Loading...
HomeMy WebLinkAbout2014-141 Health - NC HIE to oversee, administer and operate electronic health information exchange network --Please return this copy to the Clerk to the Board's — office for permanent agenda file.x/A/ TECHNOLOGY-ENABLED CARE COORDINATION SUBSCRIPTION AGREEMENT THIS TECHNOLOGY-ENABLED CARE COORDINATION SUBSCRIPTION AGREEMENT ("Agreement") is entered into and effective as of the Effective Date (as defined herein) by and between NORTH CAROLINA HEALTH INFORMATION EXCHANGE, a North Carolina nonprofit corporation whose principal office is located at 2300 Rexwoods Drive, Suite 390, Raleigh, North Carolina 27607 (hereinafter, "NC HIE"), and the Participant (hereinafter, "Participant")identified below: Participant: Orange County Health Department Whitted Human Services Center Address: 300 West Tryon Street Hillsborough,NC 27278 Attn: Colleen Bridger RECITALS: A. NC HIE is engaged in the oversight, administration and operation of an electronic health information exchange network (the "HIE Network"), and in connection therewith makes available certain Services (as defined herein) for use by Participants of the HIE Network. B. Participant desires to subscribe to certain Services offered by NC HIE, all in accordance with the terms and conditions of this Agreement. NOW, THEREFORE, for good and valuable consideration, the receipt and sufficiency of which is admitted and acknowledged,the parties hereto agree as follows: 1. EFFECTIVE DATE. The effective date ("Effective Date") of this Agreement shall be deemed the date on which the last of both of the following events occurs: (i) the full execution of this Agreement by both NC HIE and Participant, and (ii) the full execution by Participant of the Joinder Agreement attached hereto as Exhibit C. pursuant to which Participant shall become a Participant party to the Amended and Restated North Carolina Health Information Exchange Participation Agreement (the "Participation Agreement") attached to the Joinder Agreement. 2. DEFINITIONS. All capitalized words and phrases not expressly defined herein and used within this Agreement and the recital paragraphs hereof shall have the defmitions ascribed to such capitalized words and phrases as are set forth within the Participation Agreement, which definitions are incorporated herein by reference. 3. USE AND DISCLOSURE OF DATA (a) For and during the Term of this Agreement and conditioned upon the Participant's compliance with all of the terms and conditions of this Agreement, and the Participation Agreement, NC HIE grants to Participant a limited, non-exclusive, and non- transferrable, royalty-free right and license to access, disclose and use Patient Information solely to carry out Permitted Purposes. Any such access and use shall at all times and in each instance t be undertaken in full compliance with this Agreement, the Participation Agreement, and applicable NC HIE Policies and Procedures which may be amended from time to time. (b) To the extent Participant makes available data to NC HIE for Permitted Purposes, parties may agree to otherwise limit or expand the scope of Permitted Purposes for which the Participant's data may be acquired, accessed, used or Disclosed through the HIE Network. If the Participant desire to limit or expand the scope Permitted Purposes, Participant shall identify any restricts or expansions and, subject to the decision by NC HIE to implement such restrictions or expansions,NC HIE shall describe the scope of the restrictions or expansions in an exhibit to be attached hereto as Exhibit E. 4. SUBSCRIPTION TO SERVICES; FEES. (a) Subject to the terms and conditions of this Agreement, Participant hereby subscribes to use the services identified on the Service Election Schedule attached hereto as Exhibit A and incorporated herein by reference (severally and collectively, the "Services"), and NC HIE agrees to make available such Services to Participant for its use. Upon written notice received by Participant at least one hundred eighty (180) days before the end of the initial term of this Agreement or the then current renewal term, NC HIE reserves the right in its sole discretion to discontinue the offering and availability of any or all of the Services and shall have no liability to Participant or its Authorized Users for or arising out of such discontinuance of Services, provided such discontinuance shall only be effective as of the expiration of the initial term of this Agreement or the then current renewal term. Participant is also entitled to receive support and maintenance as part of the subscription services and such Service Level Agreement is described in Exhibit D provided that Participant is not in default of their subscription fees as defined herein. (b) In consideration of the rights granted Participant hereunder,Participant shall pay to NC HIE the fees set forth on the Service Fee Schedule attached hereto as Exhibit B and incorporated herein by reference, at the times and in the manner, and subject to all other terms and conditions, as are set forth on such Service Fee Schedule,without notice or demand therefor, and without deduction or offset therefrom. All fees paid by Participant to NC HIE pursuant to this Agreement shall be non-refundable under all circumstances, including without limitation in the event of the early termination of this Agreement by Participant pursuant to Section 7 hereof. Upon written notice received by Participant at least one hundred eighty (180) days before the end of the initial term of this Agreement or the then current renewal term,NC HIE reserves the right in its sole discretion to increase or decrease the fees to be charged Participant for any or all of the Services to which Participant is then subscribed pursuant to this Agreement and shall have no liability to Participant or its Authorized Users for or arising out of such increase or decrease in fees,provided any such increase or decrease in fees shall only be effective as of the expiration of the initial term of this Agreement or the then current renewal term. (c) In the event that: (i)Participant elects to discontinue its subscription to any one or more of the Services, (ii) Participant elects to subscribe to additional services offered by NC HIE and not initially subscribed to by Participant, or that NC HIE first makes available for subscription by Participant subsequent to the Effective Date of this Agreement, or (iii) NC HIE elects to discontinue the offering and availability of any or all of the Services, the parties shall execute a new Service Election Schedule and a new Service Fee Schedule, each of which shall 2 be in substantially the form attached as Exhibit A and Exhibit B, respectively, to reflect the change in Services or addition of additional services, and fees owed on account of the applicable subscription change(s). The execution of a new Service Election Schedule or new Service Fee Schedule by both of the parties hereto shall be deemed to amend, supersede and replace in full any and all prior Service Election Schedule(s) or Service Fee Schedule(s), respectively, executed by the parties and without the necessity of any further action on the part of either party. 5. STATEMENTS OF WORK. The parties contemplate that during the Term of this Agreement, Participant may request that NC HIE provide certain services to Participant for purposes of, among other things and for illustration purposes only, assisting Participant in integrating its internal system onto the HIE Network, or assisting Participant in the fulfillment of certain responsibilities that are otherwise the obligation of Participant pursuant to this Agreement. In such event, Participant shall identify any services which Participant desires be performed by NC HIE and, subject to the decision by NC HIE to provide the services desired by Participant, NC HIE shall prepare a proposed statement of work (a"SOW") which shall include, if and to the extent applicable: (a) A reasonably detailed identification and scope of the services and or project to be performed by NC HIE for Participant under the specific SOW, and the location where such services will be performed; (b) Any specific deliverables or milestones to be achieved under such SOW; (c) The fees, anticipated costs and expenses for the services to be performed under such SOW; (d) The time period during which performance of the services under such SOW shall be performed and completed; (e) Specific staffing requirements of NC HIE and Participant for the particular services; and (f) Such other information as Participant and NC HIE deem relevant to the services covered by the SOW. Each proposed SOW shall be subject to the mutual approval of both Participant and NC HIE and, when acceptable to both parties, shall be executed by both parties. Upon the full execution of any such SOW by both Participant and NC HIE, such SOW shall be automatically deemed incorporated by reference into this Agreement. Notwithstanding the foregoing, nothing in this Agreement shall constitute a commitment of either party to enter into any particular SOW with the other, and in the event of any inconsistency between this Agreement and a SOW, this Agreement shall govern and control, except with respect to compensation and payment terms in a SOW, and terms in a SOW that are specifically identified as superseding the terms of this Agreement. 6. PARTICIPANT'S AUTHORIZED USERS. For and during the Term of this Agreement and conditioned upon Participant's compliance with all of the terms and conditions of this Agreement and the Participation Agreement, NC HIE grants to Participant the non- exclusive, non-transferable, right to authorize Participant's Authorized Users, if any, to use the Services, which usage shall be authorized by Participant in the manner prescribed by the Participation Agreement. 3 7. TERM; TERMINATION. (a) Term; Without Cause Termination Rights. The term of this Agreement shall commence on the Effective Date and shall continue in effect thereafter for a one (1) year period from the Effective Date (Renewal Date). Following such initial term, this Agreement will automatically renew for consecutive periods of one (1) year each (the initial term, collectively with any such renewal terms, the "Term") unless either party provides written notice to the other parry, and such other party shall have actually received such notice, within ninety (90) days of the Renewal Date, of such parry's intention that this Agreement not renew, in which event the Term of this Agreement shall expire on such Renewal Date of the then current year. Either party may terminate this Agreement upon ninety(90) days prior written notice to the other parry. (b) Termination by Participant for Cause. Participant may terminate this Agreement immediately in the event of NC HIE's breach of any term or condition of this Agreement, provided that such breach remains uncured after a period of thirty (30) days following NC HIE's receipt of written notice from Participant describing in reasonable detail the nature of such breach. Provided however, that in the event any such breach is incapable of being cured within such thirty (30) day time period, Participant agrees to not terminate this Agreement in the event that NC HIE has begun diligently pursuing a cure of such breach during said thirty(3 0) day time period. (c) Termination by NC HIE for Cause. NC HIE may terminate this Agreement immediately upon the occurrence of any of the following events: (i) A breach by Participant of any of the terms and conditions of this Agreement, including without limitation any failure of Participant to pay to NC HIE any fees owed by Participant pursuant to this Agreement at the time when due, which breach remains uncured beyond a period of thirty (30) days following Participant's receipt of written notice from NC HIE describing in reasonable detail the nature of such breach; (ii) A breach by Participant of any of the terms and conditions of the Participation Agreement, which breach remains uncured beyond any available cure periods set forth within the Participation Agreement; or (iii) The termination by Participant of its status as a Participant party to the Participation Agreement in accordance with the terms of the Participation Agreement, or the termination by NC HIE of Participant as a Participant party to the Participation Agreement in accordance with the terms of the Participation Agreement. 8. INSURANCE. During the Term of this Agreement, both Parties shall obtain, and keep in force reasonable Cyber Liability or other insurance coverage to insure against breach notification expenses, including, but not limited to, regulatory investigation, notification, and credit monitoring provided for affected individuals. The Parties shall provide each other with certificates of insurance evidencing such coverage upon the reasonable request of the other during the time of Participant's subscription to Services through NC HIE. All such policies of insurance shall name North Carolina Health Information Exchange as an additional insured under such policies, and shall provide that such policies shall not be cancelled or amended without at least thirty (30) days prior written notice to NC HIE. 4 Participant shall tender to NC HIE and NC HIE shall have received, certificates of insurance evidencing the coverages and requirements specified in this Section 8 prior to the exercise by Participant of any of the rights granted Participant under this Agreement. 9. LIMITATION OF LIABILITY. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, THE TOTAL AGGREGATE LIABILITY OF NC HIE, REGARDLESS OF WHETHER SUCH LIABILITY IS BASED ON BREACH OF CONTRACT, TORT, STRICT LIABILITY, BREACH OF WARRANTIES, FAILURE OF ESSENTIAL PURPOSE OR OTHERWISE, UNDER THIS AGREEMENT OR WITH RESPECT TO THE SERVICES, SHALL BE LIMITED TO THE FEES PAID TO NC HIE BY PARTICIPANT DURING THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE OCCURRENCE OF THE EVENT(S) GIVING RISE TO THE APPLICABLE DEMAND(S) AND OR CLAIM(S). NOTWITHSTANDING THE FOREGOING,NEITHER NC HIE NOR PARTICIPANT SHALL HAVE ANY LIABILITY TO THE OTHER FOR ANY CONSEQUENTIAL, SPECIAL, INDIRECT OR PUNITIVE DAMAGES ARISING FROM THE COURSE OF SUCH PARTY'S PERFORMANCE OF, OR OMISSION TO PERFORM, ITS OBLIGATIONS PURSUANT TO THIS AGREEMENT. 10. INDEMNITY. (a) Participant shall to the extent permitted by North Carolina law protect, defend, indemnify, and hold NC HIE, and NC HIE's officers, directors, agents, contractors, and employees harmless from and against any and all third party claims, demands, actions, or suits brought against NC HIE, and any and all losses, costs, reasonable expenses (including reasonable attorneys' fees), damages, liabilities, recoveries and judgments of every nature or description brought against NC HIE or any of the foregoing officers, directors, agents and employees of NC HIE and arising out of(i) the performance by Participant of the obligations to be performed by it hereunder, (ii) any breach by Participant of any representation or warranty made by it under this Agreement, and (iii) any breach by Participant of its obligations, agreements or covenants under this Agreement. (b) NC HIE shall to the extent permitted by North Carolina law protect, defend, indemnify, and hold Participant, and Participant's officers, directors, agents, contractors, and employees harmless from and against any and all third party claims, demands, actions, or suits brought against Participant, and any and all losses, costs, reasonable expenses (including reasonable attorneys' fees), damages, liabilities, recoveries and judgments of every nature or description brought against Participant or any of the foregoing officers, directors, agents and employees of Participant and arising out of(i) the performance by NC HIE of the obligations to be performed by it hereunder, (ii) any breach by NC HIE of any representation or warranty made by it under this Agreement, and (iii) any breach by NC HIE of its obligations, agreements, or covenants under this Agreement. 11. SOFTWARE VENDOR INDEMNITY AND LIMITATION OF LIABILITY. Subject to the terms and conditions of this Agreement, Participant and NC HIE hereby agree that that NC HIE's software vendor obligations of indemnity and limitation of liability are defined in Exhibit F and incorporated herein by reference 12. NOTICES. Any and all notices required or permitted to be given hereunder shall be sent to the recipient party at the address for such party as is reflected on the first page of this 5 Agreement, and either hand delivered or sent by certified mail, return receipt requested, postage prepaid, or by nationally recognized courier service for overnight delivery. Either party may change its address for notices at any time by notifying the other of such parry's new address in writing, which change of address notice shall be tendered in the manner required by this Section 12 for notices generally. 13. NORTH CAROLINA COMMUNITY CARE NETWORKS INC ("CCNC") AS INTENDED THIRD-PARTY BENEFICIARY. NC HIE and Participant acknowledge and agree that CCNC is an intended third-party beneficiary of all of the rights and obligations of NC HIE and Participant with respect to the provision of HIE Connectivity Services, to the extent that such Services are being subsidized through IAPD, DMA-25833-13, as executed on January 18, 2013. CCNC is entitled to enforce the terms of Section 4 SUBSCRIPTION TO SERVICES; FEES of this Agreement to the same extent as NC HIE and Participant. i 14. JOINDER TO NC HIE PARTICIPATION AGREEMENT. Simultaneous with the execution of this Agreement, Participant shall execute the Joinder Agreement attached hereto as Exhibit C, pursuant to which Participant shall become a Participant party to the Participation Agreement. 15. AUTHORITY; NO CONFLICT. NC HIE and Participant each represent and warrant to the other as follows: (i) that it is authorized to enter into this Agreement and to perform its obligations hereunder, and that the individual signatory executing this Agreement on its behalf is authorized, and has the capacity, to so execute this Agreement on its behalf, and (ii) that the execution of this Agreement by it and the performance of its obligations hereunder shall not conflict with or result in, with or without the passage of time or the giving of notice thereof, any breach, default or violation of any third party agreement to which it is bound, or any judgment, order or ruling of any court, administrative or regulatory agency or body, or arbitration award,to which it is bound or subject. 16. RELATIONSHIP. The relationship between the parties to this Agreement is strictly that of independent contractors, and this Agreement shall not create a partnership or any other form of business relationship, or create an agency relationship, between the parties hereto. Neither party to this Agreement shall, nor shall either party have any authority to, create or incur any liability or obligation on behalf of the other. 17. ASSIGNMENT. Participant shall not assign, sublicense or otherwise transfer in any manner any of Participant's rights and obligations under this Agreement without the prior written consent of NC HIE in each instance. NC HIE reserves the right to assign its rights and obligations under this Agreement to North Carolina Community Care Networks, Inc. 18. ATTORNEY'S FEES. In the event of any action brought by either parry against the other arising out of this Agreement, or for the purposes of enforcing the Agreement or collection of any damages alleged to have resulted to one of the parties by reason of the breach or failure of performance of the other, the party prevailing in any such action shall be entitled to recover reasonable attorneys' fees and cost of suit as may be determined by the court. 19. SEVERABILITY. In the event any one or more provisions of this Agreement shall, for any reason, be held to be invalid, illegal, or unenforceable, such invalidity, illegality or unenforceability shall not affect any other provision of this Agreement or any other instrument or document, and this Agreement and such other instruments and documents shall be interpreted 6 i and construed as if such invalid, illegal or unenforceable provision had never been contained therein. 20. BINDING EFFECT. The rights and obligations of the parties to this Agreement shall be binding upon and inure to the benefit of their respective successors and permitted assigns. 21. ENTIRE AGREEMENT. This Agreement constitutes the entire agreement between the parties hereto with respect to the subject matter hereof, and supersedes all prior and contemporaneous oral statements or agreements between the parties with respect to the subject matter hereof. 22. GOVERNING LAW. This Agreement, including, without limitation, all issues as to capacity, interpretation, construction, and performance hereof, shall be governed and construed in accordance with the laws of the State of North Carolina. 23. SURVIVAL. The following Sections of this Agreement which by their nature should survive the expiration or termination of this Agreement shall survive the expiration or termination of this Agreement. 24. COUNTERPARTS. This Agreement may be executed in multiple counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument. 25. E-Verify. Pursuant to the terms of North Carolina General Statute 153A-449(b) no county may enter into a contract with a contractor unless the contractor and the contractor's subcontractors comply with the requirements of Article 2 of Chapter 64 of the North Carolina General Statutes. Where applicable, failure to maintain compliance with the requirements of Article 2 of Chapter 64 of the General Statutes constitutes NC HIE's breach of this Agreement. By executing this Agreement NC HIE affirms they are in compliance with Article 2 of Chapter 64 of the North Carolina General Statutes. [Signature page follows] 7 IN WITNESS WHEREOF, NC HIE and Participant have executed this Agreement as of the dates set forth underneath their signatures below. NORTH CAROLINA HEALTH ORANGE COUNTY HEALTH INFORMATION EXCHANGE, DEPARMENT a North Carolina nonprofit corporation By: By: G% Printed Name: Printed Name: Colleen Bridger,MP Ph.D Title: Title:Director of Health Orange County Date Signed: Date Signed:_ t^.2. C—/y This instrument has been pre-audited in the manner required by the Local Government Budget and Fiscal Control Act. yal� A, AV.-4-- Clarence G. Grier, Finance Director This i s e as been approved as to form and legal sufficiency. Anne e Moore, ffice o County Attorney 8 EXHIBIT A SERVICE ELECTION SCHEDULE Services selected by Participant as part of this agreement are defined in the table below. Service Definition HIE Connectivity Services NC HIE will connect Participant to the HIE network and allow for the exchange of healthcare information between authorized Participants.The HIE Connectivity Service will provide Participants the ability to a) publish information to other Participants, b) the ability for other Participants to publish information to Participant, and c) the ability for Participant to query the HIE network for information The HIE network will provide the following services as part of supporting the exchange of information: i. Enterprise Master Patient Index ii. Provider Directory iii. Privacy and Consent Module iv. Integration Bus supporting HL7,CCD,and other industry standards V. Normalization and Transformation Module vi. Auditing and Compliance Function Patient Record Network NC HIE will make available to Authorized Users of Participant access to the Patient Record Network portal.This portal can be used to view the longitudinal patient record,set alerts and notifications,and access other HIE services Direct Secure Messaging NC HIE will provision Authorized Users of Participant with an ONC compliant Direct messaging environment. Each Authorized User will be provided access to a web-based messaging environment with a unique address assigned in the NC HIE Direct domain (facilitycode.firstname.lastname direct.nchie.oCg). Users will have the ability to append files containing Protected Health Information to their Direct messages. Lab Distribution Program NC HIE will provide a common lab interface to Participants through which they can receive lab results from lab companies that are participating in this program. Submitting lab orders is not yet available. Hospital Lab Integration Routing of hospital lab results through common HIE interface to Participants. Routing of lab orders is not yet available. State Connectivity 1. Bi-directional routing of patient immunization information through a Services common HIE interface. 1. NOR CCNC Disease Registry Exchange of Patient Health Information (PHI)with CCNC Disease Registry for Diabetes Training services NC HIE will offer training services for the initial on-boarding for Portal use and Opt-out. Integration Services NC HIE will offer integration services for connectivity to the HIE Network for the services selected by the Participant EXHIBIT B SERVICE FEE SCHEDULE This Service Fee Schedule is an attachment to the TECHNOLOGY-ENABLED CARE COORDINATION SUBSCRIPTION AGREEMENT("Agreement")dated ,20_and is effective on the date of execution by and between NC HIE and Participant and any capitalized terms which appear herein shall have the same meaning as given in the Agreement unless otherwise noted. P ani1k{"tla'�t#O Participant Contact(Contracting Entity): NC HIE Representative: Whiffed Human Services Center Jayson Caracciolo 300 W. Tryon St. jcaraccioloe-n3cn.org Hillsborough, NC 27278 Kerry Kribbs kkribbs(a-n3cn.orq Participating Entity: Effective Date: <mm/dd/yy> Whitted Human Services Center 300 W. Tryon St. Hillsborough, NC 27278 ALL PRICING IN UNITED STATES DOLLARS 919-245-2400 PO Number(if applicable): < #> NC HIE—Bundled Services—Annual Subscription Fees E E S °�y EECE{xE EE E E .E: �i Sii t f F 5 E F E€ E€, QQSCni3rt Full Participant Package—would include $175.00 1 $175.00 the following services • CORE Services • Direct Secure Messaging • State Connectivity Services including NCIR and ELR, if applicable • Training for initial on-boarding for Opt-out and HIE portal 10 Integration Fees—One Time n y' 13escnption dard ce Ca egor ,Decptso = Fees Integration fees for Interfaces to be included through $3,000 $0. connectivity to the HIE connectivity with Patagonia: Site is eligible Network • ADT's for state CCD Interface (bi-directional) subsidy program as a CA II Participant Annual Subscription Fees are invoiced annually in advance. One-time charges shall be invoiced upon delivery or completion of the integration services. All invoices are due within thirty days of the invoice date. TOTAL FEES AND INVOICING Total Annual Subscription Fees for this Service Fee Schedule are$175.00 and are invoiced as follows: INVOICE— 100 Percent($175.00)—due upon connection to the HIE Network("go live" date) 11 JOINDER AGREEMENT THIS JOINDER AGREEMENT ("Joinder"), made as of , 20_, by and between NORTH CAROLINA HEALTH INFORMATION EXCHANGE, a North Carolina nonprofit corporation ("NC HIE") and the undersigned party (hereinafter, "New Participant"), makes New Participant a party to that certain Amended and Restated North Carolina Health Information Exchange Participation Agreement dated July 1, 2013, as amended through the date hereof, (the "Participation Agreement"). RECITALS: A. The New Participant desires to become a participant in the HIE Network. B. New Participant's application to participate in the HIE Network has been accepted, with the condition precedent that the New Participant executes this Joinder. NOW, THEREFORE, for good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged,the parties agree as follows: I. JOINDER. The New Participant is hereby made a party to the Participation Agreement, a copy of which is attached hereto as Attachment A and incorporated herein by reference, and agrees to be bound by, and shall comply with, the terms thereof. From the date hereof,the New Participant shall be a "Participant"as that term is defined in the Participation Agreement and shall be subject to all of the duties and obligations and entitled to all of the rights and benefits of a"Participant"as provided therein. 2. ACKNOWLEDGEMENT. The New Participant hereby acknowledges that it has received a copy of and read the Participation Agreement in its entirety. 3. PARTICIPATING ENTITIES. If this Agreement is joined by a Participant as an Affiliate with the authority to do so, the individual entities shall be listed on Attachment B of this Agreement ("Participation Entities") and each party so listed shall be individually entitled to the rights and subject to the obligations set for in the Participation Agreement. 4. REAFFIRMATION. The terms and provisions of the Participation Agreement remain in full force and effect in all respects. 5. COUNTERPARTS.This Joinder may be executed in any number of counterparts, each of which will be an original,but all of which taken together will constitute one and the same instrument. IN WITNESS WHEREOF, the undersigned have caused this Joinder to be executed, all as of the day and year first written above. NORTH CAROLINA HEALTH ORANGE COUNTY HEALTH INFORMATION EXCHANGE, DEPARMENT a North Carolina nonprofit corporation By. By. Printed Name: Printed Name: Colleen Bridger, H,Ph.D Title: Title: Director of Health Orange ounty Date Signed: Date Signed: ATTACHMENT A PARTICIPATION AGREEMENT (Attached Separately) 14 AMENDED AND RESTATED NORTH CAROLINA HEALTH INFORMATION EXCHANGE PARTICIPATION AGREEMENT THIS AMENDED AND RESTATED NORTH CAROLINA HEALTH INFORMATION EXCHANGE PARTICIPATION GREEMENT(the"Agreement's is entered into and effective this 1 5Y day of J 2013, by NORTH CAROLINA HEALTH INFORMATIONEXCHANGE,a torth Carolina nonprofit corporation("NC HIE"). RECITALS: A. NC HE has established a voluntary electronic, statewide network (the "HIE Network")to facilitate the exchange of Patient Information among Participants through the HIE Network for Permitted Purposes. B. Participants seek to ensure that appropriate care management is delivered between multi-disciplinary care teams to improve the quality and coordination of health care services through the enhanced access to Patient Information and other clinical support. C. NC HIE seeks to assist Participants in improving the quality and coordination of health care services through the enhanced access the HIE Network will provide to Patient Information and other clinical support. D. NC HIE entered into that certain North Carolina Health Information Exchange Participation Agreement dated March 20,2012 (the"Original Agreement')with North Carolina Community Care Networks, Inc. d/b/a Community Care of North Carolina, as the initial Participant party to such Agreement. E. Pursuant to Section 18 of the Original Agreement, such Original Agreement may be amended by agreement of at least two-thirds (2/3)of the Board of Directors of NC HIE. F. At least two-thirds (2/3) of the Board of Directors of NC HE has by their agreement authorized the amendment and restatement of the Original Agreement in the manner set forth in this Agreement, and NC HIE is desirous of so amending and restating the Original Agreement. NOW,THEREFORE,in accordance with Section 18 of the Original Agreement,NC HIE hereby amends and restates the Original Agreement in its entirety as follows: 1. Amendment and Restatement of Original Participation Agreement. This Agreement shall be deemed to and hereby does amend,restate, supersede and replace in full the Original Agreement. 2. Definitions. A defined term, indicated by capitalizing of the first letter(s) not otherwise set forth below or elsewhere in the Agreement shall have the meaning stated in the HIPAA Regulations or if not defined in the HIPAA Regulations, assigned by other Applicable Law. 1 (a) Advisory Council shall mean the NC HIE Advisory Council,composed of qualified third parties selected and formed to advise NC HIE as to matters related to the administration of the HIE Network- (b) Agreement shall mean this Amended and Restated North Carolina Health Information Exchange Participation Agreement and all Exhibits hereto. (c) Applicable Law shall mean all applicable state and federal statutes and regulations governing the activities of Participants in connection with this Agreement. (d) Authorized Users shall mean persons health care providers, employees, professional staff, and other Workforce members of a Participant organization who have been authorized by the Participant to utilize the HIE Network for a Permitted Purpose through Participant's System or through user interfaces made available by NC HIE and who have, at the request of Participant or as otherwise provided in the NC Policies and Procedures,been assigned a user name and password by NC HIE. Authorized Users shall only be natural persons and shall not be other legal or operating entities or affiliates or subsidiaries of Participant except as may be provided in the NC HIE Policies and Procedures. References to Participant will be deemed to include a reference to the Participant's Authorized Users unless the context requires otherwise. (e) Confidentiality Agreement shall mean an agreement between a party and one or more of its Authorized Users that establishes and defines restrictions on the acquisition, access, Disclosure, and use of Patient Information through its System and the HIE Network, including means for safeguarding Patient Information and Confidential Business Information. (f) Confidential Business Information shall mean proprietary or confidential materials or information of a party in any medium or format that a party labels as such upon disclosure,and shall include, but not be limited to: (i)the party's designs, drawings,procedures, trade secrets, processes, specifications, source code, System architecture, security measures, research and development, including, but not limited to, research protocols and findings, passwords and identifiers, new products, and marketing plans; (ii) proprietary financial and business information of a party;and(iii)information or reports provided by a Discloser pursuant to this Agreement."Confidential Business Information"shall not include Patient Information;or any information which: (a) is or becomes known publicly available through no fault of a Receiving Party (as defined below); (b) is learned of by a Receiving Party from a third party entitled to Disclose such information; (c) is already known to a Receiving Party before receipt from a Discloser, as evidenced by such Receiving Party's written records generated before the Receiving Party received such information; or (d) is independently developed by a Receiving Party without reference to, reliance on, or use of a Discloser's Confidential Business Information. Patient Information is excluded from the definition of Confidential Business Information. (g) Disclose, Disclosed, and the noun form, Disclosure, shall mean the release,transfer,provision of,access to,or divulging in any other manner,of Patient Information. (h) Effective Date shall mean the date that both of the following occur: (i)the Amended and Restated NC HIE Participation Agreement is approved by the NC HIE Council and(ii)the Agreement is executed unilaterally. (i) Emergency Medical Condition shall mean a medical condition manifesting itself by acute symptoms of sufficient severity, including severe pain, such that the absence of 2 immediate medical attention could reasonably be expected to result in(i)placing an Individual's health in serious jeopardy, (ii) serious impairment to an Individual's bodily functions, or (iii) serious dysfunction on any bodily organ or part of an Individual. 0) HIE Network shall mean the voluntary, statewide health information exchange network overseen and administered by NC HIE pursuant to Article 29A of Chapter 90 of the North Carolina General Statutes that enables the secure exchange of Patient Information between and among Participants in support of the provision and improvement of healthcare services and health. (k) HIE Services shall mean software, utilities, and automated tools made available by NC HIE either directly or through a Qualified Organization for use in connection with the use of the HIE Network. (1) HIPAA Regulations shall mean the Standards for Privacy of Individually Identifiable Health Information and the Security Standards for the Protection of Electronic Protected Health Information(45 C.F.R.Parts 160 and 164)promulgated by the U.S.Department of Health and Human Services under the Health Insurance Portability and Accountability Act ("IIIPAA") of 1996 and the Health Information Technology for Economic and Clinical Health Act(the"HITECH Act!') of the American Recovery and Reinvestment Act of 2009, as in effect on the Effective Date of this Agreement and as may be amended, modified, or renumbered hereafter. (m) Individual shall mean the individual person who is the subject of Patient Information and shall include a Personal Representative in accordance with 45 CFR§ 164.502. (n) Joinder Agreement shall mean the agreement that each Participant who is a signatory to a Subscription Agreement signs pursuant to which such Participant agrees to become a party to,and be bound by, this Agreement as the same may be amended from time to time in accordance with its terms. (o) Master Patient Index shall mean an electronic database that maintains a unique index(or identifier)for every Individual. (p) Message shall mean a vehicle for transmitting Patient Information between Participants through the HIE Network. (q) NC HIE Policies and Procedures shall mean the NC HM's detailed policies and procedures. (r) Qpt Out shall mean an Individual's right, including through a Personal Representative, to disallow the Individual's Patient Information that is maintained by or on behalf of one or more specific Participants from being Disclosed to other Participants through the HIE Network (s) Participant shall mean a person or organization that is a signatory to this Agreement or a Joinder Agreement. Entities that control one another or are under common control by a parent or other entity("Affiliates"),may elect to participate in the HIE Network as a single Participant or multiple Participants. If this Agreement is joined by a single Participant on behalf of multiple related entities with the authority to do so,the individual entities shall be listed on an Exhibit to the Joinder Agreement captioned "Participating Entities" and each entity so 3 listed shall be individually entitled to the rights and subject to the obligations set forth in this Agreement. (t) Patient Information shall mean medical or other health care information of or about an Individual which is Disclosed by Participants or Third Party Data Contributors through the HIE Network or which is maintained by NC HIE for indexing, record location or other purposes all in accordance with this Agreement, NC HIE Policies and Procedures and Applicable Law. (u) Permitted Purposes shall mean the following reasons for which Patient Information may be acquired,accessed,Disclosed or used through the HIE Network- i. Treatment of the Individual. Treatment shall mean the provision, coordination, or management of health care and related services by one or more Providers and that the use or Disclosure otherwise complies with the requirements of HIPAA as set forth in 45 CFR §164.506 (c) or successor provisions of HIPAA and is otherwise permitted by Applicable Law; ii. Payment activities, provided that the Participant has an established Treatment relationship with the Individual and that the use or Disclosure otherwise complies with the requirements of HIPAA as set forth in 45 CFR§164.506(c) or successor provisions of HIPAA and is otherwise permitted by Applicable Law; iii. Quality assessment and improvement activities, including care coordination, defined in the HIPAA Regulations as a subset of health care operations activities, provided that the Participant has an established Treatment relationship with the Individual and that the use or Disclosure otherwise complies with the requirements of HIPAA set forth in 45 CFR§164.506(c)or successor provisions of HIPAA and is otherwise permitted by Applicable Law; iv. Public Purpose; Public Purpose shall mean a Disclosure of Patient Information to public health officials or government agencies and others when required by Applicable Law or when permitted by Applicable Law and consistent with the mission of NC HIE V. Pursuant to an Authorization required by the BIPAA Regulations; vi. To demonstrate meaningful use of certified electronic record technology, provided that the purpose is not otherwise described in subdivisions (i.) through (v.) of this definition and the purpose is permitted by Applicable Law,including but not limited to the 1-11PAA Regulations. Meaningful use of certified electronic health record technology" shall have the meaning assigned to it in the regulations promulgated by the Department of Health and Human Services under the American Recovery and Reinvestment Act, Sections 4101 and 4102.; 4 vii. To carry out NC HIE's or a Participant's proper management and administration of its System or its responsibilities under this Agreement and Applicable Law;and viii. A Participant or Third Party Data Contributor may limit or expand, within a Subscription Agreement or other written agreement, the permitted purposes for which the Patient Information of such Participant or Third Party Data Contributor may be acquired,accessed, Disclosed or used through the HIE Network. In the event Participant or Third Party Data Contributor so elects to limit or expand the permitted purposes for which their Patient Information may be acquired,accessed,Disclosed or used,then`Termitted Purposes"shall mean the purposes set forth within the applicable Subscription Agreement or other written agreement. (v) Provider shall mean(i) an entity such as a hospital, nursing home,home health agency, adult care home, mental health facility or professional corporation legally authorized to provide health care services in North Carolina, (ii) a health care professional licensed under Chapter 90 of the N.C. General Statutes or a resident or student acting under the supervision of such a professional, or(iii) a local health department as defined in N.C. General Statutes §130A-2. (w) Qualified Organization or M" shall mean a Participant designated by NC HIE to contract with other Participants on NC HIE's behalf to facilitate such other Participants'use of the HIE Network_ (x) Recipient shall mean a party, a public health official, a governmental entity or other individual or entity that receives Patient Information transmitted through the HIE Network by a Third Party Data Contributor as provided for in this Agreement. (y) Subscription Agreement shall mean any of the following: (i) a Qualified Organization Subscription Agreement by and between NC HE and a Qualified Organization that authorizes the Qualified Organization to use and make available HIE Services for sale and subscription by Participants on NC HIE's behalf; (ii)a Subscription Agreement by and between a Qualified Organization and its subscribing Participants for use of the HIE Services and participation in the HIE Network; or (iii) any other written agreement between NC HIE and a Participant that authorizes such Participant to use the HIE Services or participate in the HIE Network. (z) System shall mean any software, portal, platform, or other electronic medium used by a party through which the party accesses,Discloses or uses Patient Information through the HIE Network, without regard to whether or not such party controls the applicable software,portal,platform,or medium,whether through ownership,lease,license,or otherwise. (aa) Third-Party Data Contributor shall mean an entity other than a Participant that provides information through the HIE Network to populate NC HIE's Master Patient Index, a physician address directory, or to otherwise provide Patient Information to Recipients in a capacity other than that of a Participant. Third Party Data Contributors include, but are not 5 limited to, clinical laboratories, radiology-imaging providers and others that provide results or reports to Participants, to public health officials, to governmental agencies and others through a Push Message. (bb) User Access Policies shall mean a Participant's policies and procedures that govern the acquisition, access, Disclosure or use of Patient Information through the HIE Network by such Participant's Authorized Users using such Participant's System 3. PURPOSE AND SCOPE. This Agreement sets forth the provisions governing the acquisition, access,Disclosure or use of Patient Information through the HIE Network It is the intent of the parties hereto to protect the confidentiality, privacy and security of Patient Information in accordance with this Agreement, the NC HIE Policies and Procedures, and Applicable Law. 4. LICENSE TO ACCESS PATIENT INFORMATION (a) By Participants. During the Term defined in Section 11(a),and solely as permitted by this Agreement,NC HIE hereby grants Participants a non-exclusive,personal,non- transferable, non-sublicensable, revocable in accordance with Section 11 limited license to access, Disclose and use Patient Information through the HIE Network to carry out Permitted Purposes and to comply with the requirements of Applicable Law. (b) By NC HIE. Participant hereby grants separately to NC HIE and all other Participants an irrevocable, non-exclusive, royalty-free right and license to use all Patient Information and Confidential Information that was Disclosed by Participant through the HIE Network during the Term of this Agreement and solely as permitted by this Agreement, which will survive the termination or expiration of this Agreement. Nothing in the grant of a license shall be deemed to limit the provision of this Agreement or of Applicable Law that makes Patient Information incorporated into a Recipient's medical records, other data or databases, the property,and the legal responsibility of the Recipient. 5. OBLIGATIONS OF PARTICIPANTS. (a) Participant shall be responsible for assuring that Participant and its Authorized Users have all equipment,software and other resources necessary and appropriate to acquire, access, use and Disclose Patient Information through the HIE Network in accordance with this Agreement and to conform to any applicable technical specifications outlined NC HIE Policies and Procedures. (b) Participant may authorize persons whose conduct, in the performance of work for the Participant, is under the direct control of the Participant, including members of its own workforce, its independent contractors, and credentialed members of its medical or other professional staffs to access,Disclose or use Patient Information through the HIE Network only to the extent consistent with this Agreement and solely for Permitted Purposes. Participant acknowledges and agrees that it is responsible for its Authorized Users' access, Disclosure and use of Patient Information through the Informatics Center and for any other individuals' use of the Informatics Center by use of any security credential received or obtained, directly or indirectly, lawfully or unlawfully, from the Participant or its Authorized Users.Disclose or use Patient Information through the HIE Network only to the extent consistent with this Agreement and solely for Permitted Purposes. Participant acknowledges and agrees that it is responsible for its Authorized Users' access, Disclosure and use of Patient Information through the HIE 6 Network and for any other individuals'use of the HIE Network by use of any security credential received or obtained, directly or indirectly, lawfully or unlawfully, from the Participant or its Authorized Users. (c) Participant will use and maintain reasonable and appropriate administrative, technical and physical safeguards to protect the confidentiality, integrity, and availability of Patient Information and to prevent the acquisition, access, Disclosure or use of Patient Information through the HIE Network other than for Permitted Purposes or as required by Applicable Law. To that end,Participant agrees to: (i) Establish role-based access standards reasonably designed to enable each Authorized User to access such Patient Information through the HIE Network as is necessary for the performance of his or her authorized activities. These standards shall ensure that Authorized Users access Disclose or use only the Minimum Necessary amount of Patient Information reasonably required to carry out the authorized purpose. (ii) Establish policies and procedures that provide for appropriate: (i) identification and authentication of its Authorized Users; (ii) security audit controls and documentation to guard against unauthorized access to Patient Information; and (iii) protection against any type of virus or malicious software designed to disrupt the operation of,destroy or damage its or NC HIE's System or the HIE Network. (d) Participant shall have in place written User Access Policies that govern its Authorized Users' ability to access, Disclose and use Patient Information through the HIE Network using such Participant's System. Such Policies shall be consistent with this Agreement. Participant agrees to provide to NC HIE,upon reasonable request,copies or detailed summaries of its User Access Policies. (e) Participant is responsible for establishing a means to inform its Authorized Users of notices, changes, information and restrictions applicable to the use and Disclosure of Patient Information through the HIE Network under this Agreement. Participant shall require that all of its Authorized Users comply with the applicable requirements of this Agreement and Applicable Law and shall promptly take appropriate action in the event that Participant knows, or reasonably should have known, of a violation of the Agreement by an Authorized User. Participant will be responsible for any breach of this Agreement by an Authorized User. Participant agrees that notices provided to Participant will be effective as to Authorized Users and the Participant will secure Authorized Users agreement to the foregoing. (f) Participants shall provide periodic reports to NC HIE upon request about the security measures implemented for using the HIE Network, including any material security incidents that have arisen since any prior report. A "material security incident" is one that results in unauthorized acquisition, access, use, disclosure, modification, destruction of Patient Information, or interference with NC HIE's or Participant's System operations. Security incidents that are not material include,but are not limited to,pings on a firewall,attempts to log onto a system with an invalid security credential, malware, and denial-of-service attacks that do not result in a server being taken off-line. (g) NC HIE,in its discretion,may deny access to Patient Information through the HIE Network to any Participant or Authorized User it reasonably believes has acquired, 7 accessed, used or Disclosed Patient Information through the HIE Network other than as permitted under this Agreement or Applicable Law. (h) If a Participant identifies "Participating Entities" on its Joinder Agreement,the Participant warrants,represents and agrees that the Participant: i. Has written authority to bind each of the identified Participating Entities to the duties and obligations set forth in this Agreement; and ii. To the extent the Participant does not have appropriate written authority to bind a Participating Entity, the Participant hereby guarantees the Participating Entity's performance of Participating Entity's obligations under this Agreement. (i) Make its internal practices, books and records relating to uses and Disclosures of Patient Information pursuant to applicable Subscription Agreements and this Agreement available to the Secretary of the U.S. Department of Health and Human Services or his/her designee,as necessary to comply with the HIPAA Regulations or other Applicable Law. 0) To the extent that a Participant uses technology partners in connection with the Participant's acquisition, access, use or Disclosure of Patient Information through the HIE Network, such Participant shall have valid and enforceable agreements with each technology partner that require the technology partner to, at a minimum* (i) comply with Applicable Law; (ii) protect the privacy and security of Patient Information to which it has access; (iii) as soon as reasonably practicable after determining a Breach has occurred, report such Breach to the Participant in accordance with Section 9 of this Agreement; and (iv) reasonably cooperate with other Participants and NC HIE on issues related to this Agreement, under the direction of the Participant. 6. OBLIGATIONS OF NC HIE. NC HIE shall maintain the functionality of the HIE Network and provide or arrange for the provision of such service, security, and other updates to NC HIE's System as NC HIE determines are appropriate from time to time. (a) Use of Patient Information_ To the extent that NC HIE workforce members have access to information, including Patient Information or Confidential Information of Participant,such information will be used only for one or more of the following purposes: i. To facilitate the Disclosure of Patient Information to Participants for Permitted Purposes. ii. To process or otherwise implement Opt Out requests. iii. To perform patient identity or patient records maintenance. iv. To conduct or assist in the performance of audits permitted or required by the NC HE Policies and Procedures,including the performance of audits of Emergency Access. V. To evaluate the performance of or develop recommendations for improving the operation of the HIE Network vi. To conduct technical system support and maintenance on the HIE Network; vii. To carry out NC HIE's functions and obligations under this Agreement, applicable Subscription Agreements or other written 8 agreements with Third Party Data Contributors, and the NC HIE Policies and Procedures. viii. To engage in any other activities as may be required to facilitate the operation of the HIE Network that are authorized by the NC HIE Board of Directors and are consistent with this Agreement and Applicable Law. (b) Implementation of Opt Out NC HIE shall establish a process for notifying Individuals about(i)the benefits of the HIE Network,(ii)the Individual's right to Opt Out and the potential consequences to Individuals of Opting Out, (ii) the Individual's right to rescind a previous decision to Opt Out, and(iv) a process whereby an Individual may exercise the right to Opt Out and the right to rescind a previous decision to Opt Out. (c) Emergency Medical Condition Exception to Opt Out Authorized Users may access Patient Information maintained by Participants about an Individual who has exercised his or her right to Opt Out of Disclosures by such Participants if all of the following requirements are satisfied: i. The reasonably apparent circumstances indicate to the Authorized User that: (a)the Individual has an Emergency Medical Condition;(a) a meaningful discussion with the Individual or his or her Personal Representative about whether to rescind a previous decision to Opt Out is impractical due to the nature of the Individual's Emergency Medical Condition; and (c) information available through the HIE Network could assist in the diagnosis or Treatment of the Individual's Emergency Medical Condition. ii. The Authorized User obtains access to the HIE Network through a Participant that is treating or diagnosing the Individual's Emergency Medical Condition. iii. The Authorized User is involved in providing or arranging for the diagnosis or Treatment of the Individual's Emergency Medical Condition. iv. Authorized Users shall cease emergency access of an Individual's Patient Information under this Section 6(c) promptly upon (a) stabilization of the Individual's Emergency Medical Condition, or(b) a request by the Individual or his or her Personal Representative to cease such access. (d) Business Associate Services.NC HIE acknowledges and agrees that it is performing its obligations under all applicable Subscription Agreement(s)and this Agreement as a Business Associate of Participants who are considered Covered Entities and that it shall limit its use and Disclosure of any Patient Information Disclosed to NC HIE by such Covered Entity Participants to only those purposes described in and allowed by the "Additional Business Associate Requirements"attached hereto and incorporated herein as Exhibit A. (e) Compliance with CLIA. For the sole and limited purpose of facilitating a "Report of Record"to be transmitted from an originating laboratory, or other authorized source, to a Participant pursuant to and in accordance with the Clinical Laboratory Improvement 9 Amendments of 1988 ("CLIA"), NC HIE agrees to be and by signing this Agreement or the Joinder Agreement, Participant hereby designates NC HIE to be the Participant's "Designated Agent" for purposes of compliance with CLIA. This designation is limited and transient such that NC HIE shall be considered a"Designated Agent"of Participant only during the window of time beginning with the point at which a CLIA"Report of Record"is received by NC HIE and ending with the point at which the"Report of Record"is delivered to Participant(the Designated Agent Window"), and for the sole purpose of transmitting the "Report of Record" to the Participant. As used in this Section 6(e), the "Report of Record" shall mean the information contained in a document, electronic or otherwise, that is certified by the originating laboratory, or other authorized source,as containing the requisite information needed to satisfy CLIA's requirement for delivery of a test result to the ordering Participant. (f) Subcontractors. To the extent that a NC HIE uses technology partners in connection with the Participant's acquisition, access, use or Disclosure of Patient Information through the HIE Network, NC HIE shall have valid and enforceable agreements with each technology partner that require the technology partner to, at a minimum: (i) comply with Applicable Law; (ii) protect the privacy and security of Patient Information to which it has access; (iii) as soon as reasonably practicable after determining a Breach has occurred, report such Breach to NC HIE in accordance with Section 9 of this Agreement, and(iv) reasonably cooperate with NC HIE on issues related to this Agreement,under the direction of the NC HIE. 7. NC HIE POLICIES AND PROCEDURES. NC HIE shall from time-to-time develop Policies and Procedures and post them on the NC HIE Website and provide notice to Participants in accordance with Section 15. NC HIE,with the approval of its Board of Directors, may amend any provision of the NC HIE Policies and Procedures in accordance with its provisions. 8. APPLICABILITY OF HIPAA REGULATIONS. Each Participant agrees as follows: If the Participant is a Covered Entity, the Participant does, and at all times shall, comply with the H1PAA Regulations to the extent applicable. If the Participant is a Business Associate of a Covered Entity, the Participant does, and at all times shall, comply with the provisions of its Business Associate Agreement(s) and Applicable Law. If the Participant is a governmental entity, the Participant does, and at all times shall, comply with the applicable privacy and security laws and regulations to which it is subject. If the Participant is neither a Covered Entity, a Business Associate of a Covered Entity, nor a governmental entity, the Participant shall, as a contractual standard, at all times, at a minimum, comply with the provisions of the HIPAA Regulations as if it were acting in the capacity of a Covered Entity. 9. BREACH NOTIFICATION. (a) Responsibilities of Participants. Participants are required to notify NC HIE if they become aware of any actual or suspected Breach through the HIE Network. Except as otherwise provided in the NC HIE Policies and Procedures, notification shall be made as expediently as possible and without unreasonable delay. (b) Responsibilities of NC HIE. If NC HIE becomes aware of any actual or suspected Breach, either through notification by a Participant or otherwise,NC HIE must, at a minimum, notify any Participants whose Patient Information is affected by the Breach. Except as otherwise provided in the NC HIE Policies and Procedures,such notification shall be made as expediently as possible and without unreasonable delay. 10 (c) Contents of Notification. The notification required by this Section 9 shall include sufficient information for NC HIE and notified Participants to understand the nature and the extent of the Breach. For instance,such notification should include,to the extent available at the time of the notification the following information: i. A brief description of what happened,including the date of the Breach and the date of discovery of the Breach,if known; ii. The identification of each Individual whose Patient Information has been,or is reasonably believed to have been, accessed,acquired,used, or Disclosed during the Breach; iii. Description of the roles of the people involved in the Breach (e.g., employees,Authorized Users,service providers,unauthorized persons, etc.); iv. Description of the types of Patient Information that were involved in the Breach(whether full name, Social Security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved); V. Description of Participants likely impacted by the Breach; vi. Number of Individuals or records impacted/estimated to be impacted by the Breach; vii. Description of actions taken to investigate the Breach, to mitigate harm to Individuals,and to protect against any further Breach; viii. Current status of the Breach(under investigation or resolved); ix. Contact procedures for Individuals to ask questions or learn additional information, which shalt include a toll-free telephone number, an e- mail address,Web site,or postal address;and X. Corrective action taken and steps planned to be taken to prevent a similar Breach. (d) The notifying party shall have a duty to supplement the information contained in the notification as it becomes available and to cooperate with other Participants and NC HIE in mitigating the effects of the Breach. (e) Except as provided for in Section 9(c)(ii),the notification required by this Section 9 shall not include any Patient Information. (f) NC HIE will provide, in a timely manner, a summary of the Breach to such Participants that does not identify any of the Participants or Individuals involved in the Breach. (g) This Section 9 shall not be deemed to supersede or relieve a party's reporting obligations(if any) under relevant security incident, breach notification or confidentiality provisions of Applicable Law, including, but not limited to, those related to Individuals. (h) The parties shall work together to coordinate any notification to Individuals, and applicable regulatory agencies, and any public announcement regarding the Breach that may be required by Applicable Law or the policies of a party. 10. CONFIDENTIAL BUSINESS INFORMATION. 11 (a) Each parry shall hold all Confidential Business Information it receives (referred to as the"Receiving Party"for purposes of this Section 10),in confidence and shall not, during the term or after termination of this Agreement, disclose to any person or entity,nor use for its own business or benefit, any Confidential Business Information obtained by it in connection with this Agreement, unless such use or disclosure is permitted by the terms of this Agreement. Notwithstanding the foregoing, Confidential Business Information may be disclosed as required by operation of Applicable Law,provided that NC HIE or a Participant, (referred to as the Disclosing Parry for purposes of this Section 10),as the Receiving Party,promptly and in advance of such disclosure,if at all possible,notifies the Disclosing Parry of the existence,terms and circumstances surrounding such operation of law or Applicable Law to allow the Disclosing Parry its rights to object to such disclosure. If after Disclosing Parry's objection the Receiving Party is still required by operation of law or Applicable Law to disclose its Confidential Business Information,it shall do so only to the minimum extent necessary to comply with the operation of law or Applicable Law and shall request that the Confidential Business Information be treated as confidential to the maximum extent practicable under the circumstances. (b) The Receiving Party shall return,or destroy and certify the destruction of, all Confidential Business Information (including all copies thereof) to the Disclosing Party promptly upon request,provided that the Receiving Party may retain in its confidential files one copy of any written materials for purposes of verifying compliance with this Agreement. 11. TERM AND TERMINATION. (a) Term. The initial term of this Agreement shall commence as of the Effective Date and shall extend through December 31 of that same year. Following the initial term, this Agreement will automatically renew for consecutive one (1) year periods (the initial term,collectively with any such renewal terms,the"Term"). (b) Termination by NC HIE of HIE Services. NC HE may terminate this Agreement at any time without cause by giving not less than ninety(90)days prior written notice to all Participants. Upon termination by NC HIE of the HIE Services, NC HIE will treat the Patient Information Disclosed to NC HE by Participants as set forth in the Business Associate Responsibilities attached hereto and incorporated herein by reference as Exhibit A. (c) Effect of Termination of Subscription Agreement on Access to the HIE Network The termination of a Participant's Subscription Agreement, for any reason, will terminate the Participant's Joinder Agreement, thereby terminating the terminating Participant's access to and use of the HIE Network (d) Termination Based Unon Change in Law.NC HIE and Participants intend and in good faith believe that this Agreement complies with all federal, State and local laws. If any provision of this Agreement is declared void or unenforceable in a final, non-appealable ruling by a court or arbitrator of competent jurisdiction, or otherwise rendered void, unenforceable or obsolete by the enactment of any law or regulation, and if the provision(s) at issue is necessary to effectuate the purposes of this Agreement, the parties agree to attempt to renegotiate in good faith the affected provision(s) of this Agreement so as to comply with such rulings(s), law(s), or regulation(s) to the satisfaction of NC HIE and Participants. In the event the parties are not able to renegotiate the affected provision(s) of this Agreement to their mutual satisfaction within one hundred eighty (180) days of the enactment of the applicable ruling(s),law(s),or regulations(s),then this Agreement shall automatically terminate. 12 12. DISCLAIMERS. (a) Carver Lines. The parties acknowledge that access to the HIE Network is to be provided over various facilities and communication lines, and information will be transmitted over facilities and communications lines, and information will be transmitted over local exchange and Internet backbone carrier lines and through routers, switches, and other devices (collectively, "carrier lines") owned, maintained and serviced by third-party carvers, utilities,and Internet service providers, all of which are beyond NC HIE's control. NC HIE HEREBY DISCLAIMS ANY LIABILITY FOR OR RELATING TO THE INTEGRITY, PRIVACY, SECURITY, CONFIDENTIALITY, OR USE OF ANY INFORMATION WHILE IT IS TRANSMITTED ON THE CARRIER LINES, OR ANY DELAY, FAILURE, INTERRUPTION, INTERCEPTION, LOSS, TRANSMISSION, OR CORRUPTION OF ANY PATIENT INFORMATION OR CONFIDENTIAL BUSINESS INFORMATION ATTRIBUTABLE TO TRANSMISSION ON THE CARRIER LINES. USE OF THE CARRIER LINES IS SOLELY AT THE RISK OF EACH PARTICIPANT AND ITS AUTHORIZED USERS, AND IS SUBJECT TO ALL APPLICABLE LOCAL, STATE, NATIONAL AND INTERNATIONAL LAWS. (b) HIE SERVICES AND SOFTWARE. THE HM SERVICES AND ALL ASSOCIATED SOFTWARE ARE PROVIDED ON AN "AS IS' BASIS ONLY. ACCORDINGLY,BUT WITHOUT IN ANY WAY LIMITING THE GENERALITY OF THE FOREGOING, NC HIE DOES NOT REPRESENT OR WARRANT THAT THE SERVICES OR ASSOCIATED SOFTWARE WILL MEET THE REQUIREMENTS OF ANY PERSON OR WILL OPERATE ERROR-FREE OR CONTINUOUSLY, AND NC HIE MAKES NO OTHER REPRESENTATIONS OR WARRANTIES OF ANY KIND,EXPRESS OR IMPLIED, INCLUDING WARRANTIES OR REPRESENTATIONS CONCERNING MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OF ANY ONE OR MORE OF THE GOODS AND SERVICES REFERRED TO ABOVE_THE PARTIES AGREE THAT NO AGREEMENTS, REPRESENTATIONS OR WARRANTIES OTHER THAN THOSE EXPRESSLY SET FORTH IN THIS AGREEMENT AND THE NC HIE PRIVACY AND SECURITY POLICIES HAVE BEEN MADE, AND THAT NO FUTURE AGREEMENT, REPRESENTATION OR WARRANTY OF ANY PARTY WITH REGARD TO INFORMATION, GOODS OR SERVICES PROVIDED UNDER THIS AGREEMENT SHALL BE EFFECTIVE UNLESS EXPRESSLY STATED IN AN AMENDMENT TO, OR AN AMENDED AND RESTATED VERSION OF,THIS AGREEMENT. (c) PATIENT INFORMATION.PATIENT INFORMATION THAT MAY BE PROVIDED TO PARTICIPANTS AND THEIR AUTHORIZED USERS THROUGH THE HIE NETWORK ARE BEING PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT ANY WARRANTY OF ANY KIND,EXPRESSED OR IMPLIED,WHETHER STATUTORY OR COMMON LAW, ARISING FROM COURSE OF DEALING, OR OTHERWISE, INCLUDING WITHOUT LIMITATION ALL WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE_ NO PARTY WARRANTS THAT THE PERFORMANCE OF ITS SYSTEM OR THE HIE NETWORK OR THE DELIVERY OF PATIENT INFORMATION WILL BE TIMELY, UNINTERRUPTED, OR ERROR FREE. 13. LIMITATIONS OF PARTY LIABILITY. 13 (a) As between parties to this Agreement: No party shall be responsible to one another for any claims, demands, expenses, liabilities, or losses, including reasonable attorney fees,which may arise from any acts or failures to act by the other parties to this Agreement or such other parties' Workforce members or agents in connection with this Agreement. In circumstances involving harm to other parties caused by the acts or omissions of individuals who access Patient Information or Confidential Business Information through the HE Network by use of any security credential received or obtained directly or indirectly, lawfully or unlawfully,from a Participant or NC HIE or any Authorized Users or authorized members of NC HIE's Workforce, each party shall be responsible for such harm to the extent that the individual's access was caused by the party's breach of this Agreement or its negligent conduct for which there is a civil remedy under Applicable Law. Notwithstanding any provision in this Agreement to the contrary,the party shall not be liable for any act or omission if a cause of action for such act or omission is otherwise prohibited by Applicable Law. If the Participant is an agency of the State of North Carolina, the provisions of N.C. General Statutes §143-291 et.seq., North Carolina General Statutes,relating to sovereign immunity shall govern. (b) Patient Care. NC HIE does not assume any role in, and shall have no liability for,the care of any Individual, or outcomes therefrom. Each Participant and each Participant's Authorized Users shall be solely responsible for all decisions and actions taken or not taken involving patient care,utilization management, and quality management of Individuals resulting from or in any way related to the use of the HIE Network or Patient Information made available thereby. Neither Participants nor any of their Authorized Users shall have any recourse against, and each hereby waives any and all claims against NC HE for any loss, damage, claim or cost relating to or resulting from such Participant's or its Authorized Users' use or misuse of the HIE Network and Patient Information. (c) Patient Information. The parties acknowledge that Patient Information made available through the HIE Network is subject to change due to numerous factors, including without limitation changes to Patient Information made at the request of the Individual, changes in the Individual's health condition, the passage of time, and other factors. Without limiting any other provision under this Agreement, no party shall have responsibility for or liability related to the accuracy, content, currency, completeness, or delivery of any Patient Information provided by NC HIE,a Participant or a Participant's Authorized Users to or through the HIE Network (d) Limitation on Damages. It is expressly agreed that in no event shall a party be liable to another party for consequential, incidental, indirect, punitive, exemplary, or special damages suffered by a party or any other third party. Notwithstanding the foregoing,this Section 13 (d)shall not be construed to limit a party's liability to another party for consequential damages arising from a party's non-compliance with Applicable Law or the obligations under this Agreement. 14. INDEMNIFICATION. Each Party agrees to indemnify, defend, and hold the other and its successors, officers, directors, agents and employees harmless from any and all actions, causes of action, claims, demands, costs, liabilities, expenses and damages (including attorneys' fees)arising out of,or in connection with,the indemnifying Party's performance of its obligations under this Agreement or any breach of this Agreement by the indemnifying Parry. The obligation to indemnify in this Section 14 shall not apply to any Participant who is barred by 14 Applicable Law from indemnifying another party, nor shall any such Participant be entitled to indemnification by another Participant pursuant to this Section 14. 15. NOTICES.Any notice or other communication to be made under this Agreement shall be given in writing to the appropriate party's representative at the address listed in the Participant's Subscription Agreement and shall be deemed to have been delivered: (a)three(3) business days after deposit in the mail when mailed by first class mail, provided that notice of default or termination shall be sent by registered or certified mail, FedEx or United Parcel overnight delivery, return receipt requested; (b) upon the date indicated on the return receipt, when sent by certified or registered mail, return receipt requested; (c) upon delivery, if personally delivered;or(d)upon receipt/delivery,if sent by e-mail or fax. 16. AMENDMENTS. This Agreement,including all Exhibits attached hereto, may be amended by agreement of at least two-thirds(2/3)of the Board of Directors of NC HIE. However, if a change to this Agreement or the Exhibits is required for NC HE or Participants to comply with Applicable Law,then this Agreement or the Exhibits, as applicable, may be amended by approval of a majority of the NC HIE Board. All approved amendments shall be distributed to Participants within five (5) business days of approval and shall become effective thirty(30)days after distribution, except for amendments required by Applicable Law, which shall become effective on the date specified by the NC HIE Board or, if no date is specified,then upon approval. 17. ASSIGNMENT. NC HIE may assign or transfer this Agreement to a successor- in-interest or to an acquiror of all or substantially all of the assets of NC HIE. Participants may not assign or transfer this Agreement, or any part thereof, without the prior written consent of NC HIE, such consent not to be unreasonably withheld.This Agreement shall be binding on NC HIE and Participants,their successors and permitted assigns. 18. WAIVER No failure or delay by NC HIE or Participant in exercising their rights under this Agreement shall operate as a waiver of such rights or estop enforcement thereof, and no waiver of any breach shall constitute a waiver of any prior, concurrent, or subsequent breach or estop enforcement thereof. 19. INTERPRETATION. This Agreement, all its Exhibits, and applicable Subscription Agreements shall be interpreted as a related set of agreements, obligations and requirements. In the event of any material conflict or ambiguity between any of their provisions, the provisions of this Agreement shall control. Any representation, promise, or condition, whether oral or written, that is not incorporated within the agreements described in this Section 19 or in the NC HIE Policies and Procedures,shall not be binding upon NC HIE or Participants. 20. INCORPORATION BY REFERENCE. All Exhibits attached to this Agreement are incorporated herein by reference and made a part of this Agreement as if those Exhibits were set forth in the text of this Agreement. 21. SEVERABILITY. If any portion of this Agreement shall for any reason be invalid or unenforceable, such portion shall be ineffective only to the extent of such invalidity or unenforceability,and the remaining portions shall remain valid and enforceable and in full force and effect. 22. RELATIONSHIP OF NC HIE AND PARTICIPANTS. Except as specifically provided in Section 6(e) above, nothing contained in this Agreement shall constitute, or be 15 construed to create, a partnership,joint venture, agency or any other relationship between NC HIE and Participants other than that of independent contractors. 23. THIRD-PARTY BENEFICIARIES. This Agreement does not and will not create in any natural person,corporation,partnership or other organization or entity other than NC HIE and Participants any benefits or rights, and this Agreement will be effective only as to NC HIE and Participants and their successors and permitted assigns. 24. FORCE MAJEURE. Notwithstanding any provision hereof to the contrary, in the event of a disruption, delay or inability to complete the requirements of this Agreement due to natural disasters,acts of terror or other similar events out of the reasonable control of NC HIE or Participants,none of them shall be considered in breach of this Agreement. 25. COUNTERPARTS. This Agreement may be executed in any number of counterparts,each of which will be deemed an original but all of which taken together will constitute one and the same instrument. 26_ AUTHORITY TO SIGN. NC HIE and Participants warrant that they have the capacity to enter into and perform the obligations under this Agreement and all activities contemplated herein, and that all corporate and other actions required to authorize them to enter into and perform this Agreement were properly taken. 27. GOVERNING LAW. This Agreement shall be governed by and construed in accordance with the applicable laws of the State of North Carolina and applicable Federal law. 28. SURVIVAL. The respective rights and obligations of NC HIE and Participants under Sections 9 (Breach Notification), 10 (Confidential Business Information), 11(b), (Disposition of Patient Information Upon Termination of this Agreement), 13 (Limitations of Liability), 14 (Indemnification), and any other provision of this Agreement that by its nature or by express statement should survive,shall survive the termination of this Agreement by NC HIE. Signature page follows. 16 IN WITNESS WHEREOF, NC HIE has executed this Agreement as of the date first written above. f '.r By: SC r -- Title: PC y 10 c.,-L Date: 17 ATTACHMENT B PARTICIPATING ENTITIES Orange County Health Department (Hillsborough) Whiffed Human Services Center 300 W. Tryon St. Hillsborough,NC 27278 (Chapel Hill) Southern Human Services Center 2501 Homestead Rd. Chapel Hill,NC 27516 15 EXHIBIT D SERVICE LEVEL AGREEMENT (Attached Separately) 16 EXHIBIT D SERVICE LEVEL AGREEMENT NC HIE has set up a multiple Tier Help Desk process to resolve QO,if applicable,and Participant questions.The table below outlines some typical questions and related responsibilities by Tier.The basic principle is that the QO or Participant Administrator(s)provide the initial support and helpdesk to the Participants'users and that NC HIE Call Center will handle the 2n Tier,if needed. In addition,NC HIE will provide an online issue tracking system that includes a full text search capability for finding solutions to similar issues. Un User QO or Participant Administrator QO/Participant Adrninistrator(s) Questions QO or Participants that have a question QO/Participants Tier I Help Desk cannot resolve: regarding that a participant cannot access or What is my user id? connect to the HIE. • Could you reset my password? that a participant is not able to access • How.do I set up a new user patient information by breaking the • How do I do access or connect glass: to the HIE? the slow performance of the system • I have an individual who the error message that;a participant is wants to Opt-Out. what is receiving. this process? when will we have a gateway to VA? Could you help me with a - I cannot access the online ticketing technical issue with the HIE system solution? QO/Participant Help Desk and Support to the Inform outcome to participants Role participants NC HIE Role Make training and FAQ available for Help desk and support to the QOTarticipant QO/Participant Help Desk Administrator(s)(designated contacts) Service Level Agreements Definitions: The Service Level describes the key areas of measurement used for demonstrating compliance with the provision of services.The Service Level Metric is a subset of each Service Level.The Service Levels are described with some of the following components. • Actual Uptime-means the measurement of time that the Service is actually available for use by NC HIE and its users as contemplated under the QO/Participant Subscription Agreement during a calendar month. Such measurement will be calculated by subtracting Downtime from Scheduled Uptime. • "Available"or"Availability"-means the Actual Uptime expressed as a percentage of the Scheduled Uptime for the Service(i.e.,Availability%=((Actual Uptime)/(Scheduled Uptime))x 100%). The Service shall not be considered Available(i)during an Outage or(ii)when it is not otherwise available for use by NC HIE and its users. • NC HIE Environment—The environment for which the definition of the scope of Service is defined and includes the system servers,operating system,and databases.NC HIE will work with QO/Participant to address network-based outages but does not have responsibility for network service levels. • Downtime-means the aggregate duration of Outages for the Service during the applicable Scheduled Uptime during a calendar month. • "Incident"or"Problem"means any event in the Service that is not part of the standard operation of the service and that causes,or may cause,an interruption to,or a reduction in,the quality or Availability of the Services. • Measurement Hours—Sets forth the hours and respective time zones that performance against the Service Level will be measured. • Outage-means any time during which the Service is not Available as defined as a Priority 1 and 2 incident in which NC HIE Solution is not responding or performing according to specification, measured from the point in time that such is or reasonably should be detected by NC HIE,but in any event no later than the time the Outage actually occurred. An Outage is an Incident. • Production Environment-The system environment,which the NC HIE is using to process live business data in actual business operations. • Reporting Period—The Reporting Period sets out the periodic basis for which performance reports for the Service Level will be delivered. • Resolve or Resolution-means,with respect to an Incident,that a workaround or fix with respect to such Incident has been implemented by NC HIE. • Resolution Time-"Resolution Time"shall be calculated for each Incident occurring in a calendar month as the total minutes commencing from the time when NC HIE becomes aware of a Priority 1,2,or 3 Incident,whether by automated alarm or otherwise,until NC HIE resolves each such Incident as determined by QO/Participant. NC HIE shall track and report monthly to QO/Participant each Priority 1, 2 and 3 Incident and the time required to resolve each such Incident. The Resolution Time Service Level is set forth on the Problem Management Process service level. . • Respond -means,with respect to an Incident, that NC HIE has notified QO/Participant of such Incident and commenced steps to Resolve such Incident. • Scheduled Uptime - means twenty-four (24)hours each day, seven (7) days per week, excluding (i) regular maintenance windows between the hours of 10:00 p.m. and 3:00 a.m. Pacific Time on Saturdays and Sundays and(ii) Scheduled Outages. NC HIE shall ensure that the Services remain Available during the foregoing maintenance windows to the extent reasonably practicable. • Server-shall mean the server(s)on which the Services will be hosted. • Service-shall be the Hosting services delivered by NC HIE to the QO/Participant. • Service Level Metric—The Service Level Metric is comprised of two parts,the Metric and the Threshold. The Metric is the value that defines the data points that will be measured and reported.The Threshold is a description of the metric level to be measured against. Threshold levels will be Service Level,and Missed Service Level. Problem Management Process Coverage Hours: Help desk coverage shall be provided by NC HIE to QO or Participant Administrators on Business Days (Monday—Friday)8 AM to 8 PM EST. A Business Hour is defined as 8 AM to 8 PM EST during any Business Day.After hours coverage will be available for Priority 1 and Priority 2 problems on a 24x7x365 basis. Problem Priority Definition All problems or requests received by NC HIE help desk shall be given a problem priority based on the feedback from the reporting parry.The definitions for Problem Priority are as follows: Pii6iity Detention Priority 1 Priority 1 Critical Business Impact—System down or immediate work stoppage of a critical business service that threatens current and future productivity. Priority 2 Priority 2 Significant Business Impact—Problem where system or business service is proceeding but in a seriously impaired or in a restricted fashion and no acceptable workaround is possible. Priority 3 Priority 3 Some Business Impact—Problem for which the impact is an inconvenience,which may require a workaround to restore functionality and productivity is not seriously impaired. Priority 4 All other problems or requests. Problem Response Time For purposes of reporting and tracking problems as well as ensuring that problem resolution is completed in a timely and orderly manner,the following guidelines have been establish for problem response times. Key definitions are: • Initial Response: This term shall refer to NC HIE providing updates to QO by phone,email or other manner as determined by NC HIE for resolution of each support request submitted by QO. • Progress Report:This term shall define the frequency with which updates are provided to the parry who report the problem/request • Communication Method:This term shall refer to the method through which Progress Reports and the Initial Response are communicated to the reporting party • Target Resolution Time: This term shall mean the target elapsed time between when NC HIE is formally notified of a support request by QO and the time a final position is agreed between NC HIE and QO/Participant,where either a solution(which may be remedying the fault or providing a work-around)has been reached or no further action can be taken under the terms of this Agreement. This time is a target only,and NC HIE does not guarantee that any particular support request will be resolved within the specified time period. Fault Initial Progress. Communication Target"Resolution ; Coverage Priority Response "` Report Method Time Hours) Level Time Level 1 1 Hour 2 Hours Phone and e-mail 5 Business Hours 7x24x365 Level 2 2 Hours 4 Hours Phone and e-mail 10 Business Hours 7x24x365 Leve13 Next Business Daily E-mail 3 Business Days Business Day Day Leve14 Next Business As required E-mail By arrangement Business Day Day Service Availability: NC HIE systems and services shall achieve a Systems Availability of 99.7%or better.The Systems Availability will be measured Daily and reported to QO/Participants on a monthly basis. EXHIBIT E ADDITIONAL PERMTTED USES AND DISCLOSURES Pursuant to Section 3(b) of this Agreement, in addition to those reasons for which Patient Information may be acquired, accessed, used or Disclosed through the HIE Network under the terms and conditions of the Participation Agreement, Patient Information made available by Participant to NC HIE may be acquired, accessed, use or Disclosed through the HIE Network as for the following additional reasons: To make Participant's Patient Information available to North Carolina Community Care Networks, Inc., and its Affiliates d/b/a Community Care of North Carolina(CCNC) for purposes of providing patient care, or conducting quality assessments and improvement activities, including case management or care coordination, in connection with one or more health care quality initiative programs administered or sponsored by CCNC. NC HIE represents to Participant that (i) CCNC is an existing Participant of the HIE Network, and (ii)NC HIE has entered into a Business Associate Agreement with CCNC through NC HIE's and CCNC's execution of the NC HIE Participation Agreement, which, among other things, permits NC HIE to receive and disclose certain individually identifiable health information from, on behalf of, or to CCNC. 17 EXHIBIT F SOFTWARE VENDOR INDEMNITY AND LIMITATION OF LIABILITY. (Attached Separately) 18 EXHIBIT F SERVICE LEVEL AGREEMENT SOFTWARE VENDOR INDEMNITY AND LIMITATION OF LIABILITY. (a) For purposes of this Section 11 of the Agreement, the term "Software" shall mean and refer to, severally and collectively, the Portal v7.0 (including Results Viewer), Rhapsody Integration Engine, Clinical Data Repository, HIE Module, NextGate Master Patient Index, NextGate Provider Index, and Health Language LE Architecture software owned by Orion Health, Inc. ("Orion Health") and which is used in connection with the operation of the HIE Network and offering of the Services by NC HIE for end use by Participants and their Authorized Users. (b) Orion Health shall have no liability for any third party claim with respect to medical malpractice related to the use of the Software unless and until adjudicated by a court of competent jurisdiction and the cause of the claim is determined by such court to be directly related to the malfunction of the Software. Participant shall indemnify Orion Health for any breach of Participant's obligations under this Agreement or the Participation Agreement. (c) ORION HEALTH SHALL NOT BE LIABLE TO PARTICIPANT FOR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES (INCLUDING DAMAGES RELATED TO DELAYS, LOSS OF DATA, INTERRUPTION OF SERVICE OR LOSS OF USE, BUSINESS, REVENUE, OR PROFITS), OR THE USE OR INABILITY TO USE THE SOFTWARE, UNLESS SUCH DAMAGES RESULT FROM OR ARISE OUT OF, OR ARE AWARDED AS A RESULT OF, THE GROSSLY NEGLIGENT ACTS OR OMISSIONS, OR INTENTIONAL WRONGDOING, OF ORION HEALTH. (d) ORION HEALTH'S TOTAL LIABILITY TO PARTICIPANT OR ANY THIRD PARTY AND PARTICIPANT'S EXCLUSIVE REMEDY FOR ANY ACTUAL OR ALLEGED DAMAGES ARISING OUT OF, BASED ON OR RELATING TO THE SOFTWARE SHALL BE LIMITED TO (A) FOUR MILLION DOLLARS ($4,000,000) FOR ANY CLAIM AND RESULTING LIABILITY DIRECTLY RELATED TO THE OPERATION OR USE OF THE SOFTWARE; OR(B) TWO MILLION DOLLARS ($2,000,000) IN TOTAL FOR ANY CLAIM AND RESULTING LIABILITY DIRECTLY RELATED TO THE MAINTENANCE, SUPPORT OR IMPLEMENTATION SERVICES PROVIDED BY ORION HEALTH. (e) Orion Health shall be an intended third parry beneficiary of the terms and provisions of this Section 11. i E7111BIT A TO THE NC HIE PARTICIPATION AGREEMENT BUSINESS ASSOCIATE OBLIGATIONS 1. PURPOSE: The purpose of this Exhibit A is to provide satisfactory written assurances to Covered Entity Participants that NC HIE will comply with applicable business associate requirements of the HIPAA Regulations,specifically,45 C.F.R. §§ 164.314(a),.502(e), .504(e), of the privacy and security regulations as modified by the HITECH Act and implemented by Regulations and Guidance. 2. APPLICATION: In addition to the requirements set forth in this Agreement,NC HIE agrees to the following responsibilities which shall apply solely in NC HM's capacity as a Health Information Exchange and on behalf of a Covered Entity Participant: (a) Creates, receives, maintains, or transmits Protected Health Information (PHI)for a function or activity regulated by the HIPAA Privacy Rule;or (b) Provides, other than in the capacity of a member of the Work force of a Covered Entity Participant, HIE Services, consulting, data aggregation (as defined in 45 CFR §164-50 1),management,administrative,or other services to or for a Covered Entity Participant, where the provision of the service involves the Disclosure of PHI from such Covered Entity Participant,or from another Business Associate of the Covered Entity Participant,to NC HIE. 3. DEFINITIONS. All capitalized terms used, but not otherwise defined in this Agreement, shall have the same meaning for those terms as set forth in the HIPAA Privacy and Security Rules for purposes of this Exhibit A. (a) Breach shall the same meaning as the term"Breach" set forth in 45 C.F.R. § 164.402. (b) Designated Record_ Set shall have the same meaning as "Designated Record Set"set forth in 45 C.FR § 164.501. (c) HITECH Act means Title XIII and Title IV of Division B of the American Recovery and Reinvestment Act of 2009,Public Law No. 1 1 1-5. (d) Individual has the same meaning as the term "individual" in 45 C.F.R. § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R.. § 164.502(g). (e) Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 C.FR part 160 and part 164,subparts A and E. (f) Protected Health Information or PHI and ePHI shall have the same meaning as the term"protected health information"in the HIPAA Regulations and shall include em. Specific references to"ePHP' shall be deemed to refer only to PHI in electronic form All references to PHI or ePHI shall refer only to PHI or ePHI of Covered Entity Disclosed to, accessed,used,held,or created by NC HIE under an applicable Subscription Agreement and this Agreement unless specifically stated otherwise. (g) Required By Law has the same meaning as the term"required by law"in 45 CF.R-§ 164.103. 18 (h) Security Incident shall mean the attempted or successful unauthorized access, use, Disclosure, modification, or destruction of information or interference with System operations in an information system. (i) Security Rule means the Security Standards and Implementation Specifications at 45 C.F.R part 160 and part 164,subpart C. (j) Unsecured Protected Health Information shall mean Protected Health Information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in guidance published at 74 Fed. Reg. 19006 (April 27, 2009), and in any additional guidance published thereafter. 4. PERMITTED USES and DISCLOSURES. (a) NC HIE may use and Disclose PHI on behalf of Covered Entity Participants in accordance with the terms and conditions of any applicable Subscription Agreement and this Agreement, and, if necessary: (i) for the proper management and administration of NC HIE; and (ii) to carry out the legal responsibilities of NC HIE, provided that in each such instance,NC HIE may only disclose PHI if. (i) the disclosure is Required By Law;or(ii)NC HIE obtains reasonable assurances from the person or entity to whom the PHI is disclosed that such PHI will remain confidential and will be used or further disclosed only as Required By Law or for the purpose for which such PHI was disclosed to the person or entity, and the person or entity notifies NC HIE of any instances of which it is aware in which the confidentiality of such PHI has been breached;and (b) NC HIE may use or disclose PHI pursuant to a valid authorization by an Individual that satisfies the requirements of 45 C.F.R § 164.508. 5. OBLIGATIONS OF NC HIE. (a) Prohibition on Unauthorized Use or Disclosure.NC HIE will not use or disclose PHI except as permitted or required by the Privacy Rule, the Security Rule, this Agreement,applicable Subscription Agreements,or as Required By Law. (b) Minimum Necessary Uses and Disclosures.NC HE shall limit its use and disclosure of PHI under this Agreement to the"minimum necessary"as set forth in guidance that the Secretary issues under the Privacy Rule, or if guidance has not been issued, to the Limited Data Set(as defined by HIPAA) or the minimum necessary to carry out NC HIE's duties. This Section 5.(b) does not apply to: (i) Disclosures to, or requests by, a health care provider for treatment; (ii)uses or Disclosures made to the Individual; (iii)Disclosures made pursuant to an authorization as set forth in 45 C.FR§ 164.508;(iv)Disclosures made to the Secretary under 45 C.F.R.part 160, subpart C; (v)uses or Disclosures that are Required By Law as described in 45 C.F.R. § 164.512(a); and (vi) uses or Disclosures that are required for compliance with applicable requirements of the Privacy Rule. (c) Safeguards. NC HIE will use appropriate safeguards to prevent the use or Disclosure of PHI other than as provided for by this Agreement. NC HIE will implement administrative, physical and technical safeguards as required by the Security Rule, and that reasonably and appropriately protect the confidentiality and integrity of the Electronic Protected Health Information that it creates,receives,maintains or transmits on behalf of Covered Entity Participant. 19 (d) Duty to Report Violations. NC HIE agrees to report to Covered Entity Participants any use or Disclosure of PHI by NC HIE not allowed for by the Privacy Rule, the Security Rule or this Agreement of which it becomes aware. NC HIE agrees to report to Covered Entity Participants any Security Incident of which it becomes aware, except that, for purposes of this reporting requirement,the term"Security Incident"shall not include: (i)"pings" on NC HIE's firewall(s); (b)port scans;(c) attempts to log on to NC HIE's systems or to enter a database of NC HIE with an invalid security credential; (d) denial-of-service attacks that do not result in a server being taken offline; or(e)malware, (e.g., a worm or virus)that does not result in unauthorized access, use, disclosure, modification or destruction of Electronic Protected Health Information. (e) Duty to Report Breaches. NC HIE also agrees to report any other Breaches of PHI If a Breach occurs,NC HIE shall cooperate and assist in any steps taken by Covered Entity Participant to mitigate and address the Breach in accordance with Section 10 of this Agreement.Business Associate shall maintain evidence to demonstrate that any notifications required under this Section were made by Business Associate. (f) Subcontractors and Agents. NC HIE agrees to ensure that any subcontractor or agent to whom it provides PHI agrees in writing to the same restrictions and conditions that apply through this Agreement to NC HIE with respect to such PHI. NC HIE will ensure that any agent,including a subcontractor,to whom it provides Electronic Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect such Electronic Protected Health Information. Personel data made available to NC HE by Covered Entity Participant for the performance or administration of this Agreement shall be used only for those purposes and shall not be used in any other way without the prior written approval of the Covered Entity Participant. (g) Access to PHI Upon request by Covered Entity Participant, NC HIE agrees to provide access to PHI in a Designated Record Set in NC HIE's possession and control to Covered Entity Participant or,at the direction of Covered Entity Participant to an Individual in order to meet the requirements of 45 C.F.R. § 164.524. (h) Amendment of PHI.Upon request by Covered Entity Participant,NC HIE agrees to make available to the Covered Entity Participant, PHI in a Designated Record Set in NC HIE's possession and control, as required for amendment of such PHI, and shall make and incorporate any amendment(s) to the PHI that the Provider agrees to pursuant to 45 C.F.R. § 164.526. (i) IMection of Books and Records.Upon reasonable notice,NC HIE agrees to make its internal practices, books, and records relating to the use and disclosure of PER available to Covered Entity Participant or, at the request of Covered Entity Participant, to the Secretary in a time and manner designated by Provider or the Secretary for purposes of the Secretary determining Provider's compliance with the Privacy Rule or Security Rule. (j) Accounting of Disclosures. NC HIE agrees to provide to Covered Entity Participants,upon request,information regarding disclosures of PHI by NC HIE through the HIE Network to permit Covered Entity Participants to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528. 20 6. RETURN OF PHI UPON TERMINATION. Upon termination as provided for in Section 11 of the Agreement,NC HIE shall return or destroy all PHI received from or created or received by NC HIE on behalf of Covered Entity Participants that NC HIE still maintains in any form and retain no copies of such information- In the event that NC HIE determines that retaming or destroying the PHI is infeasible,NC HIE shall provide to Covered Entity Participant notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the parties that return or destruction of PHI is infeasible,NC HIE shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as NC HIE maintains such PHL 21 Client#: 1536997 201NCHEA2 DATE(MM/DDNYYY) ACORD,. CERTIFICATE OF LIABILITY INSURANCE 3/2012014 THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER.THIS CERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND,EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES BELOW.THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S),AUTHORIZED REPRESENTATIVE OR PRODUCER,AND THE CERTIFICATE HOLDER. IMPORTANT:If the certificate holder is an ADDITIONAL INSURED,the policy(ies)must be endorsed.If SUBROGATION IS WAIVED,subject to the terms and conditions of the policy,certain policies may require an endorsement.A statement on this certificate does not confer rights to the certificate holder in lieu of such endorsement(s). PRODUCER NAME: BB&T Insurance Services,Inc. PHONE 919 281-4500 AX,No): 8887468761 AIC No,Ext Post Office Box 13941 E-MAIL ADDRESS: Durham,NC 27709 INSURER(S)AFFORDING COVERAGE NAIC# 919 281-4500 INSURER A:Sentinel Insurance Company,Ltd 11000 INSURED INSURER B:Allied World Assurance Company 19489 North Carolina Health Information Exch INSURER C: 2300 Rexwoods Drive;Suite 390 INSURER D Raleigh,INC 27607 INSURER E INSURER F: COVERAGES CERTIFICATE NUMBER: REVISION NUMBER: THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIOD INDICATED. NOTWITHSTANDING ANY REQUIREMENT, TERM OR CONDITION OF ANY CONTRACTOR OTHER DOCUMENT WITH RESPECT TO WHICH THIS CERTIFICATE MAY BE ISSUED OR MAY PERTAIN, THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS, EXCLUSIONS AND CONDITIONS OF SUCH POLICIES. LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS. LTRR TYPE OF INSURANCE NSR WVD POLICY NUMBER MMIDDmYY MM/DDYIYYYY LIMITS A GENERAL LIABILITY 22SBABK5678 7101/2013 07101/201 -EACH OCCURRENCE $11,000,000 X COMMERCIAL GENERAL LIABILITY PREMISES Ea RENTED $1,000,000 CLAIMS-MADE [�OCCUR MED EXP(Any one person) $10,000 PERSONAL&ADV INJURY $1,000,000 GENERAL AGGREGATE $2,000,000 GEN'L AGGREGATE LIMIT APPLIES PER: PRODUCTS-COMP/OP AGG $2,000,000 POLICY 7 PR10T_ LOC COMBINED SINGLE LIMIT $ A AUTOMOBILE LIABILITY 22SBABK5678 7/01/2013 07/01/201 Ea accident 1,000,000 ANY AUTO BODILY INJURY(Per person) $ LHIRED NED SCHEDULED BODILY INJURY(Per accident) $ AUTOS PROPERTY DAMAGE $ NON-OWNED Per accident X AUTOS X AUTO S A X UMBRELLA LIAB X OCCUR 22SBABK5678 7/01/2013 07/011201 EACH OCCURRENCE $11.000.000 EXCESS LIAB CLAIMS-MADE AGGREGATE $1,000,000 DED X RETENTION$10000 $ WORKERS COMPENSATION WC STATU- OTH- AND EMPLOYERS'LIABILITY ANY PROPRIETOR/PARTNER/EXECUTIVE YIN N E.L.EACH ACCIDENT $ OFFICERIMEMBER EXCLUDED? ❑ N/A (Mandatory in NH) E.L.DISEASE-EA EMPLOYEE $ If yes,describe under DESCRIPTION OF OPERATIONS below E.L.DISEASE-POLICY LIMIT $ B Errors&Omi 03074541 4106/2013 04/061201 $2,000,000 Limit $50,000 Ded DESCRIPTION OF OPERATIONS/LOCATIONS/VEHICLES(Attach ACORD 101,Additional Remarks Schedule,if more space is required) CERTIFICATE HOLDER CANCELLATION SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE North Carolina Health THE EXPIRATION DATE THEREOF, NOTICE WILL BE DELIVERED IN Information Exchange ACCORDANCE WITH THE POLICY PROVISIONS. 2300 Rexwoods Drive,Ste 390 Raleigh,INC 27607 AUTHORIZED REPRESENTATIVE ©1 88-2010 ACORD CORPORATION.All rights reserved. ACORD 25(2010/05) 1 of 1 The ACORD name and logo are registered marks of ACORD #S12018184/M12018171 SB7