42 CFR 422.503 and 423.504(b)(4)(vi)(A)

• The FDR ensures the Health First Code of Ethics & Business Conduct and applicable policies and procedures were provided to, at a minimum, employees and Downstream Entities who have an involvement in the administration or delivery of Parts C and D benefits related to the contract with Health First within ninety (90) days of hire or contracting and annually thereafter.

• The FDR created its own Code of Ethics and policies and procedures which are significantly similar to the Health First Code of Ethics & Business Conduct and policies and procedures, and were provided to, at a minimum, employees and Downstream Entities who have an involvement in the administration or delivery of Parts C and D benefits related to the contract with Health First within ninety (90) days of hire or contracting and annually thereafter. Initials: If this method is chosen, I attest that I will send a copy of the referenced document(s) to Health First Corporate Compliance via fax, mail or email within 24 hours of submitting this form. (required)

42 CFR 422.503 and 423.504(b)(4)(vi)(C)

The FDR shall present compliance training to all new and established employees (including temporary workers and volunteers) and downstream entities within 90 days of hire or contracting and annually thereafter. Please indicate the method in which General Compliance Training is satisfied:

• Complete CMS web-based training module through the Medicare Learning Network© (MLN) and retain the certificate of completion for each employee and downstream entity.

• Complete comparable training adopted by your organization and retain proof of completion for each employee and downstream entity. Your training materials must incorporate the content of the CMS standardized training modules from the CMS website. CMS does not allow training content to be modified, except for the appearance of the content. Initials: If this method is chosen, I attest that I will send a copy of the referenced document(s) to Health First Corporate Compliance via fax, mail or email within 24 hours of submitting this form. (required)

• Additional Option for Providers Only: Incorporate content of CMS training modules into written documents for providers (e.g. Provider Guides, Business Associate Agreements, etc.) and retain documented proof of distribution.

42 CFR 422.503 and 423.504(b)(4)(vi)(C)

FDR shall present FWA training to all new and established employees (including temporary workers and volunteers) and downstream entities within 90 days of hire or contracting and annually thereafter. Please indicate the method in which FWA training is satisfied:

• Complete CMS web-based training module through the Medicare Learning Network© (MLN) and retain the certificate of completion for each employee and downstream entity.

• Complete comparable training adopted by your organization and retain proof of completion for each employee and downstream entity. Your training material must incorporate the content of the CMS standardized training modules from the CMS website. CMS does not allow training content to be modified, except for the appearance of the content. Initials: If this method is chosen, I attest that I will send a copy of the referenced document(s) to Health First Corporate Compliance via fax, mail or email within 24 hours of submitting this form. (required)

• Additional Option for Providers Only: Incorporate content of CMS training modules into written documents for providers (e.g. Provider Guides, Business Associate Agreements, etc.) and retain documented proof of distribution.

• Additional Option for Deemed Providers Only: FWA training is not required for deemed providers of Medicare Parts A/B.

422 CFR 422.503 and 423.504(b)(4)(vi)(C)

• FDR agrees to comply with Medicare laws, regulations and CMS instructions as it relates to maintaining training records of employees and downstream entities for a period of 10 years.

• FDR ensures that employees and downstream entities agree to safeguard beneficiary privacy and confidentiality and assure accuracy of beneficiary health records pursuant to applicable laws. FDR affirms that its employees and downstream entities will comply with the confidentiality and enrollee record accuracy requirements, including: (1) abiding by all federal and state laws regarding confidentiality and disclosure of medical records, or other health and enrollment information, (2) ensuring that medical information is released only in accordance with applicable federal or Florida law, or pursuant to court orders or subpoenas, (3) maintaining the records and information in an accurate and timely manner, and (4) ensuring timely access by enrollees to the records and information that pertains to them. FDR affirms that it has provided or required appropriate training and/or education on these subjects to its employees and downstream entities.

• FDR agrees that if your organization decides to subcontract with other entities to perform any of the services contractually delegated to your organization to perform on behalf of HFHP, your organization is required to obtain permission from HFHP prior to subcontracting with these entities to perform services as directed in the contract. Should a subcontract be granted, the FDR will maintain active oversight and monitoring of such activity to ensure downstream entities are complying with CMS program requirements.

42 CFR 422.503, 422.752(a)(8), 423.504(b)(4)(vi)(F), and 423.752(a)(6)

• FDR ensures that employees and downstream entities are screened against the DHHS Office of Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) and the System for Award Management (SAM) list prior to hire or contracting and monthly thereafter. Monthly screening must include all current employees, new employees, temporary employees, volunteers, contractors and consultants to ensure individuals are not excluded or become excluded from participation in federal programs.

42 CFR 422.503 and 423.504(b)(4)(vi)(E)

• FDR ensures that the FDR’s employees and downstream entities understand the disciplinary standards and duty to report all suspected or known instances of non-compliance and/or FWA activity, as well as maintaining and enforcing disciplinary standards in a timely and consistent manner. Please review the Health First Code of Ethics & Business Conduct for reporting methods. FDR is obligated to report within a reasonable time frame to HFHP all suspected or known instances of non-compliance and/or FWA.

• HFHP is obligated to ensure the FDR corrects any deficiencies related to misconduct or Medicare program non-compliance and detail the elements of any corrective action in a written agreement with the FDR, which includes ramifications if the FDR fails to implement the corrective action satisfactorily. To substantiate compliance, the FDR organization will furnish reasonable documentation to support any CMS requirements to HFHP upon request at no cost. FDR shall reasonably cooperate and fulfill any corrective action requested by HFHP.

FDR shall not utilize Offshore Subcontractors in connection with providing administrative or healthcare services for HFHP without first gaining approval from HFHP. CMS defines an “Offshore Subcontractor” as a FDR entity that the Company contracts with to fulfill or help fulfill requirements in their Part C and/or Part D contracts. The term “offshore” refers to any country that is not one of the fifty United States or one of the United States territories. Offshore Subcontractors can be American-owned companies with portions of their operations performed outside the United States or foreign-owned companies with operations performed outside of the United States.

• FDR does not utilize offshore subcontractors in connection with providing administrative or healthcare services for HFHP.

• FDR does utilize offshore subcontractors in connection with providing administrative or healthcare services for HFHP. FDR will contact the HFHP Vendor Management Office at VendorManagement@Health-First.org if FDR has not already completed an Off-Shoring Addendum with HFHP.