HomeMy WebLinkAbout2018-132 Health - UNC Health Care System new EMR system UNCHCS
EMR SYSTEM ACCESS AGREEMENT
This EMR System Access Agreement ("Agreement") is made and entered into as of June 26 ,
2018 (the "Effective Date") written above by and between University of North Carolina Health
Care System ("UNCHCS ") , and Orange County, a body politic and corporate , by and through its
Orange County Health Department (" CLIENT") :
1 . Definitions . As used in this Agreement, the following capitalized terms shall have the
following meanings :
1 . 1 " Client Equipment " means all hardware , software (other than the EMR System) ,
printers , peripherals , network connectivity, and other client- side components
required for remote access to and use of the EMR System, as may be updated from
time to time by Epic and/or UNCHCS . The Client Equipment required as of the
Effective Date is described in Exhibit A attached hereto .
1 . 2 "EMR System " means any and all Epic electronic health records software and
updates thereto licensed by Epic to UNCHCS and its affiliated entities and made
available for remote access and use by CLIENT under this Agreement, including
the computer program object and source code, and any instructions , manuals or
other materials relating to the installation, operation or code of the Epic electronic
health records software .
1 . 3 "Epic" means Epic Systems Corp . , a Wisconsin corporation, or any successor
thereto .
1 . 4 "Services " means any implementation, training, technical support, maintenance and
other services provided by or through UNCHCS to or for the benefit of CLIENT in
connection with the EMR System and this Agreement, including any attachments
hereto .
2 . Background . UNCHCS is a not- for-profit integrated health care system owned by the State
of North Carolina and based in Chapel Hill, North Carolina, which exists to further the
teaching mission of the University of North Carolina through its association with the UNC -
Chapel Hill School of Medicine and to provide state - ofAhe - art patient care through UNC
Chapel Hill faculty physicians , affiliated hospitals , centers of excellence and a network of
UNC - owned medical practices a community-based healthcare delivery, and to provide
quality healthcare services and improve the health and well-being of its community. In order
to better meet its mission, UNCHCS has invested in an electronic medical record_ system and
certain related components as further described on Exhibit A (the "EMR System") . CLIENT
and UNCHCS recognize the enormous benefit to patients when medical providers have
access to the EMR System when caring for patients . In order to realize this benefit for its
patients , CLIENT desires to obtain the right to access and use the EMR System, and, in order
to better serve the health needs of its community , UNCHCS desires to provide such access ,
subject to the terms and conditions of this Agreement.
3 . Provision of E_MR System.
3 . 1 Implementation . As soon as practicable following the Effective Date, UNCHCS
shall provide the services necessary to implement CLIENT' s access to the EMR
System, in accordance with this agreement and any attachments hereto .
3 . 2 Training . UNCHCS shall provide to CLIENT training at UNCHCS ' s facilities for
Authorized Users regarding use of the EMR System at mutually agreed upon
times and dates in accordance with a written training plan (the " Training
Services ") .
3 . 3 Grant of Access to EMR System . Subject to the terms and conditions of this
Agreement, UNCHCS hereby grants to CLIENT a non-exclusive , non-
transferable , non- sublicensable license to remotely access . and use the EMR
System, solely for storing, processing and displaying medical records and other
information, images and content related to the provision of healthcare to patients
of CLIENT, in accordance with the Epic user documentation, and in compliance
with all applicable laws and regulations , including, without limitation,
requirements set forth in rules and regulations promulgated under the
Administrative Simplification provisions of the Health Insurance Portability and
Accountability Act of 1996 , as amended (collectively, "HIPAA") , and fin they
subject to the Recovery and Reinvestment Act of 2009 , including its provisions
commonly known as the HITECH Act and rules and regulations promulgated
thereunder, as may be amended from time to time ("HITECH") as well as any
other federal , state or local laws , rules and regulations protecting the
confidentiality, privacy and security of Patient Records , protected health
information (PHI) and other confidential , proprietary, sensitive or personal
information (regardless of form or format, and whether or not obtained hereunder)
(collectively, "Applicable Law") , the terms and conditions set forth in this
Agreement, and UNCHCS ' duties and obligations to its Patients . For purposes of
this Agreement, "treatment" and "payment" shall have the same definitions as
those in HIPAA and HITECH (see 45 CFR 164 . 501 ) . Access to and use of the
EMR System under the foregoing license is strictly limited to the medical
providers (each a "Medical Provider") set forth in Exhibit A and their office
administrators , secretaries and nurses , and other support staff determined by
CLIENT to require access (collectively "Authorized Users ") . The number of
Authorized Users accessing the EMR System concurrently may not exceed the
maximum number listed on Exhibit A . CLIENT shall only request access to the
EMR System for a Medical Provider who ( 1 ) is duly licensed to practice medicine
or their particular allied health profession, or has received such other license or
certification as required by applicable law to provide any other applicable
category of health services in the State of North Carolina; and (2) has been
credentialed by CLIENT in accordance with CLIENT ' s policies and applicable
law.
3 . 4 Maintenance . UNCHCS shall provide the following maintenance and support
services (the "Maintenance and Support Services ") "
2
a. Technical Support. UNCHCS shall snake available to CLIENT
UNCHCS ' s technical support staff via UNC ' s Service Desk or use of
UNC ' s issue management solution (" Technical Support") for the purpose
of answering questions and assisting in resolving problems regarding the
use of the EMR System, all subject to and in accordance with UNCHCS ' s
standard practices and procedures for such technical support . Any issues
with the EMR System that cannot be resolved by UNCHCS ' s EMR
support staff shall be escalated by UNCHCS to Epic . UNCHCS shall use
commercially reasonable efforts to coordinate an appropriate resolution of
such support issues with Epic . Notwithstanding the foregoing , CLIENT
acknowledges that UNCHCS is not the vendor of the EMR System, and
shall have no direct responsibility or liability for the correction of bugs ,
errors , or other problems with the EMR System, or for any unavailability
of the EMR System caused by such problems , other than to escalate such
issues to Epic for resolution under the terms of support made available by
Epic .
b . System Availability. UNCHCS commits to maintain availability of the
EMR System for remote access and use by CLIENT on substantially the
same basis that UNCHCS makes the EMR System available to its internal
users . CLIENT acknowledges that from time to time , the EMR System
may be unavailable due to scheduled down time necessary to maintain
effective operation of the EMR System , and emergency downtime
required to correct problems or install emergency updates . Furthermore
UNCHCS does not control and shall have no responsibility or liability for
unavailability of the EMR System arising out of or resulting in whole or in
part from a failure of CLIENT ' s systems , network or facilities , any misuse
or unauthorized modification of the EMR System or Client Equipment by
CLIENT, its personnel , or a third party, disruptions to telecommunications
systems or the Internet generally, force maj eure events , or other events or
conditions outside of UNCHCS ' s reasonable control .
c. System Updates. During the term of the Agreement, UNCHCS shall
require for remote access and use by CLIENT certain software updates
and new versions of the EMR System that Epic releases and UNCHCS
chooses to deploy for the EMR System (" System Updates ") . System
Updates released by Epic to UNCHCS as part of Epic ' s standard
maintenance and support plan shall be made available to CLIENT in
consideration of CLIENT ' s payment of the annual maintenance fee , at no
additional charge . System Updates released by Epic outside of its
standard maintenance and support plan, such as new modules and add- ons ,
may not be available to CLIENT without the payment of additional
license , maintenance and support fees , to the extent Epic requires payment
from UNCHCS in connection with such items . UNCHCS shall retain
ultimate discretion and control over determining which System Updates
will be deployed for the EMR System and the schedule for
implementation of such System Updates . All System Updates deployed
3
by UNCHCS will be considered part of the EMR System , under and
subject to the license and other provisions of this Agreement, together
with any additional license terms and restrictions that may be imposed by
Epic for such System Updates . Client acknowledges and agrees that
certain System Updates will require additional training at UNCHCS ' s
facilities for Authorized Users regarding the use of the EMR System, such
training to be provided in accordance with UNCHCS ' s written training
plan .
3 . 5 Changes to EMR System . UNCHCS may, from time to time , change , update and/or
enhance the components and functionality of the EMR System . UNCHCS shall , in
accordance with its existing policy, timelines and methods for notifying internal
users , notify CLIENT of such changes if such changes will materially impact
CLIENT ' s use of the EMR System . In the event that any such changes materially
and adversely impact CLIENT ' s use of the EMR System , and if UNCHCS cannot
reasonably mitigate the impact, then CLIENT may terminate this Agreement upon
written notice given within ninety ( 90 ) days following implementation of the
change and UNCHCS shall refund to CLIENT any prepaid fees attributable to the
terminated portion of the Service Period in which such termination occurs .
3 . 6 Technology Refresh . CLIENT acknowledges that effective use of the EMR System
will require keeping pace with Client Equipment technology changes . From time to
time during the term of the Agreement, Epic and/or UNCHCS may announce
modified and/or additional technology infrastructure requirements arising out of,
among other factors , System Updates to the EMR System, necessary or desirable
standardization of technology across the EMR System user base , or the replacement
of outdated, under-performing or unsupported hardware , software or other
equipment . UNCHCS shall use commercially reasonable efforts to keep CLIENT
abreast of such changes . CLIENT acknowledges that UNCHCS does not have any
control over the timing or scope of any Client Equipment changes that may be
dictated by Epic or any other third party supplier . In the event a Client Equipment
change is required, UNCHCS agrees to provide CLIENT with six ( 6 ) months notice
prior to the effective date of such change . Upon receipt of such notice , CLIENT
may terminate this Agreement by providing UNCHCS with written notice no later
than ninety ( 90 ) days from the date CLIENT received notice of the Client
Equipment change . If CLIENT does not exercise its right to terminate the
Agreement, CLIENT shall be responsible for promptly procuring and installing (or
arranging for UNCHCS to install on its behalf) all Client Equipment (including
procuring maintenance and support plans , where applicable) required to meet such
announced requirements , at CLIENT ' s sole expense . In the event UNCHCS
purchases any Client Equipment on CLIENT ' s behalf, CLIENT shall promptly
reimburse UNCHCS for such costs .
3 . 7 License Restrictions . CLIENT shall not, nor shall it authorize or enable any other
person or entity to : ( a) reproduce , distribute , publicly display , sublicense , lease ,
rent , loan, transfer, or otherwise make available the EMR System to any third party ;
(b) modify , adapt, alter, translate , or create derivative works of the EMR System ;
4
(c) merge the EMR System with any other software ; (d) use the EMR System for
the benefit of a third party , whether in or as part of a service bureau, timesharing or
other capacity ; (e) use the EMR System in violation of any import, export, re - export
or other applicable laws or regulations ; (f) attempt to deactivate , bypass , or
otherwise circumvent the license keys , access controls , or other security measures
for the EMR System ; (g) attempt to gain unauthorized access to any data,
functionality, or systems of UNCHCS or any other user of the EMR System ; (h)
attempt to use automated systems (such as test tools , screen capture technology ,
scripted browsers , or other programmatic methods) not approved by UNCHCS and
Epic for use in conjunction with the EMR System ; (1 ) remove or obscure any
copyright or other proprietary rights , notices , trademarks , logos or trade
designations for the EMR System , or on any user screens or documentation
therefor ; (j ) disseminate viruses , Trojan horses , spyware , adware , or other malicious
code through the EMR System ; (k) disclose the results of any benchmarking or
other performance testing of the EMR System , except as required to meet its
obligations under this Agreement or to participate in a user group ; or (1 ) reverse
engineer, decompile , disassemble , or otherwise attempt to derive the source code
for the EMR System .
3 . 8 Reservation of Rights . Except for the express rights granted to CLIENT under this
Agreement, all rights , title and interest in and to the EMR System , the
documentation and any other information and materials provided to CLIENT by
UNCHCS in connection with this Agreement, including all intellectual property
rights therein, shall at all times remain solely with UNCHCS and its suppliers . No
rights or licenses , express or implied, are granted to CLIENT, other than the express
license rights set forth in this Agreement or granted to CLIENT by the applicable
supplier . The rights and licenses granted by UNCHCS and its suppliers do not
include a license to any patents or patent rights that may be held by a third party .
4 . Client Obligations .
4 . 1 Client Equipment . CLIENT acknowledges and agrees that the Client Equipment on
Exhibit A are necessary in order for CLIENT to access and use the EMR System
and must be obtained separately by Client . Client agrees that the Client Equipment
are not the subject of this Agreement, and UNCHCS shall not be responsible for the
procurement , installation or maintenance of the Client Equipment , and makes no
representations or warranties regarding the Client Equipment whatsoever . Any fees
for the Client Equipment shall be borne by CLIENT and paid directly . to the
vendors of the Client Equipment . CLIENT shall notify UNCHCS in writing at least
two weeks prior to any change to or addition of any hardware , equipment or other
components of the CLIENT equipment to allow UNCHCS to make necessary
modifications to the EMR System . CLIENT shall notify UNCHCS in writing six
months prior to any new clinic openings and/or clinic location move activities that
will impact IT networking and/or hardware .
4 . 2 Staffing Resources ; Testing and Functionality . In addition to the responsibilities
specifically identified elsewhere in this Agreement, CLIENT is responsible for : (i )
5
appointing a qualified project leader to manage CLIENT ' s responsibilities and
coordinate with UNCHCS regarding the implementation and other activities under
this Agreement; (ii) appointing and procuring training for at least one employee to
serve as CLIENT ' s " Super User" in fielding dayAo - day questions and issues
encountered by CLIENT ' s end users ; (iii) maintaining internal business continuity
and disaster recovery procedures , consistent with EMR System business continuity
functionality, in the event of unavailability of the EMR System for any reason ; (iv)
testing and validating the EMR System for use in CLIENT ' s business , including
compatibility with CLIENT ' s culture , policies , procedures and operations ; and (v)
assigning a project team and point- of- contact for each application area within the
EMR System .
4 . 3 Authorized Users . In order to remotely access and use the EMR System, CLIENT
must set up and manage user accounts for each of its Authorized Users in
accordance with UNCHCS ' s standard policies and procedures . As part of its initial
access request hereunder, CLIENT will provide UNCHCS with the name and
contact information of CLIENT ' s Privacy Officer and/or Administrator
("Administrator") and notify UNCHCS of any change in such contact( s) . The
Administrator will coordinate the Authorized Users ' access to the EMR System
hereunder, if granted, with UNCHCS Registration . The Administrator is
responsible for managing the initiation, changes and termination of any Authorized
User user accounts created for such access if granted . Each account may be used
only by the individual authorized by CLIENT . CLIENT is solely responsible for
the selection of its Authorized Users , all use of user IDs and passwords assigned to
Authorized Users , the implementation and maintenance of security or chosen by
relating to access to the EMR System through CLIENT ' s facility , and all activities
occurring under its user accounts . CLIENT shall ensure that such Authorized Users
(1) keep any and all usernames , passwords and account information confidential ,
private and secure , (ii) use only the usemames , passwords and account information
assigned to them and (iii) not share usernames , passwords and account information
with any other person or entity including , without limitation, any other CLIENT
personnel . CLIENT shall notify UNCHCS immediately in the event of any known
or suspected misuse of any usernames , passwords and account information .
UNCHCS reserves the right to temporarily suspend access to the EMR System
and/or any user account , but only if such suspension is necessary to protect the
security and integrity of the EMR System . In connection with any such suspension
of access , UNCHCS shall contact CLIENT ' s designated representative by email or
telephone and await CLIENT ' s response for at least thirty (30 ) minutes before
suspending access , where feasible and appropriate , and in any event shall promptly
contact CLIENT to coordinate an appropriate resolution .
4 . 4 Compliance with Laws . CLIENT is responsible for all use of the EMR System by
its Authorized Users . CLIENT represents and warrants that it shall comply with :
(a) all reasonable remote access and network security requirements communicated
by UNCHCS from time to time ; and (b ) all applicable federal , state or local laws
and regulations and rules of professional conduct . CLIENT shall not use or enable
its Authorized Users to use the EMR System (1) in violation of any applicable
6
export laws and regulations ; (n ) in violation of any applicable federal , state or local
laws or regulations , including without limitation any laws governing access to the
EMR System or governing CLIENT ' s use of patient medical records and other
information and materials uploaded to the EMR System by Authorized Users ; or
(iii) in ways that interfere with other users of the EMR System or other networks .
4 . 5 Restrictions . CLIENT shall not, nor shall it authorize or enable any other person or
entity to : (a) reproduce , distribute , publicly display, sublicense , lease , rent, loan,
transfer, or otherwise make available the EMR System to any third party ; (b)
modify , adapt, alter, translate , or create derivative works of the EMR System ; (c)
merge the EMR System with any other software ; (d) use the EMR System for the
benefit of a third party, whether in or as part of a service bureau, timesharing or
other capacity ; (e) use the EMR System in violation of any import, export , re - export
or other applicable laws or regulations ; (f) attempt to deactivate , bypass , or
otherwise circumvent the license keys , access controls , or other security measures
for the EMR System ; (g) attempt to gain unauthorized access to any data,
functionality, or systems of UNCHCS or any other user of the EMR System ; (h)
attempt to use automated systems ( such as test tools , screen capture technology ,
scripted browsers , or other programmatic methods) not approved by UNCHCS and
Epic for use in conjunction with the EMR System ; (1) remove or obscure any
copyright or other proprietary rights , notices , trademarks , logos or trade
designations for the EMR System , or on any user screens or documentation
therefor ; (j ) disseminate viruses , Trojan horses , spyware , adware , or other malicious
code through the EMR System ; (k) disclose the results of any benchmarking or
other performance testing of the EMR System , except as required to meet its
obligations under this Agreement ; or ( 1 ) reverse engineer, decompile , disassemble ,
or otherwise attempt to derive the source code for the EMR System .
5 . Ownership .
5 . 1 EMR System . Except for the express rights granted to CLIENT under this
Agreement, all right , title and interest to the EMR System , the software applications
used to provide the EMR System , the documentation and any other information ,
software or materials provided to CLIENT by UNCHCS under this Agreement,
including all intellectual property rights therein, shall at all times remain solely with
UNCHCS and/or its licensors and vendors . CLIENT shall reproduce all copyright
and trademark notices appearing on all copies of the documentation .
5 . 2 Third- Party Software . If UNCHCS licenses any third-party software on CLIENT' s
behalf at CLIENT ' s request, CLIENT shall execute any required third-party license
agreements prior to delivery or installation of the third-party software . If UNCHCS
installs third- ft party soware at CLIENT ' s request and acceptance of license terms is
affected electronically, CLIENT authorizes UNCHCS to accept the third-party
license terms on CLIENT ' s behalf.
6 . Payment, Pricing.
7
6 . 1 Fees . CLIENT shall pay to UNCHCS the fees and expenses set forth in Exhibit A .
The maximum amount payable -under this Agreement is one hundred twenty- seven
thousand and three hundred sixty- one dollars ( $ 127 , 361 . 00 ) . This amount may not
be exceeded without a written amendment duly executed by authorized
representatives of both parties . Neither the fees charged to CLIENT under this
agreement nor CLIENT' s eligibility to enter into this agreement were determined in
a manner that takes into account the volume or value of referrals or other business
generated between the parties . Except as otherwise set forth in Exhibit A , all
invoices shall be due upon receipt .
6 . 2 Late Payments . All payments not made within thirty (30 ) days after they become
due shall be subject to late charges of the lesser of (1) one and one -half percent
( 1 . 5 %) per month of the overdue amount or (ii) the maximum amount permitted
under applicable law. In addition to any other remedies that may be available ,
UNCHCS may suspend access to the EMR System in the event that payment
remains outstanding for more than fifteen ( 15 ) days after written notification to the
CLIENT .
6 . 3 Fee Increases . UNCHCS reserves the right to increase the pricing under this
Agreement on the terms set forth herein and in the Exhibits attached hereto to
reflect any additional fees and charges imposed by Epic or any original equipment
manufacturer in connection with CLIENT ' s access to and use of the EMR System
or the Client Equipment and/or to reflect any increased costs borne by UNCHCS in
connection with the provision of the Services . UNCHCS shall provide supporting
documentation for any increases made in respect of fees or charges imposed by
Epic or any original equipment manufacturer upon CLIENT ' s written request . Any
increase in this pricing under this Agreement must be memorialized in a written
amendment duly executed by authorized representatives of both parties .
7 . Term ; Termination .
7 . 1 Initial Term ; Renewal . The term of this Agreement shall commence on the
Effective Date and shall continue for an initial term of three (3 ) years (the " Initial
Term " ) , unless sooner terminated in accordance with the provisions hereof. At the
conclusion of the Initial Term and any Renewal Term, UNCHCS and CLIENT may
mutually agree to renew this Agreement for an additional and consecutive renewal
term of one ( 1 ) year (each a " Renewal Term " ) , on the terms set forth herein . Any
such decision to renew this Agreement must be set forth in a written agreement
signed by an authorized representative of each party . No later than six (6 ) months
prior to the expiration of the Initial Term or any Renewal Term, the parties shall
meet in person or by phone to discuss such potential renewal . The Initial Term and
any and all Renewal Terms are referred to collectively herein as the "term" of this
Agreement .
7 . 2 Termination By Either Party . Either party may terminate this Agreement :
8
(a) in the event the other party commits a material breach of this Agreement
and such breach continues for a period of thirty (30) days following written notice
of such breach ;
(b ) immediately if the other party makes any assignment of assets or business
for the benefit of creditors , or a trustee or receiver is appointed to conduct its
business or affairs , or it is adjudged in any legal proceeding to be in either
voluntary or involuntary bankruptcy ; or
(c) either party advises the other party of its desire to terminate by providing
notice in writing to the other party at least ninety ( 90 ) days prior to the date of
termination .
7 . 3 Termination by UNCHCS .
( a) UNCHCS may terminate the access granted to any component of the EMR
System in the event that any license or other agreement under which UNCHCS
acquires rights to such component expires or terminates , in which event UNCHCS
shall refund to CLIENT any prepaid fees attributable to such component for the
terminated portion of the Service Period in which such termination occurs .
(b) UNCHCS may terminate this Agreement for cause upon written notice to
CLIENT if CLIENT fails to pay any amount owed under this Agreement when
due , and fails to cure such breach within sixty (60 ) days after receipt of a notice of
delinquency and demand for payment from UNCHCS .
Termination by CLIENT .
(a) UNCHCS acknowledges that CLIENT is a governmental entity, and the
validity of this Agreement is based upon the availability of public funding under
the authority of its statutory mandate . In the event the public funds are
unavailable and not appropriated for the performance of CLIENT ' s obligations
under this Agreement, then this Agreement will automatically expire
without penalty to CLIENT immediately upon written notice to UNCHCS of the
unavailability and non- appropriation of public funds .
7 . 4 Transition and Wind- Down . Upon the expiration or termination of this Agreement
for any reason, the parties shall cooperate in good faith to wind- down CLIENT ' s
use of the EMR System and transition CLIENT to another EMR solution of its
choosing (or if permitted by Epic , directly to Epic ) . Except as stated in Section 7 . 5
below, CLIENT shall bear all costs of selecting, procuring and transitioning to such
alternative EMR solution . In connection with such wind- down, CLIENT shall use
its best efforts to identify , select and procure an alternative EMR solution and shall
transfer to such solution on or prior to the date of expiration or termination of this
Agreement . Upon CLIENT ' s request, provided that CLIENT remains current with
its payment obligations , and except where this Agreement is terminated by
9
UNCHCS pursuant to Section 7. 2 (a) , or Section 7 . 3 , UNCHCS agrees to extend
CLIENT ' s right to access and use the EMR System under this Agreement on a
monthAo -month chargeable basis for up to six (6 ) months , and to provide the
Services in connection therewith, all at the pricing and on the terms set forth herein,
while CLIENT procures and implements its alternative EMR solution . Any such
extension shall not be deemed a renewal of this Agreement , or relieve CLIENT for
any payment obligations or other liabilities incurred during the term hereof.
7 . 5 Return of Data. Upon the expiration or termination of this Agreement for any
reason, the parties shall cooperate in good faith to transfer any patient records and
similar data of CLIENT stored on the EMR System to CLIENT . In connection with
such data transfer, UNCHCS shall : (i) work with CLIENT to provide CLIENT with
a tape ( s) or disk( s) with files containing a copy of CLIENT patient demographic
data, a listing of all open accounts and a listing of all future scheduled patient
appointments within thirty ( 30) days after CLIENT ' s written request ; and (ii)
explore options for providing patient- specific EMR data to assist with CLIENT
transition to another EMR solution . UNCHCS does not guarantee that the data
extracted from the EMR System will be compatible with or suitable for use in
CLIENT ' s alternative EMR solution, and shall have no obligation to reformat or
restructure such data in a manner that exceeds the standard data export capabilities
and options provided in the EMR System . The return of data by UNCHCS under
subpart (i) shall be provided at no charge . Any resources dedicated by UNCHCS
and/or Epic personnel to data transfer, migration and conversion beyond that
specified in subpart (i) will be billed to and payable by CLIENT , at UNCHCS ' s and
Epic ' s then- current rates .
7 . 6 Effect of Termination . Upon the expiration or termination of this Agreement for any
reason, subject to the transition and wind - down ( if any) under Section 7 . 4 above :
(a) UNCHCS shall cease providing the Services ; (b ) CLIENT ' s right and license to
access and use the EMR System shall automatically terminate ; (c) CLIENT shall
discontinue use of the EMR System , promptly (within 5 days ) uninstall and remove
any remnants of the EMR System and documentation from its computers , network
and systems , and destroy (or return to UNCHCS ) all tangible copies of the EMR
System and documentation in its possession (though CLIENT shall continue to have
access to Client ' s patient records) ; (d) CLIENT shall pay all amounts due and
owing to UNCHCS through the date of expiration or termination ; and (e) each party
shall perform and abide by its surviving obligations under this Agreement . Unless
otherwise expressly agreed to in writing by the parties , the expiration or termination
of this Agreement shall not relieve either party of its obligations and liabilities
incurred prior to such expiration or termination , including without limitation
CLIENT ' s obligation to pay amounts due and owing for the EMR System and the
Services .
7 . 7 Survival . Termination shall not affect obligations that accrued prior to the effective
date of termination . The obligations of the parties under Sections 4 , 6 , 7 , 8 , 9 , 10 ,
11 , 12 and 14 , and any other provisions of this Agreement which by their terms or
10
nature are intended to survive , shall survive any expiration or termination of this
Agreement .
8 . Warranties .
8 . 1 By UNCHCS . UNCHCS represents and warrants to CLIENT that : (1) UNCHCS has
09
the full right, power and authority to enter into this Agreement, and (ii ) to
UNCHCS ' s knowledge , the services provided to CLIENT under this agreement are
not technically or functionally equivalent to items and services that CLIENT
already possesses or has obtained .
8 . 2 By Client . CLIENT represents and warrants to UNCHCS that : (1) CLIENT has the
full right, power and authority to enter into this Agreement ; and (ii ) the Client Data
will not infringe or violate the rights of any third party including, but not limited to ,
intellectual property rights ; will not be abusive ; will not be defamatory or obscene ;
and will not violate any applicable law and (ill
CLIENT has not made and will not
make the provision of the services provided to it under this agreement a condition
of continuing to utilize the health facilities and services offered by UNCHCS and
(v) the services provided to CLIENT under this agreement are not technically or
functionally equivalent to items and services that CLIENT already possesses or has
obtained .
8 . 3 DISCLAIMER . THE WARRANTIES STATED IN THIS SECTION 8 ARE THE
ONLY WARRANTIES MADE BY THE PARTIES . THE PARTIES EXPRESSLY
DISCLAIM ALL OTHER WARRANTIES , EXPRESS OR IMPLIED ,
INCLUDING , BUT NOT LIMITED TO , IMPLIED WARRANTIES OF TITLE ,
MERCHANTABILITY, ACCURACY AND FITNESS FOR A PARTICULAR
PURPOSE . UNCHCS DOES NOT WARRANT THAT CLIENT ' S USE OF THE
EMR SYSTEM SHALL BE UNINTERRUPTED OR ERROR- FREE . NO
REPRESENTATION OR STATEMENT SHALL BE BINDING UPON UNCHCS
AS A WARRANTY OR OTHERWISE UNLESS EXPRESSLY CONTAINED IN
THIS AGREEMENT ,
9 . Disclaimer and Limitation of Liability .
9 . 1 TO THE EXTENT ALLOWABLE BY NORTH CAROLINA LAW , IN NO
EVENT SHALL EITHER PARTY BE LIABLE FOR ANY LOST OR
ANTICIPATED PROFITS , OR ANY INCIDENTAL , EXEMPLARY, SPECIAL ,
RELIANCE , CONSEQUENTIAL OR PUNITIVE DAMAGES , REGARDLESS
OF WHETHER EITHER PARTY WAS ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES . TO THE EXTENT ALLOWABLE BY NORTH CAROLINA
LAW, UNCHCS ' S ENTIRE LIABILITY TO CLIENT FOR DAMAGES UNDER
OR RELATED TO THIS AGREEMENT , WHETHER BASED IN CONTRACT ,
TORT OR OTHERWISE , SHALL NOT EXCEED THE AMOUNT ACTUALLY
PAID TO UNCHCS UNDER THIS AGREEMENT . CLIENT ' S ENITRE
LIABILITY TO UNCHCS FOR DAMAGES UNDER OR RELATED TO THIS
AGREEMENT , WHETHER BASED IN CONTRACT , TORT OR OTHERWISE ,
11
SHALL NOT EXCEED THE AMOUNT ACTUALLY DUE AND OWING TO
UNCHCS UNDER THIS AGREEMENT AT THE TIME OF THE
OCCURRENCE GIVING RISE TO SUCH CLAIM . THE FOREGOING
LIMITATIONS SHALL NOT APPLY IN CASES OF INDEMNIFICATION OR
BREACH OF THE CONFIDENTIALITY PROVISIONS OF THIS AGREEMENT
OR BREACH OF THE PROVISIONS OF THE BUSINESS ASSOCIATE
AGREEMENT ,
10 . HIPAA Compliance
10 . 1 The parties to this Agreement shall comply with all applicable state and federal
laws and regulations regarding confidentiality of patient records , including but not
limited to the Health Insurance Portability and Accountability Act of 1996 and the
Privacy and Security Standards (45 C . F . R. Parts 160 and 164 ) and the Standards for
Electronic Transactions (45 C . F . R. Parts 160 and 162) (collectively, the
" Standards ") promulgated or to be promulgated by the Secretary of Health and
Human Services on and after the applicable effective dates specified in the
Standards . All medical information and data concerning specific patients , including
but not limited to the identity of the patients , derived from the business relationship
set forth in this Agreement shall be treated and maintained in a confidential manner
by all parties to this Agreement and shall not be released, disclosed , or published to
any party other than as required or permitted under applicable laws . The parties
agree to be bound by the terms and conditions of the Shared Access Agreement and
the Business Associate Agreement attached hereto as Exhibits B and C ,
respectively .
11 . Confidentiality .
11 . 1 Confidentiality . Except as otherwise provided in the Business Associate Agreement,
each party shall retain in confidence and shall not, without the prior written consent
of the other party (the " Disclosing Party") , disclose in any manner or use , except in
performance of its obligations or enjoyment of its rights under this Agreement, any
information disclosed to a party (the "Receiving Party") by the Disclosing Party and
either marked at the time of disclosure as being confidential or identified in writing
by the Disclosing Party within thirty (30 ) days of disclosure to the Receiving Party
as being confidential (" Confidential Information") . The EMR System and the
corresponding documentation shall be deemed Confidential Information of
UNCHCS and Epic , regardless of how marked or identified . This Section shall
impose no obligation upon the Receiving Party with respect to any information that :
(1) is publicly available at the time received by Receiving Party ; (ii) becomes
publicly available other than by breach of the Receiving Party' s obligations
hereunder ; (iii ) is known to the Receiving Party prior to receipt from the Disclosing
Party ; (iv) is received by Receiving Party from a third party if such third party has
the right to make such disclosure ; (v) is independently developed by the Receiving
Party without use of Confidential Information ; or (vi) is required to be disclosed by
law, including but not limited to the North Carolina Public Records Act .
12
11 . 2 Proprietary Financial Data. Without CLIENT ' s express consent, UNCHCS shall not
access any of CLIENT ' s proprietary financial information that may be present
within the EMR System database by virtue of CLIENT ' s implementation of the
EMR System . UNCHCS shall implement reasonable protections within the EMR
System to prevent such access . Nothing herein shall restrict UNCHCS from
accessing patient health information that will be available to users of the EMR
System .
12 . Promotion .
12 . 1 Product Reference . CLIENT agrees to act in the capacity of a reference to discuss
the EMR System with potential UNCHCS clients and business partners .
12 . 2 Press Release . CLIENT agrees to allow the use of its name and a description of its
use of the EMR System to be used in UNCHCS press releases , including one (1 )
press release within thirty ( 30 ) days following the Effective Date . CLIENT will
have the right to review and approve any press release before publication, and such
approval will not be unreasonably withheld or delayed .
12 . 3 Client Lists . CLIENT agrees to allow the use of its name in a list of clients on the
UNCHCS Web site and in other UNCHCS marketing materials .
12 . 4 If this Agreement is terminated by CLIENT, UNCHCS releases CLIENT from its
obligation to act in the capacity as a reference , and shall remove CLIENT ' s name
from any then- current client lists or webpages identifying its clients , and shall not
use CLIENT ' s name and description of its use of the EMR System in any press
release following notice of the termination .
13 . General.
13 . 1 Independent Contractors . The relationship between the parties shall be that of
independent contractors . Nothing m this Agreement shall create , or be deemed to
imply the creation of, any partnership , joint venture or other relationship . Neither
party shall have the authority to incur any obligation, contractual or otherwise , in
the name or on behalf of the other party .
13 . 2 Entire Agreement ; Conflicting Terms ; Amendment . This Agreement, including any
exhibits or appendices hereto , constitutes the entire agreement between the parties
with respect to the subject matter hereof and supersedes all prior and
contemporaneous communications . This agreement covers all of the electronic
health records items and services to by furnished by UNCHCS to CLIENT . In the
event of a conflict between the terms contained in the body of this Agreement and
the terms contained in any exhibit or appendices hereto , the terms contained in the
body of this Agreement shall control , except that with respect to any conflict
between the terms of this Agreement and the Business Associate Agreement, the
terms of the Business Associate Agreement shall control . This Agreement may be
modified only by a written agreement dated subsequent to the Effective Date and
signed on behalf of the parties by their respective duly authorized representatives .
13
13 . 3 Compliance with Law/ Severability . In the event that a party becomes aware in the
future that this arrangement does not comport with the requirements of the federal
Stark law or the federal anti -kickback laws or other applicable law, that party shall
promptly inform the other party of this occurrence and both parties shall meet
promptly and endeavor in good faith to take such action as is legally warranted to
restore this Agreement to compliance with the law . If the parties are unable to agree
within fifteen ( 15 ) days (or such lesser time if required by law) to such
amendment( s ) to this Agreement as will render the offending provision( s) of this
Agreement compliant with law, or if a court of competent jurisdiction or other
appropriate legal agency or authority determines that any provision of this
Agreement is invalid, illegal or unenforceable , that provision( s) of the Agreement
shall be deemed stricken from the Agreement and the remainder of the Agreement
shall remain in full force and effect .
13 . 4 Audit and Inspection . CLIENT understands and agrees that compliance with this
Agreement may be audited by UNCHCS at any time . If requested, CLIENT agrees
to promptly and fully cooperate , and to cause its parent( s) , affiliates and
subsidiaries and its and their Authorized Users , physicians or other healthcare
providers , owners , directors , officers , other employees , agents and contractors to so
cooperate , in any such audit .
13 . 5 Limitation on Actions . Any cause of action by CLIENT against UNCHCS with
respect to this Agreement must be commenced within one ( 1 ) year after the accrual
thereof or it shall be barred .
13 . 6 No Waiver . No waiver of any breach of any provisions of this Agreement shall
constitute a waiver of any prior, concurrent or subsequent breach of the same or any
other provisions hereof or thereof, and no waiver shall be effective unless made in
writing and signed by the duly authorized representative of the party to be charged .
13 . 7 Notices . All notices that UNCHCS or CLIENT may give to the other pursuant to
this Agreement shall be in writing and shall be hand delivered or sent by registered
or certified mail postage prepaid , return receipt requested, or by overnight courier
service , postage prepaid , (1) if to CLIENT, to the CLIENT Contact set forth in
Exhibit A, (ii) if to UNCHCS , to the address set forth above , to the attention of the
VP/CIO and the General Counsel , or (iii) to such other address as the receiving
party shall designate by written notice given in accordance with this Section .
13 . 8 Assignment ; Subcontractors . This Agreement may not be assigned or otherwise
transferred by either party without the prior written consent of the other party ;
provided, however, that either party shall have the right to assign its rights and
obligations under this Agreement in connection with a merger, acquisition, or sale
or transfer of substantially all of its assets . Any assignment which is not in
accordance with this Section will be void . Notwithstanding anything herein to the
contrary, UNCHCS may subcontract with other parties for the provision of the
EMR System .
14
13 . 9 Counterparts . This Agreement may be executed in counterparts which , when taken
together, shall constitute one and the same instrument .
13 . 10 Force Majeure . Neither party shall be liable hereunder by reason of any failure or
delay in the performance of its obligations hereunder (except for the payment of
money) on account of strikes , shortages , riots , insurrection , fires , flood, storm,
explosions , acts of God , war, terrorism, governmental action, labor conditions ,
earthquakes , material shortages , or any other cause (whether or not similar to any of
the foregoing) beyond the reasonable control of such party (each a "Force Maj eure
Event") . Upon the occurrence of a Force Majeure Event, the non-performing party
will be excused from any further performance of its obligations effected by the
Force Maj eure event for so long as the Force Maj eure event continues and such
party continues to sue commercially reasonable efforts to recommence
performance . Either party has the right to terminate this Agreement if a force
majeure event suspends performance of its obligations under this Agreement for
ninety ( 90 ) days or more .
Governing Law and Forum . This Agreement and all claims related to it, its
execution or the performance of the parties under it, shall be construed and
governed in all respects according to the laws of the State of North Carolina,
without regard to the conflict of law provisions thereof. Any dispute arising
hereunder which cannot be informally resolved shall be brought solely and
exclusively in the federal or state courts sitting in the State of North Carolina, and
each party hereby consents to the sole and exclusive jurisdiction and venue of such
courts with regard to such actions . UNCHCS shall at all times remain in compliance
with all applicable local , state , and federal laws , rules , and regulations including but
not limited to all state and federal anti - discrimination laws , policies , rules , and
regulations and the Orange County Non- Discrimination Policy and the Orange
County Living Wage Policy (each policy is incorporated by reference and may be
viewed at
http : //www . orangecountync . gov/departments/purchasing- division/contracts . php) .
Any violation of this requirement is a breach of the Agreement, and CLIENT may
immediately terminate this Agreement without further obligation on part of
CLIENT . By executing this Agreement, UNCHCS affirms that UNCHCS is and
shall remain in compliance with Article 2 of Chapter 64 of the North Carolina
General Statutes . By executing this Agreement, UNCHCS certifies that UNCHCS
has not been identified and has not utilized the services of any agent or
subcontractor on the list created by the State Treasurer pursuant to G . S . 147 - 86 . 58 .
15
IN WITNESS WHEREOF , the parties hereto , each acting with proper authority, have
executed this Agreement under seal as of the Effective Date .
UNCHCS CLIENT- Orange County
By : � '' �'� By :
Name : �+� 4 2 N A Name :
Print or Type Print or Type
tw ,
Title : � � Title : C ► o YR)(Dcc
Date : � - 2c) I c Date : Z
16
Signature Page UNHCS -EMR System Access Agreement
EMR SYSTEM ACCESS AGREEMENT
EXHIBIT A
I . CLIENT CONTACT INFORMATION
Client : Client Contact :
Company Name : Orange County Health Dept. Name : Pam McCall
Billing Addresse 300 W. Tryon Street Phone : 919 -245 -2402
Hillsborough, NC 27278 Fax : 919 - 644- 3312
E-Mail . pmccall@orangecountync . gov
Billing Contact : ( if different from Client Contact) Technical Contact :
Name : Kimberlee Quatrone Name : Jim Northrup
Phone : 919 -245 -2460 Phone : 919 -245 - 2276
Fax : 919 - 644 -3007 Fax : 919 - 644- 3001
E-Mail : Health.Purchasing@orangecountync . gov E-Mail : jorthrup@orangecountync . gov
Administrator/Privacy Officer :
Name : Carla Julian
Phone : 919 -245 -2434
Fax : 919 -2454 015
E-Mail : cjulian@orangecountync . gov
II . EMR SYSTEM
A . EMR System Components :
• EpicCare Ambulatory Clinical System
• Resolute Professional Billing w/ Prelude Registration (Does not include
physician billing services)
• Cadence Scheduling
• MyChart Patient Portal
• Haiku for iPhone and Canto for iPad
Exhibit A - 1
• Care Everywhere — Care Epic
• EpicCare Link for External Providers
III. MAXIMUM NUMBER OF Authorized Users
Total Maximum Number of Authorized Users Permitted to Access the EMR System : 50
providers . Client may request that UNCHCS increase the maximum number of
Authorized Users permitted to access the EMR System by providing prior written notice
to UNCHCS , and UNCHCS will grant such request provided UNCHCS is able to meet
the corresponding increased demands on system capacity . CLIENT shall pay to
UNCHCS the then- applicable fees attributable to any increase in the total number of
Authorized Users in accordance with UNCHCS ' s then- current pricing methodology .
Notwithstanding the foregoing, the total number of Authorized Users shall not exceed 50
providers without mutual agreement of the parties .
IV. PATIENT VOLUMES
Total anticipated Annual Patient Volume covered by initial Agreement : Not to exceed
200 , 000 per year .
Should Client exceed anticipated Annual Patient Volume, Client must obtain additional
licenses and agrees to pay to UNCHCS the cost of obtaining these additional licenses in
accordance with UNCHCS ' s then-current pricing methodology. Any additional licenses
and costs shall be memorialized in a written amendment duly executed by authorized
representatives of each party .
V. FEES
A . EMR System Access Fees based upon total of 50 Authorized Users, and estimated
visit volume of < 200, 000 annual visits .
Pricing is on a per provider basis for the one-time license & implementation fees as well as the
ongoing monthly fee .
• One- time License & Implementation Fee *
The one-time license and implementation fee includes Epic licensing, the implementation
team' s efforts , training and go -live support.
o EMR plus Practice Management = $ 19 , 646 per provider
o UNC approved a 50 % subsidy for the implementation fees .
■ Subsidized cost for EMR plus Practice Management = $ 9 , 823 per
Provider
Exhibit A - 2
• Ongoing Fee *
The on-going monthly fee includes application support, maintenance and upgrades for
UNC Community Connect and access to the Epic@UNC Help Desk.
o EMR plus Practice Management = $ 465 . 75 per provider
• Pass - through Costs
Additional pass -through costs may be applicable for 3rd party agreements owned by UNC
Health Care (i. e . Eligibility, Document Management, Patient Correspondence, etc .)
ContractTerm
Contract requires three year contract between the practice and UNC Health Care System.
Notes :
• Pfice does not include additional go -live su
'ppoiY including elbow support that may be required based on
practice side other factor r. Also, excludes tecImicallil frastructuve costs such as building a site to site
VPN as these costs are practice specific. Tbese technical/ it f astructure costs will be the responsibility of
tl)e practice.
• One-time fee + (36 x ongoing monthly fees
• Plysician billing semces are not included
VI . CLIENT EQUIPMENT
Client is responsible for procuring the following Client Equipment :
Device Hardware
Hardware Specifications for Acceptable Response Times
• Operating system - Windows 7 Enterprise Edition x64
• Processor - A minimum of two processor cores running at 3 GHz or faster
• Intel Core 2 Duo E8400 3 GHz (launched Q 12008 ) .
• Memory - 4 GB
• Disk - 7200 RPM access speed or better
• Network- Gigabit ( 10/ 100/ 1000 ) Network Interface Card
• Monitor and Display recommendation for workstations used by physicians in
outpatient settings :
• 24 widescreen , flat panel display monitor
• 1920x1080 resolution or higher, 32 -bit color
• Cadence - Workflows with Patient Sidebar - recommendation
• Optimal - 24 " , 1920x1080
• Minimum - 20 " , 1280x768
• HIM - Coding Info Dual monitors - recommendation
Exhibit A - 3
• Optimal - 24 1920xI080
• Minimum - 20 " , 1280x768
• For all other workstations
• 19 " monitor
• 1024x768 resolution or higher, 16 -bit color
Network Printers
• 2926397 HP M401 DN Personal Laser printer with duplex , 3 5ppm, 250 sheet
paper tray -No USB cable included
• 183032 6 Ft . USB Printer Cable
• 2608562 HP LJ PRO 400 CLJ451 DN Color Printer with duplex , for small
workgroups or personal use . 21ppm black and color printing . 250 sheet paper tray . No
USB cable included
• 3329789 HP M651DN Color Laser printer with duplex , networkable for large
workgroups . 45ppm black and color printing . 600 sheet paper tray
• 183032 6 Ft . USB Printer Cable
Peripheral Devices
• 9018506 Motorola DS4208HC Tethered Scanner
• 2099585 Optionall5 ft Coiled cable for tethered scanner
• 8370600 Motorola DS6878 Wireless Scanner with Cradle
• 11205142 Fujitsu 7160 Desktop Scanner
• 5686064 Credit Card Swipe
• 8054158 Topaz Signature Capture Pad
• 2461739 GX420D Labs and Visit Label Printer
Network Hardware :
• VPN router . . . . . . . . . . . . . . . . . . . . . . . supports IPSec , SHA- 1 (Authentication) and 3DES
(Encryption)
• Internet connection . . . . . . . . . . . DSL , cable or T1
• TCPIIP protocol . . . . . . . . . . . . . . . for communication with UNCHCS ' s server
• Private IP addressing scheme
• Wireless network (only if client wishes to be wireless )
• Print Server
Exhibit A - 4
Exhibit B
Shared Access Addendum
Pursuant to the UNCHCS EMR System Access Agreement ( "Agreement") , to which this
Shared Access Addendum (the "Addendum") is attached, CLIENT is obtaining the right to
access and use the EMR System solely for storing , processing and displaying medical records
and other information, images and content related to the provision of healthcare to its patients
and patients of its Medical Providers . In addition , upon implementation of the EMR System by
CLIENT, CLIENT and UNCHCS may access each other ' s Records (as defined below) solely in
accordance with the terms of this Addendum .
1 . Definitions . For the purposes of this Addendum , the terms below shall have the
meanings set forth in this Section . Other capitalized terms used herein but not defined in this
Shared Access Addendum shall have the same meaning as set forth in 45 CFR Parts 160 and 164
or the Agreement .
(A) "Party" means a party to the Agreement . .
(B ) "Records " means the treatment, payment and operations records that each
Party maintains with respect to its patients or patients of its Medical Providers within the
EMR System .
(C ) " Shared Patients " means those individuals who are patients of both Parties
(or their Medical Providers ) at the time a Party obtains access to , or uses or discloses the
other Party ' s records .
(D ) "Privacy Rule " means the regulations at 45 C . F . R . Parts 160 and 164
Subparts A and E , as may be amended from time to time .
(E) " Security" means the regulations at 45 C . F . R . Parts 160 and 164
Subparts A and C , as may be amended from time to time .
(F) "Breach Notification Rule" means the regulations at 45 C . F . R. Parts 160
and 164 Subparts A and D , as may be amended from time to time .
( G) "HIPAA" means the Privacy Rule , Security Rule , Breach Notification
Rule , and any other regulations located at 45 C . F . R Parts 160 and 164 , as may be
amended from time to time .
2 . Uses and Disclosures . Subject to the terms of the Agreement, including without
limitation this Shared Access Addendum , each Party (the "Authorizing Party" ) authorizes the
other Party , and the other Party ' s Medical Providers and Authorized Users on its behalf, to
access the Authorizing Party ' s Records with respect to Shared Patients and to use Protected
Health Information concerning Shared Patients solely for its own treatment , payment and quality
Exhibit B - 1
assessment and improvement activities , as those terms are defined in the Privacy Rule or as
permitted by and in accordance with a valid HIPAA authorization meeting the requirements of
45 C . F . R. § 164 . 508 , as may be amended from time to time , so long as each Party (or its Medical
Providers) has a treatment relationship with the individual who is the subject of the Protected
Health Information being accessed .
In consideration of its access to the Authorizing Party ' s Records of Shared Patients , each
Party agrees it will :
(A) Restrict Medical Provider and Authorized User access to the
Authorizing Party ' s Records to those patients who are current patients of the Party (or its
Medical Providers) at the time the Records are accessed , for the sole purposes described in
this Addendum and for no other reason absent express authorization from the Authorizing
Party ,
(B ) Comply, and cause its Medical Providers and Authorized Users to comply,
with the terms of this Addendum, the Agreement and all Applicable Laws , including but not
limited to HIPAA ;
(C) Adopt, implement, and require its Medical Providers and Authorized
Users accessing Records to comply with policies , procedures , and administrative , physical and
technical safeguards regarding confidentiality, security and integrity of patient information and
electronic information, including such Party ' s own computer systems and the information on the
EMR System . Such policies , procedures and safeguards shall include , without limitation, the
following : (1) an overall policy and safeguards governing confidentiality, security and integrity
of health information and compliance with the terms of the HIPAA and the North Carolina
Identity Theft Protection Act (ITPA) , and all other state and federal laws and regulations
pertaining to the privacy, security, or confidentiality of information contained in the Records , as
may be amended from time to time , including but not limited to the Privacy Rule , Security Rule ,
and Breach Notification Rule ; (ii) requirements for training of Medical Providers and Authorized
Users on use of the EMR System and on confidentiality , security and integrity of patient
information ; and (iii) sanctions that are at a minimum as stringent as those listed in Attachment
2 , which will apply to individuals who breach any of the requirements of this Addendum or the
Agreement regarding confidentiality, security or integrity of patient information or other
information in the Records . Further, should a Party implement its sanctions policy as a result of
a violation, such Party agrees to notify the other Party, and, to the extent permitted by applicable
law, provide a copy of any relevant documentation to the Party which, at a minimum, provides
information sufficient for such Party to determine the nature and source of any violation and to
comply with any state or federal law or regulation regarding privacy and the release of medical
records ;
(E) Complete annually and require Medical Providers and Authorized Users to
Exhibit B - 2
complete annually full HIPAA training in accordance with its policies and procedures and the
requirements of Applicable Laws ;
(F ) Prohibit access by or disclosure to any third party, except for a purpose
expressly permitted by this Addendum, of any information contained in the Records or regarding
patients of the other Party , including personal , medical , or financial information, except as such
access or disclosure is necessary on an individual basis to health care providers employed by the
Party who are treating a patient who is the subject of the information or as may be required or
permitted by Applicable Laws ;
(G) Each Party shall require its Authorized Users and Medical Providers to
sign and comply with confidentiality agreements with terms substantially the same as those
provided in the UNCHC Confidentiality Statement attached hereto as Attachment I , the terms of
which are incorporated herein by reference ;
(H) Cooperate with the other Party in its continuing verification of compliance
with the terms of this Addendum , including any attachments hereto , by Party , its Medical
Providers and Authorized Users ;
(I) Ensure that only authorized personnel have access to the unique user ID
and password( s ) . Any information transmitted through the EMR System will be the sole
responsibility of the user whose ID and password was utilized to gain access . Each Party shall ,
and shall cause its Medical Providers and Authorized Users to immediately notify the
Authorizing Party if he/she suspects the unauthorized use of login information and request a new
user ID and a new password ;
(J) Prohibit Medical Providers and Authorized Users from accessing the
Authorizing Party ' s Records from any site other than the non- authorizing Party ' s own facilities ,
the facilities of the Authorizing Party, or from other remote site (s ) approved in writing in
advance by the Authorizing Party ;
(K) Make its Authorized Users and Medical Providers aware of all state and
federal privacy and medical records confidentiality requirements and of the requirements
imposed by this Addendum ;
(L) Not obligate another Party , directly or indirectly , with regard to requests
by individuals to restrictions on certain uses and disclosures of the individuals ' Protected Health
Information, or to receiving Protected Health Information by alternative means of
communications , on another ' s Records ; and
(M) To the extent permitted by law, provide prompt notice to the other Party of
any demand for compulsory disclosure , including without limitation, any subpoena or court order
for medical records or Protected Health Information accessed by or through the other Party ' s
Exhibit B - 3
Records . In such event, the Party shall cooperate fully with the other Party ' s instructions relating
to disclosing Protected Health Information from such Party ' s Records , to the extent permitted by
law .
3 . This Shared Access Addendum shall automatically terminate upon termination
of the EMR System Access Agreement . Notwithstanding anything to the contrary in the EMR
System Access Agreement, either Party shall have the right to immediately terminate , suspend,
or amend this Shared Access Addendum, without liability : (a) to comply with any legal order
issued or proposed to be issued by a federal or state department, agency, commission, or court ;
(b) to comply with any provision of law, reimbursement, or accreditation ; or (c) if performance
of any term of this Shared Access Addendum by either Party would cause that party to be in
violation of the law. Additionally, any Party or Authorized User or Medical Provider that uses
the EMR System or Records in violation of this Addendum or the Agreement may have its
access to the Authorizing Party ' s Records revoked and may be barred from any future access .
Additionally, the Authorizing Party reserves the right to terminate all non- authorizing Party ' s
access to the Records if any Authorized User or Medical Provider of non- authorizing Party
breaches the terms of this Addendum, including but not limited to its Attachments .
4 . Except to the extent otherwise set forth herein, and to the extent allowed under
North Carolina law, UNCHCS shall indemnify and hold harmless CLIENT , its officers , agents ,
and employees from all Damages arising out of the wrongful acts or omissions of UNCHCS or
any of its subcontractors , agents , or employees in using the EMR System or any information
obtained from the EMR System or the breach by UNCHCS or any of its subcontractors , agents ,
or employees of this Addendum . The provisions of this Section shall survive the expiration or
termination of this Addendum for any reason .
5 . All UNCHCS site content, and the content of other services provided by UNCHC ,
is protected by applicable copyright law unless otherwise noted . Trademarks and service marks
belonging to UNCHC or other entities may not be used without the permission of the owner of
such marks , except as provided by North Carolina law .
6 . The Parties acknowledge and agree that the information contained in the EMR
System may be confidential and that any unauthorized disclosure or use of such information may
cause irreparable harm , injury, and loss . In the event of any actual or threatened breach or
violation of this Addendum by either Party or its Authorized Users or Medical Providers , the
other Party shall have full rights to injunctive relief, in addition to any other rights and remedies
it may have . The terms of this Section 6 shall survive the termination of this Addendum for any
reason .
7 . Neither Party will use or permit others to use the EMR System or Records for
anything other than a lawful and legitimate business purpose . Examples of prohibited uses of the
Exhibit B - 4
EMR System or Records include , but are not limited to , the following : ( 1 ) removing data in an
unauthorized manner for the purposes of reselling the information ; (2 ) placement on the site of
any untrue , malicious , fraudulent, harassing , offensive or defamatory material , or any material
that is irrelevant to a legitimate use of the site ; ( 3 ) introduction of viruses , worms or other
programming routines that are intended to disrupt or interfere with the intended operation of the
site ; (4 ) insertion of links to other sites of whatever character ; ( 5 ) promotion of any unlawful
activity or purpose , including any activity that could give rise to criminal or civil liability ; (6 )
unauthorized alteration of any data or information supplied by another user of the site ; or (7) any
activity that infringes on the copyright , patent , trademark or other rights of any person or entity .
Individuals who engage in a prohibited use of the site will be liable to UNCHCS for damages
incurred by UNCHCS as a result .
8 . Each Party shall comply with Applicable Laws , and is solely responsible for
developing and providing its HIPAA notice of privacy practices to its patients and complying
with its terms . If warranted , in the sole judgment of each Party, to provide adequate notice to
patients regarding the Party ' s data practices , such Party may include notice of this shared access
arrangement in its notice of privacy practices . The Parties agree to cooperate on the
development of such language .
9 . Each Party acknowledges and agrees that as a data owner authorizing access to its
Records , such Party is subject to certain data security and security breach notification
requirements under applicable law. In addition to its responsibilities under this Addendum
described above , each Party agrees to implement any data security measures that are required by
Applicable Laws with respect to patient information . In the event of an incident or occurrence
resulting in the compromise , unauthorized access , manipulation or disclosure of patient
information, the affected Party will promptly notify the other Party of such incident, and shall
cooperate with an Authorizing Party ' s efforts to implement any required security remediation
and to notify affected individuals , as the Parties mutually agree , in order to help the Authorizing
Party comply with its notification or remediation obligations under Applicable Law or agency
guidance . Each Party ' s cooperation in notification and remediation activities under this Section 9
shall be at such Party ' s sole expense ; provided however that the actual costs of delivering such
notification, and any related services that an Authorizing Party chooses to provide to patients in
conjunction with such notification, will be at such Party ' s sole expense
10 . Each Party WILL BE SOLELY RESPONSIBLE FOR ANY DAMAGE TO THE
RECORDS OR ANY COMPUTER SYSTEM, ANY LOSS OF DATA, OR ANY IMPROPER
USE OR DISCLOSURE OF INFORMATION ON THE RECORDS CAUSED BY THE
PARTY , ITS AUTHORIZED USERS , OR ITS MEDICAL PROVIDERS , OR ANY PERSON
USING A USER ID OR A UNIQUE IDENTIFIER OF THE PARTY ' S AUTHORIZED USERS
OR MEDICAL PROVIDERS .
Exhibit B - 5
11 . Each Party is solely responsible for complying, and ensuring its Authorized Users
and Medical Providers comply, with all laws that may now or in the future govern the gathering,
transmission, processing, use , receipt, reporting , disclosure , maintenance and storage of
Protected Health Information, including without limitation HIPAA . Each Party shall obtain and
maintain consents and/or authorizations for releases and disclosure of such information, in any
medium, as necessary to comply with all applicable federal and state laws , including but not
limited to HIPAA .
Exhibit B - 6
VV
i
Attachment 1
Confidentiality Statement
Confidentiality :
As a user of UNC Health Care System patient information , you will have access to the
Clinical Information System of UNC for the purpose of providing patient care services to
current patients of User or as expressly permitted by the Shared Access Addendum of
which this is an Attachment, and for no other reason absent express authorization from
UNC Health Care System . This information in any form, including , but not limited to , paper
record, oral communication, audio recording , and electronic display, is strictly confidential .
Access to confidential information is permitted only on a needAo -know basis and limited to the
minimum amount of confidential information necessary to accomplish the intended purpose of
the use , disclosure or request .
It is the policy of UNC Health Care that users (i . e . , employees , medical staff, students ,
volunteers , and outside entities) shall respect and preserve the privacy , confidentiality and
security of confidential information . Violations of this statement include , but are not limited
to :
• Accessing information that is not within the scope of your duties ;
• Misusing, disclosing without proper authorization , or altering confidential
information ;
• Disclosing to another person your sign- on code and/or password for
accessing electronic confidential information or for physical access to
restricted areas ,
• Using another person ' s sign - on code and/or password for accessing electronic
confidential information or for physical access to restricted areas ;
• Intentional or negligent mishandling or destruction of confidential
information ;
• Leaving a secured application unattended while signed on ; or
Attachment - 1
• Attempting to access a secured application or restricted area without proper
authorization or for purposes other than official UNC Health Care business .
I understand the UNC Health Care .
* Employs security and auditing technologies to track and log my activity
within the UNC EMR system including all patient records I have viewed ;
* requires audits of my patient records accesses ;
Produces reports and
* Requires my employer to take disciplinary action if I commit an
inappropriate patient access
* May terminate access of ALL of my employer ' s UNC users if I commit an
inappropriate patient access
Violation of this statement may constitute grounds for corrective action up to and including
termination of employment, loss of UNC Health Care System privileges or contractual or
affiliation rights in accordance with applicable UNC Health Care System procedures .
Unauthorized use or release of confidential information also may subject the violator to personal ,
civil , and/or criminal liability and legal penalties .
I have read and agree to comply with the terms of the above statement and will read and comply
with the Health Care Privacy and Confidentiality of Individually Identifiable Health Information
(Protected Health Information or PHI) and Information Security Policies , as applicable , copies of
which will be provided upon request .
EXAMPLES OF BREACHES OF CONFIDENTIALITY
Accessing confidential information that is not Misusing , disclosing without proper
within the scope of your duties : authorization, or altering confidential
information :
Unauthorized reading of patient account
information ; Making unauthorized marks on a patient ' s
chart ;
Unauthorized reading of a patient ' s chart;
Making unauthorized changes to a personnel
Unauthorized access of personnel file file ;
information ;
Sharing or reproducing information in a
Accessing information that you do not "needAo - patient chart or a personnel file with
know" for the proper execution of your duties . unauthorized personnel ;
Discussing confidential information in a
Attachment - 2
public area such as a waiting room or
elevator.
Disclosing to another person your sign- on code Using another person ' s sign- on code and/or
and/or password for accessing electronic password for accessing electronic
confidential information or for physical access to confidential information or for physical
restricted areas : access to restricted areas .
Using a co -worker ' s password to log in to
Telling a co -worker your password so that he or the Health Care System computer system or
she can log in to your work or access your work access their work area;
area;
Unauthorized use of a login code for access
Telling an unauthorized person the access codes to personnel files , patient accounts , or
for personnel files , patient accounts , or restricted restricted areas .
areas .
Intentional or negligent mishandling or Leaving a secured application unattended
destruction of confidential information : while signed on :
Leaving confidential information in areas outside
of your work area, such as the cafeteria or your Being away from your desk while you are
logged into an application.
home .
Allowing a co -worker to use your secured
Disposing of confidential information in a non-
application for which he or she does not have
approved container, such as a trash can .
access after you have logged in .
Attempting to access a secured application or
restricted area without proper authorization or for
purposes other than official UNC Health Care
System business : The examples above are only a few types of
mishandling of confidential information. If
Trying passwords and login codes to gain access you have any questions about the handling,
to an unauthorized area of the computer system or use or disclosure of confidential information,
restricted area; please contact your supervisor, manager, or
director .
Using a co -worker ' s application for which you do
not have access after he or she is logged in.
New OF
Attachment - 3
EMR SYSTEM ACCESS AGREEMENT
EXHIBIT C
BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement ("Agreement") is made effective the 26th of June
2018 , by and between Orange County, a body politic and corporate , by and through its Orange
County Health Department, hereinafter referred to as "Covered Entity" , and the University of
North Carolina Health Care System, hereinafter referred to as "Business Associate" ,
(individually, a "Party" and collectively, the "Parties ") . This Agreement supersedes any
previously executed Business Associate Agreement between the parties .
WITNESSETH :
WHEREAS , the Department of Health and Human Services has issued regulations at 45
CFR Parts 160 and 164 to protect the security, confidentiality and integrity of health information
as required by Sections 261 through 264 of the federal Health Insurance Portability and
Accountability Act of 1996 , Public Law 104491 , as modified by the Health Information
Technology for Economic and Clinical Health Act (collectively, "HIPAA Rules ") ; and
VVHEREAS , the Parties wish to enter into or have entered into an arrangement whereby
Business Associate will provide certain services to Covered Entity, and, pursuant to such
arrangement, Business Associate may be considered a "business associate " of Covered Entity as
defined in the HIPAA Rules (the agreement evidencing such arrangement is described on Exhibit
A attached hereto and made a part hereof, and is hereby referred to as the "Arrangement
Agreement") ; and
WHEREAS , Business Associate may have access to Protected Health Information (as
defined below) in fulfilling its responsibilities under such Arrangement Agreement;
THEREFORE , in consideration of the Parties ' continuing obligations under the
Arrangement Agreement, compliance with the HIPAA Rules , and other good and valuable
consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties agree to
the provisions of this Agreement in order to address the requirements of the HIPAA Rules and to
protect the interests of both Parties .
Exhibit C - 1
I . DEFINITIONS
Except as otherwise defined herein, any and all capitalized terms in this Agreement shall have
the definitions set forth in the HIPAA Rules . In the event of an inconsistency between the
provisions of this Agreement and mandatory provisions of the HIPAA Rules , as amended, the
HIPAA Rules shall control . Where provisions of this Agreement are different than those
mandated in the HIPAA Rules , but are nonetheless permitted by the HIPAA rules , the provisions
of this Agreement shall control .
The term "Protected Health Information" ( "PHI " ) shall have the meaning provided in 45 C . F . R .
§ 160 . 103 "Protected Health Information" includes without limitation "Electronic Protected
Health Information" as defined below.
The term "Electronic Protected Health Information" means Protected Health Information that is
transmitted by Electronic Media (as defined in the HIPAA Rules ) or maintained in Electronic
Media ,
Business Associate acknowledges and agrees that all Protected Health Information that is created
or received by Covered Entity and disclosed or made available in any form, including paper
record, oral communication, audio recording , and electronic display by Covered Entity or its
operating units to Business Associate or is created or received by Business Associate on Covered
Entity ' s behalf shall be subject to this Agreement .
II . PERMITTED USES AND DISCLOSURES
(a) Business Associate may use or disclose Protected Health Information only as
permitted or required by this Agreement or as Required By Law . Except as specifically set forth
herein , Business Associate may not use or disclose Protected Health Information in a manner
that would violate the HIPAA Rules if such use or disclosure were done by Covered Entity ,
Specifically , Business Associate may use or disclose Protected Health Information ( 1 ) for
meeting its obligations as set forth in any agreements between the Parties evidencing their
business relationship , including the Arrangement Agreement, or (2 ) as required by applicable
law, rule or regulation, or by an accrediting or credentialing organization to whom Covered
Entity is required to disclose such information, or (3 ) as otherwise permitted under this
Agreement, the Arrangement Agreement (if consistent with this Agreement and the HIPAA
Rules ) , or the HIPAA Rules , or (4) as would be permitted by the HIPAA Rules as if such use or
disclosure were made by Covered Entity .
(b) Business Associate may De4dentify Protected Health Information only at the
specific direction of and only for the use of Covered Entity . Business Associate may not sell
Protected Health Information except at the direction of Covered Entity and in compliance with
the requirements of the HIPAA Rules .
Exhibit C - 2
(c) Notwithstanding the prohibitions set forth in this Agreement,
(1) Business Associate may use Protected Health Information for the proper
management and administration of Business Associate or to carry out the legal responsibilities of
Business Associate ;
(ii) Business Associate may disclose Protected Health Information for the proper
management and administration of Business Associate or to carry out the legal responsibilities of
Business Associate , provided that as to any such disclosure , the following requirements are met :
(A) The disclosure is Required By Law; or
(B ) Business Associate obtains reasonable assurances from the person to whom the
information is disclosed that the information will remain confidential and will be used or further
disclosed only as Required By Law or for the purpose for which it was disclosed to the person,
and the person notifies Business Associate of any instances of which it is aware in which the
confidentiality of the information has been breached ;
(iii) Business Associate may provide data aggregation services relating to the health care
operations of Covered Entity pursuant to any agreements between the Parties evidencing their
business relationship . For purposes of this Agreement, data aggregation means the combining of
Protected Health Information by Business Associate with the protected health information
received by Business Associate in its capacity as a business associate of another covered entity,
to permit data analyses that relate to the health care operations of the respective covered entities .
III . CONFIDENTIALITY AND SECURITY REQUIREMENTS
(a) Business Associate agrees not to use or disclose Protected Health Information
other than as permitted or required by this Agreement or as Required By Law . To the extent
Business Associate carries out obligations of Covered Entity under the HIPAA Rules , Business
Associate shall comply with the applicable provisions of the HIPAA Rules as if such use or
disclosure were made by Covered Entity , Covered Entity will not request Business Associate to
use or disclose Protected Health Information in any manner that would not be permissible under
the HIPAA Rules if done by Covered Entity . Business Associate agrees to comply with Covered
Entity ' s policies regarding the Minimum Necessary use or disclosure of Protected Health
Information, provided such policies are consistent with the HIPAA Rules and are provided to
Business Associate in writing in advance .
(b) Business Associate agrees to provide HIPAA training to all of its personnel who
service Covered Entity ' s account or who otherwise will have access to Covered Entity ' s
Protected Health Information .
Exhibit C - 3
(c) At termination of this Agreement, the Arrangement Agreement (or any similar
documentation of the business relationship of the Parties ) , or upon request of Covered Entity,
whichever occurs first, if feasible , Business Associate will return (in a manner or process
approved by the Covered Entity) or destroy all Protected Health Information received from
Covered Entity, or created , maintained or received by Business Associate on behalf of Covered
Entity, that Business Associate still maintains in any form and retain no copies of such
information . If such return or destruction is not feasible , Business Associate will (1) retain only
that Protected Health Information necessary under the circumstances ; (ii) return or destroy the
remaining Protected Health Information that the Business Associate still maintains in any form ;
(iii) extend the protections of this Agreement to the retained Protected Health Information ; (iv)
limit further uses and disclosures to those purposes that make the return or destruction of the
Protected Health Information not feasible ; and (v) return or destroy the retained Protected Health
Information when it is no longer needed by Business Associate . This paragraph shall survive the
termination of this Agreement and shall apply to Protected Health Information created ,
maintained , or received by Business Associate and any of its subcontractors .
( d) Business Associate agrees to ensure that its agents , including any subcontractors ,
that create , receive , maintain or transmit Protected Health Information on behalf of Business
Associate agree to the same (or greater) restrictions and conditions that apply to Business
Associate with respect to such information, and agree to implement reasonable and appropriate
safeguards to protect any of such information that is Electronic Protected Health Information .
Business Associate agrees to enter into written agreements with any subcontractors in
accordance with the requirements of the HIPAA Rules . In addition, Business Associate agrees to
take reasonable steps to ensure that its employees ' actions or omissions do not cause Business
Associate to breach the terms of this Agreement .
(e) Business Associate will implement appropriate safeguards to prevent use or
disclosure of Protected Health Information other than as permitted in this Agreement . Business
Associate will implement administrative , physical , and technical safeguards that reasonably and
appropriately protect the confidentiality, integrity , and availability of any Electronic Protected
Health Information that it creates , receives , maintains , or transmits on behalf of Covered Entity
as required by the HIPAA Rules .
(f) To the extent applicable , Business Associate will comply with (1) Covered
Entity ' s Notice of Privacy Practices ; (ii ) any limitations to which Covered Entity has agreed in
regard to an Individual ' s permission to use or disclose his or her Protected Health Information ;
and (iii) any restrictions to the use or disclosure of Protected Health Information to which
Covered Entity has agreed or is required to agree .
(g) Business Associate will make its internal practices , books and records available to
the Secretary of the Department of Health and Human Services for purposes of determining
compliance with the HIPAA Rules , and , at the request of the Secretary , will comply with any
investigations and compliance reviews , permit access to information, and cooperate with any
Exhibit C - 4
complaints , as Required By Law. If permitted, without unreasonable delay and, in any event, no
more than 48 hours of receipt of the request or notification, Business Associate will notify
Covered Entity in writing of any request by any governmental entity, or its designee , to review
Business Associate ' s compliance with law or this BAA , to pursue a complaint, or to conduct an
audit or assessment of any kind involving Protected Health Information received from Covered
Entity or created on Covered Entity ' s behalf.
(h) Business Associate shall report to Covered Entity ( see Exhibit B ) any use or
disclosure of Protected Health Information that is not in compliance with the terms of this
Agreement as well as any Breach of which it becomes aware , without unreasonable delay, and in
no event later than forty- eight (48 ) hours of such Discovery . Such notification shall contain the
elements required by 45 C . F . R. § 164 . 410 . In addition, Business Associate agrees to mitigate , to
the extent practicable , any harmful effect that is known to Business Associate of a use or
disclosure of Protected Health Information by Business Associate in violation of the
requirements of this Agreement, as well as to reasonably cooperate with Covered Entity should
Covered Entity elect to review or investigate such noncompliance or Breach . Business Associate
shall reasonably cooperate in Covered Entity ' s Breach analysis and/or risk assessment, if
requested . Furthermore , Business Associate shall reasonably cooperate with Covered Entity in
the event that Covered Entity determines that any third parties must be notified of a Breach,
provided that Business Associate shall not provide any such notification except at the direction
of Covered Entity . Business Associate shall indemnify and hold harmless Covered Entity for any
direct injury or damages arising from any noncompliance with this Agreement or any Breach
attributable to the negligence of Business Associate , including the failure to execute the terms of
this Agreement .
(1) Business Associate shall permit Covered Entity, after providing ten ( 10 ) business days '
written notice , to conduct an audit of Business Associate ' s compliance with this BAA and the
HIPAA Rules , provided that such audit does not unreasonably interfere with Business
Associate ' s operations . Such audit may consist of an onsite visit, a series of inquiries that
requi re written responses , or both . Business Associate shall promptly and completely respond to
Covered Entity ' s reasonable requests for information in support of the audit, which shall not be
conducted more than once annually except in cases of an actual Breach or noncompliance with
this BAA or the HIPAA Rules . Each Party shall bear its own costs associated with the audit .
IV . AVAILABILITY OF PHI
(a) Business Associate agrees to make available within ten ( 10 ) days of a request by
Covered Entity Protected Health Information in a Designated Record Set to Covered Entity to
the extent and in the manner required by 45 C . F . R . § 16405240
(b ) Business Associate agrees to make available Protected Health Information in a
Designated Record Set for amendment and to incorporate any amendments to Protected Health
Exhibit C - 5
Information within ten ( 10 ) days of a request by Covered Entity in accordance with the
requirements of 45 C . F . R. § 164 . 526 and at the direction of Covered Entity .
(c) Business Associate agrees to maintain and make available the information
required to provide an accounting of disclosures , as required by 45 C . F . R. § 164 . 528 . Business
Associate will comply with Covered Entity ' s policy regarding accounting of disclosures , a copy
of which is attached hereto
(d) In the event an Individual makes a request under this Section IV directly to
Business Associate , Business Associate will notify Covered Entity of such request within three
( 3 ) business days and shall cooperate with, and act only at the direction of, Covered Entity in
responding to such request .
V . TERMINATION
Subject to Section III (c) , this Agreement shall be effective as of the date first set forth above and
shall terminate upon the earlier of (1) the termination of all agreements between the parties , and
(ii) the termination by Covered Entity for cause as provided herein . Notwithstanding anything in
this Agreement to the contrary , Covered Entity shall have the right to terminate this Agreement
and the Arrangement Agreement immediately if Business Associate has violated any material
term of this Agreement and has failed to cure such material breach or violation within thirty (30 )
days following Covered Entity ' s written notice to Business Associate . Business Associate may
terminate this Agreement if Covered Entity has violated any material term of this Agreement and
has failed to cure such material breach or violation within thirty (30 ) days following Business
Associate ' s written notice to Covered Entity .
VI . MISCELLANEOUS
Except as expressly stated herein or in the HIPAA Rules , the parties to this Agreement do not
intend to create any rights in any third parties . The rights and obligations of Business Associate
in Section I11 ( c ) and Section V of this Agreement shall survive the expiration, termination , or
cancellation of this Agreement, the Arrangement Agreement and/or the business relationship of
the parties , and shall continue to bind Business Associate , its agents , employees , contractors ,
successors , and assigns as set forth herein .
This Agreement may be amended or modified only in a writing signed by the Parties . No Party
may assign its respective rights and obligations under this Agreement without the prior written
consent of the other Party . None of the provisions of this Agreement are intended to create , nor
will they be deemed to create any relationship between the Parties other than that of independent
parties contracting with each other solely for the purposes of effecting the provisions of this
Agreement and any other agreements between the Parties evidencing their business relationship .
This Agreement will be governed by the laws of the State of North Carolina . No change , waiver
Exhibit C - 6
or discharge of any liability or obligation hereunder on any one or more occasions shall be
deemed a waiver of performance of any continuing or other obligation, or shall prohibit
enforcement of any obligation, on any other occasion .
To the extent that any terms of this Agreement and the underlying Arrangement Agreement (or
any other agreement between the parties) conflict, the terms of this Agreement shall control .
Notwithstanding the foregoing , the parties agree that, in the event that any written agreement
between the parties contains greater restrictions on the use or disclosure of Protected Health
Information than provided in this Agreement„ the more restrictive use and disclosure provisions
will control . The provisions of this Agreement are intended to establish the minimum
requirements regarding Business Associate ' s use and disclosure of Protected Health Information .
In the event that any provision of this Agreement is held by a court of competent jurisdiction to
be invalid or unenforceable , the remainder of the provisions of this Agreement will remain in full
force and effect . In addition, in the event a party believes in good faith that any provision of this
Agreement fails to comply with the then- current requirements of the HIPAA Rules , such party
shall notify the other party in writing . For a period of up to thirty days , the parties shall address
in good faith such concern and amend the terms of this Agreement, if necessary to bring it into
compliance . If, after such thirty- day period, a party believes in good faith that the Agreement
fails to comply with the HIPAA Rules , then either party has the right to terminate upon written
notice to the other party .
Covered Entity makes no warranty or representation that compliance by Business Associate with
this Agreement, HIPAA, HITECH , or the HIPAA Regulations will be adequate or satisfactory
for Business Associate ' s own purposes . Business Associate is solely responsible for all decisions
made by Business Associate regarding the safeguarding of Protected Health Information .
Business Associate shall make itself, and any subcontractors , employees , affiliates or agents
assisting Business Associate in the performance of its obligations under this Agreement,
available to Covered Entity, at no cost to Covered Entity, to testify as witnesses , or otherwise , in
the event of litigation or administrative proceedings being commenced against Covered Entity,
its directors , officers or employees based upon a claimed violation of HIPAA, HITECH , the
HIPAA Regulations , or other laws relating to security and privacy, except where Business
Associate or its subcontractor, employee or agent is named adverse party .
Covered Entity owns all right , title , and interest in and to the Protected Health Information and
Business Associate does not hold and will not acquire by virtue of this Agreement or by virtue of
providing goods or services to Covered Entity, any right, title , or interest in or to the PHI or any
portion thereof.
Business Associate expressly acknowledges and agrees that the breach , or threatened breach, by
it of any provision of this Agreement may cause covered entity to be irreparably harmed and that
Covered Entity may not have an adequate remedy at law . Therefore , Business Associate agrees
Exhibit C - 7
that upon such breach , or threatened breach , Covered Entity will be entitled to seek injunctive
relief to prevent Business Associate from commencing or continuing any action constituting such
breach without having to post a bond or other security and without having to prove the
inadequacy of any other available remedies . Nothing in this paragraph shall be deemed to limit
ilable to Covered Entity at law or in equity .or abridge any other remedy ava
No Party may assign its respective rights and obligations under this Agreement without prior
written consent of the other Party . A reference in this Agreement to a section in HIPAA ,
HITECH , or the HIPAA Regulations means the section as it currently is in effect or amended .
All instructions , notices , consents , demands , or other communications required or contemplated
by this Agreement shall be in writing and shall be delivered to the Parties at the address below :
For Covered Entity : For Business Associate :
Orange County Health Department UNCHCS Legal Department
200 W . Tryon Street 101 Manning Drive , Med Wing E , 2nd Floor
Hillsborough, NC 27278 Chapel Hill , NC 27514
If applicable , by executing this Agreement, Business Associate affirms that it is in compliance
with Article 2 of Chapter 64 of the North Carolina General Statutes .
IN WITNESS WHEREOF , the Parties have executed this Agreement as of the day and
year written above .
COVERED ENTITY : BUSINESS ASSOCIATE .
By : oUu, aAP 9&(w By :
Title : r Title :
Exhibit C - 8
EXHIBIT B
CONTACT INFORMATION
To report to Covered Entity any use or disclosure of Protected Health Information not in
ith the terms of this Agreement that might be considered a Breach, Business
compliance w
Associate should contact the Carla Julian, or the Privacy Officer for Orange County Health
Department at 919 . 245 . 2434 ,
Exhibit C - 9