RFP 26-86378 - Att B - Sample Contract.docx

PROFESSIONAL SERVICES CONTRACT

Contract # This Contract ("Contract"), entered into by and between (the "State") and (the "Contractor"), is executed pursuant to the terms and conditions set forth herein. In consideration of those mutual undertakings and covenants, the parties agree as follows:

1. Duties of Contractor.

The Contractor shall provide the services relative to this Contract set forth in EXHIBIT 1 -- Statement of Work, attached hereto and incorporated herein by reference (collectively, the "Services").

Time is of the essence in connection with the performance of the Services.

2. Consideration.

The Contractor will be paid at the rate described in EXHIBIT 2 -- Budget, attached hereto and incorporated herein by reference, for performing the duties set forth above. Total remuneration under this Contract shall not exceed $[CONTRACT_MAX_AMT].

3. Term.

This Contract shall be effective for a period of ____________. It shall commence on [CONTRACT_START_DATE] (the "Effective Date") and shall remain in effect through [CONTRACT_END_DATE]. (collectively, the "Term").

4. Access to Records.

The Contractor and its subcontractors, if any, shall maintain all books, documents, papers, accounting records, and other evidence pertaining to all costs incurred under this Contract. They shall make such materials available at their respective offices at all reasonable times during this Contract, and for three (3) years from the date of final payment under this Contract, for inspection by the State or its authorized designees. Copies shall be furnished at no cost to the State if requested.

5. Assignment; Successors.

The Contractor binds its successors and assignees to all the terms and conditions of this Contract. The Contractor may assign its right to receive payments to such third parties as the Contractor may desire without the prior written consent of the State, provided that the Contractor gives written notice (including evidence of such assignment) to the State thirty (30) days in advance of any payment so assigned. The assignment shall cover all unpaid amounts under this Contract and shall not be made to more than one party.

The Contractor shall not assign or subcontract the whole or any part of this Contract without the State's prior written consent. Additionally, the Contractor shall provide prompt written notice to the State of any change in the Contractor's legal name or legal status so that the changes may be documented and payments to the successor entity may be made.

6. Assignment of Antitrust Claims.

As part of the consideration for the award of this Contract, the Contractor assigns to the State all right, title and interest in and to any claims the Contractor now has, or may acquire, under state or federal antitrust laws relating to the products or services which are the subject of this Contract.

7. Audits.

The Contractor acknowledges that it may be required to submit to an audit of funds paid through this Contract. Any such audit shall be conducted in accordance with IC § 5-11-1, et seq., and audit guidelines specified by the State.

The State considers the Contractor to be a "Contractor" under 2 C.F.R. 200.331 for purposes of this Contract. However, if it is determined that the Contractor is a "subrecipient" and if required by applicable provisions of 2 C.F.R. 200 (Uniform Administrative Requirements, Cost Principles, and Audit Requirements), Contractor shall arrange for a financial and compliance audit, which complies with 2 C.F.R. 200.500 et seq.

8. Authority to Bind Contractor.

The signatory for the Contractor represents that he/she has been duly authorized to execute this Contract on behalf of the Contractor and has obtained all necessary or applicable approvals to make this Contract fully binding upon the Contractor when his/her signature is affixed, and accepted by the State.

9. Changes in Work.

The Contractor shall not commence any additional work or change the scope of the work until authorized in writing by the State. The Contractor shall make no claim for additional compensation in the absence of a prior written approval and amendment executed by all signatories hereto. This Contract may only be amended, supplemented or modified by a written document executed in the same manner as this Contract.

10. Compliance with Laws.

The Contractor shall comply with all applicable federal, state, and local laws, rules, regulations, and ordinances, and all provisions required thereby to be included herein are hereby incorporated by reference. The enactment or modification of any applicable state or federal statute or the promulgation of rules or regulations thereunder after execution of this Contract shall be reviewed by the State and the Contractor to determine whether the provisions of this Contract require formal modification.

The Contractor and its agents shall abide by all ethical requirements that apply to persons who have a business relationship with the State as set forth in IC § 4-2-6, et seq., IC § 4-2-7, et seq. and the regulations promulgated thereunder. If the Contractor has knowledge, or would have acquired knowledge with reasonable inquiry, that a state officer, employee, or special state appointee, as those terms are defined in IC § 4-2-6-1, has a financial interest in the Contract, the Contractor shall ensure compliance with the disclosure requirements in IC § 4-2-6-10.5 prior to the execution of this Contract. If the Contractor is not familiar with these ethical requirements, the Contractor should refer any questions to the Indiana State Ethics Commission, or visit the Inspector General's website at http://www.in.gov/ig/. If the Contractor or its agents violate any applicable ethical standards, the State may, in its sole discretion, terminate this Contract immediately upon notice to the Contractor. In addition, the Contractor may be subject to penalties under IC §§ 4-2-6, 4-2-7, 35-44.1-1-4, and under any other applicable laws.

The Contractor certifies by entering into this Contract that neither it nor its principal(s) is presently in arrears in payment of taxes, permit fees or other statutory, regulatory or judicially required payments to the State of Indiana. The Contractor agrees that any payments currently due to the State of Indiana may be withheld from payments due to the Contractor. Additionally, further work or payments may be withheld, delayed, or denied and/or this Contract suspended until the Contractor is current in its payments and has submitted proof of such payment to the State.

The Contractor warrants that it has no current, pending or outstanding criminal, civil, or enforcement actions initiated by the State, and agrees that it will immediately notify the State of any such actions. During the term of such actions, the Contractor agrees that the State may delay, withhold, or deny work under any supplement, amendment, change order or other contractual device issued pursuant to this Contract.

Pursuant to IC § 5-22-3-1, the State and the Contractor shall act in good faith in connection with the performance or administration of or any negotiations undertaken in accordance with or with respect to this Contract.

The Contractor warrants that the Contractor and its subcontractors, if any, shall obtain and maintain all required permits, licenses, registrations, and approvals, and shall comply with all health, safety, and environmental statutes, rules, or regulations in the performance of work activities for the State. Failure to do so may be deemed a material breach of this Contract and grounds for immediate termination and denial of further work with the State.

The Contractor affirms that, if it is an entity described in IC Title 23, it is properly registered and owes no outstanding reports to the Indiana Secretary of State.

As required by IC § 5-22-3-7:

The Contractor and any principals of the Contractor certify that:

the Contractor, except for de minimis and nonsystematic violations, has not violated the terms of:

IC §24-4.7 [Telephone Solicitation Of Consumers];

IC §24-5-12 [Telephone Solicitations]; or

IC §24-5-14 [Regulation of Automatic Dialing Machines];

in the previous three hundred sixty-five (365) days, even if IC § 24-4.7 is preempted by federal law; and the Contractor will not violate the terms of IC § 24-4.7 for the duration of the Contract, even if IC §24-4.7 is preempted by federal law.

The Contractor and any principals of the Contractor certify that an affiliate or principal of the Contractor and any agent acting on behalf of the Contractor or on behalf of an affiliate or principal of the Contractor, except for de minimis and nonsystematic violations, has not violated the terms of IC § 24-4.7 in the previous three hundred sixty-five (365) days, even if IC §24-4.7 is preempted by federal law; and will not violate the terms of IC § 24-4.7 for the duration of the Contract, even if IC §24-4.7 is preempted by federal law.

Executive Order 25-64:

The Company warrants that the Company, and (if applicable) any of its holding companies, affiliates, or subsidiaries, is not:

listed in Section 889 of the 2019 National Defense Authorization Act;

listed in Section 1260H of the 2021 National Defense Authorization Act;

owned by the government of a country, or controlled by any governing or regulatory body located in a country, on the United States Department of Commerce's foreign adversaries list under 15 C.F.R. 791.4; or included on or controlled by an entity on the Specially Designated Nationals list maintained by the United States Department of the Treasury's Office of Foreign Asset Control.

In accordance with Executive Order 25-64, if the State determines that the Contractor has been added to any list or designation set forth in clauses (1) through (4) in subparagraph I.i above, after entering this Contract, the State shall investigate the reasons the Contractor was added to any such list or designation. Depending upon the outcome of such investigation, the State may be required to terminate this Contract and/or dispose of any of the goods or cease the use of any of the goods or services procured under this Contract. In addition, the State shall not be required to pay for any goods or services tendered or provided under this Contract to the Contractor on or after the date the Contractor is added to any such list or designation.

11. Condition of Payment.

All services provided by the Contractor under this Contract must be performed to the State's reasonable satisfaction, as determined at the discretion of the undersigned State representative and in accordance with all applicable federal, state, local laws, ordinances, rules and regulations. The State shall not be required to pay for work found to be unsatisfactory, inconsistent with this Contract or performed in violation of any federal, state or local statute, ordinance, rule or regulation.

12. Confidentiality of State Information.

Definitions.

Personally Identifiable Information ("PII") means personal information as collectively defined in IC-4-1-6-1 and IC 4-1-11-2 and under the National Institute of Standards and Technology ("NIST") Special Publication 800-122, regardless of form (oral, written, electronic, or otherwise). As used here, PII includes PHI, SSA-data, and ACA-PII (as defined herein) as applicable, whether or not separately stated.

Data Breach means the loss of control, compromise, unauthorized disclosure, unauthorized access or acquisition, or any similar occurrence where: a person other than an authorized user accesses or potentially accesses PII or other confidential information; or an authorized user accesses PII or other confidential information for other than an authorized purpose.

Security Incident means an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the information system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.

Confidential Information means information that is not publicly available under State or Federal laws, regulations, administrative code or rules, or as otherwise deemed confidential by the State.

FedRAMP means the Federal Risk and Authorization Management Program.

Terms used, but otherwise not defined in this Contract shall have the same meaning as those found in 45 CFR Parts 160, 162, and 164, and 45 CFR Subtitle A.

"HIPAA" means the Health Insurance Portability and Accountability Act of 1996 (sections 1171 through 1179 of the Social Security Act), including any subsequent amendments to such Act.

"HIPAA Rules" mean the rules adopted by and promulgated by the US Department of Health and Human services ("HHS") under HIPAA and other relevant Federal laws currently in force or subsequently made, such as the Health Information Technology for Economic and Clinical Heath Act ("HITECH"), as enumerated under 45 CFR Parts 160, 162, and 164, including without limitation any and all additional or modified regulations thereof. Subsets of the HIPAA Rules include:

"HIPAA Enforcement Rule" as defined in 45 CFR Part 160;

"HIPAA Security Rule" as defined in 45 CFR Part 164, Subparts A and C;

"HIPAA Breach Rule" as defined in 45 CFR Part 164, Subparts A and D; and

"HIPAA Privacy Rule" as defined in 45 CFR Part 164, Subparts A and E.

If Contractor's services under this Contract includes State authorized access to and use of PHI on the State's behalf then Contractor is hereby deemed a Business Associate to the State and, as such, Contractor is hereby authorized by the State to create, receive, maintain, use, and/or transmit Protected Health Information ("PHI") on the State's behalf pursuant to and consistent with the services performed by Contractor under this Contract.

Contractor is hereby authorized by the State to create, receive, maintain, use and/or transmit PII on the State's behalf pursuant to and consistent with the services performed by Contractor under this Contract. As used here, PII includes PHI, SSA-data, and ACA PII (as defined herein) as applicable, whether or not separately stated.

Contractor understands that pursuant to and consistent with the services performed by Contractor under this Contract, Contractor may be permitted authorized access to data obtained by the State from the Social Security Administration ("SSA-data"). In this regard and to the extent that Contractor is permitted authorized access and use of SSA-data:

Contractor agrees that it will comply with the provisions of the Computer Matching and Privacy Protection Act Agreement ("CMPPA") and the Information Exchange Agreement ("IEA") executed between the Social Security Administration ("SSA") and the State; these agreements are incorporated herein by reference and current copies of the CMPPA and IEA are attached to this Contract;

Contractor further agrees that it will abide by all relevant Federal laws and restrictions on access, use, and disclosure of SSA-data, including the security requirements enumerated in the CMPPA and IEA;

Contractor understands that its access, use, or disclosure of SSA-data in a manner or purpose not authorized by the CMPPA or IEA may subject Contractor, including Contractor's employees, agents, and subcontractors, to civil and criminal sanctions pursuant to applicable Federal statutes; and, Contractor understands that the State, in compliance with the CMPPA, will undertake a review of Contractor's compliance with Contractor's obligations under the CMPPA, IEA, and this Contract no less than triennially; Contractor agrees to fully cooperate with the State in such reviews. Such reviews may be undertaken by the State in addition to or as part of other reviews of Contractor's privacy and security policies, procedures, and practices undertaken by the State pursuant to this Contract.

Contractor agrees that as a Business Associate to the State it is obligated to comply with the HIPAA Rules, as such Rules apply to Business Associates, throughout the term of this Contract and thereafter as may be required by Federal law and such compliance will be at Contractor's sole expense. Further:

Contractor will not use or further disclose PHI or PII except as expressly permitted by this Contract or as required by law. It is further provided that nothing in this Contract shall be construed to permit Contractor use or disclose PHI in a manner that would violate the provisions of the HIPAA Privacy Rule as such Rule applies to the State with regard to the services performed by Contractor under this Contract or otherwise cause the State to be non-compliant with the HIPAA Privacy Rule.

Contractor understands it must fully comply with the HIPAA Security Rule and will employ appropriate and compliant safeguards to reasonably prevent the use or disclosure of PHI and PII other than as permitted by this Contract or required by the HIPAA Privacy Rule or other applicable Federal or state law or regulation. Such safeguards will be designed, implemented, operated, and managed by Contractor at Contractor's sole expense and following the Contractor's best professional judgment regarding such safeguards. Upon the State's reasonable request, Contractor will review such safeguards with the State.

Contractor understands that it is subject to the HIPAA Enforcement Rule under which Contractor may be subject to criminal and civil penalties for violations of and non-compliance with the HIPAA Rules.

Improper Disclosure, Security Incident, and Breach Notification.

As a Business Associate Contractor, it understands that it is subject to the HIPAA Breach Rule.

If a Security Incident occurs or if Contractor suspects that a Security Incident may have occurred with respect to PII in Contractor's safekeeping or as otherwise being legitimately used by Contractor in Contractor's performance of its services under this Contract:

Contractor shall notify the State of the Security Incident within twenty-four (24) hours of when Contractor discovered the Security Incident; such notification shall be made to the FSSA Privacy & Security Office in a manner reasonably prescribed by the FSSA Privacy & Security Officer and shall include as much detail as the Contractor reasonably may be able to acquire within the twenty-four (24) hour period.

For the purposes of such Security Incidents, "discovered" and "discovery" shall mean the first day on which such Security Incident is known to the Contractor or, by exercising reasonable diligence, would have been known to the Contractor. Regardless of whether the Contractor failed to exercise reasonable diligence, improperly delaying the notification of discovery beyond the twenty-four (24) hour requirement, the Contractor will notify the FSSA Privacy & Security Office within twenty-four (24) hours of gaining actual knowledge of a Security Incident.

In collaboration with the FSSA Privacy & Security Office, Contractor shall undertake all commercially reasonable efforts necessary to thoroughly investigate the Security Incident and to provide all results of such investigation to the FSSA Privacy & Security Office, including but not limited to Contractor personnel involved, source and cause of the Security Incident, specific information disclosed or possibly exposed, disclosure victims (those whose PII was disclosed or may have been disclosed or exposed to unauthorized access/use), disclosure recipients, supporting materials, actions taken to mitigate or stop the Security Incident, and similar details.

Contractor's investigation must be undertaken expeditiously and completed to the extent that a determination of whether a Breach has occurred can be reasonably made, including the identification of the victims or likely victims, within a reasonable timeframe as mutually agreed upon with the FSSA Privacy & Security Office, from the date of discovery of the Security Incident. Contractor shall provide details of its investigation to the FSSA Privacy & Security Office on an ongoing basis until the investigation is complete.

Contractor and the FSSA Privacy & Security Office will collaborate on the results of Contractor's investigation; the determination as to whether a Breach has occurred rests solely with the FSSA Privacy & Security Office.

If it is determined by the FSSA Privacy & Security Office that a Breach has occurred:

Contractor agrees that it shall be responsible for, including all costs with respect to, fulfilling the State's and/or Contractor's obligations for notice to all of the known and suspected victims of the Breach. Such notice shall comply with the HIPAA Breach Rule notification requirements and/or applicable notification requirements under State law or regulation.

Contractor further agrees that such notification will be made under its name, unless otherwise specified by the FSSA Privacy & Security Office. Contractor will coordinate its Breach notification efforts with the FSSA Privacy & Security Office; the FSSA Privacy & Security Office will approve Contractor's Breach notification procedures and plans, including the format and content of the notice(s) prior to such notification being made.

Contractor accepts full responsibility for the Breach and any resulting losses or damages incurred by the State or any victim of the Breach.

Contractor will undertake all commercially reasonable efforts necessary to mitigate any deleterious effects of the Breach for the known and suspected victims of the Breach.

The State, through the FSSA Privacy & Security Office, will make the appropriate notifications to HHS and/or the applicable Federal or State agencies with respect to the Breach, unless the Contractor is directed to do so by the FSSA Privacy & Security Office.

Contractor will undertake commercially reasonable corrective actions to eliminate or minimize to the greatest degree possible the opportunity for an identified Security Incident to reoccur and provide the FSSA Privacy & Security Office with its plans, status updates, and written certification of completion regarding such corrective actions.

If Contractor observes or otherwise becomes aware of a Security Incident or suspected Security Incident outside of Contractor's scope of responsibilities under this Contract (for example, affecting PII not in Contractor's safekeeping), Contractor agrees to promptly report such Security Incidents to the FSSA Privacy & Security Office and cooperate with the FSSA Privacy & Security Office's investigation of the Security Incident.

Subcontractors. Contractor agrees that in accordance with the HIPAA Privacy Rule, CMPPA, IEA, and 45 CFR §155.260 any subcontractors engaged by Contractor (in compliance with this Contract) that will create, receive, maintain, use or transmit State PII on Contractor's behalf will contractually agree to the same restrictions, conditions, and requirements that apply to Contractor with respect to such PII.

Access by Individuals to their PHI/PII. Contractor acknowledges that in accordance with the HIPAA Privacy Rule and 470 IAC 1-3-1, et seq, individuals for whom Contractor has direct possession of their PHI/PII on the State's behalf have the right to inspect and amend their PHI/PII, and have the right for an accounting of uses and disclosures of such PHI/PII, except as otherwise provided therein. Contractor shall provide such right of inspection, amendment, and accounting of disclosures to such individuals upon reasonable request by the State (or by such individuals if the State directly refers such individuals to Contractor). In situations in which Contractor does not have direct possession of such PHI/PII, then the State shall be responsible for such inspection, amendment, and accounting of disclosures rights by individuals.

Access to Records. Contractor shall make available to HHS and/or the State and/or other Federal agencies so authorized by law Contractor's internal practices, books, and records relating to the use and disclosure of PHI and PII provided to Contractor by the State or created, received, maintained, used, or transmitted by Contractor on the State's behalf. Contractor shall promptly inform the State by giving notice to the FSSA Privacy & Security Office of any request by HHS (or its designee), other State agencies, or other Federal agencies for such internal practices, books, and/or records and shall provide the State with copies of any materials or other information made available to such agencies.

Return of Protected Health Information. Upon request by the State or upon termination of this Contract, Contractor will, at the State's sole option, either return or destroy all copies of any PHI or PII provided to Contractor by the State, including PHI or PII created, received, maintained, used or transmitted by Contractor on the State's behalf and Contractor shall warrant in writing that it has returned or destroyed such PHI and/or PII. Further, upon termination of this agreement Contractor will not retain any copies of any such PHI and PII and shall warrant same in writing.

At the sole discretion of the State, the State may terminate this Contract for Contractor's material breach of this Section.

Contractor agrees to participate in a disaster recovery plan, as appropriate to the Contractor's services, as determined by the State to be necessary to uphold integral business functions in the event of an unforeseen disaster.

Drug and Alcohol Records. In the performance of the services under this Contract, Contractor may have access to confidential information regarding alcohol and drug abuse patient records. Contractor agrees that such information is confidential and protected information and promises and assures that any such information, regardless of form, disclosed to Contractor for the purposes of this Contract will not be disclosed or discussed with others without the prior written consent of the State. The Contractor and the State will comply with the applicable requirements of 42 CFR Part 2 and any other applicable Federal or state law or regulatory requirement concerning such information. The Contractor will report any unauthorized disclosures of such information in compliance with this Section.

Confidentiality of State Information. The Contractor understands and agrees that data, materials, and information disclosed to the Contractor may contain confidential and protected information. The Contractor covenants that data, material, and information gathered, based upon, or disclosed to the Contractor for the purpose of this Contract, will not be disclosed to or discussed with third parties without the prior written consent of the State.

The parties acknowledge that the services to be performed by Contractor for the State under this Contract may require or allow access to data, materials, and information containing Social Security numbers maintained by the State in its computer system or other records. In addition to the covenant made above in this Section and pursuant to 10 IAC 5-3-1(4), the Contractor and the State agree to comply with the provisions of IC 4-1-10 and IC 4-1-11. If any Social Security number(s) is/are disclosed by Contractor, Contractor agrees to pay the cost of the notice of disclosure of a breach of the security of the system in addition to any other claims and expenses for which it is liable under the terms of this Contract. The Contractor shall report any unauthorized disclosures of Social Security numbers to the FSSA Privacy & Security Office within one (1) business day of the date of discovery in accordance with this Section.

Contractor will indemnify and hold the State harmless from any loss, damage, costs, expense, judgment, sanction or liability, including, but not limited to, attorneys' fees and costs, that the State incurs or is subject to, as a result of a breach of this Section by the Contractor or any subcontractor, agent or person under Contractor's control. In the event a claim is made against the State for any such claim, cause of action, liability, damage, cost or expense, State may, at its sole option: (i) tender the defense to Contractor, who shall provide qualified and competent counsel to represent the State interest at Contractor's expense; or (ii) undertake its own defense, utilizing such professionals as it deems reasonably necessary, holding Contractor responsible for all reasonable costs thereof. In any event, the State shall have the sole right to control and approve any settlement or other compromise of any claim brought against it that is covered by this Section.

Contractor shall adhere to all relevant FSSA Security Policies for any related activities provided to FSSA under this Contract. Contractor is responsible for verifying that any subcontractors they engage will also comply with these policies. Any exceptions to these policies require written approval from the FSSA Privacy & Security Office.

Access to FSSA and/or State Information Systems.

"FSSA and/or State Information Systems" means all computing hardware and related components, all computer software and related components, all network devices and related functions, and data owned by, licensed to, in the legal custody of, and/or operated by FSSA and/or the State.

If the Contractor, in the performance of Contractor's services under this Contract, is authorized and granted by the State with access to FSSA and/or State Information Systems:

Contractor agrees that it and all members of its workforce (as used here, "workforce" means employees, volunteers, interns, trainees, (sub)contractors, and other persons whose conduct is under the control of Contractor) performing such services will comply with all FSSA and State Privacy and Security Policies and Procedures.

All members of Contractor's workforce who are or will be granted access to FSSA and/or State Information Systems will undertake and certify completion of all FSSA and State mandated privacy and security training following a schedule reasonably required by FSSA and the State (e.g., upon new hire/assignment and annually thereafter).

All members of Contractor's workforce who are or will be granted access to FSSA and/or State Information systems will agree in writing or through electronic confirmation to the rules of behavior regarding access to and use of FSSA and/or State information systems; such rules of behavior include but are not limited to the State Information Technology Resources User Policy ("ITR").

All members of Contractor's workforce who are or will be granted access to the FSSA Division of Family Resources ("DFR") eligibility and enrollment systems, a subset of FSSA Information Systems as defined by DFR, will agree in writing or through electronic confirmation to the DFR Rules of Behavior.

Such training and rules of behavior agreement(s) will be coordinated with Contractor by the FSSA Privacy and Security Office and the Indiana Office of Technology ("IOT").

Any members of Contractor's workforce who fail to complete the required training as described above within the scheduled timeframes or who fail to agree to the rules of behavior will not be permitted to access FSSA and/or State information systems.

Access to and usage of FSSA and/or State Information Systems is controlled through role-based access privileges and follows the principle of least privilege, meaning users are granted access to/usage of only the minimum amount of information and system functions necessary to perform their role or job assignment. As such, FSSA or its designee will provide Contractor with a list of roles it deems necessary for Contractor to perform the services; Contractor will identify each individual workforce member who requires access to/usage of FSSA and/or State Information Systems and the role to be assigned to each individual. Contractor will certify in writing that the role assigned to each individual workforce member is necessary and appropriate for the individual to perform their job assignment with respect to the performance of Contractor's services under this Contract.

FSSA will authorize and grant Contractor workforce member access privileges based on the requested and certified role in a timely manner; FSSA and IOT reserve the right to withdraw such authorization for any workforce member, with or without cause, at any time and without prior notice.

Contractor agrees to notify the FSSA Privacy and Security Office or its designee within twenty-four (24) hours of any workforce member terminations or changes in workforce member assignment that would affect their need for access or role.

Contractor agrees that it is solely responsible for the actions, including errors and omissions, intentional misconduct, or malfeasance of its workforce members with respect to their access to and usage of FSSA and/or State Information Systems.

The FSSA Privacy and Security Office (or its designee) and Contractor will collaborate on the methods and means to identify workforce members requiring access, certification, changes, and other communications under this subsection.

45 CFR §155.260 Compliance.

FSSA participates in a PII data exchange with the Centers for Medicare and Medicaid services ("CMS") mandated under the Affordable Care Act ("ACA", Public Law 111-148). The receipt of PII data from CMS through this data exchange ("ACA PII") is in support of the determination of eligibility for healthcare coverage for individuals, which is a primary function of DFR. DFR is designated as the Administering Entity on behalf of FSSA under a computer matching agreement with CMS and, per the terms of that agreement, is obligated to comply with the provisions of 45 CFR §155.260 and §155.280 regarding the privacy and security of ACA PII and that such compliance will be achieved through the application of the privacy and security standards and obligations established in the Minimum Acceptable Risk Standards for Exchanges ("MARS-E") promulgated by CMS, including any subsequent versions issued by CMS.

45 CFR §155.260(b)(2)(v) requires DFR on behalf of FSSA to bind all downstream entities with which ACA PII is shared to same privacy and security standards and obligations that DFR is obligated to comply with, subject to the provisions under 45 CFR §155.260(b)(3) and in compliance with the monitoring provisions under 45 CFR §155.280.

In this regard (pursuant to the immediately preceding):

Contractor understands that in the performance of its services under this Contract Contractor will be given access to and usage of ACA PII to the extent necessary to perform such services; such access and usage of ACA PII is hereby authorized by the State.

Contractor agrees that such ACA PII is subject to the same provisions of this Section as apply to PII and PHI, including but not limited to subsection F Improper Disclosure, Security Incident, and Breach Notification.

Contractor further agrees that it will employ privacy and security standards over such ACA PII that are consistent with and being at least as protective as the privacy and security standards employed by DFR as described in paragraph 1) above taking into consideration: (i) the environment in which the Contractor is operating; (ii) whether specific standards are relevant and applicable to the Contractor's duties and activities in the performance of the services; and, (iii) existing legal requirements to which Contractor is bound in relation to its administrative, technical, and operational controls and practices, including but not limited to, its existing data handling and information technology processes and protocols.

Contractor additionally agrees that the privacy and security standards it employs over ACA PII will be consistent with the principles established in 45 CFR §155.260(a)(3) and that Contractor will bind any subcontractors with authorized access to ACA PII to the same or at least as protective as the privacy and security standards Contractor employs over ACA PII.

Contractor agrees that it will comply with the applicable provisions under 45 CFR §155.260 as a non-exchange entity; specifically, Contractor will comply with the MARS-E 2.2 privacy and security control requirements and with any subsequent versions of those control requirements promulgated by CMS with Contractor's compliance with those subsequent versions to be achieved by the compliance date established by CMS in such subsequent versions.

Information Systems Outside of the State Network, including Cloud-based Services.

To provide the Services under this Contract, if the Contractor employs or provides Information Systems that are external to the State Network, in whole or in part, then:

The External Information Systems will be FedRAMP Authorized at the FIPS 199 Moderate level.

Contractor will provide the State with a copy of the current FedRAMP Authorization(s) for the External Information Systems provided or employed under this Contract and any renewed FedRAMP Authorization(s) issued thereafter.

Contractor will provide the State with a copy of the most recent SOC 2 (Service Organization Control Type 2) report for the External Information Systems provided or employed under this Contract and annually thereafter as each annual SOC 2 report is completed.

If the most recent SOC 2 report(s) contains a qualified opinion by the service auditor, Contractor will provide the State with its Plan of Action & Milestones to resolve the qualified opinion. The State has the right to terminate the Contract (in accordance with the terms herein) if Contractor materially fails to resolve the deficiencies identified in the SOC 2 report in a timely manner consistent with its Plan of Action & Milestones or fails to receive an unqualified option by the service auditor on the next, annual SOC 2 report.

The State has the right to terminate the Contract (in accordance with the terms herein) if the Contractor's External Information Systems are no longer FedRAMP Authorized at the FIPS 199 Moderate level.

Contractor agrees that all External Information Systems provided or employed under this Contract by Contractor are subject to the requirements specified under Section R above.

Contractor agrees that these Section S requirements apply to all instances of External Information Systems provided or employed by Contractor to provide the Services, including if such External Information Systems are provided, in whole or in part, by one or more third parties, such as Cloud-service Providers, under a separate agreement between the Contractor and the third-party(ies). The FedRAMP Authorizations and the SOC 2 reports are then required for both the Contractor's External Information Systems and the third-party(ies') External Information Systems.

As used in this Contract, "External Information Systems" means any information system that is external to the State network; that is, not physically housed on State premises and connects to the State network through a State-approved connection such as secured web services, Virtual Private Network, secured data exchanges, and similar methods. This includes Cloud-based Services. The External Information Systems may include application software, computing infrastructure and hardware, data management and storage systems, middleware, and similar computing components, in total or in part, and whether provided solely by Contractor through Contractor's agreement with third parties, necessary for Contractor to deliver the Services.

13. Continuity of Services.

The Contractor recognizes that the service(s) to be performed under this Contract are vital to the State and must be continued without interruption and that, upon Contract expiration, a successor, either the State or another contractor, may continue them. The Contractor agrees to:

Furnish phase-in training; and

Exercise its best efforts and cooperation to effect an orderly and efficient transition to a successor.

The Contractor shall, upon the State's written notice:

Furnish phase-in, phase-out services for up to sixty (60) days after this Contract expires; and

Negotiate in good faith a plan with a successor to determine the nature and extent of phase-in, phase-out services required. The plan shall specify a training program and a date for transferring responsibilities for each division of work described in the plan, and shall be subject to the State's approval. The Contractor shall provide sufficient experienced personnel during the phase-in, phase-out period to ensure that the services called for by this Contract are maintained at the required level of proficiency.

The Contractor shall allow as many personnel as practicable to remain on the job to help the successor maintain the continuity and consistency of the services required by this Contract. The Contractor also shall disclose necessary personnel records and allow the successor to conduct on-site interviews with these employees. If selected employees are agreeable to the change, the Contractor shall release them at a mutually agreeable date and negotiate transfer of their earned fringe benefits to the successor.

The Contractor shall be reimbursed for all reasonable phase-in, phase-out costs (i.e., costs incurred within the agreed period after contract expiration that result from phase-in, phase-out operations).

14. Debarment and Suspension.

The Contractor certifies by entering into this Contract that neither it nor its principals nor any of its subcontractors are presently debarred, suspended, proposed for debarment, declared ineligible or voluntarily excluded from entering into this Contract by any federal agency or by any department, agency or political subdivision of the State of Indiana. The term "principal" for purposes of this Contract means an officer, director, owner, partner, key employee or other person with primary management or supervisory responsibilities, or a person who has a critical influence on or substantive control over the operations of the Contractor.

The Contractor certifies that it has verified the state and federal suspension and debarment status for all subcontractors receiving funds under this Contract and shall be solely responsible for any recoupment, penalties or costs that might arise from use of a suspended or debarred subcontractor. The Contractor shall immediately notify the State if any subcontractor becomes debarred or suspended, and shall, at the State's request, take all steps required by the State to terminate its contractual relationship with the subcontractor for work to be performed under this Contract.

15. Default by State.

If the State, sixty (60) days after receipt of written notice, fails to correct or cure any material breach of this Contract, the Contractor may cancel and terminate this Contract and institute measures to collect monies due up to and including the date of termination.

16. Disputes.

In the event that any dispute arises with respect to this Contract, the Contractor and the State agree to act immediately to resolve such disputes. Time is of the essence in the resolution of disputes.

If a valid dispute exists as to the Contractor's liability or guilt in any action initiated by the State or its agencies, and the State decides to delay, withhold, or deny work to the Contractor, the Contractor may request that it be allowed to continue, or receive work, without delay. In any event, the Contractor agrees that, notwithstanding the existence of a dispute, it will continue without delay to carry out all of its responsibilities under this Contract that are not affected by the dispute. Should the Contractor fail to continue to perform its responsibilities regarding all non-disputed work, without delay, any additional costs incurred by the State or the Contractor as a result of such failure to proceed shall be borne by the Contractor, and the Contractor shall make no claim against the State for such costs. Any payments that the State may delay, withhold, deny, or apply under this subparagraph shall not be subject to penalty or interest, except as permitted by IC § 5-17-5.

If the parties are unable to resolve a contract dispute between them after good faith attempts to do so, a dissatisfied party shall submit the dispute to the Commissioner of the Indiana Department of Administration (the "IDOA") for resolution, except as otherwise provided in the Funding Cancellation and Termination for Convenience paragraphs. The dissatisfied party shall give written notice to the Commissioner of the IDOA (the "Commissioner") and the other party. The notice shall include: (1) a description of the disputed issues, (2) the efforts made to resolve the dispute, and (3) a proposed resolution. The Commissioner shall promptly issue a notice setting out documents and materials to be submitted to the Commissioner in order to resolve the dispute. The notice may also afford the parties the opportunity to make presentations and enter into further negotiations. Within thirty (30) business days of the conclusion of the final presentations, the Commissioner shall issue a written decision and furnish it to both parties. The Commissioner's decision shall be the final and conclusive administrative decision, unless either party serves on the Commissioner and the other party, within ten (10) business days after receipt of the Commissioner's decision, a written request for reconsideration and modification of the written decision. If the Commissioner does not modify the written decision within thirty (30) business days, either party may take such other action helpful to resolving the dispute, including submitting the dispute to an Indiana court of competent jurisdiction. If the parties accept the Commissioner's decision, it may be memorialized as a written amendment to this Contract, if appropriate.

The State may withhold payments on disputed items pending resolution of the dispute. The unintentional nonpayment by the State to the Contractor of one or more invoices not in dispute in accordance with the terms of this Contract will not be cause for the Contractor to terminate this Contract, and the Contractor may bring suit to collect these amounts without following the disputes procedure contained herein.

With the written approval of the Commissioner, the parties may agree to forego the process described in subparagraph C, relating to submission of the dispute to the Commissioner.

This paragraph shall not be construed to abrogate provisions of IC § 4-6-2-11 in situations where dispute resolution efforts lead to a compromise of claims in favor of the State, as described in that statute. In particular releases or settlement agreements involving releases of legal claims or potential legal claims of the State should be processed consistent with IC § 4-6-2-11, which requires approval of the Governor and Attorney General.

17. Drug-Free Workplace Certification.

As required by Executive Order No. 90-5 dated April 12, 1990, issued by the Governor of Indiana, the Contractor hereby covenants and agrees to make a good faith effort to provide and maintain a drug-free workplace. The Contractor will give written notice to the State within ten (10) days after receiving actual notice that the Contractor, or an employee of the Contractor in the State of Indiana, has been convicted of a criminal drug violation occurring in the workplace. False certification or violation of this certification may result in sanctions including, but not limited to, suspension of contract payments, termination of this Contract and/or debarment of contracting opportunities with the State for up to three (3) years.

In addition to the provisions of the above paragraph, if the total amount set forth in this Contract is in excess of $25,000.00, the Contractor certifies and agrees that it will provide a drug-free workplace by:

Publishing and providing to all of its employees a statement notifying them that the unlawful manufacture, distribution, dispensing, possession or use of a controlled substance is prohibited in the Contractor's workplace, and specifying the actions that will be taken against employees for violations of such prohibition;

Establishing a drug-free awareness program to inform its employees of: (1) the dangers of drug abuse in the workplace; (2) the Contractor's policy of maintaining a drug-free workplace; (3) any available drug counseling, rehabilitation and employee assistance programs; and (4) the penalties that may be imposed upon an employee for drug abuse violations occurring in the workplace;

Notifying all employees in the statement required by subparagraph (A) above that as a condition of continued employment, the employee will: (1) abide by the terms of the statement; and (2) notify the Contractor of any criminal drug statute conviction for a violation occurring in the workplace no later than five (5) days after such conviction;

Notifying the State in writing within ten (10) days after receiving notice from an employee under subdivision (C)(2) above, or otherwise receiving actual notice of such conviction;

Within thirty (30) days after receiving notice under subdivision (C)(2) above of a conviction, imposing the following sanctions or remedial measures on any employee who is convicted of drug abuse violations occurring in the workplace: (1) taking appropriate personnel action against the employee, up to and including termination; or (2) requiring such employee to satisfactorily participate in a drug abuse assistance or rehabilitation program approved for such purposes by a federal, state or local health, law enforcement, or other appropriate agency; and

Making a good faith effort to maintain a drug-free workplace through the implementation of subparagraphs (A) through (E) above.

18. Employment Eligibility Verification.

As a condition precedent to entering this contract, and as required by IC § 22-5-1.7 and Executive Order 25-29, the Contractor swears or affirms under the penalties of perjury that the Contractor has not knowingly employed, and will not knowingly employ, an unauthorized alien. The Contractor further affirms that:

The Contractor has enrolled in, and verified the work eligibility status of all his/her/its employees…