SOFTWARE AS A SERVICE EULA THIS SOFTWARE AS A SERVICE EULA (THE “AGREEMENT”) IS A BINDING AGREEMENT MADE BETWEEN ABEL HEALTHCARE ENTERPRISES, INC (THE “COMPANY”) AND YOU (“YOU” OR THE “SUBSCRIBER”). BY INDICATING CONSENT ELECTRONICALLY OR ACCESSING OR USING THE SOFTWARE AND SERVICES, YOU ACKNOWLEDGE THAT (I) YOU HAVE READ AND UNDERSTAND THIS AGREEMENT, (II) YOU ACCEPT ALL OF THE TERMS AND CONDITIONS CONTAINED HEREIN, AND (III) YOU AGREE THAT THE TERMS AND CONDITIONS SHALL BE FULLY AND LEGALLY BINDING UPON THE PARTIES. IF YOU CHOOSE NOT TO AGREE TO ALL OF THESE TERMS AND CONDITIONS, YOU MAY NOT ACCESS AND/OR USE THE SOFTWARE OR SERVICES. YOUR ACCESS AND/OR USE OF THE SOFTWARE OR SERVICES SHALL CONSTITUTE YOUR ACCEPTANCE OF ALL OF THE TERMS AND CONDITIONS SET FORTH IN THIS AGREEMENT. IF YOU ACCEPT THIS AGREEMENT FOR AN ENTITY, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND THE ENTITY TO THIS AGREEMENT. DEFINITIONS. Capitalized terms shall have the meanings set forth in this section, or in the section where they are first used. “Access Protocols” means the passwords, access codes, technical specifications, connectivity standards or protocols, or other relevant procedures, as may be necessary to allow Subscriber or any Authorized Users to access the Services. “Authorized User” means any individual who is an employee of Subscriber or such other person or entity as may be authorized by Company in writing, to access one or more Services pursuant to Subscriber’s rights under this Agreement. “Documentation” means the technical materials provided by Company to Subscriber in hard copy or electronic form describing the use and operation of the Software. “Error” means a reproducible failure of the Software to substantially conform to the Documentation. “Intellectual Property Rights” means any and all now known or hereafter existing (a) rights associated with works of authorship, including copyrights, mask work rights, and moral rights; (b) trademark or service mark rights; (c) trade secret rights; (d) patents, patent rights, and industrial property rights; (e) layout design rights, design rights, and other proprietary rights of every kind and nature other than trademarks, service marks, trade dress, and similar rights; and (f) all registrations, applications, renewals, extensions, or reissues of the foregoing, in each case in any jurisdiction throughout the world. “Services” means Company’s proprietary service which allows Subscriber to transmit and exchange patient health information and up to 100 images each calendar month to other registered users of the Software and Services. “Subscriber Content” means any content developed by or on behalf of Subscriber and used with the Software. “Software” means the software programs and any associated user interfaces and related technology that Company makes available in connection with the Services pursuant to this Agreement. PROVISION OF SERVICES. Access. Subject to Subscriber’s strict compliance with the terms of this Agreement, Company will provide the Services via an online user interface. On or as soon as reasonably practicable after the Company completes the registration process (such date being the “Effective Date”), Company shall provide to Subscriber the necessary passwords, security protocols and policies and network links or connections and Access Protocols to allow Subscriber and its Authorized Users to access the Services in accordance with the Access Protocols. Responsibility for Software and Content Hosting. Company shall, at its own expense, provide for the hosting of the Software which is accessible as part of the Services, provided that nothing herein shall be construed to require Company to provide for, or bear any responsibility with respect to any telecommunications or computer network hardware required by Subscriber or any Authorized User to provide access from the Internet to the Services. HIPAA Compliance. The parties hereby agree to comply with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and all other applicable laws, rules and regulations addressing the privacy and security of protected health information and the terms and conditions of the Business Associate Addendum attached hereto INTELLECTUAL PROPERTY. License Grant. Subject to the terms and conditions of this Agreement, Company grants to Subscriber a non-exclusive, non-transferable, royalty free license during the Term, solely for Subscriber’s internal business purposes: (i) to access, use, perform, and digitally display the Software as required for use of the Services and in accordance with the Documentation; and (ii) to use and reproduce a reasonable number of copies of the Documentation solely to support Subscriber’s use of the Services. Limitations. The Services, Software, Documentation, and all other materials provided by Company hereunder, including but not limited to all manuals, reports, records, programs, data and other materials, and all Intellectual Property Rights in each of the foregoing, are the exclusive property of Company and its suppliers. Subscriber agrees that it will not, and will not permit any Authorized User or other third party to: (i) permit any person to access the Software, or Documentation or use the Services, other than the Authorized Users authorized under this Agreement; (ii) modify, adapt, alter or translate the Software or Documentation, except as expressly allowed herein; (iii) sublicense, lease, rent, loan, distribute, or otherwise transfer the Software, or Documentation to any third party; (iv) reverse engineer, decompile, disassemble, or otherwise derive or determine or attempt to derive or determine the source code (or the underlying ideas, algorithms, structure or organization) of the Software; (v) use or copy the Software or Documentation except as expressly allowed under this subsection; or (vi) disclose or transmit any data contained in the Software to any individual other than a Authorized User, except as expressly allowed herein. Notwithstanding the foregoing, decompiling the Software is permitted to the extent the laws of Subscriber’s jurisdiction require Company to give Subscriber the right to do so to obtain information necessary to render the Software interoperable with other software; provided, however, that Subscriber must first request such information from Company and Company may, in its discretion, either provide such information to Subscriber or impose reasonable conditions, including a reasonable fee, on such use of the source code for the Software to ensure that Company’s and its suppliers’ proprietary rights in the source code for the Software are protected. Except as expressly set forth herein, no express or implied license or right of any kind is granted to Subscriber regarding the Services, Software, Documentation, or any part thereof, including any right to obtain possession of any source code, data or other technical material relating to the Software. Ownership. The Services, Software, Documentation, and all worldwide Intellectual Property Rights in each of the foregoing, are the exclusive property of Company and its suppliers. All rights in and to the Services, Software, and Documentation not expressly granted to Subscriber in this Agreement are reserved by Company and its suppliers. Except as expressly set forth herein, no express or implied license or right of any kind is granted to Subscriber regarding the Software, Documentation, and Services or any part thereof, including any right to obtain possession of any source code, data or other technical material related to the Software. Open Source Software. Certain items of software may be provided to Subscriber with the Software and are subject to “open source” or “free software” licenses (“Open Source Software”). Some of the Open Source Software is owned by third parties. The Open Source Software is not subject to the terms and conditions of the section titled Indemnification or the subsection titled License Grant. Instead, each item of Open Source Software is licensed under the terms of the end-user license that accompanies such Open Source Software. Nothing in this Agreement limits Subscriber’s rights under, or grants Subscriber rights that supersede, the terms and conditions of any applicable end user license for the Open Source Software. If required by any license for particular Open Source Software, Company makes such Open Source Software, and Company’s modifications to that Open Source Software, available by written request at the notice address specified below. SUBSCRIBER CONTENT AND RESPONSIBILITIES. License; Ownership. Subscriber grants Company a non-exclusive, worldwide, royalty-free and fully paid license (i) to use the Subscriber Content as necessary for purposes of providing the Services to Subscriber and (ii) to use the Subscriber trademarks, service marks, and logos as required to provide the Services to Subscriber. The Subscriber Content hosted by Company as part of the Services, and all worldwide Intellectual Property Rights in it, is the property of Subscriber. All rights in and to the Subscriber Content not expressly granted to Company in this Agreement are reserved by Subscriber. Authorized Users Access to Services. Subscriber may permit any Authorized Users to access and use the features and functions of the Services as contemplated by this Agreement. User IDs cannot be shared or used by more than one Authorized User at a time. Subscriber shall use commercially reasonable efforts to prevent unauthorized access to, or use of, the Services, and notify Company promptly of any such unauthorized use known to Subscriber. Subscriber Warranty. Subscriber represents and warrants that any Subscriber Content hosted by Company as part of the Services shall not (i) infringe any copyright, trademark, or patent; (ii) misappropriate any trade secret; (iii) be deceptive, defamatory, obscene, pornographic or unlawful; (iv) contain any viruses, worms or other malicious computer programming codes intended to damage Company’s system or data; (v) otherwise violate the rights of a third party, including, without limitation, any privacy rights; or (vi) violate any applicable law, ordinance, or government regulation applicable to such Subscriber Content. Subscriber agrees that any use of the Services contrary to or in violation of the representations and warranties of Subscriber in this section constitutes unauthorized and improper use of the Services. Subscriber Responsibility for Data and Security. Subscriber and its Authorized Users shall have access to the Subscriber Content and shall be responsible for all changes to and/or deletions of Subscriber Content and the security of all passwords and other Access Protocols required in order the access the Services. Subscriber shall have the sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of all Subscriber Content. Copyright Policy. Company reserves the right to terminate its agreement with any Subscriber who repeatedly infringes third party copyright rights upon prompt notification to Company by the copyright owner or the copyright owner’s legal agent. Additional Subscriber Responsibilities. It shall be Subscriber’s sole responsibility to perform those specific services that are necessary to establish Subscriber’s or Authorized Users’ use of the Software, Documentation, and Services. NO WARRANTY; DISCLAIMERS. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SOFTWARE, DOCUMENTATION, AND SERVICES ARE PROVIDED SOLELY ON AN “AS IS,” AND “AS AVAILABLE BASIS, WITHOUT WARRANTY OF ANY KIND, AND COMPANY MAKES NO (AND HEREBY DISCLAIMS ALL) WARRANTIES, REPRESENTATIONS, OR CONDITIONS, WHETHER WRITTEN, ORAL, EXPRESS, IMPLIED OR STATUTORY, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF SATISFACTORY QUALITY, COURSE OF DEALING, TRADE USAGE OR PRACTICE, MERCHANTABILITY, TITLE, NONINFRINGEMENT, OR FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE USE, MISUSE, OR INABILITY TO USE THE SOFTWARE, DOCUMENTATION, OR SERVICES (IN WHOLE OR IN PART) OR ANY OTHER PRODUCTS OR SERVICES PROVIDED TO SUBSCRIBER BY COMPANY. COMPANY DOES NOT WARRANT THAT ANY OR ALL ERRORS CAN BE CORRECTED, OR THAT OPERATION OF THE SOFTWARE, AND SERVICES SHALL BE UNINTERRUPTED OR ERROR-FREE. SOME STATES AND JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES OR CONDITIONS OR LIMITATIONS ON HOW LONG AN IMPLIED WARRANTY LASTS, SO SOME OF THE ABOVE LIMITATIONS MAY NOT APPLY TO SUBSCRIBER IN THEIR ENTIRETY. LIMITATION OF LIABILITY. Types of Damages. TO THE EXTENT LEGALLY PERMITTED UNDER APPLICABLE LAW, COMPANY SHALL NOT BE LIABLE TO SUBSCRIBER FOR ANY SPECIAL, INDIRECT, EXEMPLARY, PUNITIVE, INCIDENTAL OR CONSEQUENTIAL DAMAGES OF ANY NATURE INCLUDING, BUT NOT LIMITED TO DAMAGES OR COSTS DUE TO LOSS OF PROFITS, DATA, REVENUE, GOODWILL, PRODUCTION OR USE, BUSINESS INTERRUPTION, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR PERSONAL OR PROPERTY DAMAGE ARISING OUT OF OR IN CONNECTION WITH PERFORMANCE HEREUNDER OR THE USE, MISUSE, OR INABILITY TO USE THE SOFTWARE, DOCUMENTATION, SERVICES OR OTHER PRODUCTS OR SERVICES HEREUNDER, REGARDLESS OF THE CAUSE OF ACTION OR THE THEORY OF LIABILITY, WHETHER IN TORT, CONTRACT, OR OTHERWISE, EVEN IF SUCH PARTY HAS BEEN NOTIFIED OF THE POSSIBILITY OF SUCH DAMAGES. Amount of Damages. EXCEPT WITH RESPECT TO CLAIMS MADE PURSUANT TO SECTION 9 OR WITH RESPECT TO THE BUSINESS ASSOCIATE AGREEMENT, IN RECOGNITION THAT THE SERVICES AND SOFTWARE ARE BEING PROVIDED AT NO-CHARGE, SUBSCRIBER ACKNOWLEDGES AND AGREES THAT THE CUMULATIVE LIABILITY OF COMPANY ARISING OUT OF OR IN ANY WAY CONNECTED TO THIS AGREEMENT SHALL NOT EXCEED ONE HUNDRED DOLLARS ($100.00). IN NO EVENT SHALL COMPANY’S SUPPLIERS HAVE ANY LIABILITY ARISING OUT OF OR IN ANY WAY CONNECTED TO THIS AGREEMENT. THIS LIMITATION OF LIABILITY SHALL BE ENFORCED TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW. Basis of the Bargain. The parties agree that the limitations of liability set forth in this section shall survive and continue in full force and effect despite any failure of consideration or of an exclusive remedy. The parties acknowledge that the prices have been set and the Agreement entered into in reliance upon these limitations of liability and that all such limitations form an essential basis of the bargain between the parties. CONFIDENTIALITY. The Software, Services, and Documentation are the Confidential Information of Company. Subscriber agrees that it will not use or disclose to any third party any Confidential Information of the Company, except as expressly permitted under this Agreement. Subscriber will limit access to the Confidential Information to Authorized Users who have confidentiality obligations no less restrictive than those set forth herein, and who have been informed of the confidential nature of such information. In addition, Subscriber will protect the Company’s Confidential Information from unauthorized use, access, or disclosure in the same manner that it protects its own proprietary information of a similar nature, but in no event with less than reasonable care. At Company’s request or upon termination of this Agreement, Subscriber will return to Company or destroy (or permanently erase in the case of electronic files) all copies of the Confidential Information that Subscriber has in its possession at the time of such request or as of the effective date of termination, and, if requested by Company, Subscriber shall provide to Company a written affidavit certifying compliance with this sentence. The pricing, terms and conditions offered herein are confidential and proprietary and Subscriber shall not disclose such pricing, terms or conditions to any third party, excepting its accountants and attorneys, unless required to do so by law. The confidentiality requirement includes the prohibition of disclosure, whether blinded as to its source or otherwise, to any group purchasing organization, consultant, online comparative source, subcontractor, or temporary employee which may, from time to time, be retained by Subscriber for the purpose of rendering a service. This confidentiality requirement is not only specific to the proposal herein but also to any resultant agreement to purchase. With any breach of this confidentiality requirement, the non-breaching party may rescind or terminate this Agreement immediately and may seek any and all remedies available to it as a result of such breach, including injunctive relief and damages. SUBSCRIBER INDEMNIFICATION. Subscriber will defend, indemnify, and hold harmless Company, and its officers, directors, employees, agents, and customers (each, a “Company Indemnitee”) from and against any claim, suit, demand, or other legal action (each, a “Claim”) brought by a third party against any Company Indemnitee(s), to the extent such Claim arises from or relates to any breach of this Agreement by Subscriber, and Subscriber shall pay all liabilities, costs, damages, and expenses (including, without limitation, reasonable attorneys’ fees) suffered or incurred by Company Indemnitees in connection with such Claim. COMPANY INDEMNIFICATION. Company will defend, indemnify, and hold harmless Company from and against any Claim that Subscriber’s use of the Services or Software infringes or violates any copyright or patent. If an injunction is obtained against Subscriber’s use of the Services or Software by reason of such infringement, or if in Company’s opinion the Services or Software are likely to become the subject of a claim for such infringement, Company shall, at its sole option and expense: (i) procure for Subscriber the right to continue using the Services and/or Software in the manner permitted hereunder; (ii) replace or modify the Services and/or Software so that they become non-infringing, or (iii), if (i) and (ii) are not feasible, terminate this Agreement. The foregoing remedies shall be Subscriber’s sole and exclusive remedies in the event of a successful claim of infringement. Company shall have no liability to Subscriber under hereunder if any infringement is based upon Subscriber’s use of the Services and/or Software in combination with any software not furnished by Company, if the Services or Software are used in a manner for which they are not designed or permitted, or if the infringement is based upon modifications of the Services and Software by Subscriber. The foregoing indemnification shall be subject to the following: (a) Subscriber promptly notifies the Company in writing of the claim; (a) Company has sole control of the defense and all related settlement negotiations with respect to the claim, provided, however, that the Subscriber has the right, but not the obligation, to participate at its expense in the defense of any such claim or action through counsel of its own choosing; and (3) the Subscriber cooperates fully to the extent necessary, and executes all documents necessary for the defense of such claim. TERM AND TERMINATION. Term. This Agreement will remain effective until terminated in accordance with this Section. This Agreement will immediately terminate upon notice if Subscriber exceeds the scope of license granted or otherwise fails to comply with the terms and conditions set forth in this Agreement. Termination. Either party may terminate this Agreement immediately upon notice to the other party if the other party materially breaches this Agreement, and such breach remains uncured more than ten (10) days after receipt of written notice of such breach. This Agreement will immediately terminate upon notice if Subscriber exceeds the scope of license granted or otherwise fails to comply with the terms and conditions set forth in this Agreement. Further, either party may terminate this Agreement at any time by providing the other party with thirty (30) days advance written notice. Effect of Termination. Upon termination or expiration of this Agreement for any reason: (i) all rights and obligations of both parties, including all licenses granted hereunder, shall immediately terminate; (ii) within ten (10) days after the effective date of termination, Subscriber shall comply with the obligations to return all Confidential Information of Company, as set forth in the section titled Confidentiality; (iii) within ten (10) days after the effective date of termination, Company shall discontinue all use of Subscriber Content; and (iv) Company shall immediately return all Subscriber documents, records and information to Subscriber. Any unsatisfied payment obligation through the date of Termination, and the sections and subsections titled Definitions, Limitations, No Warranty; Disclaimers, Limitation of Liability, Confidentiality, Indemnification, Effect of Termination, and Miscellaneous will survive expiration or termination of this Agreement for any reason. MISCELLANEOUS. Governing Law. This Agreement and any action related thereto will be governed and interpreted by and under the laws of the State of Alabama, without giving effect to any conflicts of laws principles that require the application of the law of a different jurisdiction. Subscriber hereby expressly consents to the personal jurisdiction and venue in the state and federal courts in Jefferson county, Alabama for any lawsuit filed there against Subscriber by Company arising from or related to this Agreement. The United Nations Convention on Contracts for the International Sale of Goods does not apply to this Agreement. Compliance with Laws. Each party shall always comply with all international and domestic laws, ordinances, regulations, and statutes that are applicable the Software, Documentation, or Services hereunder. Until the expiration of four years after the furnishing of the Services provided under this Agreement, Company will make available to the Secretary, U.S. Department of Health and Human Services, and the U. S. Comptroller General, and their representatives, this contract and all books, documents and records necessary to certify the nature and extent of the costs of those services. If Company carries out the duties of the contract through a subcontract worth $10,000 or more over a 12-month period with a related organization, the subcontract will also contain an access clause to permit access by the Secretary, Comptroller General, and their representatives to the related organization's books and records. This provision shall survive the termination of this Agreement. If either party receives notice that its licensure or its participation in any federal health care program is suspended or revoked, that party will immediately notify the other party of such suspension or revocation. This Agreement will terminate immediately in the event of such suspension or revocation on the part of either party. Export. Subscriber agrees not to export, reexport, or transfer, directly or indirectly, any U.S. technical data acquired from Company, or any products utilizing such data, in violation of the United States export laws or regulations. Severability. If any provision of this Agreement is, for any reason, held to be invalid or unenforceable, the other provisions of this Agreement will remain enforceable and the invalid or unenforceable provision will be deemed modified so that it is valid and enforceable to the maximum extent permitted by law. Waiver. Any failure to enforce any term or provision of this Agreement shall not be deemed a waiver of that or any other breach of that or any other term or provision of this Agreement. In addition, any failure to enforce any term or provision of this Agreement shall not constitute a waiver of a future breach of that or any other term or provision of this Agreement. Remedies. Company’s rights and remedies under this Agreement are cumulative. Subscriber acknowledges that the Services, Software, and Documentation contain valuable trade secrets and proprietary information of Company, that any actual or threatened breach of the sections titled Intellectual Property or Confidentiality or any other breach by Subscriber of its obligations with respect to Intellectual Property Rights of Company will constitute immediate, irreparable harm to Company for which monetary damages would be an inadequate remedy. In such case, Company will be entitled to seek immediate injunctive relief without the requirement of posting bond, including an order that any Software, Documentation, or any portions thereof, that Subscriber attempts to import into any country or territory be seized, impounded and destroyed by customs officials. If any legal action is brought to enforce this Agreement, the prevailing party will be entitled to receive its reasonable attorneys’ fees, court costs, and other collection expenses, in addition to any other relief it may receive. No Assignment. Subscriber shall not assign, subcontract, delegate, or otherwise transfer this Agreement, or its rights and obligations herein, without obtaining the prior written consent of Company, and any attempted assignment, subcontract, delegation, or transfer in violation of the foregoing will be null and void. Company may freely assign this Agreement or delegate its obligations hereunder, in whole or in part, to any third party provided that such third party agrees to be bound by the terms hereof. The terms of this Agreement shall be binding upon the parties and their respective successors and permitted assigns. Force Majeure. Any delay in the performance of any duties or obligations of either party (except the payment of money owed) will not be considered a breach of this Agreement if such delay is caused by a labor dispute, shortage of materials, fire, earthquake, flood, or any other event beyond the control of such party, provided that such party uses reasonable efforts, under the circumstances, to notify the other party of the cause of such delay and to resume performance as soon as possible. Independent Contractors. Subscriber’s relationship to Company is that of an independent contractor, and neither party is an agent, employee, or partner of the other. Subscriber will not have, and will not represent to any third party that it has, any authority to act on behalf of Company. Notices. Each party must deliver all notices or other communications required or permitted under this Agreement in writing to the other party at the address listed on the first page of the Agreement by courier, by certified or registered mail (postage prepaid and return receipt requested), or by a nationally-recognized express mail service. Notice will be effective upon receipt or refusal of delivery. If delivered by certified or registered mail, any such notice will be considered to have been given five (5) business days after it was mailed, as evidenced by the postmark. If delivered by courier or express mail service, any such notice shall be considered to have been given on the delivery date reflected by the courier or express mail service receipt. Each party may change its address for receipt of notice by giving notice of such change to the other party. Entire Agreement. This Agreement, together with the attached Business Associate Agreement, is the final, complete and exclusive agreement of the parties with respect to the subject matters hereof and supersedes and merges all prior discussions between the parties with respect to such subject matters. No modification of or amendment to this Agreement, or any waiver of any rights under this Agreement, will be effective unless in writing and signed by an authorized signatory of Subscriber and the Company. Without limiting the generality of the foregoing, if Subscriber has previously submitted a purchase order to Company regarding the Services, then Subscriber expressly agrees that any terms and conditions in such purchase order, that are additional to or different from the terms and conditions of this Agreement, are superseded by the terms and conditions of this Agreement, are expressly excluded from this Agreement, and shall not, in any manner whatsoever, apply to this Agreement, notwithstanding any language in such purchase order that would purport to supersede any terms and conditions of this Agreement. Counterparts. This Agreement may be executed in counterparts, each of which shall be deemed an original, but all of which together shall be deemed to be one and the same agreement. A signed copy of this Agreement delivered by facsimile, e-mail or other means of electronic transmission (to which a signed PDF copy is attached) shall be deemed to have the same legal effect as delivery of an original signed copy of this Agreement. [The remainder of this page is intentionally left blank] BUSINESS ASSOCIATE ADDENDUM This Business Associate Addendum (“Addendum”) is incorporated into and made part of the Agreement between Company (“Business Associate”) and Subscriber (“Covered Entity”) (each a “Party” and collectively the “Parties”). RECITALS WHEREAS, Covered Entity and Business Associate have entered into, or are entering into, or may subsequently enter into, agreements or other documented arrangements (collectively, the “Business Arrangements”), pursuant to which Business Associate may create, receive, maintain, or transmit data for or from Covered Entity that constitutes Protected Health Information to perform services (“Services”) on behalf of Covered Entity; and WHEREAS, Covered Entity is or may be subject to the requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), and the implementing regulations set forth at 45 CFR Parts 160, 162, and 164 (the “HIPAA Regulations”); and WHEREAS, to the extent required by the HIPAA Regulations and applicable state law, Business Associate is or may be directly subject to certain privacy and security obligations and penalty provisions of the HIPAA Regulations and state law. NOW, THEREFORE, in consideration of the foregoing recitals and the mutual covenants contained herein, the Parties, intending to be legally bound, agree as follows: I. DEFINITIONS Capitalized terms used but not otherwise defined in this Addendum shall have the same meaning as those terms in the HIPAA Regulations. “PHI” shall have the same meaning as the term “Protected Health Information” in 45 CFR § 160.103, limited to the information created, received, maintained, or transmitted by Business Associate from or on behalf of Covered Entity. “Electronic PHI” shall have the same meaning as the term “Electronic Protected Health Information” in 45 CFR § 160.103, limited to the information created, received, maintained, or transmitted by Business Associate from or on behalf of Covered Entity. “Unsecured PHI” shall have the same meaning as the term “Unsecured Protected Health Information” in 45 CFR 164.402, limited to the information created, received, maintained, or transmitted by Business Associate from or on behalf of Covered Entity. II. EFFECT OF ADDENDUM The Parties agree that any ambiguity in this Addendum shall be resolved in favor of a meaning that permits the Parties to comply with HIPAA, the HITECH Act, the HIPAA Regulations, and applicable state law. III. BUSINESS ASSOCIATE OBLIGATIONS Permitted Uses and Disclosures: Business Associate shall not use and disclose PHI other than as expressly permitted or required by this Business Associate Addendum or as Required By Law. Except as otherwise limited in this Business Associate Addendum, Business Associate is permitted to use and disclose PHI as follows: Business Associate may use and disclose PHI to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the Business Arrangements, provided that use or disclosure would not violate the HIPAA Regulations if done by Covered Entity. Business Associate may use and disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate (collectively, “Business Associate’s Operations”), provided that Business Associate may only disclose PHI for Business Associate’s Operations if the disclosure is Required By Law or Business Associate obtains reasonable assurances, evidenced by a written contract, from the recipient that the recipient will: (1) hold such PHI in confidence and use or further disclose it only for the purpose for which Business Associate disclosed it to the recipient or as Required By Law; and (2) notify Business Associate of any instance of which the recipient becomes aware in which the confidentiality of such PHI has been breached without unreasonable delay. Business Associate may use PHI to provide Data Aggregation services to Covered Entity as permitted by 45 CFR 164.504(e)(2)(i)(B). Business Associate may use PHI to create information that is de-identified in accordance with 45 CFR 164.514. Business Associate may use and disclose PHI as otherwise permitted by law, provided that such use or disclosure would not violate the HIPAA Regulations if done by Covered Entity directly and provided that Covered Entity gives its prior written consent. To the extent Covered Entity notifies Business Associate of a restriction request granted by Covered Entity that would limit Business Associate’s use or disclosure of PHI, Business Associate will comply with the restriction. To the extent Business Associate is authorized to make disclosures directly to health plans, Business Associate shall not disclose PHI to a health plan for payment or health care operations purposes if the patient has requested this special restriction, and has paid out of pocket in full for the health care item or service to which the PHI solely relates, as required by 42 USC 17935(a). Notwithstanding anything herein to the contrary, Business Associate shall not use or disclose PHI for purposes of marketing or fundraising, as defined in the HIPAA Regulations, the HITECH Act, and applicable state law. Notwithstanding anything herein to the contrary, Business Associate shall not sell or receive remuneration, directly or indirectly, in exchange for PHI; provided, however, that this prohibition shall not be construed to limit or otherwise affect payment by Covered Entity to Business Associate for services provided pursuant to the Business Arrangements. Compliance: Business Associate shall be directly responsible for full compliance with the applicable requirements of the HIPAA Regulations to the same extent as Covered Entity. To the extent Business Associate is to carry out an obligation of Covered Entity under the HIPAA Regulations, Business Associate shall comply with the requirements of the HIPAA Regulations that apply to Covered Entity in the performance of such obligation. Minimum Necessary: Business Associate represents that the PHI requested, used, or disclosed by Business Associate shall be the minimum amount necessary to carry out the purposes of the Business Arrangements. To the extent the requirements of 45 CFR 164.502(b) apply, Business Associate will limit all of its uses and disclosures of, and requests for, PHI (1) when practical, to the information making up a Limited Data Set, and (2) in all other cases, to the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure, or request. Business Associate Agents: Business Associate shall ensure that each agent or subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions and conditions that apply to Business Associate pursuant to this Business Associate Addendum. Appropriate Safeguards; Security: Business Associate shall use and maintain reasonable and appropriate administrative, technical, and physical safeguards to prevent uses and disclosures of PHI other than as permitted in this Business Associate Addendum. In addition, Business Associate agrees to comply with the applicable requirements of 45 C.F.R. Part 164 Subpart C with respect to Electronic PHI and any guidance issued by the Secretary of the Department of Health and Human Services. Access to Records: Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity available to Covered Entity, or to the Secretary of the Department of Health and Human Services, for purposes of determining compliance with the HIPAA Regulations. Improper Access, Use, or Disclosure; Security Incident; Breach: Business Associate shall promptly report to Covered Entity in writing any access, use, or disclosure of PHI not permitted by this Business Associate Addendum, any Security Incident, and any Breach of Unsecured PHI of which it becomes aware or which it discovers without unreasonable delay. A Breach shall be treated as discovered by Business Associate as of the first day on which such Breach is known to Business Associate, or by exercising reasonable diligence would have been known to Business Associate. Business Associate shall be deemed to have knowledge of a Breach if the Breach is known by, or by exercising reasonable diligence would have been known to, any person, other than the person committing the Breach, who is an employee, officer, or other agent of Business Associate. Any report of Breach required by this section shall include the information specified in 45 CFR 164.410. Business Associate shall promptly provide Covered Entity with updates of information concerning the details of any unauthorized access, use, or disclosure of PHI, Security Incident, or Breach. Business Associate shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Business Associate Addendum, a Security Incident, or a Breach of Unsecured PHI. It is the sole responsibility of Covered Entity to notify individuals of any Breach of Unsecured PHI. Business Associate shall cooperate with Covered Entity in the provision of any such notification. Notwithstanding Business Associate’s obligation to notify Covered Entity of any Security Incident, the Parties acknowledge and agree that this Section constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which no additional notice to Covered Entity shall be required. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service, and any combination of the above, so long as no such incident results in unauthorized access, use, or disclosure of Electronic PHI. Business Associate shall report to Covered Entity in writing any security incident or breach of personal information for which applicable state law may require notification or other action by either Business Associate or Covered Entity. Any such report shall be made in accordance with the requirements of the relevant state law. Access to PHI; Amendment of PHI: To the extent that the Parties mutually agree in writing that PHI is part of a Designated Record Set, and that such Designated Record Set (or a portion thereof) is to be maintained by Business Associate, as set forth and agreed to in Schedule A: Business Associate shall within ten (10) days after a written request from Covered Entity provide access, at the request of the Covered Entity, and in the time and manner designated by the Covered Entity, to such PHI to Covered Entity or, as directed by the Covered Entity, to an Individual in order to meet the requirements of 45 CFR § 164.524. If the requested PHI is maintained electronically, Business Associate shall provide a copy of the PHI in the form and format requested by the Individual, if it is readily producible, or, if not, in a readable electronic form and format agreed to by Covered Entity and the Individual. In the event that any individual requests access to PHI directly from Business Associate, Business Associate shall immediately and in no event later than ten (10) days of receiving such request forward the request to Covered Entity. Any denials of access to the PHI requested shall be the responsibility of Covered Entity. Business Associate shall within ten (10) days after a written request from Covered Entity make amendments to such PHI as directed or agreed to by Covered Entity in accordance with the requirements of 45 CFR 164.526. In the event that a request for an amendment is delivered directly to Business Associate, Business Associate shall immediately and in no event later than ten (10) days of receiving such request forward the request to Covered Entity. Accounting: Business Associate shall document such disclosures of PHI and information related to such disclosures and, within ten (10) days after Covered Entity’s written request, shall provide to Covered Entity or to an Individual, in time and manner designated by Covered Entity, information collected in accordance with this section, as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR 164.528. In the event that a request for an accounting is delivered directly to Business Associate, Business Associate shall immediately and in no event later than ten (10) days of receiving such request forward the request to Covered Entity. IV. COVERED ENTITY’S OBLIGATIONS Notice of Privacy Practices: Covered Entity shall provide Business Associate with the notice of privacy practices that Covered Entity produces in accordance with 45 CFR 164.520, as well as any subsequent changes to such notice of privacy practices. Changes in Access by Individual: Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by an Individual to use or disclose PHI, if such changes affect Business Associate’s permitted or required uses and disclosures. Restrictions on Use and Disclosure of PHI: Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR 164.522. V. TERMINATION Term: The Term of this Addendum shall be effective as of the Effective Date of this Agreement and shall remain in effect until termination of the Business Arrangements; provided, however, that certain obligations shall survive termination of this Addendum as set forth in Section V(C). Termination for Cause: Covered Entity may immediately terminate this Agreement, including the Addendum, in the event that Business Associate materially breaches any provision of this Addendum. In its sole discretion, Covered Entity may permit Business Associate the ability to cure or take substantial steps to cure such material breach to Covered Entity’s satisfaction within thirty (30) days after receipt of written notice from Covered Entity. If termination pursuant to this section is infeasible, Covered Entity shall report the breach to the Secretary of the Department of Health and Human Services. Return or Destruction of PHI: Upon termination, if feasible, Business Associate shall return or destroy, at no cost to Covered Entity, all PHI that Business Associate still maintains in any form and shall retain no copies of such information. Prior to doing so, Business Associate further agrees to recover any PHI in the possession of its subcontractors or agents. If it is infeasible to return or destroy PHI, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction of PHI infeasible and Business Associate shall continue to extend the protections of this Addendum to such PHI, and limit further use of such PHI solely to those purposes that make the return or destruction of such PHI infeasible. The provisions of this section shall survive the expiration or termination of this Business Associate Addendum. VI. MISCELLANEOUS Amendment to Comply with Law: The Parties acknowledge that it may be necessary to amend this Business Associate Addendum to comply with modifications to HIPAA, the HITECH Act, the HIPAA Regulations, and applicable state law, including but not limited to statutory or regulatory modifications or interpretations by a regulatory agency or court of competent jurisdiction. The Parties agree to use good faith efforts to develop and execute any amendments to this Business Associate Addendum as may be required by any such modifications. Amendment: This Business Associate Addendum may be amended or modified only in writing signed by the Parties. No Third Party Beneficiaries; Agency Relationship: Nothing expressed or implied in this Business Associate Addendum is intended to confer, nor shall anything herein confer, upon any person other than Covered Entity, Business Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever. Nothing in this Business Associate Addendum shall be construed to create any agency relationship between the parties. Paragraph Headings: The paragraph headings in this Business Associate Addendum are for convenience only. They form no part of this Business Associate Addendum and shall not affect its interpretations. Limitation on Liability: Notwithstanding anything to the contrary contained herein or in the Business Arrangements, to the maximum extent permitted by law, neither party shall be liable to the other party for (i) any incidental, indirect, consequential, special or punitive damages of any kind or nature, whether such liability is asserted on the basis of contract, tort (including negligence or strict liability), or otherwise even if such party has been advised of the possibility of such loss or damage and (ii) any amount in excess of $100,000.00. This Section shall not be construed as permitting double or multiple recoveries for the same loss (no double dipping). Any and all damages allowable under this Agreement must be the result of a breach or of a failure to abide by HIPAA and/or it’s implementing regulations.

This Quick Referral link isn't valid