42 CFR 422.503 and 423.504(b)(4)(vi)(A)

• FDR provides Health First's Code of Ethics & Business Conduct and applicable policies and procedures to, at a minimum: Employees and Downstream Entities who have an involvement in the administration or delivery of Parts C and D benefits related to the contract with Health First within ninety (90) days of hire or contracting and annually thereafter.

• The FDR created its own Code of Ethics and policies and procedures which are significantly similar to the Health First Code of Ethics & Business Conduct and policies and procedures, and were provided to, at a minimum, employees and Downstream Entities who have an involvement in the administration or delivery of Parts C and D benefits related to the contract with Health First within ninety (90) days of hire or contracting and annually thereafter. Initials: If this method is chosen, I attest that I will send a copy of the referenced document(s) to Health First Corporate Compliance via fax, mail or email within 24 hours of submitting this form. (required)

42 CFR 422.503 and 423.504(b)(4)(vi)(C)

FDR presents compliance training to all new and established employees (including temporary workers and volunteers) and downstream entities within ninety (90) days of hire or contracting and annually thereafter and retains logs, sign-in sheets, certificates of completion or other evidence that each employee and downstream entity has taken the training. Please indicate the method in which general compliance training is satisfied:

• FDR provides HFHP's "Medicare Parts C & D Annual Compliance Training" and retains proof of completion for each employee and downstream entity. HFHP's general compliance training is available at: hf.org/health_plans/fdrattestation/compliance.cfm

• Complete CMS web-based training module through the Medicare Learning Network© (MLN) and retain the certificate of completion for each employee and downstream entity.

• Complete comparable general compliance training adopted by your organization and retain proof of completion for each employee and downstream entity. Initials: If this method is chosen, I attest that I will send a copy of the referenced document(s) to Health First Corporate Compliance via fax, mail or email within 24 hours of submitting this form. (required)

42 CFR 422.503 and 423.504(b)(4)(vi)(C)

FDR presents FWA training to all new and established employees (including temporary workers and volunteers) and downstream entities within ninety (90) days of hire or contracting and annually thereafter and retains logs, sign-in sheets, certificates of completion or other evidence that each employee and downstream entity has taken the training. Please indicate the method in which fraud, waste and abuse training is satisfied:

• FDR provides HFHP's "Annual Fraud, Waste and Abuse Training" and retains proof of completion for each employee and downstream entity. HFHP's FWA training is available at: hf.org/health_plans/fdrattestation/compliance.cfm

• Complete CMS web-based training module through the Medicare Learning Network© (MLN) and retain the certificate of completion for each employee and downstream entity.

• Complete comparable FWA training adopted by your organization and retain proof of completion for each employee and downstream entity. Initials: If this method is chosen, I attest that I will send a copy of the referenced document(s) to Health First Corporate Compliance via fax, mail or email within 24 hours of submitting this form. (required)

422 CFR 422.503 and 423.504(b)(4)(vi)(C)

• FDR complies with Medicare laws, regulations and CMS instructions as it relates to maintaining training records of employees and downstream entities for a period of 10 years.

• FDR's employees and downstream entities agree to safeguard beneficiary privacy and confidentiality and assure accuracy of beneficiary health records pursuant to applicable laws. FDR affirms that its employees and downstream entities will comply with the confidentiality and enrollee record accuracy requirements, including: (1) abiding by all federal and state laws regarding confidentiality and disclosure of medical records, or other health and enrollment information, (2) ensuring that medical information is released only in accordance with applicable federal or Florida law, or pursuant to court orders or subpoenas, (3) maintaining the records and information in an accurate and timely manner, and (4) ensuring timely access by enrollees to the records and information that pertains to them. FDR affirms that it has provided or required appropriate training and/or education on these subjects to its employees and downstream entities.

• FDR agrees that if it decides to subcontract with other entities to perform any of the services HFHP contractually delegated to your organization to perform, FDR/your organization is required to obtain permission from HFHP prior to subcontracting with these entities to perform services as directed in the contract. Should a subcontract be granted, your organization as the First Tier Entity will maintain active oversight and monitoring of such activity to ensure any downstream entities are complying with CMS program requirements.

42 CFR 422.503, 422.752(a)(8), 423.504(b)(4)(vi)(F), and 423.752(a)(6)

• FDR ensures that employees and downstream entities are screened against the DHHS Office of Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) and the System for Award Management (SAM) list prior to hire or contracting and monthly thereafter. Monthly screening must include all current employees, new employees, temporary employees, volunteers, contractors and consultants to ensure individuals are not excluded or become excluded from participation in federal programs.

42 CFR 422.503 and 423.504(b)(4)(vi)(E)

• FDR ensures that the FDR’s employees and downstream entities understand the disciplinary standards and duty to report all suspected or known instances of non-compliance and/or FWA activity, as well as maintaining and enforcing disciplinary standards in a timely and consistent manner. Please review the Health First Code of Ethics & Business Conduct for reporting methods. FDR is obligated to report within a reasonable time frame to HFHP all suspected or known instances of non-compliance and/or FWA.

• HFHP is obligated to ensure the FDR corrects any deficiencies related to misconduct or Medicare program non-compliance and detail the elements of any corrective action in a written agreement with the FDR, which includes ramifications if the FDR fails to implement the corrective action satisfactorily. To substantiate compliance, the FDR organization will furnish reasonable documentation to support any CMS requirements to HFHP upon request at no cost. FDR shall reasonably cooperate and fulfill any corrective action requested by HFHP.

FDR shall not utilize Offshore Subcontractors in connection with providing administrative or healthcare services for HFHP without first gaining approval from HFHP. CMS defines an “Offshore Subcontractor” as a FDR entity that the Company contracts with to fulfill or help fulfill requirements in their Part C and/or Part D contracts. The term “offshore” refers to any country that is not one of the fifty United States or one of the United States territories. Offshore Subcontractors can be American-owned companies with portions of their operations performed outside the United States or foreign-owned companies with operations performed outside of the United States.

• FDR does not utilize offshore subcontractors in connection with providing administrative or healthcare services for HFHP.

• FDR does utilize offshore subcontractors in connection with providing administrative or healthcare services for HFHP. FDR will contact the HFHP Vendor Management Office at VendorManagement@Health-First.org if FDR has not already completed an Off-Shoring Addendum with HFHP.