Revised Attachment E -Draft Contract.pdf

4050 Esplanade Way Tallahassee, FL 32399-0950

850-488-2786

Ron DeSantis, Governor Pedro Allende, Secretary

REVISED ATTACHMENT E

DRAFT CONTRACT

FOR

THIRD PARTY ADMINISTRATIVE SERVICES FOR

HMO HEALTH INSURANCE

DMS-22/23-072

BETWEEN

STATE OF FLORIDA

DEPARTMENT OF MANAGEMENT SERVICES

AND

[INSERT CONTRACTOR NAME]

Contract No.: DMS-22/23-072 Revised Attachment E: Draft Contract Page 2 of 36

Table of Contents

Section 1 DEFINITIONS

Section 2 CONTRACT DOCUMENTS

Section 3 TERM, SCOPE, AND PAYMENTS

Section 4 CONTRACT ADMINISTRATION

Section 5 AUDIT RIGHTS

Section 6 DIVERSITY

Section 7 LIQUIDATED DAMAGES

Section 8 INSURANCE

Section 9 EVENTS OF DEFAULT AND REMEDIES

Revised Attachment E: Draft Contract Page 3 of 36

Section 10 GENERAL PROVISIONS

ATTACHMENTS:

Revised Attachment E: Draft Contract Page 4 of 36

ATTACHMENT 1: ADMINISTRATIVE REQUIREMENTS

ATTACHMENT 2: PERFORMANCE GUARANTEES

ATTACHMENT 3: COST REPLY/PRICE SHEET

ATTACHMENT 4: DEPARTMENT SELECTED PORTIONS OF ATTACHMENT B -

TECHNICAL

ATTACHMENT 5: DEPARTMENT SELECTED PORTIONS OF ATTACHMENT C -

NETWORK

ATTACHMENT 6: LIST OF DEPARTMENT APPROVED SUBCONTRACTORS

ATTACHMENT 7: DEPARTMENT SELECTED PORTIONS OF THE VENDOR’S BAFO

ATTACHMENT 8: PRIVACY, SECURITY, AND CONFIDENTIALITY BUSINESS

ASSOCIATE AGREEMENT

THIS SPACE INTENTIONALLY LEFT BLANK

Revised Attachment E: Draft Contract Page 5 of 36

Contract

This Contract is between the STATE OF FLORIDA, DEPARTMENT OF MANAGEMENT SERVICES (Department), an agency of the State of Florida with offices at 4050 Esplanade Way, Tallahassee, Florida 32399-0950, and {Insert Contractor Name} (Contractor), with offices at {Insert Contractor Address} each, a “Party” and collectively referred to herein as the “Parties”.

WHEREAS, the Contractor responded to the Department’s Invitation to Negotiate (ITN) No. DMS- 22/23-072 for Third Party Administrative Services for Health Maintenance Organization (HMO) Health Insurance and was selected for award; and

WHEREAS, the Parties enter into this Contract in accordance with the terms and conditions of the solicitation.

NOW THEREFORE, in consideration of the premises and mutual covenants set forth herein, the Parties agree as follows:

The following capitalized terms used in this Contract (including the Attachments and any attachments thereto) have the meanings ascribed below:

“Business Day” means any day of the week excluding weekends and holidays observed by State agencies pursuant to subsection 110.117(1)(a)-(j), Florida Statutes.

“Calendar Day” means any day in a month, including weekends and holidays.

“Claim(s)” means an application for payment of or reimbursement for health care expenses, including prescription drugs, incurred by Participants, which is filed in accordance with the Benefits Document and the Service Provider’s and/or Department’s requirements.

“Confidential Information” means information in the possession or under control of the State or Vendor that is exempt from public disclosure pursuant to section 24, Article I of the Constitution of the State; the Public Records Law, Chapter 119, Florida Statutes; or to any other Florida law, federal law or regulation that serves to exempt information from public disclosure.

"Contract" means this agreement between the Department and Contractor consisting of, in order of precedence, the following documents:

1. This agreement and its attachments, in the following order of precedence:

a. Attachment 8: Privacy, Security, and Confidentiality Business Associate Agreement;

b. Attachment 1: Administrative Requirements;

c. Attachment 2: Performance Guarantees;

d. Attachment 3: Cost Reply / Price Sheet

e. Attachment 4: Department Selected Portions of Attachment B – Technical

f. Attachment 5: Department Selected Portions of Attachment C – Network

g. Attachment 6: List of Department approved Subcontractors

h. Attachment 7: Department selected portions of the Vendor’s BAFO

In the event of conflict between this document and the Attachments, this document will control.

Revised Attachment E: Draft Contract Page 6 of 36

2. The General Contract Conditions - PUR 1000 form, which is incorporated by reference, and available at the weblink listed below. The Parties agree that the following provisions of the PUR 1000 are not applicable to this Contract: 2-13, 17, 20-23, 26-29, 31-32, 34- 35, 38-39, 42, 45.

https://www.dms.myflorida.com/content/download/2933/11777/PUR_1000_General_Co ntract_Conditions.pdf

“Contract Administrator” means the person designated pursuant to subsection 10.5 of this Contract.

“Contract Manager” means those persons designated pursuant to subsection 10.6 of this

“Data” or “State of Florida Data” means a representation of information, knowledge, facts, concepts, computer software, or computer programs or instructions (including any that it is exempt; confidential; or Protected Health Information protected under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 45 C.F.R. §§ 160 and 164, the Health Information Technology for Economic and Clinical Health Act of 2009 (the “HITECH Act”), and the regulations promulgated thereunder, or section 110.123(9), Florida Statutes), that is received by the Contractor, or created by the Contractor, in the performance of the Services under the Contract. State of Florida Data may be in any form including, but not limited to, storage media, computer memory, in transit, presented on a display device, or in physical media such as paper, film, microfilm, or microfiche. State of Florida Data includes the original form of the State of Florida Data and all metadata associated with the State of Florida Data.

“Department” means the Florida Department of Management Services or its designee, which may include a third-party administrator contracted to assume responsibility for the Department’s administration of this Contract pursuant to section 110.123(3)(d)1., Florida Statutes.

“Deliverables” mean those services, items and/or materials provided, prepared, and delivered to the Department in the course of performance under this Contract by the Contractor.

“Division” means the Department’s Division of State Group Insurance.

“Effective Date” means the date the Contract is fully executed by all Parties.

“Eligible Dependent” means a Dependent of a Subscriber, as defined by the Florida Administrative Code and statutes.

“Implementation Date” means January 1, 2024, at 12:00 A.M., Eastern Time (EST).

“Implementation Plan” means the written description provided by Contractor, as approved by the Department, of the schedule of actions necessary to implement the services and begin fulfilling the Contract in a timely manner.

https://www.dms.myflorida.com/content/download/2933/11777/PUR_1000_General_Contract_Conditions.pdf https://www.dms.myflorida.com/content/download/2933/11777/PUR_1000_General_Contract_Conditions.pdf

Revised Attachment E: Draft Contract Page 7 of 36

“Member” means those persons defined as a “health plan member” in subsection 110.123(2)(e), Florida Statutes.

“Notice” means written notification from one Party to the other Party regarding performance under the Contract.

“Performance Guarantees” means specific measurement indicators assigned to Contract tasks representing timeliness and quality of task output.

“Plan(s)” means any of the insurance coverages offered through the Department, as authorized in section 110.123, Florida Statutes.

“Plan Year” means the calendar year from January 1 to December 31.

“Privacy Rule” means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

“Program” means the State Group Insurance Program defined in sections 110.123(3) and 110.12315, Florida Statutes.

“Protected Health Information” is defined in HIPAA at 45 CFR 160.103, and as used in this Agreement also refers to the term “Protected Health Information,” as defined in the HITECH Act.

“Rural Area” means less than 1,000 persons per square mile.

“Secretary” means the Secretary of the Department or his or her designee.

“Services” means services to be performed by Contractor as specified in this Contract, including the requirements of the Attachments to this Contract. The term “Services” includes, but is not limited to, all Deliverables and any unspecified service that is inherent in proper delivery of a specified service or Deliverable. During the term of the Contract, the Department will have the right to add or delete services and products. If the Department elects to add services or products, the Contractor and the Department will negotiate a mutually agreed amendment to the Contract.

“State” means the State of Florida.

“Standard Reporting” means periodic reports as described in Attachment 1: Administrative Requirements.

“Subcontractor” means the Contractor’s subcontractors and agents that deliver the Services required by this Contract. The term “Subcontractor” does not include health care providers.

“Subscriber”, “Enrollee”, “Member”, or “Participant” means the enrolled employee, retiree, surviving spouse, or Consolidated Omnibus Budget Reconciliation Act of 1985 (COBRA) participant that is the primary insured, as defined in Florida law.

“Suburban Area” means between 1,000 to 3,000 persons per square mile.

“Urban Area” means greater than 3,000 persons per square mile.

Revised Attachment E: Draft Contract Page 8 of 36

Rules of Interpretation

The following rules of interpretation shall apply, unless otherwise indicated:

a. Reference to, and the definition of, any document (including any attachments) shall be deemed a reference to such document as it may be amended, supplemented, revised or modified;

b. The table of contents and section headings and other captions are for the purpose of reference only and do not limit or affect the content, meaning or interpretation of the text;

c. Defined terms in the singular shall include the plural and vice versa and the masculine, feminine or neutral-genders shall include all genders;

d. The words “hereof,” “herein,” “hereunder,” and words of similar import, shall refer to this Contract as a whole and not to any particular provision of this Contract;

e. The words “include,” “includes” and “including” are deemed to be followed by the phrase “without limitation”;

f. Any reference to a governmental entity or person shall include the governmental entity’s or person’s authorized successors and assigns; and

g. The words “quarterly,” “on a quarterly basis,” “quarterly meeting” or other similar terms mean, unless otherwise stated herein, once every three (3) months, beginning <<mm/dd/yyyy>>.

Term

Initial term The initial Contract term is three (3) years and Services will commence on the Effective Date and end <<mm/dd/yyyy>>, unless extended, terminated, or renewed as provided herein. The Parties acknowledge that the Plan will not be administered under this Contract until January 1, 2024. While implementation services will be required, premium payments from Enrollees will not be collected until December 2023, for coverage effective January 1, 2024.

Renewals

At its sole option and discretion, the Department may renew the Contract for up to three

(3) additional one (1) year renewal terms. Such renewal will be binding on the Contractor and may be in one (1) year or multiple year increments at the Department’s sole option.

Renewal in whole or in part shall be at the sole discretion of the Department. The Department shall also consider whether the Contractor has been subject to any performance violations and/or liquidated damages in complying with any of the Contract requirements. Any renewal shall be in writing and signed by both Parties.

The Contractor shall not charge any fees and/or costs for renewing the Contract.

Pursuant to section 287.057(13), Florida Statutes, this Contract may be extended if the failure to meet the criteria set forth in the contract for completion of the Contract is due to events beyond the control of the Contractor, as determined by the Department.

Revised Attachment E: Draft Contract Page 9 of 36

Department’s Right to Terminate for Convenience

The Department, by sixty (60) Calendar Days advanced written notice to Contractor, may terminate the Contract for any reason or no reason at all when the Department determines in its sole discretion that it is in the Department’s best interest to do so. The Contractor shall not perform any Services after the effective date of the termination, except as necessary to complete the continued portion of the Contract, if any. The Contractor will not be entitled to recover any lost profits, consequential, special, punitive, or indirect damages, or any other damages other than the payment amounts due for performance until the effective date of termination. If this Contract is terminated for convenience prior to January 1, 2024 the Department shall reimburse Contractor for direct costs actually incurred for Services authorized by the Department and satisfactorily performed prior to receipt of the notice of termination.

Scope of Work The Contractor will provide all labor, materials, and supplies necessary to provide the Services as described in this Contract. Contractor agrees to periodic reviews by the Department on Contractor’s performance to improve delivery of the scope of work.

Corrective work to comply with the requirements of this Contract will be performed by the Contractor at its expense, and the Contractor will not be entitled to any compensation for such corrective work.

Modifications and Changes The Department, by written change order, may unilaterally require changes altering, adding to, or deducting from the Services, products, or Contract specifications, provided that such changes are within the general scope of the Contract. If Services or products are added, the Contractor and the Department will negotiate a mutually agreed amendment to the Contract. The Department may make an equitable adjustment in the Contract price or delivery date if changes to Contract specifications affect the cost or time of performance. Such equitable adjustments require the written consent of the Contractor, which shall not be unreasonably withheld. If the Parties fail to agree to an equitable adjustment, such dispute must be resolved pursuant to the Dispute Resolution procedures identified in section 10.7.

The Contract, including its Attachments, contains all the terms and conditions agreed upon by the Parties, which shall govern all transactions under the Contract. Other than as specified above, the Contract may only be modified or amended upon mutual written agreement of the Department and Contractor. No oral agreements or representations shall be valid or binding upon the Department or Contractor. Contractor may not unilaterally modify the terms of the Contract by incorporating terms onto Contractor’s order or fiscal forms or other documents forwarded by Contractor for payment. The Department’s acceptance of Service or processing of documentation on forms furnished by Contractor for approval or payment will not constitute amendment to this Contract or waiver of a default.

Department’s Right to Suspend Work

The Department may in its sole discretion suspend any or all Services under the Contract, at any time, when in the best interests of the Department to do so. The Department will provide Contractor written Notice outlining the particulars of suspension. Examples of the reason for

Revised Attachment E: Draft Contract Page 10 of 36 suspension include, but are not limited to, budgetary constraints, declaration of emergency or other like circumstances. After receiving a suspension Notice, the Contractor will comply with the Notice.

Department’s Obligation to Supply Data to Contractor The Department shall supply all eligibility and personnel data and information necessary for Contractor to provide the Services.

Bills for Travel Bills for travel expenses are not permitted under this Contract.

Payments The Contractor agrees to perform all Services for the compensation and financial arrangements set forth in Attachment 3: Cost Reply/Price Sheet. No additional compensation will be allowed.

Specific Appropriation The State of Florida’s performance and obligation to pay under this Contract is contingent upon an annual appropriation by the Legislature. The following is the specific state funds from which the state will make payment under the Contract:

Self-Insured HMOs - 2022-23 GAA Line item(s) # 2850 - Special Categories: Administrative Services Only Contract for Health Insurance from State Employees Health Insurance Trust Fund:

72 7275 73 2 668003 72750200 00, Appropriation Category Code: 101520, Organization Code:

7275 02 00 802. Budget Entity – 72750200, Fund – 2668.

Fully Insured HMO - State Employees’ Health Insurance Trust Fund: 72 7275 73 2 668003 72750200 00, Appropriation Category: Payments to HMOs, Category Code: 310340, Organization Code: 72750200805, Budget Entity – 72750200, Fund – 2668

3.10 Non-Exclusive Contract

Nothing herein is intended to assure the Contractor that it is the only vendor providing these Services to the State, nor does it prohibit the State from procuring these services from additional vendors during the term of the Contract.

Ownership of Deliverables and Retention of Records All Deliverables, papers, documents, materials, work, and other items prepared by the Contractor and provided to the State for purposes of the Contract are the property of the Department and shall be available to the Department at any time. The Department has the right to use the same without restriction and without payments to Contractor other than that specifically provided by the Contract. Data deemed proprietary, trade secret or confidential shall be subject to compliance with Florida Statutes and federal laws and regulations.

Contractor shall retain sufficient documentation to substantiate Claims for payment under this Contract, and all other records, electronic files, papers, and documents, which were made for purposes of the Contract. Such records shall include magnetic tapes, CD-ROM, diskettes, or other

Revised Attachment E: Draft Contract Page 11 of 36 electronic media files maintained by the Contractor directly relating to the Services, including file labels, complete file layouts, data element descriptions and detailed processing logic to assist the Department auditor in processing or utilizing files. Contractor shall retain all such records, papers, and documentation in compliance with record retention schedules published by the State of Florida Department of State.

Contractor Obligations General

Contractor will provide any and all labor, materials and supplies necessary to perform the Services in the manner prescribed by this Contract. The Contractor will meet or exceed the Minimum Service Requirements set forth in Attachment 2:

Performance Guarantees.

Major Organizational Changes The Parties agree that in order for efficient and effective communication to occur, clear lines of authority and areas of responsibility need to be identified for each Party. Each Party agrees to promptly notify the other in the event of any material change in personnel, address, or phone number.

The Contractor recognizes and agrees that award of the Contract was predicated upon features of Contractor’s business organization as represented by the Contractor in its response to the ITN. A transfer or sale fifty percent (50%) or more of Contractor’s equity interests (whether in a single transaction or series of transactions), or a sale of substantially all of Contractor’s assets shall constitute an impermissible assignment subject to the provisions of section 10.2.

Subcontractors Contractor is responsible for the acts or omissions of all Subcontractors, if any, it uses in the provision of the Services during the term of the Contract. The Department will have no liability of any kind for Subcontractor demands, loss, damage, negligence, or any expense relating, directly or indirectly, to Subcontractors.

Contractor will not subcontract any of the Services or enter into any subcontracts or change approved Subcontractors as listed in Attachment 6: List of Department approved Subcontractors (including their key personnel and/or location of processes for the Services) without providing the Department prior Notice of at least sixty (60) Calendar Days or, in case of an emergency, as soon as practicable and receiving approval from the Department. Each approved Subcontractor will be subject to the same terms and conditions as outlined in this Contract.

Background Screening and Record Retention All of Contractor’s employees, Subcontractors and agents performing work under the Contract must comply with all security and administrative requirements of the Department.

Background Screening In addition to any background screening required by the Contractor as a condition of employment, the Contractor warrants that it will conduct a criminal background screening of, or ensure that such a screening is conducted for each of its employees, Subcontractor personnel, independent contractors, leased

Revised Attachment E: Draft Contract Page 12 of 36 employees, volunteers, licensees, or other person, hereinafter referred to as “Person” or “Persons,” operating under their direction who directly perform services under the Contract, whether or not the Person has access to State of Florida Data, as well as those who have access, including indirect access, to State of Florida Data, whether or not they perform services under the Contract. The Contractor represents and warrants that all Persons will have passed the background screening described herein prior to, but no longer than five (5) years before, they gain access to State of Florida Data or begin performing services under the Contract. The look-back period for such background screenings shall be for a minimum of six (6) years where six (6) years of historical information is available.

“Access” means to review, inspect, access, approach, instruct, communicate with, store data in, retrieve data from, transmit, or otherwise make use of any data, regardless of type, form, or nature of storage or the ability to review, inspect, approach, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any data, regardless of type, form, or nature of storage. Access to a computer system or network includes local and remote access.

“Data” or “State of Florida Data” is as defined in section 1 of this Contract.

The minimum background check process must include a check of the following databases through a law enforcement agency or a Professional Background Screener accredited by the National Association of Professional Background Screeners, the National Committee for Quality Assurance, or a comparable standard:

• Social Security Number Trace; and

• Criminal Records (Federal, State and County criminal felony and misdemeanor, national criminal database for all states which make such data available).

The Contractor agrees that each Person has been screened as a prior condition for performing services under the Contract or having access to State of Florida Data.

The Contractor is responsible for any and all costs and expenses in obtaining and maintaining the criminal background screening information for each Person described above. The Contractor will maintain, or cause to be maintained, documentation of the screening in the Person’s employment file. The Contractor will abide by all applicable laws, rules, and regulations including, but not limited to, the Fair Credit Reporting Act and/or any equal opportunity laws, rules, regulations, or ordinances. The Department may require the Contractor to exclude the Contractor’s employees, agents, representatives, or Subcontractors based on the background check results.

The Department may refuse access to, or require replacement of, any Contractor, employee, Subcontractor, or Subcontractor employee, or agent for cause, including, but not limited to, technical or training qualifications, quality of work, change in security status, or non-compliance with the Department’s security or other requirements. Such approval shall not relieve the Contractor of its obligation

Revised Attachment E: Draft Contract Page 13 of 36 to perform all work in compliance with the Contract. The Department may reject and bar from any facility for cause any of the Contractor’s employees, subcontractors, or agents.

Disqualifying Offenses

If at any time it is determined that a Person has a criminal misdemeanor or felony record regardless of adjudication (e.g., adjudication withheld, a plea of guilty or nolo contendere, or a guilty verdict) within the last six (6) years from the date of the court’s determination for the crimes listed below, or their equivalent in any jurisdiction, the Contractor is required to immediately remove that Person from any position with Access to State of Florida Data or directly performing services under the Contract. The disqualifying offenses are:

(a) Computer-related crimes;

(b) Information technology crimes;

(c) Fraudulent practices;

(d) False pretenses;

(e) Frauds;

(f) Credit card crimes;

(g) Forgery;

(h) Counterfeiting;

(i) Violations involving checks or drafts;

(j) Misuse of medical or personnel records;

(k) Felony theft; and

(l) Identity Theft.

If the Contractor finds a Disqualifying Offense for a Person within the last six (6) years from the date of the court’s disposition, it may obtain information regarding the incident and determine whether that Person should continue providing Services under the Contract or have Access to State of Florida Data. The Contractor will consider the following factors only in making the determination: i.)

nature and gravity of the offense, ii.) the amount of time that lapsed since the offense, iii.) the rehabilitation efforts of the person and iv.) relevancy of the offense to the job duties of the Person. If the Contractor determines that the Person should be allowed Access to State of Florida Data, then Contractor shall maintain all criminal background screening information and the rationale for such Access in the Person’s employment file.

The Contractor shall require all Persons to self-report within three (3) Business Days of adjudication to the Contractor any adjudication of guilt as described above for the Disqualifying Offenses. The Contractor shall immediately disallow that Person Access to any State of Florida Data or from directly performing Services under the Contract. Additionally, the Contractor shall require that the Person complete an annual certification that he or she has not received an adjudication of guilt as described above for the Disqualifying Offenses and shall maintain that certification in the employment file.

Refresh Screening

Revised Attachment E: Draft Contract Page 14 of 36

The Contractor will ensure that all background screening will be refreshed every five (5) years from the time initially performed for each Person during the term of the Contract.

Department’s Ability to Audit Screening Compliance and Inspect Locations

The Department reserves the right to audit the Contractor’s background screening process upon two (2) days prior written Notice to the Contractor during the term of the Contract. Department will have the right to inspect the Contractor’s working area, computer systems, and/or location upon two (2) Business Days prior written notice to the Contractor to ensure that Access to the State of Florida Data is secure and in compliance with the Contract and all applicable state and federal rules and regulations.

Record Retention The Contractor shall retain a list of all Persons with Access to State of Florida Data, including a statement confirming that each Person has passed the Background Screening required herein. Such a statement shall not include the substance of the screening results, only that the Person has passed the screening.

The Contractor shall create a written policy for the protection of State of Florida Data, including a policy and procedure for Access to State of Florida Data.

The Contractor shall document and record, with respect to each instance of Access to State of Florida Data:

1) The identity of all individual(s) who Accessed State of Florida Data in any way, whether those individuals are authorized Persons or not;

2) The duration of the individual(s)’ Access to State of Florida Data, including the time and date at which the Access began and ended;

3) The identity, form, and extent of State of Florida Data accessed, including, but not limited to, whether the individual Accessed partial or redacted versions of State of Florida Data, read-only versions of State of Florida Data, or editable versions of State of Florida Data; and

4) The nature of the Access to State of Florida Data, including whether State of Florida Data was edited or shared with any other individual or entity during the duration of the Access, and, if so, the identity of the individual or entity.

The Contractor shall retain the written policy and information required in this subsection for the duration of this Contract and a period of no less than five

(5) years from the date of termination of this Contract and any Contract extensions. The written policy and information required in this subsection shall be included in the Department’s audit and screening abilities as defined in subsection 4.2.4 of this Contract. The written policy and information required in this subsection shall also be subject to immediate disclosure upon written or oral demand at any time by the Department or its designated agents or auditors.

Failure to compile, retain, and disclose the written policy and information as required in this subsection shall be considered a breach of the Contract. The

Revised Attachment E: Draft Contract Page 15 of 36 resulting damages to the Department from a breach of this subsection are by their nature impossible to ascertain presently and will be difficult to ascertain in the future. The issues involved in determining such damages will be numerous, complex, and unreasonably burdensome to prove. The Parties acknowledge that these financial consequences are liquidated damages, exclusive of any other right to damages, not intended to be a penalty, and solely intended to compensate for unknown and unascertainable damages.

The Contractor therefore agrees to credit the Department the sum of $10,000 per event, for each breach of this subsection.

Data Security

Work Locations, No Offshoring of Data Contractor, including its employees, Subcontractors, Subcontractor personnel, independent contractors, leased employees, volunteers, licensees, or other persons operating under their direction, are prohibited from (i) performing any of the Services under the Contract outside of the U.S., or (ii) sending, transmitting, or accessing any State of Florida Data outside of the U.S. The Parties agree that a violation of this provision will:

(a) result in immediate and irreparable harm to the Department, entitling the

Department to immediate injunctive relief, provided, however, this shall not constitute an admission by the Contractor to any liability for damages under subsection (c) below or any claims, liability, or damages to a third party, and is without prejudice to the Contractor in defending such claims.

(b) entitle the Department to a credit of $50,000 per violation, with a cumulative total cap of $500,000 per event. This credit is intended only to cover the Department’s internal staffing and administrative costs of investigations and audits of the transmittal of State of Florida Data outside the U.S.

(c) entitle the Department to recover damages, if any, arising from a breach of this subsection and beyond those covered under subsection (b).

The credits in subsection (b) are a reasonable approximation of the internal costs for investigations and audits from a violation. The credits are in the nature of liquidated damages and not intended to be a penalty on the Contractor. By executing this Contract, Contractor acknowledges and agrees the costs intended to be covered by subsection (b) are not readily ascertainable and will be difficult to prove. Contractor agrees that it will not argue, and is estopped from arguing, that such costs are a penalty or otherwise unenforceable. For purposes of determining the amount of credits due hereunder, a group of violations relating to a common set of operative facts (e.g., same location, same time period, same off-shore entity) shall be treated as a single violation. The credits will be applied against the monthly invoices submitted by the Contractor, and are exclusive of any other right to damages.

Contractor’s Responsibility to Notify Department for a Breach

For purposes of subsection 4.2.5.3 of this Contract, the following definitions apply:

Revised Attachment E: Draft Contract Page 16 of 36

“Breach” means a confirmed event that compromises the confidentiality, integrity, or availability of information or State of Florida Data, or unauthorized access of State of Florida Data in electronic form containing personal information. Additional requirements related to breaches of HIPAA information are covered in Attachment 8: Privacy, Security, and Confidentiality Business Associate Agreement.

“Incident” means a violation or imminent threat of violation, whether such violation is accidental or deliberate, of information technology security policies, acceptable use policies, or standard security practices. An imminent threat of violation refers to a situation in which the state agency has a factual basis for believing that a specific incident is about to occur.

Notice of Breach Notwithstanding any provision of this Contract to the contrary, the Contractor shall notify the Department as soon as possible and in all events immediately upon discovering any Breach or Incident regarding State of Florida Data; any unauthorized access of State of Florida Data (even by persons or companies with authorized access for other purposes); any unauthorized transmission of State of Florida Data; or any credible allegation or suspicion of a material violation of the above. This notification is required whether the event affects one Member or the entire population. The notification shall be clear and conspicuous and include a description of the following:

(a) The Breach or Incident in general terms.

(b) The type of personal information that was subject to the unauthorized Access and acquisition.

(c) The number of individuals who were, or potentially have been, affected by the Breach or Incident.

(d) The actions taken by the Contractor to protect the State of Florida Data information from further unauthorized Access. However, the description of those actions in the written notice may be general so as not to further increase the risk or severity of the Breach.

Upon becoming aware of an alleged Breach or Incident, the Contractor shall set up a conference call (via a telephone call and email) with the Department’s Contract Manager and any necessary parties. The conference call invitation shall contain a brief description of the nature of the event. When possible, a thirty (30) minute notice shall be given to allow Department personnel to be available for the call. If the designated time is not practical for the Department, an alternate time for the call shall be scheduled. All available information shall be shared on the call. The Contractor shall answer all questions based on the information known at that time and shall answer additional questions as additional information becomes known. The Contractor shall provide the Department with final documentation of the incident including all actions that took place. If the Contractor becomes aware of a Breach or Incident outside of normal business hours, the Contractor shall

Revised Attachment E: Draft Contract Page 17 of 36 notify the Department’s Contract Manager as soon as possible, and in all events, within twenty-four (24) hours.

The Contractor’s failure to perform the obligations in this subsection shall also be an Event of Default, and will entitle the Department to recover any other damages it incurs arising from a failure to perform the obligations in this subsection (including any actual out-of-pocket expenses incurred by the Department to investigate and remediate the violation) and/or to pursue injunctive relief.

Contractor’s Responsibility to Notify Members The Contractor shall, at Contractor’s sole expense, notify all Members whose State of Florida Data was accessed by any Breach, unauthorized access or transmission is determined by the Department to have been caused by the Contractor or its Subcontractors no later than thirty (30) Calendar Days after the determination of a Breach or reason to believe a Breach occurred. If the Contractor cannot identify the specific persons whose data may have been accessed, such notice shall be provided to all persons whose data reasonably may have been accessed. The Department shall pay all costs to notify such persons related to any Breach determined by the Department to not have been caused by the Contractor or its Subcontractors. Nothing in this subsection will alter or replace the application of section 501.171, Florida Statutes, as to the Contractor’s obligations and liability for Breaches concerning confidential personal information.

Credit Monitoring and Notification The Contractor shall include credit monitoring services at its own cost for those Members affected or potentially affected by an alleged Breach for no less than a period of one (1) year following the Breach.

The Contractor shall provide the Department of Legal Affairs written notice of a Breach that affects 500 or more Members as soon as practicable, but not later than thirty (30) Calendar Days after the determination of the Breach or reason to believe a Breach has occurred. The Contractor shall provide the Department a copy of the written notice to the Department of Legal Affairs. If a Breach impacts more than 1,000 Members at a single time, the Contractor shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in the Fair Credit Reporting Act, 15 U.S. Code Section 1681a (p), of the timing, distribution, and content of the notices required pursuant to Contract subsections 4.2.5.2 (“Contractor’s Responsibility to Notify Department”) and

4.2.5.3.1 (“Contractor’s Responsibility to Notify Members”) of this Contract.

Duty to Provide Secure Data

The Contractor will maintain the security of State of Florida Data including, but not limited to, a secure area around any display of such State of Florida Data or State of Florida Data that is otherwise visible. The Contractor will also comply with all state and federal rules and regulations, as well as industry standards, related to security of information and cybersecurity . This includes, but is not limited to, Revised Attachment E: Draft Contract Page 18 of 36

Chapter 282, F.S., Rule Chapter 60GG-2, F.A.C., and all requirements set forth in the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act of 2009, and their implementing regulations, as amended. The Contractor agrees to cooperate with the Department and perform all actions necessary to assist with all tasks in furtherance of the Department’s efforts to comply with the obligations under Chapters 60FF and 60GG of the Florida Administrative Code, as applicable. State of Florida Data cannot be disclosed to any person or entity that is not directly approved to participate in this Contract.

Loss of Data

In the event of loss of any State of Florida Data or record where such loss is due to the negligence of Contractor or any of its Subcontractors or agents, Contractor shall be fully responsible for recreating such lost State of Florida Data in the manner and on the schedule set by the Department, in addition to any other damages the Department may be entitled to by law or this Contract. Contractor shall bear the full cost for recreating any lost State of Florida Data and will not be entitled to any compensation by the Department for those costs. This subsection shall survive termination of this Contract.

E-Verify The Contractor (and its subcontractors) have an obligation to utilize the U.S.

Department of Homeland Security’s (DHS) E-Verify system for all newly hired employees. By executing this Contract, the Contractor certifies that it is registered with, and uses, the E-Verify system for all newly hired employees. The Contractor must obtain an affidavit from its subcontractors in accordance with paragraph (2)(b) of section 448.095, Florida Statutes, and maintain a copy of such affidavit for the duration of the Contract. In order to implement this provision, the Contractor shall provide a copy of its DHS Memorandum of Understanding (MOU) to the Contract Manager within five (5) days of Contract execution.

This section serves as notice to the Contractor regarding the requirements of section 448.095, Florida Statutes, specifically sub-paragraph (2)(c)1, and the Department’s obligation to terminate the Contract if it has a good faith belief that the Contractor has knowingly violated section 448.09(1), Florida Statutes. If terminated for such reason, the Contractor will not be eligible for award of a public contract for at least one year after the date of such termination. The Department reserves the right to order the immediate termination of any contract between the Contractor and a subcontractor performing work on its behalf should the Department develop a good faith belief that the subcontractor has knowingly violated section 448.09(1), Florida Statutes.

Scrutinized Companies – Termination by the Department The Department may, at its option, terminate the Contract if the Contractor is found to have submitted a false certification as provided under subsection 287.135(5), Revised Attachment E: Draft Contract Page 19 of 36

F.S., or been placed on the Scrutinized Companies with Activities in Sudan List or the Scrutinized Companies with Activities in the Iran Petroleum Energy Sector List, or been engaged in business operations in Cuba or Syria, or to have been placed on the Scrutinized Companies that Boycott Israel List or is engaged in a boycott of Israel.

Employment of State Workers

During the term of the Contract, Contractor shall not knowingly employ, subcontract with or sub-grant to any person (including any non-governmental entity in which such person has any employment or other material interest as defined by section 112.312(15), Florida Statutes) who is employed by the State or who has participated in the performance or procurement of this Contract, except as provided in section 112.3185, Florida Statutes.

Acceptance of Deliverables The Department will conduct its acceptance review in a manner so as to identify whether the Deliverables fail to conform to the Contract. The Department shall notify the Contractor in writing of failures of a Deliverable to conform to the Contract and specify how the Deliverable failed to meet the requirements of the Contract. Within five (5) Business Days of such notice, Contractor will give written notice of one of the following:

• The correction of the nonconformity and the details of the correction;

• A written corrective action plan for correcting the nonconformity; or

• Its disagreement as to the nature or scope of the nonconformity and the reasons therefore.

The Department will either accept or reject the Contractor’s reply (with or without modifications from the Department) and provide notice of the Department’s decision and proposed remedy, if any.

Warranty Generally. Contractor warrants that the Services shall be delivered in a professional workman-like manner in accordance with the standards and quality prevailing among first-rate nationally recognized firms in the industry and in accordance with this Contract and this warranty will remain in effect for a period of three hundred, sixty-five (365) Calendar Days following delivery of the Services (“Warranty Period”).

Remedies. In the event that the Department discovers that the Services are not delivered in accordance with the foregoing warranties during the Warranty Period, the Department will provide Notice to the Contractor, and the Contractor will promptly correct, cure, replace or otherwise remedy such performance at no cost to the Department.

This subsection 4.4 (Warranty) shall survive termination of this Contract.

The Department has the right to conduct performance and/or compliance audits of any and all areas of the Contractor and/or Subcontractors activities related to this Contract. The Department may at any time enter and inspect the Contractor’s physical facilities where operations required under this Contract are performed, within reasonable notice. Except in emergency situations, reasonable notice will be provided for audits conducted at Contractor’s premises, which notice will not be less than 10 (ten) Business Days. Audits may include, but not be limited to, audits of procedures, computer systems, claims files, provider contracts, service records, accounting records, internal audits, quality control assessments, and any and all applicable provider contracts, including

Revised Attachment E: Draft Contract Page 20 of 36 contracts with pharmaceutical manufacturers, and service programs related to this Contract.

Contractor will cooperate and work with any representatives selected by the Department to conduct said audits and inspections, including but not limited to, other state agencies. The Contractor will make available all data and information requested by the Department in furtherance of any audit.

Prior to the commencement of this audit, the Contractor may request to enter into a mutually agreeable confidentiality agreement with any third-party auditor. However, no such agreement shall limit the Department’s access to this audit report or any other document, and must be consistent with section 10.4 of this Contract, Article 1, section 24 of the Florida Constitution, and Chapter 119, Florida Statutes.

The Contractor recognizes and acknowledges that release statements from its healthcare providers are not required for the Department or its designee to conduct compliance and performance audits on any of the Contractor’s contracts relating to this Contract.

The right of the Department to perform audits and inspections will survive the expiration or termination of this Contract. The Department will use reasonable efforts to minimize the number and duration of such audits or inspections conducted and to conduct such audits and inspections in a manner that minimizes disruption to Contractor's business operations.

This provision does not operate to limit the rights of the Inspector General (as required by section 20.055, Florida Statutes) or other state agencies or officers, such as the state’s Chief Financial Officer and the Office of the Auditor General, to perform audits and inspections. Contractor shall be responsible for any taxes or any other liabilities imposed as a result of such audits and inspections.

The Department will be responsible for the independent third-party auditor costs associated with any audit performed on the Department’s behalf.

Any disputes regarding the audit findings of the Department or its designated auditor shall be resolved in accordance with section 10.7 (Dispute Resolution, Governing Law and Venue) of this

It is the policy of the State that Minority Business Enterprises, Woman-Owned Business Enterprises, and Service-Disabled Veteran Business Enterprises (as those terms are defined by Florida Statutes), have the maximum practicable opportunity to participate in performing contracts let by any State agency. Contractor will carry out this policy in the awarding of subcontracts to the fullest extent consistent with efficient Contract performance by reasonably considering such business enterprises as Subcontractors for the Services. Contractor further agrees to comply with all controlling laws and regulations respecting the participation of such business enterprises in the provision of the Services and to reasonably cooperate in any studies or surveys as may be conducted by the State to determine the extent of Contractor’s compliance with this section.

Generally Time is of the essence in performing the Contract; this is true generally and particularly with respect to providing Services on the Effective Date and meeting the Performance Guarantees.

Contractor acknowledges that untimely performance or other material noncompliance will damage the Department, but by their nature such damages are impossible to ascertain presently and will be difficult to ascertain in the future. The issues involved in determining the amount of damages will be multiple and complex, and will be dependent on many and variant factors, proof of which would be burdensome and require lengthy and expensive litigation, which the Parties

Revised Attachment E: Draft Contract Page 21 of 36 desire to avoid. Accordingly, the Parties agree that it is in the Parties’ best interests to agree upon a reasonable amount of liquidated damages, which are not intended to be a penalty and are solely intended to compensate for unknown and unascertainable damages. The Parties acknowledge that liquidated damages are contemplated and required by subsection 110.123(3)(d)3, Florida Statutes.

Implementation Delays Untimely Implementation of Services. If Contractor fails to meet deadlines set forth in the Department approved Implementation Plan, it shall pay liquidated damages of $10,000 per Calendar Day, for each unmet deadline, unless any such delay is due to the Department’s failure to comply with the defined timeline. Contractor will pay this amount of liquidated damages for every full or partial Calendar Day until a deadline set forth in the Department approved Implementation Plan has been met.

Failure to Meet Performance Guarantees

a. Contractor agrees to payment of liquidated damages if it fails to meet the…