.

4.5.2. Contractor shall provide DHHS with any draft Breach notification letters and communication plans for approval prior to distribution. Breach notification letters will be in Contractor's name and on Contractor's letterhead, unless otherwise directed by DHHS, and will contain contact information, including the name and title of Contractor's representative, an email address, and toll-free telephone number.

4.5.3. Contractor must comply with all applicable legal and regulatory notification and reporting requirements in the time, manner, and content required by state or federal authorities. Contractor will provide a copy of all reports made on behalf of DHHS to DHHS.

4.5.4. Contractor shall have the burden of demonstrating to the satisfaction of DHHS that required notification or reporting was timely made. If there are delays outside of Contractor's control, Contractor shall provide written documentation to DHHS of the reasons for the delay.

5. GENERAL PROVISIONS

5.1. Ownership of Confidential Information

5.1.1. Notwithstanding any other provision in the Contract, all data collected as a result of this project (including but not limited to all Confidential Information) shall be the property of DHHS.

5.2. DHHS Commitment and Obligations

5.2.1. DHHS will not request Contractor to create, maintain, transmit, use, or disclose Confidential Information in any manner that would not be permissible under applicable law if done by DHHS.

5.3. DHHS Right to Inspection

5.3.1. At any time, upon reasonable notice to Contractor, or if DHHS determines that Contractor has violated this DUA, DHHS, directly or through an agent, may inspect the facilities, systems, books, and records of Contractor to monitor compliance with this DUA.

5.4. Term; Termination of DUA; Survival

5.4.1. This DUA will be effective on the date on which it was signed and will terminate upon termination of the Contract and as set forth herein. If the Contract is extended, this DUA is extended to run concurrent with the Contract.

5.4.2. If DHHS determines that Contractor has violated a material term of this DUA, DHHS may, in its sole discretion, and after providing written notice to Contractor:

a. Exercise any of its rights under this DUA and/or the Contract;

b. Require Contractor to submit to a corrective action plan;

c. Provide Contractor with a reasonable period to cure the violation; or

d. Terminate the DUA and Contract immediately, and, if DHHS further determines, seek relief in a court of competent jurisdiction.

5.4.3. If neither termination nor cure is feasible, DHHS shall report, or require the Contractor to report, the violation to the applicable regulatory authorities.

5.4.4. The duties of Contractor or its Subcontractor under this DUA survive the expiration or termination of this DUA until all the Confidential Information is Destroyed or returned to DHHS, as required by this DUA.

5.5. Injunctive Relief

5.5.1. Contractor acknowledges and agrees that DHHS may suffer irreparable injury if Contractor or its Subcontractor fails to comply with any of the terms of this DUA.

5.5.2. Contractor further agrees that monetary damages may be inadequate to compensate DHHS for Contractor's or Subcontractor's failure to comply. Accordingly, Contractor agrees that DHHS will, in addition to any other remedies available to it at law or in equity, be entitled to seek injunctive relief without posting a bond and without the necessity of demonstrating actual damages, to enforce the terms of this DUA.

5.6. Indemnification

5.6.1. All of Contractor’s duties and obligations regarding indemnification otherwise contained herein apply to the provisions contained in this DUA.

5.7. Automatic Amendment and Interpretation

5.7.1. Upon the effective date of any amendment or issuance of additional regulations to any law applicable to Confidential Information, this DUA will automatically be amended so that the obligations imposed on DHHS and/or Contractor remain in compliance with such requirements. Any ambiguity in this DUA will be resolved in favor of a meaning that permits DHHS and Contractor to comply with laws applicable to Confidential Information.

5.8. Notices; Requests for Approval

5.8.1. All notices and requests for approval related to this DUA must be directed to the DHHS Contract Manager.

Data Use Agreement – Addendum A Page 1 of 9 07/2025

APPENDIX 1. SUBCONTRACTOR AGREEMENT FORM

DHHS CONTRACT NUMBER

RFP #124528 ON

Medicaid Drug Rebate (MDR) System State of Nebraska, Department of Health and Human Services

The Data Use Agreement (“DUA”) between DHHS and Contractor establishes the permitted and required uses and disclosures of Confidential Information by Contractor. Contractor has received permissions by DHHS for operations purposes for Authorized Use, and has subcontracted with ____________________ (Subcontractor name) for performance of duties on behalf of Contractor, which are subject to the DUA. Subcontractor acknowledges, understands and agrees to be bound by the same terms and conditions applicable to Contractor under the DUA, incorporated by reference in this Agreement, with respect to DHHS Confidential Information. Contractor and Subcontractor agree that DHHS is a third-party beneficiary to applicable provisions of the subcontract.

DHHS has the right, but not the obligation, to review or approve the terms and conditions of the subcontract by virtue of this Subcontractor Agreement Form.

Contractor and Subcontractor assure DHHS that any Breach as defined by the DUA that Subcontractor Discovers shall be reported to DHHS by Contractor in the time, manner and content required by the DUA.

If Contractor knows or should have known in the exercise of reasonable diligence of a pattern of activity or practice by Subcontractor that constitutes a material breach or violation of the DUA or the Subcontractor's obligations, Contractor shall:

1. Take reasonable steps to cure the violation or end the violation, as applicable;

2. If the steps are unsuccessful, terminate the contract or arrangement with Subcontractor, if feasible;

3. Notify DHHS immediately upon Discovery of the pattern of activity or practice of Subcontractor that constitutes a material breach or violation of the DUA and keep DHHS reasonably and regularly informed about steps Contractor is taking to cure or end the violation or terminate Subcontractor's contract or arrangement.

This Subcontractor Agreement Form is executed by the parties in their capacities indicated below.

FOR CONTRACTOR: FOR SUBCONTRACTOR:

DATE: ____________________ DATE: __________________