MASTER AGREEMENT FOR APPROVED DIRECT VENDOR THIS AGREEMENT (“Agreement”) is entered into this ___ day of _____________________, 2013, by and between Michigan Health Information Network Shared Services (“HIN”), with its principal place of business located at 120 W. Saginaw, East Lansing, Michigan 48823 and __________________________________________, (“ Approved Direct Vendor” or “ADV”), with its principal place of business located at ____________________________________________________________. WHEREAS, HIN has selected ADV to provide Direct messaging capabilities and/or professional services to assist HIN and its participating organizations to securely deliver health information over the Internet and to aid in the development of health information exchange and associated activities. WHEREAS, ADV has agreed to provide specific software and/or services for HIN, assisting in the design, development and support of current and future HIN health information exchange efforts, platforms and associated technical architecture. WHEREAS, the parties desire to set forth the terms of their Agreement. NOW THEREFORE, ADV and HIN agree as follows: 1. Procedure. A. Statement of Work. Any work performed by ADV for HIN shall be in accordance with one or more Statements of Work (“SOW(s)”) substantially in the form attached as Exhibit A issued or to be issued by HIN to ADV and ADV agrees to perform the services identified in the SOW(s) (“Work”). All financial terms and conditions shall appear in the SOW(s). ADV acknowledges that the terms of this Agreement are incorporated in and are part of each SOW and any purchase order, invoice, release, specification or other document relating to the services of ADV. Training and other similar services purchased, as part of a Software license, may be included on the applicable Order Form. B. Order Form. Each purchase of Software licenses shall be documented in a mutually executed order form substantially in the form attached as Exhibit B (“Order Form”). Each Order Form shall constitute a separate license (the “License”). “Software” means the software program(s) identified on the applicable Order Form and includes all upgrades of such program(s) provided under this Agreement. C. Conflicting Terms. Each Order Form and SOW shall be a part of and be governed by the terms and conditions of this Agreement. If there is a conflict between this Agreement and any Order Form or SOW, the terms of the Order Form or SOW shall control, provided, however, that an amendment to any term of these general terms and conditions shall not be effective unless otherwise 9631666 -1 of 43- expressly provided in such Order Form or SOW that a contrary provision is necessary due to applicable legal or regulatory requirements, or unless identified by reference to the specific provision of these general terms and conditions. D. No Commitment to Purchase. Unless otherwise specifically agreed between the parties, HIN is under no obligation or commitment to make any purchases from ADV. HIN shall be obligated to make purchases in accordance with this Agreement if and when the parties enter into an Order Form or SOW. 2. Work. A. Scheduling. HIN agrees to cooperate with ADV’s reasonable request(s) for the scheduling and performance of the Work and to pay ADV for ADV’s Work as set forth in the SOW(s). B. Skills. All personnel assigned by ADV to perform Work under this Agreement shall have suitable experience and qualifications required to perform such Work in accordance with the standards established in this Agreement. ADV shall not bill HIN for any on-the-job training. 3. Grant of Licenses. A. Grant. ADV grants to HIN a nonexclusive, perpetual, sublicenseable worldwide, license to use the Software and Documentation subject to the restrictions set forth in this Agreement. The rights and licenses granted under this Agreement to HIN may be used by or on behalf of any participating organizations of HIN and, unless the Order Form expressly states otherwise, any individual or entity that is not a competitor of the ADV and that is managed by or in a contractual relationship with HIN or any of its participating organizations. “Documentation” means user guides, operating manuals, release notes, specifications, system operation materials and other similar documents, whether in print or machine-readable media, made available by ADV to HIN. “Participating organizations” means any organization, including any individual, who has entered into an agreement with HIN to transmit data through the HIN network. B. Copies. HIN shall have the right to make, retain, and use such copies of the Software and Documentation as are reasonably necessary to exercise its rights under this Agreement, subject to the restrictions set forth herein. HIN shall not remove or destroy any proprietary notices of ADV from the Software or Documentation and shall reproduce all copyrights, trademarks, or other proprietary markings of ADV on all copies. 4. Delivery and Acceptance. 2 A. Delivery of Software. ADV shall deliver, install and implement the Software in accordance with the requirements set forth in the Order Form. B. Acceptance Testing. Following installation of the Software, HIN shall have the period of time specified in the Order Form (the “Test Period”), or if no period of time is so specified, thirty (30) days, in which to test the Software to verify that it meets the Specifications. If the Software does not perform in accordance with the Specifications, HIN shall so notify ADV and ADV shall provide HIN with a written work plan that specifies when each deficiency shall be corrected. The work plan shall be subject to HIN’s written approval. ADV shall work diligently to correct all deficiencies within the timeframe specified in the work plan and free of costs to HIN. If ADV is unable to correct a deficiency in the Software within the agreed-upon timeframe and to HIN’s reasonable satisfaction, HIN may terminate the License and ADV shall promptly return to HIN any and all payments received under the applicable Order Form. The Software shall be deemed accepted (“Acceptance”) upon written notice of acceptance by HIN or expiration of the Test Period if HIN fails to notify ADV of any deficiency during that period. 5. Maintenance and Support Services. A. Scope. ADV agrees to provide to HIN maintenance and support services during the Warranty Period and thereafter, provided that HIN has paid the annual maintenance and support fee specified in the Order Form. These services shall include at a minimum (a) telephone support; (b) corrections of errors and (c) all upgrades (the "Maintenance and Support Services"). The hours of support, response times and other terms and conditions governing the provision of Maintenance and Support Services are set forth in the Order Form. ADV shall have no liability or responsibility for problems with the Software caused by misuse, improper installation, alteration or modification by HIN, or for problems arising from the malfunction of HIN's equipment or software not supplied by ADV. “Warranty Period” means the warranty period specified in the applicable Order Form and if no period is specified, ninety (90) days. Unless otherwise provided in the Order Form, the Warranty Period shall commence upon Acceptance. B. Term. Unless otherwise provided in the Order Form, the initial term for maintenance shall commence upon delivery of the Software and continue for a period one (1) year following Acceptance. Thereafter, maintenance shall automatically renew for successive one year periods unless terminated by HIN upon at least thirty (30) days written notice prior to the expiration of the initial term or renewal period. C. Supported Platform. ADV shall support the Platform for the minimum period specified on the Order Form. Thereafter, ADV may discontinue support of the Platform, or any subsequent Platform to which HIN may move, upon no less 9631666 -3 of 43- than eighteen (18) months prior written notice. “Platform” means the computer equipment and operating system specified on the Order Form. D. Minimum Support Commitment. Notwithstanding anything in this Agreement to the contrary, ADV shall provide support of the Software for a minimum period of five (5) years from the date of the Order Form. As used in this Section, "support" means the provision of upgrades of the Software on a regular and ongoing basis. E. Fee. The fee for the initial term shall be as specified in the Order Form. The maintenance fee shall be invoiced annually prior to the commencement of the maintenance period. The maintenance fee for any renewal term may be increased by ADV upon at least sixty (60) days written notice prior to the commencement of the renewal period; provided, however, that the increase shall not be greater than the lesser of (i) the corresponding increase in the CPI for the prior 12 month period; or (ii) 3%. “CPI” means the Consumer Price Index for all Urban Consumers (Index base: 1982/1984 = 100; Index Components: All Items) published by the Bureau of Labor Statistics, United States Department of Labor or its nearest equivalent as mutually agreed upon by the parties if not so published. 6. Term and Termination. A. Unless terminated as provided herein, this Master Agreement for Approved Vendor shall be for an initial term of five (5) years, effective as of the date of this Agreement. The initial term may be extended for consecutive one (1) year periods unless either party provides written notice of its intent to terminate this Agreement not less than sixty (60) days before the end of the then current term. B. HIN may terminate this Agreement without cause upon thirty (30) days written notice. Unless otherwise provided in the SOW, HIN shall have the right to suspend performance or terminate Work under any SOW upon at least thirty (30) days’ prior written notice to ADV. In the event of such termination, HIN agrees to pay ADV for all of ADV’s Work performed up to the date of termination. C. Either party may terminate this Agreement for a material breach, provided, however, that the terminating party has given the non-terminating party at least twenty-one (21) days prior written notice of the breach and an opportunity to cure the breach. Termination for breach shall not preclude the terminating party from exercising any other remedies for such breach. D. If HIN terminates this Agreement or any SOW under this Section 6, ADV shall advise HIN of the extent to which performance has been completed through the termination notice date, and collect and deliver to HIN all deliverables, including, without limitation, all work-in-progress. 4 E. Notwithstanding any provision of this Agreement to the contrary, in the event ADV is no longer accredited under the Direct Trusted Agent Accreditation Program (“DTAAP”) and/or the Electronic Healthcare Network Accreditation Commission (“EHNAC”) ADV shall immediately notify HIN and ADV acknowledges and agrees that HIN may immediately terminate this Agreement and any SOWs or Order Forms entered into between the parties. F. In the event of termination under Section 6.E, HIN shall refund to HIN a pro rata amount for any prepaid undelivered Work and shall provide reasonable assistance to HIN and HIN’s participating organizations to migrate from ADV to a replacement Health Information Service Provider. 7. Ownership of Intellectual Property. A. “Intellectual Property Rights” means domain names, company names, patents, copyrights, trademarks, trade names, trade dress, trade secrets, knowhow, concepts, ideas, discoveries, inventions (whether or not patentable), processes, developments, suggestions, materials, improvements, works of authorship, artwork, HIN Data, Software, Documentation, intellectual property, rights in other tangible and intangible assets of a proprietary nature, and the like. “HIN Data” means all user statistical information such as usage or traffic patterns generated by participating organizations and all electronic data entered into the hosted environment by HIN or any of its participating organizations. B. Unless otherwise provided in the SOW, any and all work produced by ADV in the course of ADV’s performance of the Work, including, without limitation, all underlying Intellectual Property Rights (the “Work Product”) or the like shall be the sole and exclusive property of HIN, and ADV shall have no rights to retain or use any of the Work Product. ADV shall disclose promptly in writing to HIN all inventions, improvements, and developments and materials. C. ADV represents, warrants, and agrees that any and all Work Product shall be original (except as may be otherwise provided in Section 7.G) and shall not infringe on any Intellectual Property Rights of any third person. D. At the request and expense of HIN, ADV shall make, execute, and deliver all application papers, assignments, and instruments, and perform, or cause to be performed, such other lawful acts as HIN may deem necessary or desirable in making or prosecuting applications, domestic or foreign, for patents or copyrights, and any reissues and extensions related to such inventions, improvements, and developments. ADV shall assist and cooperate with HIN and its attorneys in any controversy or legal proceedings relating to such inventions, improvements, and developments, and materials or to the patents or copyrights that may be procured thereon. The decision on whether to file a patent or copyright application with respect to any invention, improvement, or development and the manner of 9631666 -5 of 43- preparation and prosecution of any patent or copyright application shall be wholly within the discretion of HIN. E. All Work Products of the categories identified in Section 101 of the federal Copyright Act of 1976 (the “Copyright Act”) shall be considered “works made for hire” as defined in Section 101. HIN shall own the copyright, the right to register and renew the copyright, the right of first publication, the reproduction right, the performance right, and all other rights provided by the Copyright Act in each “work made for hire.” F. ADV assigns to HIN all common law and statutory copyrights, all rights to register and renew the copyright, all rights of first publication, all reproduction rights, all performance rights, and all rights provided by the Copyright Act and by the laws of all foreign countries in all Work Product that is not described in Section 7.E. ADV shall execute a written assignment and other documents required by HIN for each Work Product described in this Section 7.F. G. ADV may include preexisting work or materials in a Work Product only if they are provided by HIN or if they are owned or licensable without restriction by ADV. To the extent that preexisting work or materials owned or licensed by ADV are included in a Work Product, ADV shall identify any such work or materials prior to commencement of the services involving such works or materials. ADV grants to HIN an irrevocable, nonexclusive, worldwide, royalty free right and license to use, execute, reproduce, display, perform and distribute (internally and externally) copies of, and prepare derivative works based upon, such work and materials, and the right to authorize others to do any of the foregoing. ADV shall be responsible for obtaining any consent of third parties necessary for HIN to fully exercise its rights hereunder. H. HIN Data (i) Ownership. As between HIN and ADV, all HIN Data shall be and remain the sole and exclusive property of HIN. (ii) Limited License. HIN grants to ADV a non-exclusive license to including a license to store, record, transmit, maintain, and display HIN Data only to the extent necessary to provide services under this Agreement. Except as permitted in this Agreement, ADV will not edit, delete, or disclose the contents of HIN Data unless authorized in writing by the HIN. 8. Confidential Information. A. The parties acknowledge the existence of that Mutual Confidentiality and Non-Disclosure Agreement (the “NDA”) executed between the parties dated ___________________, a copy of which is 6 attached hereto and incorporated herein as Exhibit C. The parties agree that the NDA is hereby republished and shall remain in full force and effect according to its terms and shall govern all disclosures of Confidential Information (as defined in the NDA) between the parties with respect to this Agreement and any Statements of Work hereunder. The parties agree that the terms of this Agreement and each Statement of Work shall be deemed Confidential Information under the NDA and subject to the non-disclosure and non-use obligations of the NDA. Protected Health Information shall not be considered to be Confidential Information. B. ADV acknowledges that in the course of performing the SOW(s) it may have access to Protected Health Information, the terms and conditions of the disclosure, and the restrictions on any further disclosure, shall be subject to HIPAA, HITECH and other applicable laws and standards as described in Section 26 below. 9. Representations and Warranties. A. Work. ADV warrants that ADV's Work will be provided in a workmanlike manner, and in conformity with generally prevailing industry standards. ADV warrants that the services and Work provided does and will conform to and comply with all applicable laws and standards including those described in Section 26 below, and that ADV has obtained or will obtain all permits, licenses, certificates and other authorizations necessary to commence and complete its work. B. Specifications. ADV represents and warrants that the Software will operate in conformance with the Specifications during the Warranty Period and thereafter for so long as HIN is purchasing Maintenance and Support Services from ADV. In addition, ADV represents and warrants that all Services shall meet the specifications as set forth in the applicable SOW. “Specifications” means the Documentation and any additional technical or performance criteria set forth in the Order Form, provided as part of an RFP or proposal, or subsequently agreed to in writing by the parties. C. Right to Grant License. ADV represents and warrants that it has the right to grant a license to the Software free and clear of any liens and encumbrances. D. Integration. ADV represents and warrants that the Software may and shall be fully integrated with the system components included as part of any integration services to be performed by ADV. E. Compliance with Standards and Laws. ADV represents and warrants that the Software will, during the Warranty Period and for so long as HIN in on Maintenance and Support Services, comply with any applicable industry standards and Requirements of Law. In addition, the ADV represents and warrants that it and the Services shall comply 9631666 -7 of 43- with any applicable industry standards and Requirements of Law. “Requirements of Law” shall mean those federal and state governmental and quasi-governmental regulatory requirements, statutes, ordinances, policies, edicts, rules, guidelines, or standards related to HIN’s use of the Services or the functions of the Software including, without limitation, all standards or guidelines established by committees, agencies or other standard-setting organizations implementing regulatory requirements, policies, or operating standards adopted by the healthcare industry and any other such modifications or changes that may be required to meet the then-current, industry-accepted specifications and all federal, state, and regulatory requirements that relate to HIN and its participating organizations. Without limiting the generality of the foregoing, Requirements of Law shall mean those requirements shall include, without limitation, all federal and state standards and regulations regarding electronic data interchange transactions (including, without limitation, 45 CFR Part 142 and any other standards or regulations addressing the mandates of Section 262 (Administrative Simplification) of the Health Insurance Portability and Accountability Act of 1996). F. Documentation. ADV represents and warrants that the Documentation is and shall at all times during the term of this Agreement remain complete and current with the version of the Software then in use by HIN and in substance at least as equal to comparable material in use in the industry. G. Platform. ADV represents and warrants that the Software shall operate on or with the Platform. H. Service Levels. In the event the Software is provided to HIN in a Software as a Service format (“SaaS Services”), ADV represents and warrants that the Software hosting will meet or exceed the service level agreements set forth in the attached Exhibit F. I. Security. ADV represents and warrants that ADV will use all commerciallyreasonable efforts to ensure that ADV’s System is protected against security risks and vulnerabilities, including, but not limited to: (a) implementing security procedures that are, at a minimum, at least as secure as those available in the most-recent versions of commercially available web hosting products, including patches, fixes or updates thereto within 24 hours of release to the general public; (b) secure SSL encryption of all data transmissions; (c) password protected access and user IDs; (d) automatic log off if the System is idle or no action is taken after a specified period of time; and (e) isolation of HIN Data into separate databases. ADV will immediately notify HIN of any actual or threatened security breach in or unauthorized or suspicious access to the telecommunications systems that would adversely affect HIN’s systems or access to the System. “System” means all software, equipment, network resources, data or materials owned or controlled by ADV and used to provide the SaaS Services. 10. Indemnification. ADV, at its sole expense, agrees to defend, hold harmless and indemnify HIN, its officers, directors, employees, agents, sub-state HIE’s, stakeholders and any of HIN’s participating organizations from and against any claim, suit or action brought against HIN that is based on a third party claim that any Software, Work Product, Documentation, 8 deliverables or intellectual property provided by ADV infringes any copyrights, trade secrets or patent and (ii) from and against all claims, losses, expenses, liabilities, demands, obligations and damages of every kind and nature (including, without limitation, reasonable attorney fees and expenses) (“Losses”) arising out of or related to any act or omission of ADV or any breach of this Agreement by ADV. HIN, at its sole expense, agrees to defend, hold harmless and indemnify ADV, its officers, directors, employees and agents from and against any third party Losses arising out of or related to any act or omission of HIN or any breach of this Agreement by HIN. 11. Release. ADV agrees to and does hereby release HIN from any and all liability for damages, claims or liability which arises from ADV’s negligent or wrongful actions or omissions in performing the services set forth in this Agreement including, but not limited to, any health reporting requirements, confidentiality or maintenance of confidential records and transmission of electronic medical records. 12. Personnel. A. All personnel assigned by ADV to perform under this Agreement shall be reasonably acceptable to HIN. Upon request by HIN, ADV shall remove any employee, agent or subcontractor reasonably determined by HIN to be unacceptable. B. All personnel assigned by ADV to perform under this Agreement shall have suitable experience and qualifications required to perform such services in accordance with the standards established in this Agreement and the applicable SOW. ADV shall not bill HIN for any on-the-job training. C. ADV will ensure that the ADV personnel, while assigned to provide services or otherwise visiting or accessing any HIN facility will (a) comply with HIN’s then-current environmental, health, safety, and security policies and procedures and other rules and regulations applicable to HIN personnel at those facilities; (b) comply with all reasonable requests of HIN personnel, as applicable, pertaining to personal and professional conduct; (c) submit to appropriate background checks; (d) upon request by HIN, make, execute, deliver, and perform, or cause to be performed, such lawful acts as HIN may deem necessary or desirable, including, but not limited to, providing any releases required under the Fair Credit Report Act, such that HIN can adequately and fully conduct social engineering security testing upon ADV and ADV personnel; (e) receive any necessary training, provided by the ADV and at ADV’s expense, required under applicable laws and standards, including, but not limited to, HIPAA training for any personnel with access to PHI; and (f) otherwise conduct themselves in a professional and businesslike manner. If HIN so requests, based on a reasonable belief that ADV has breached this obligation, ADV will immediately remove any such ADV personnel from HIN’s account and any HIN facility and prevent such ADV personnel from providing services. 9631666 -9 of 43- 13. Independent Contractor. The relationship between the parties is that of an independent party. Nothing contained in this Agreement or in the course of conduct between the parties will be considered to form or constitute a partnership, joint venture, agency, employment or other relationship except that of an independent contractor. In the performance of the services under this Agreement, ADV is an independent contractor with authority to control and direct the performance of its services. 14. Taxes, Benefits and Expenses. ADV is responsible for all expenses connected with its performance of the services to HIN under this Agreement unless noted otherwise in a SOW. ADVs shall be solely responsible to pay all applicable federal, state and local taxes and to file all related returns and reports in connection with the performance of the Work for HIN under this Agreement. ADV acknowledges that HIN has no obligation to and will not withhold taxes of any kind or nature with respect to the services performed by ADV. ADV shall indemnify and hold HIN harmless to the extent of any obligation of the Company to pay any taxes, whether income or otherwise, including any withholding taxes, social security taxes, unemployment taxes, or disability insurance or similar items in connection with payments made to the ADV by HIN. 15. Insurance. ADV shall purchase and maintain throughout the term of this Agreement, statutory worker’s compensation and commercial general liability insurance covering bodily injury, property damage, premise operations, completed operations, and contractual liability, and if requested, media liability and errors and omissions liability, each insurance policy shall have limits reasonably satisfactory to HIN. ADV shall also maintain automobile insurance coverage on vehicles its employees use in the course of performance of services to HIN under this Agreement. All insurance shall be in an amount, with the coverage and from insurance companys satisfactory to HIN. ADV shall maintain all coverages without interruption from the date of this Agreement until the date of termination of this Agreement. At the request of HIN, HIN shall be added as an additional named insured on any insurance policy. Additionally, ADV shall furnish HIN with a copy of certificates of insurance, which shall contain an obligation of the carrier to notify HIN at least thirty (30) days in advance of any cancellation or non-renewal of the policy. 16. Non-Solicitation. ADV agrees that during the term of this Agreement and for a period of one year following its termination, ADV will not employ, or solicit for employment any current or former employee of HIN, solicit any business with any current or former employee of HIN, or contract with any customer of HIN or perform any services that are in direct competition with the services of HIN or the services provided pursuant to the terms of this Agreement. 17. Reasonableness of Agreement. ADV acknowledges and agrees that ADV has weighed all the facts, conditions and circumstances pertaining to this Agreement, has been afforded an opportunity to consult with counsel of its choice concerning this Agreement and its legal effect, and acknowledges that all of the provisions of this Agreement are reasonable. ADV shall not contest the validity of any provision of this Agreement and waives any and all rights 10 that ADV may have to bring any claim, action or suit or to raise any defense regarding the validity and reasonableness of this Agreement or any of its provisions. 18. Assignment. The rights and obligations conferred under this Agreement may not be assigned by either party without the prior written consent of the other party, which consent shall not be unreasonably withheld. Any attempt to assign the Agreement in violation of this provision is null and void. 19. Notices. Any notice required or permitted to be given under this Agreement must be in writing and may be delivered in person, by registered mail, by email for which receipt is acknowledged, or by overnight carrier addressed to the respective party at the address set forth in this Agreement, or such other address as may be provided by a party to the other by written notice. Any notice will be considered to have been given when personally delivered or five (5) business days after mailing or two (2) business day after if sent by overnight carrier. 20. Binding Agreement. This Agreement shall be binding upon and inure to the benefit of and be enforceable by the successors and assigns of the parties. 21. Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of Michigan. 22. Waiver. The failure of either party to require the performance of any term or obligation of this Agreement, or the waiver by either party of any breach of this Agreement shall not prevent any subsequent enforcement of any term or obligation or be deemed to be a waiver of any subsequent breach. 23. Severability. If any provision of this Agreement is held to be invalid or unenforceable for any reason, the remaining provisions shall continue to be valid and enforceable. If a court of competent jurisdiction finds that any provision is invalid and unenforceable as written, that provision will be deemed modified in a manner consistent with the intent of the original provisions, so as to make it valid and enforceable. 24. Subcontract. ADV agrees to notify HIN in writing if it intends to subcontract any part of the Work to an independent contractor. HIN reserves the right to refuse to allow ADV to subcontract specific work or refuse a specific subcontractor. 25. Arbitration. Any dispute arising under this Agreement shall be subject to binding arbitration by a single Arbitrator, in accordance with its relevant industry rules, if any. The parties agree that this Agreement shall be governed by and construed and interpreted in accordance with the laws of Michigan. The arbitration shall be held in Michigan. The Arbitrator shall have the authority to grant injunctive relief and specific performance to enforce the terms of this Agreement. Judgment on any award rendered by the Arbitrator may be entered in any Court of competent jurisdiction. 9631666 -11 of 43- 26. Flow-Down Terms. The Flow-down terms required by the State of Michigan, set forth on Exhibit E of the Agreement, apply to this Agreement. In the event of any conflict between the terms of this Agreement and Exhibit E, the terms of Exhibit E shall control. 27. Protected Health Information. ADV may, in the course of performing the services set forth in this Agreement, have access to certain Protected Health Information (PHI), the terms and conditions of the disclosure of which is subject to the Health Insurance Portability and Accountability Act (HIPAA), the American Recovery and Reinvestment Act of 2009 (ARRA), and the Health Information Technology for Economic and Clinical Health Act (HITECH) and the regulations promulgated thereunder. If ADV will have such access, ADV agrees to execute the HIPAA Addendum attached hereto as Exhibit D contemporaneously with this Agreement. Furthermore, ADV agrees to execute any other documents that may be reasonably requested by HIN for purposes of HIN or its end-users efforts to comply with HIPAA. ADV will comply with all applicable laws and standards necessary to perform this Agreement and ADV will be solely responsible for any violations, breach or failure to abide such applicable laws and standards, including any civil or criminal penalties. Applicable laws and standards include Federal, State and local laws, statutes, acts, codes, regulations and judicial or administrative decisions promulgated by any governmental agency, including the State of Michigan, the Michigan Health Information Technology Commission and any Federal, State or local action having the affect of the law, as any of the foregoing may be amended, modified, codified, re-enacted, promulgated or published, in whole or in part, in effect from time to time. Without limiting the generality of the foregoing, this would include HIPAA, ARRA, HITECH, the Rehabilitation Act of 1973, the Anti-Lobbying Act as revised by the Lobbying Disclosure Act, Section 503 of the Department of Labor, Health and Human Services, and Education and Related agencies, the Omnibus Appropriations Act, the Export Administration Act of 1979 and regulations promulgated thereunder, and the Michigan Identity Theft Protection Act. 28. Cooperation. HIN provides services that are funded, in part, under the American Recovery and Reinvestment Act of 2009 and is required to file certain financial and informational reports. HIN is responsible for insuring that all applicable requirements, including those set forth in ARRA are met. During the term of this Agreement, ADV agrees to reasonably cooperate with HIN in order to meet the ARRA reporting requirements as imposed by HIN, its auditors, accountants, consultants, the State of Michigan and the Office of the National Coordinator for Health Information Technology. 29. Communications. Upon receipt of any request for information from HIN, in any form whatsoever, whether written or oral, ADV shall, within twenty-four (24) hours confirm receipt of such communication. Within two (2) business days of receipt of such communication ADV shall either (a) reasonably answer the HIN request for communication; or (b) provide a specific date by which time such answer shall be provided to HIN. Upon request by HIN, ADV shall, within two (2) business days of receipt of request, provide HIN with a complete summary and status report of all known, open items and/or work assignments. 30. Audit. ADV shall maintain complete and accurate records of the supporting documentation for all charges, and all transactions, authorizations, changes, implementations, reports, filings, returns, analyses, procedures, controls, records, data, or information created, 12 generated, collected, processed or stored by ADV in the performance of its obligations under this Agreement (“Contract Records”). ADV shall maintain such Contract Records in accordance with applicable laws and standards. HIN shall have the right, on at least thirty (30) days’ prior written notice to ADV, to conduct an audit during ADV’s normal business hours to verify ADV’s compliance with the terms of this Agreement. 31. Headings. The headings of this Agreement are for convenience of reference only and have no legal affect. 32. Nondiscrimination. In the performance of this Agreement, ADV agrees not to discriminate against any employee or applicant for employment or service delivery or access with respect to its hire, tenure, terms, conditions or privileges of employment, programs and services provided or any matter directly or indirectly related to employment, because of race, color, religion, national origin, ancestry, age, sex, height, weight, marital status, physical or mental disability unrelated to the individual’s ability to perform the duties of a particular job or position or to receive services. ADV further agrees that it shall not discriminate against minority owned and women owned businesses and businesses owned by persons with disabilities. 33. Debarment and Suspension. ADV represents and warrants that to the best of its knowledge it, and none of its employees providing services under this Agreement: (a) are not presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from covered transactions by any federal department or contractor; (b) have not within a three (3) year period preceding the effective date of this Agreement been convicted of or had a civil judgment rendered against it for the commission of fraud or criminal offense in connection with obtaining, attempting to obtain, or performing a public (federal, state or local) transaction or contract under a public transaction: violation of a federal or state anti-trust statute; or commission of embezzlement, theft, forgery, bribery, falsification or destruction of records, making false statements or receiving stolen property; (c) are not presently indicted or otherwise criminally or civilly charged by a government entity with the commission of any of the offenses enumerated above and (d) have not within a three (3) year period preceding the date of this Agreement had one or more public transactions terminated for cause or default. 34. Entire Agreement. This Agreement, together with the attached Exhibits constitute the entire agreement between the parties with respect to the subject matter hereof, and supersedes all prior agreements, proposals, negotiations, representations or communications relating to the subject matter. Both parties acknowledge that they have not been induced to enter into this Agreement by any representations or promises not specifically stated herein. IN WITNESS WHEREOF, the parties have executed this Agreement on the date first set forth above. Michigan Health Information Network Shared ADV Services By:_______________________________ By: _________________________________ 9631666 -13 of 43- Printed Name: _______________________ Title::___________________ Date: ______________________________ Email: _____________________________ Tim Pletcher, Executive Director Date: _________________________________ Email: ________________________________ 14 Exhibit A Statement of Work STATEMENT OF WORK – [Company Name] # [N]– [General Name For Project] PREAMBLE This Statement of Work (“SOW”) accompanies the following agreement: ____________________________(choose one from: MMA, QDSOA, VQDSOA, Participant Agreement, or Basic Contract for Consulting Services) (“Agreement”) that has been executed by the parties. All statements of fact contained in this SOW are subject to the terms and conditions set forth in the Agreement. The terms and conditions set forth in the Agreement control in the event of any inconsistency between such terms and conditions and the matters set forth in this SOW. In this SOW, the undersigned Contractor (“Contractor”) will perform work for Michigan Health Information Network Shared Services (“HIN” or “Client”) as described herein as the Services (“Services”) and Deliverables (“Deliverables”). 1.0 Project Deliverables Subject to timely payment, the deliverables described hereafter (the "Deliverables") will be provided to Client in final form upon completion of the tasks and Services described in this SOW. Preliminary or draft versions of these Deliverables or written summaries or presentations will be made available to Client for review during the course of the Project upon request by the Client Executive Director (“CED”), Client Associate Director (“CAD”). The CED or the CAD may direct Contractor to report to a Client-specified Project Manager during the Project. During the period [mm/dd/yyyy start date] to [mm/dd/yyyy end date], Contractor will deliver to Client [General Name for Project, same as in title above] the following Deliverables: 1. Detailed description of deliverable 1; 2. Detailed description of deliverable 2; 3. Detailed description of deliverable …; N. Other tasks as specified by the CAD or CED from time to time. [this deliverable must remain in all SOWs] Work on the above activities will begin only upon receipt of written/email authorization from the CED or CAD. Upon receipt of email authorization from the CAD or CED, the Contractor will start work immediately upon the activities as per the terms herein. Upon receipt of email notification from the CAD or CED Contractor will stop work immediately upon the Services and Deliverables as per the terms herein. 2.0 Price and Payment Contractor is being hired to perform the Services and provide the Deliverables according to this SOW. Services shall be provided (check one): subject to an estimate of total costs to complete this work with a not to exceed (“NTE”) total of $[xxx].00 (i.e. the total amount billed for this SOW may not exceed $[xxx].00). Contractor 9631666 -15 of 43- will maintain daily records of hours and tasks performed for its personnel, which will be submitted to Client with each invoice. Contractor total number of hours billed against the NTE shall not be less than [xxx] hours. The Services or Deliverable shall be provided on a time-andmaterial basis for not more than the NTE. Contractor shall use all reasonable efforts to complete the Services and Deliverables for less than the NTE. Special tasks outside the Scope of Work/Project Deliverables in section 1.0 shall be billed at the Contractor’s actual rate and recorded/documented as required herein (or at $______/hour) but in no event shall the NTE be exceeded under this SOW. at a time and material rate of $__________/hour Contractor will maintain daily records of hours and tasks performed for its personnel, which will be submitted to Client with each invoice. at a fixed fee of __________.00. Contractor will be paid upon completion of implementation milestones and sign-off from Client Project Manager. Client shall not be liable for any additional charges in the event Contractor’s actual costs exceed the fixed fee. Specific implementation milestone, payment amount and anticipated completion dates are outlined below: 3.0 Invoices Services will be invoiced monthly by email to accounts-payable@mihin.org by the 24th day of the month in order to receive payment according to the schedule below. All invoices shall plainly indicate the staff, hours, and rates billed. 4.0 Payment Payment from Client is due 60 days after receipt of invoice if the invoice was sent appropriately per section 3.0. Client may not withhold any undisputed amounts due hereunder and Contractor reserves the right to cease work without prejudice if amounts are not paid when due. In the event of a good faith dispute about an invoiced amount, Client may withhold the disputed amount while the parties attempt to resolve the dispute. Client’s withholding of that payment will not constitute a breach of this SOW or the MMA or be grounds for Contractor to suspend its provision of Services, it being recognized and understood by Contractor that provision thereof is critical to Client’s business 5.0 Expenses and Taxes Prices quoted for Services do not include and Client will reimburse Contractor for its reasonable and necessary cost of Non-local travel and out-of-pocket costs for photocopying, overnight courier, unusual long distance telephone and the like. Non-local travel is defined as travel to locations other than Client’s primary offices that exceeds 10 miles. All Non-local travel and out-of-pocket expenses must be approved by Client before commencing. Upon request by Client, Contractor shall provide copies of documentation for such expenses. Any applicable sales tax is to be paid by Contractor. Travel time is not billable hourly time. 6.0 Intellectual Property and Documentation Requirements Pursuant to the Agreement all work products developed under this SOW are instantly the property of HIN. 16 Every page of every work developed under this SOW, including but not limited to electronic documents, paper documents, word documents, power point slides, diagrams, software source code files, and every other written document shall bear the following: Copyright yyyy Michigan Health Information Network Shared Services MiHIN Confidential – Proprietary - Restricted where yyyy is the calendar year such as 2013 or 2014 in which the work was first developed. No work product under this SOW shall bear or contain any Contractor logo or Contractor identification information of any kind without explicit written permission from both the CED and CAD. All slide presentations must use the official Client-approved master slide template and format. File names for all non-source-code documents communicated to HIN shall follow the following convention: “MiHIN [‘content description’] v[N] mm-dd-yy.ext” where: ‘content description’ is 20 characters or less describing what is in the file vN is the version number, starting with v1; version numbers are incremented by 1 every time the file is changed, i.e. v2, v3, v4, v5. Decimal points must not be used in file version numbers. Version numbers shall strictly be monotonically increasing integers. mm-dd-yy is the hyphenated month, day, and two-digit year of the latest revision of the document, appearing IN the file name. .ext is the regular three letter file-type extension. Other than as indicated above, hyphens and underscores shall not be used in or appear in non-source code document names. Source code document names shall follow the convention except no blanks shall occur in source code file names; instead underscores shall be used instead of blanks. Source code file names shall follow convention rules established by the Client Project Manager for each Project. Contractor company or personnel names shall not appear anywhere in any deliverable files or filenames. Example correct filenames: MiHIN Complex Diagram For Widgets v3 09-17-12.vsd MiHIN White Paper On Security v21 09-16-12.doc MiHIN Presentation on Architecture v12 01-07-13.ppt Example incorrect filename: Bad_Company_document_version_6_0_Jan 12 2013.doc 9631666 -17 of 43- Contractor shall have access to, and shall maintain, store, and routinely update timely copies of all electronic documents/deliverables for this SOW on a Backpack page provided by Client. Software source code shall be stored in a BitBucket account provided by Client. 7.0 Flow down terms The Flow-down terms required by either the federal government or the State of Michigan, set forth on the attached Exhibit A, apply to the Services performed under this SOW. In the event of any conflict between the terms of this SOW and Exhibit A, the terms of Exhibit A shall control. 8.0 Other Terms 8.1 Non-Solicitation. Contractor agrees that during the term of this SOW and for a period of one year following its termination, Contractor will not employ, or solicit for employment any current or former employee of Client, solicit any business with any current or former employee of Client, or contract with any customer of Client or perform any services that are in direct competition with the services of Client or the services provided pursuant to the terms of this Agreement. IN WITNESS WHEREOF, the parties have executed this SOW on the date first set forth above. Contractor ___________________________ By:_________________________________ Title: Principal Date: _________________________ Client / Michigan Health Information Network Shared Services By: _________________________________ Tim Pletcher, Executive Director Date: _______________________ 18 ORDER FORM TO MASTER AGREEMENT FOR APPROVED DIRECT VENDOR This Order Form is made and entered into pursuant to the terms and conditions of a certain Master Agreement for Approved Direct Vendor dated _______________, 20_____ (the "Agreement") , by and between HIN entity and the undersigned ADV. Software and License Fees Quantity Item No./Description Price/License Fee Total: License Fees Payment Schedule _____% upon execution of this Order Form _____% upon installation of the Software _____% upon Acceptance (as defined in Section 4 of the Agreement) Additional Licenses License Type Check one: Server License – licensed number: Workstation License - licensed number: Concurrent User License - licensed number: Named User License - licensed number: Other (specify): Deliverables/Specifi cations 9631666 List any additional technical or performance criteria that the Software must meet (e.g. RFP/RFI, proposals, marketing materials): -19 of 43- Delivery Date 1. 2. 3. 4. 5. The Software shall be delivered on or before: Acceptance Testing Length of the Test Period: Warranty Period Length of the Warranty Period: Maintenance Fee $___________ for the initial term as specified in Section 5. Maintenance and Support Services Platform Description: Object Code/Source Code Services and Services Fees Minimum support period: Check one: Object Code only will be provided. Object Code and Source Code will be provided. Object Code only will be provided. HIN shall have the right to access the Source Code in accordance with the terms of the attached escrow agreement with: . Description of Services (describe in detail): Training (describe in detail): Other (describe in detail): Services Fees: Payment Schedule: Licensure & Qualifications 20 Specify the department and address where invoices should be sent: Invoicing Information Additional Term and Conditions (if any) The parties have executed this Order Form as of the dates set forth below their respective signatures. HIN ADV By: By: (Signature) (Signature) (Type or Print Name) (Type or Print Name) Its: Its: (Type or Print Title) Date: 9631666 (Type or Print Title) Date: -21 of 43- Exhibit C MUTUAL CONFIDENTIALITY AND NON-DISCLOSURE AGREEMENT Effective as of: _________________________ (“Effective Date”) By and Between And Michigan Health Information Network Shared Services (Type or Print Name of Party) 120 W. Saginaw (Address) East Lansing, Michigan 48823 (City) Attention: Jeff Livesay Phone No.: 248.802.8844 E-Mail Address: livesay@mihin.org (State) (Zip) Attention: Phone No.: ( ) E-Mail Address: The parties to this Agreement (individually “Party” and collectively “Parties”) have disclosed and/or desire to disclose certain confidential information to each other in connection with an existing or prospective business relationship. To protect the information, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows: know-how, processes, templates, apparatus, equipment, algorithms, formulas, ingredients, software programs, software source documents, and formulas, (g) information from third parties that Discloser is obligated to treat as confidential, and (h) information that is derived from Confidential Information (for example through testing, analysis or processing). 1. Discloser and Recipient. As to any particular Confidential Information (defined below), the Discloser is the Party disclosing the Confidential Information and the Recipient is the Party receiving the Confidential Information. 2. Confidential Information. As used in this Agreement, “Confidential Information” means any information (whether tangible or intangible, printed, electronic, or otherwise) and items embodying information (including graphs, photographs, samples, working models, and prototypes) at any time furnished by either Party to the other, or to which either Party is exposed, whether before or during the term of this Agreement, including, without limitation, (a) the identities of or information concerning Discloser’s customers, suppliers, or other business partners, (b) information concerning Discloser’s business and business plans, (c) Discloser’s marketing plans and materials, (d) financial information concerning Discloser and its affiliates, (e) information concerning Discloser’s pending patents or other trade secrets, (f) Discloser’s business techniques and methodologies, operating procedures, systems operations, management tools, manuals, sketches, drawings, designs and specifications, data models, concepts, ideas, inventions, 3. Restrictions on Use; Non Disclosure. Except as otherwise expressly permitted in writing by an authorized representative of Discloser, Recipient agrees that it will not: (a) use the Confidential Information of Discloser for any purpose other than the purpose for which Discloser disclosed the information; (b) directly or indirectly copy, transfer, or otherwise disclose or reveal Confidential Information of Discloser to any person or entity other than its employees, directors, officers, agents and consultants who (i) have a need to know to further the purpose of this Agreement; (ii) have been advised of the information’s confidential status; and (iii) are subject to legally binding obligations of confidentiality as to such information no less restrictive than those contained in this Agreement; provided, however, that Recipient shall at all times be fully responsible to Discloser for 22 the compliance by such persons and entities with this Agreement; or (c) if requested by Discloser, disclose its business relationship with Discloser. 4. Exceptions. The obligations set forth in Section 3 above shall not apply to Confidential Information that: (a) before the time of its disclosure was already in the lawful possession of the Recipient; or (b) through no wrongful act of the Recipient, at the time of its disclosure to Recipient is, or later becomes, available to the general public; or (c) Recipient demonstrates with appropriate written documentation to have been lawfully independently developed by Recipient without the use of or reliance upon any Confidential Information of the other party and without any breach of this Agreement. 5. Standard of Care. Recipient shall use its best efforts to prevent unauthorized access to and unauthorized use, dissemination or copying of any Confidential Information of Discloser. Recipient shall upon request describe to Discloser the procedures it uses to protect Confidential Information of Discloser, and shall thereafter at its own initiative advise Discloser of any changes in such procedures. 6. Ownership; No License. Each Party shall retain ownership of all rights, including all intellectual property rights, in its Confidential Information. Nothing in this Agreement shall be deemed by implication or otherwise (a) to convey to Recipient any right under any patent, patent application, invention, or other proprietary right owned by Discloser or anyone associated with Discloser; or (b) to create a commitment of any kind by either Party to enter into any further agreement with the other Party. 7. Ownership; No Reverse Engineering. Recipient agrees not to assert any claim of title or ownership to the Confidential Information or any portion thereof. If Confidential Information consists of computer software disclosed in object code form, Recipient shall not, and shall not permit any other party to, reverse engineer, reverse compile, or disassemble such object code, or take any other steps to derive a source code equivalent thereof. If Confidential Information is embodied in an item, such as a model or prototype, then except as specifically approved in writing by Discloser Recipient shall not, and shall not permit any other party to, reverse engineer such item to derive drawings, plans, or designs, specifications, or other embodied information, and any such derived information shall constitute Confidential Information protected by this Agreement. 8. Disclosures Required by Law. If Recipient becomes legally compelled (by deposition, interrogatory, subpoena, civil investigative demand or similar process) to disclose any Confidential Information, then Recipient shall notify Discloser of the requirement promptly in writing so that Discloser may seek a protective order or other appropriate remedy. If a protective order or other remedy is not obtained, or if Discloser waives in writing compliance with the terms hereof, then Recipient shall furnish only that portion of the information which Recipient is advised by written opinion of counsel is legally required and to exercise reasonable efforts to obtain confidential treatment of such information. 9. Duration. The obligations set forth in this Agreement shall survive indefinitely. 10. Term. This Agreement shall become effective as of the Effective Date and shall perpetually govern all -23 of 43- disclosures made between the Parties until such time as the Parties agree otherwise in a written instrument signed by both Parties. provision or provisions of this Agreement shall be held, for any reason, to be illegal, invalid or nonenforceable, then the remaining provisions shall nonetheless be legal, valid and enforceable provisions. This Agreement does not reduce or supplant the protections contained in the Uniform Trade Secrets Act. Notices required or permitted with respect to this Agreement shall be given in writing by (a) personal or courier delivery, (b) registered or certified mail with return receipt, (c) facsimile transmission with confirmed receipt, or (d) electronic mail with confirmed receipt. This Agreement constitutes the entire agreement between the Parties with respect to the subject matter of this Agreement and supersedes all earlier agreements and understandings, oral and written, between the Parties with respect to the subject matter. This document may be executed in one or more counterparts each of which shall be an original, but all of which together shall constitute one and the same agreement. Any signature of this Agreement through facsimile shall constitute execution of this Agreement by such party. 11. Warranty. Discloser represents and warrants that it has the right to make the disclosures under this Agreement and that Recipient’s use of the Confidential Information in accordance with this Agreement will not infringe any trademark, copyright, patent, trade secret or other proprietary right of a third party. 12. Disposal of Confidential Information. Recipient agrees to return to Discloser all copies of Confidential Information promptly upon Discloser’s request at any time. If return is impossible as to any portion of the Confidential Information, or upon Discloser’s request, then Recipient shall certify to Discloser promptly that all such Confidential Information of Discloser, including all copies thereof, has been totally and permanently destroyed. 13. On-Site Visits. Any employee, director, officer, agent or consultant of one Party that enters the premises or property of the other Party shall follow all policies and procedures of the other Party in place on those premises, including, without limitation, all policies and procedures relating to health, safety and the protection of confidential or trade secret information. 17. Governing Law. This Agreement shall be governed by the laws of the State of Michigan without regard to conflicts of law principles. 14. Remedies. The Parties acknowledge and agree that a breach of this Agreement by either Party will cause continuing and irreparable injury to the other’s business as a direct result of any such violation, for which the remedies at law will be inadequate, and that Discloser shall therefore be entitled, in the event of any actual or threatened violation of this Agreement by Recipient, and in addition to any other remedies available to it, to a temporary restraining order and to injunctive relief against the other Party to prevent any violations thereof, and to any other appropriate equitable relief. 15. Assignment. Neither Party may assign, delegate or subcontract any of its rights or obligations under this Agreement without the prior written consent of the other Party. Subject to the foregoing, this Agreement shall inure to the benefit of, and be binding upon, the successors and permitted assigns of the Parties. 16. Miscellaneous. No failure or delay by Discloser in exercising any right, power or privilege hereunder shall operate as a waiver thereof, nor shall any single or partial exercise thereof preclude any other or further exercise thereof or the exercise of any right, power or privilege hereunder. This Agreement may be modified or waived only by a separate writing signed by Discloser and Recipient expressly so modifying or waiving any provision of this Agreement. If any 24 The parties have signed this Agreement as of the dates set forth below their respective signatures. Michigan Health Information Network Shared Services (Type or Print Name of Party) By: (Signature) By: (Type or Print Name) (Signature) Its: Jeff Livesay (Type or Print Name) Its: Associate Director Date: 2.3.2012 Date: 25 Exhibit D HIPAA ADDENDUM The parties to this HIPAA Addendum (“Addendum”) are Michigan Health Information Network Shared Services (“HIN”) and ______________ (“Approved Direct Vendor” or “ADV”). This Addendum supplements and is made a part of the Master Agreement for Approved Vendor between the Parties (“Agreement”). RECITALS A. Under the terms of the Agreement, HIN wishes to disclose certain information to ADV, some of which may constitute PHI. In consideration of the receipt of PHI, ADV agrees to protect the privacy and security of the information as set forth in this Addendum. B. HIN and ADV intend to protect the privacy and provide for the security of PHI disclosed to ADV under the Agreement in compliance with HIPAA and the HITECH Act. C. As part of HIPAA, the Privacy Rule and Security Standards (defined below) require HIN to enter into a contract containing specific requirements with ADV before the disclosure of PHI occurs. In consideration for ADV’s access to and/or use of PHI for those purposes allowed by HIPAA and consistent with the services that ADV performs for HIN, and in consideration for the mutual promises and covenants set forth below, the parties agree as follows: 1. Definitions. As used in this Addendum: “Breach Notification Standards” means the HIPAA regulations governing notification in the case of breach of unsecured PHI as set forth at 45 CFR § Part 164, Subpart D, and all applicable stricter state and federal laws, as they exist now or as they may be amended. “Designated Record Set” means a group of records maintained by or for HIN that is (i) the medical records and billing records about individuals maintained by or for HIN, (ii) the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) used, in whole or in part, by or for HIN to make decisions about individuals. As used herein, the term “Record” means any item, collection, or grouping of information that includes PHI and is maintained, collected, used, or disseminated by or for HIN. “HIPAA” means the Health Insurance Portability and Accountability Act, Public Law 104-91, and any amendments thereto. 26 “HIPAA Transaction” means Transactions as defined in 45 CFR § 160.103 of the Transaction Standards. “HITECH Act“ means the Health Information Technology for Economic and Clinical Health Act, found in the American Recovery and Reinvestment Act of 2009 at Division A, title XIII and Division B, Title IV. “Individual” shall have the same meaning as the term “individual” in 45 CFR § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g). “Minimum Necessary” shall have the meaning set forth in the Health Information Technology for Economic and Clinical Health Act, § 13405(b). “Privacy Rule” means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR § Part 160 and Part 164, as they exist now or as they may be amended. “Protected Health Information” or “PHI” shall have the meaning set forth at 45 CFR § 160.103 of HIPAA. “Required By Law” shall have the same meaning as the term “required by law” in 45 CFR § 164.103. “Secretary” means the Secretary of the Department of Health and Human Services or his designee. “Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. “Security Standards” means the Security Standards, 45 CFR § parts 160, 162 and 164, as they exist now or as they may be amended. “Transaction Standards” means the Standards for Electronic Transactions, 45 CFR § part 160 and part 162, as they exist now or as they may be amended. 1.1. Terms used, but not otherwise defined, in this Addendum shall have the same meaning as those used in the Privacy Rule or the HITECH Act, and any amendments or implementing regulations. 2. Obligations and Activities of ADV. 2.1. ADV agrees that it shall not, and that its directors, officers, employees, contractors and agents shall not, use or further disclose PHI other than as permitted or required by this Addendum or as Required By Law. 27 2.2. ADV agrees to use appropriate safeguards in accordance with the Privacy Rule to prevent use or disclosure of the PHI other than as provided for by this Addendum. 2.3. ADV agrees to mitigate, to the extent required by law, any harmful effect that is known to ADV of a use or disclosure of PHI by ADV in violation of the requirements of this Addendum, including, but not limited to, compliance with any state law or contractual data breach requirements. 2.4. ADV agrees to report to HIN any use or disclosure of the PHI not provided for by this Addendum of which it becomes aware, or of any act or omission that violates the terms of this Addendum in accordance with Section 2.17, below. 2.5. ADV agrees to ensure that any agent, including a subcontractor, to whom it provides PHI received from, or created or received by ADV on behalf of HIN, agrees in writing to the same restrictions and conditions that apply through this Addendum to ADV with respect to such information. Further, ADV shall include in its contracts with agents or subcontractors the right to terminate the contract if the agent or subcontractor commits a material breach under the contract, and ADV shall exercise such termination rights in the event of a material breach. ADV shall exercise such termination rights in the event of a material breach. These obligations do not pertain to subcontractors that act as mere conduits for the transport of PHI but do not access the information other than on a random or infrequent basis. 2.6. ADV agrees to provide access, at the request of HIN, and in the time and manner designated by HIN, to PHI in a Designated Record Set, to HIN or, as directed by HIN, to an Individual in order to meet the requirements under 45 CFR § 164.524 and HITECH Act § 13405(e). 2.7. ADV agrees to make any amendment(s) to PHI in a Designated Record Set that HIN directs or agrees to pursuant to 45 CFR § 164.526 at the request of HIN or an Individual, and in the time and manner designated by HIN. If ADV provides Designated Record Sets to third parties, ADV shall ensure such records are also amended. 2.8. ADV agrees to make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by ADV on behalf of HIN, available to the Secretary, in a time and manner designated by HIN or the Secretary, for purposes of the Secretary determining HIN’s compliance with the Privacy Rule. 2.9. ADV agrees to document disclosures of PHI, and information related to such disclosures, as would be required for HIN to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528 and any additional regulations promulgated by the Secretary pursuant to HITECH Act § 13405(c). ADV agrees to implement an appropriate record keeping process that will track, at a minimum, the following information: (i) the date of the disclosure; (ii) the name of the entity or person who received the PHI, and if known, the address of such entity or person; (iii) a brief description of the PHI 28 disclosed; and (iv) a brief statement of the purpose of such disclosure which includes an explanation of the basis for such disclosure. 2.10. ADV agrees to provide to HIN or to an Individual, in the time and manner designated by HIN, information collected in accordance with Section 2.9 of this Addendum, to permit HIN to respond to a request by an Individual for an accounting of disclosures of PHI during the six (6) years prior to the date on which the accounting was requested, in accordance with 45 CFR § 164.528. 2.11. In the event ADV receives a subpoena, court or administrative order or other discovery request or mandate for release of PHI, ADV will respond as permitted by 45 CFR § 164.512(e) and (f). 2.12. ADV will not make any communications to individuals in violation of the restrictions on marketing in HITECH Act § 13406(a) and without the prior consent of HIN. 2.13. If ADV will communicate with any individuals who are the subject of PHI originating from or prepared for HIN, ADV agrees to implement procedures to give timely effect to an individual’s request to receive communications of PHI by alternative means or at alternative locations, pursuant to 45 CFR § 164.522(b), so as to ensure that PHI will only be communicated to those individuals designated in such a request as authorized to receive the PHI. If ADV provides records to agents, including subcontractors, who may also communicate with the individual, ADV shall ensure that the individual’s request for communications by alternative means is provided to and given timely effect by such agents. 2.14. ADV shall not directly or indirectly receive or provide remuneration in exchange for any PHI in violation of any final regulations promulgated by the Secretary under HITECH Act § 13405(d) once such regulations become effective. 2.15. Electronic Transactions. ADV hereby agrees that, to the extent that it is electronically transmitting any of the HIPAA Transactions for ADV, the format and structure of such transmissions shall be in compliance with the Transaction Standards. 2.16. Electronic Data Security. To the extent that ADV creates, receives, maintains or transmits electronic PHI, ADV hereby agrees that it: 2.16.1. Has implemented and documented administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic PHI that ADV creates, receives, maintains or transmits on behalf of HIN consistent with the requirements at 45 CFR §§ 164.308, 164.310, 164.312 and 164.316; 2.16.2. Will ensure that any agent, including a subcontractor, to whom ADV provides electronic PHI agrees to implement reasonable and appropriate safeguards to protect the PHI; and 29 2.16.3. Will keep records of all Security Incidents involving PHI of which ADV becomes aware, and will report to HIN all significant Security Incidents of which ADV becomes aware. 2.17. Breach Notification. The parties have in place policies and procedures that are designed to detect inappropriate acquisition, access, use or disclosure of unsecured PHI, as that term is defined in HITECH, and each party trains its work force and agents on these procedures. Each party agrees that it will notify the other party within ten (10) business days of discovering an inappropriate acquisition, access, use or disclosure of PHI transmitted by, to, through, or on behalf of the other party, and, as soon as reasonably practicable, but in no event later than thirty (30) calendar days of discovery will provide the other party with the identification of each individual whose PHI has been or is reasonably believed to have been breached during such incident, and any other information required pursuant to 45 C.F.R. §§ 164.400-414. Each party will assist the other party in assessing whether the Breach poses a significant risk of financial, reputational or other harm to the individuals whose information is involved. In the event that individuals whose data is affected by the impermissible acquisition, access, use or disclosure must be notified pursuant to the HIPAA Breach Notification Standards or other applicable law, the party responsible for the Breach will provide such notification at its own expense without unreasonable delay and in compliance with applicable law or reimburse the reasonable costs of the party that bears the responsibility to provide notification. 2.18. If HIN delegates the performance of a particular Privacy Rule obligation to ADV, ADV will comply with the requirements of the Privacy Rule that would apply to HIN in the performance of such obligation. 3. Permitted Uses and Disclosures by HIN 3.1. General Use. Except as otherwise limited in this Addendum, ADV may use or disclose PHI to perform functions, activities, or services for, or on behalf of, HIN as specified in the Agreement, provided that such use or disclosure of PHI would not violate the Privacy Rule if done by HIN or the minimum necessary policies and procedures of HIN. 3.2. Specific Use and Disclosure Provisions. Except as otherwise limited in this Addendum, ADV may disclose PHI to carry out the legal responsibilities of ADV and for its own proper management and administration, provided that disclosures are required by law, or ADV obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and be used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies ADV of any instances of which it is aware in which the confidentiality of the information has been breached. All other disclosures shall be subject to HIN’s prior written permission. 4. Obligations of HIN. 30 4.1. HIN shall notify ADV of any limitation(s) in the notice of privacy practices of HIN in accordance with 45 CFR § 164.520, to the extent that such limitation may affect ADV’s use or disclosure of PHI. ADV will give timely effect to such limitations. 4.2. HIN shall notify ADV of any changes in, or revocation of, permission by Individual to use or disclose PHI, to the extent that such changes may affect ADV’s use or disclosure of PHI. ADV will give timely effect to such changes or revocations. 4.3. HIN shall notify ADV of any restriction to the use or disclosure of PHI that HIN has agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect ADV’s use or disclosure of PHI. ADV will give timely effect to such restrictions. 4.4. HIN shall not request ADV to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by HIN, except as specifically allowed by Section 3.2 of this Addendum. 5. Term and Termination. 5.1. Term. The Term of this Addendum shall be effective so long as the Agreement is in effect between the parties and shall terminate when all of the PHI in any form, recorded on any medium, or stored in any storage system provided by HIN to ADV, or created or received by ADV on behalf of HIN, is destroyed or returned to HIN, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with the termination provisions in this Section. This provision shall apply to PHI that is in the possession of ADV or agents of ADV. ADV shall retain no copies of the PHI. 5.2. Termination for Breach by HIN. Upon ADV’s knowledge of a material breach of the terms of this Addendum by HIN, ADV shall either: 5.2.1. Provide an opportunity for HIN to cure the breach or end the violation and terminate their relationship and the Agreement if HIN does not cure the breach or end the violation within the time specified by ADV; 5.2.2. Immediately terminate its relationship with HIN and the Agreement if HIN has breached a material term of this Addendum and cure is not possible; or 5.2.3. If neither termination nor cure are feasible, report the violation to the Secretary. ADV’s option to have cured a breach of this Addendum shall not be construed as a waiver of any other rights ADV has in the Agreement, this Addendum or by operation of law or in equity. 5.3. Termination for Breach by ADV. Upon HIN’s knowledge of a material breach of the terms of this Addendum by ADV, HIN shall either: 31 5.3.1. Provide an opportunity for ADV to cure the breach or end the violation and terminate their relationship and the Agreement if ADV does not cure the breach or end the violation within the time specified by HIN; 5.3.2. Immediately terminate its relationship with ADV and the Agreement if ADV has breached a material term of this Addendum and cure is not possible; or 5.3.3. If neither termination nor cure are feasible, report the violation to the Secretary. 5.4. Other Conditions Allowing for Immediate Termination. Notwithstanding anything to the contrary in this Addendum or the Agreement, HIN may terminate its relationship with ADV and the Agreement immediately upon written notice to ADV, without any notice period and/or judicial intervention being required, and without liability for such termination, in the event that: 5.4.1. ADV (i) receives a criminal conviction, (ii) is excluded, barred or otherwise ineligible to participate in any government health care program, including but not limited to Medicare, Medicaid, CHAMPUS or Tricare; (iii) is named as a defendant in a criminal proceeding for a violation of any information privacy and protection law; or (iv) is found to have or stipulates that it has violated any privacy, security or confidentiality protection requirements under any applicable information privacy and protection law in any administrative or civil proceeding in which ADV has been joined; 5.4.2. A trustee or receiver is appointed for any or all property of ADV; 5.4.3. ADV becomes insolvent or unable to pay debts as they mature, or ceases to so pay, or makes an assignment for benefit of creditors; 5.4.4. Bankruptcy or insolvency proceedings under bankruptcy or insolvency code or similar law, whether voluntary or involuntary, are properly commenced by or against ADV; 5.4.5. ADV is dissolved or liquidated. 5.5. Effect of Termination. 5.5.1. Except as provided in paragraph 5.5.2 of this Section, upon termination of the Agreement, for any reason, ADV shall return or, at HIN’s direction, destroy all PHI received from HIN, or created or received by ADV on behalf of HIN in any form, recorded on any medium, or stored in any storage system. This provision shall apply to PHI that is in the possession of subcontractors or agents of ADV. ADV shall retain no copies of the PHI. 32 5.5.2. In the event that return or destruction of the PHI is infeasible, ADV shall extend the protections of this Addendum to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as ADV maintains such PHI. 6. Indemnification and Insurance. 6.1 Indemnification. ADV shall indemnify and hold harmless HIN for any and all claims, inquiries, costs or damages, including but not limited to any monetary penalties, that HIN incurs arising from a violation by ADV of its obligations hereunder. To the extent that ADV has limited its liability under the terms of the Agreement, whether with a maximum recovery for direct damages or a disclaimer against any consequential, indirect or punitive damages, or other such limitations, all limitations shall exclude any damages to HIN arising from ADV’s breach of its obligations relating to the use and disclosure of PHI. 6.2 Insurance. Each party shall obtain and maintain insurance coverage with at least such limits as provided under the Agreement. 7. Miscellaneous. 7.1. Amendment. No provision of this Addendum may be modified except by a written document signed by a duly authorized representative of the parties. The parties agree to amend this Addendum, as appropriate, to conform with any new or revised legislation, rules and regulations to which ADV is subject now or in the future including, without limitation, the Privacy Rule, Security Standards or Transactions Standards (collectively “Laws”). If within ninety (90) days of either party first providing written notice to the other of the need to amend this Addendum to comply with Laws, the parties, acting in good faith, are i) unable to mutually agree upon and make amendments or alterations to this Addendum to meet the requirements in question, or ii) alternatively, the parties determine in good faith that amendments or alterations to the requirements are not feasible, then either party may terminate this Addendum upon thirty (30) days’ written notice. 7.2. Assignment. No party may assign or transfer any or all of its rights and/or obligations under this Addendum or any part of it, nor any benefit or interest in or under it, to any third party without the prior written consent of the other party, which shall not be unreasonably withheld. 7.3. Survival. The respective rights and obligations of ADV under Section 5.5 of this Addendum shall survive the termination of this Addendum. 7.4. Interpretation. Any ambiguity in this Addendum shall be resolved to permit HIN to comply with the Breach Notification Standards, Privacy Rule, Security Standards, and Transaction Standards. If there is any inconsistency between this Addendum and any other agreement between the parties, the language in this Addendum shall control. 33 7.5. Third Party Rights. The terms of this Addendum are not intended, nor should they be construed, to grant any rights to any parties. 7.6. Minimum Necessary. ADV agrees that, for all PHI that ADV accesses or requests from HIN for the purposes of providing services, it shall access or request, and HIN shall provide, only that amount of information that is minimally necessary to perform such services. In addition, for all uses and disclosures of PHI by ADV, ADV shall institute and implement policies and practices to limit such uses and disclosures to that which is minimally necessary to perform its services. ADV shall determine the amount minimally necessary consistent with the requirements in the HITECH Act, § 13405(b), or as otherwise specified in regulations promulgated by the Secretary of the Department of Health and Human Services. 7.7. HITECH Act, § 13404. ADV may use and disclose PHI only if such use or disclosure, respectively, is in compliance with each applicable requirement of 45 CFR §164.504(e) and this Addendum. 7.8. Notice. All notices required under this Addendum shall be in writing and shall be deemed to have been given on the next day by fax or other electronic means or upon personal delivery, or in ten (10) days upon delivery in the mail, first class, with postage prepaid. Notices shall be sent to the addressees indicated below unless written notification of change of address shall have been given. If to ADV If to HIN: _________________________________ _________________________________ _________________________________ _________________________________ ____________________________________ ____________________________________ ____________________________________ ____________________________________ Tel: _____________________________ Tel: ________________________________ Fax:_____________________________ Fax: _______________________________ 7.9 Owner of PHI. Under no circumstances shall ADV be deemed in any respect to be the owner of any PHI used or disclosed by or to ADV by HIN. IN WITNESS WHEREOF, the parties have executed this Addendum the dates indicated below. ADV HIN ______________________________ _____________________________ 34 Signed Signed ______________________________ Printed _____________________________ Printed ______________________________ Date _____________________________ Date 35 Exhibit E FLOW-DOWN TERMS As used in this Exhibit, “Contract” means the applicable SOW. “Contractor” means Approved Direct Vendor or “ADV” A. Federal Economic Stimulus Funding: This Contract requires the Contractor to provide products and/or services that are funded in whole or in part under the American Recovery and Reinvestment Act of 2009, Public Law 111-5, (Recovery Act). The Contractor is responsible for ensuring that all applicable requirements, including but not limited to those set forth herein, of the Recovery Act are met and that the Contractor provides information to the State as required. The Contractor (and any of its providers) shall comply with the following: 1. Federal Grant Award Documents, as applicable. The parties hereby acknowledge and agree that any references in the Federal Grant Award Documents that prohibit the charging of profit or fee do not apply to Contractor. In addition, Contractor will not be subject to any Cost Accounting Standards set forth in the Federal Grant Award Documents. 2. Executive Office of the President, Office of Management and Budget (OMB) Guidelines as posted at www.whitehouse.gov/omb/recovery_default/, only to the extent that such guidelines are applicable to for-profit commercial entities such as Contractor or to support HIN’s compliance therewith. 3. OMB Circulars applicable to for-profit commercial entities such as Contractor or to support HIN’s compliance with the OMB Circulars, including but not limited to A-102, A-110 and A-133 as posted at www.whitehouse.gov/omb/financial_offm_circulars/. Contract terms established or expected by OMB Circulars will be included in the contract to the extent they are applicable. 4. The applicable sections of the Recovery Act, including but not limited to the following sections of that Act: i. Section 1604 – Disallowable Use. No funds pursuant to this Contract may be used for any casino or other gambling establishment, aquarium, zoo, golf course, or swimming pool. 36 ii. Section 1512 – Reporting and Registration Requirements. To the extent applicable to a vendor to a sub-recipient, the Contractor must report on use of Recovery Act funds provided through this Contract. Information from these reports will be made available to the public. Contractor shall provide HIN with the information HIN needs to meet its reporting obligations. iii. Section 1553 – Recovery Act Whistleblower Protections. An employee of any non- Federal employer receiving covered funds under the Recovery Act may not be discharged, demoted, or otherwise discriminated against as a reprisal for disclosing, including a disclosure made in the ordinary course of an employee’s duties, to the Accountability and Transparency Board, an inspector general, the Comptroller General, a member of Congress, a State or Federal regulatory or law enforcement agency, a person with supervisory authority over the employee (or other person working for the employer who has the authority to investigate, discover or terminate misconduct), a court or grand jury, the head of a Federal agency, or their representatives, information that the employee believes is evidence of one or more of the following related to the implementation or use of covered funds: gross mismanagement, gross waste, substantial and specific danger to public health or safety, abuse of authority, or violation of law, rule, or regulation (including those pertaining to the competition for or negotiation of a Contract). Non-enforceability of Certain Provisions Waiving Rights and Remedies or Requiring Arbitration: Except as provided in a collective bargaining agreement, the rights and remedies provided to aggrieved employees by this section may not be waived by any agreement, policy, form, or condition of employment, including any predispute arbitration agreement. No predispute arbitration agreement shall be valid or enforceable if it requires arbitration of a dispute arising out of this section. Requirement to Post Notice of Rights and Remedies: The Contractor and any Solutions Provider shall post notice of the rights and remedies as required under Section 1553. (Refer to Section 1553 of the American Recovery and Reinvestment Act of 2009, Pub. L. 111-5 located at www.recovery.gov, for specific requirements of this section and prescribed language for the notices.) 37 iv. Section 902 – Access Of Government Accountability Office. The Contractor shall provide that the Comptroller General and his representatives are authorized: to examine any records of the Contractor or any of its providers, that directly pertain to, and involve transactions relating to, this Contract or an Agreement; and to interview any officer or employee of the Contractor or any of its providers regarding such transactions. v. Section 1514 – Inspector General Reviews. Any inspector general of a federal department or executive agency has the authority to review, as appropriate, any concerns raised by the public about specific investments using such funds made available in the Recovery Act. In addition, the findings of such reviews, along with any audits conducted by any inspector general of funds made available in the Recovery Act, shall be posted on the inspector general’s website and linked to the website established by Recovery Act Section 1526, except that portions of reports may be redacted to the extent the portions would disclose information that is protected from public disclosure under sections 552 and 552a of title 5, United States Code. vi. Section 1515 – Access of Offices of Inspector General to Certain Records and Employers. With respect to this Contract, any representative of an appropriate inspector general appointed under section 3 or 8G of the Inspector General Act of 1978 (5 U.S.C. App.), is authorized: vii. to examine any records, of the Contractor or any of its Solutions Providers, that pertain to and involve transactions relating or pursuant to this Contract; and to interview any officer or employee of the Contractor regarding such transactions. Section 1606 – Wage Rate Requirements. All laborers and mechanics employed by pursuant to this Contract shall be paid wages at rates not less than those prevailing on projects of a character similar in the locality as determined by the Secretary of Labor in accordance with subchapter IV of chapter 31 of title 40, United States Code. All rulings and interpretations of the Davis-Bacon Act and related acts contained in 29 CFR 1, 3, and 5 are herein incorporated by reference. For purposes of this Contract, laborer or mechanic includes at least those workers whose duties are manual or physical in nature (including those workers who use tools or who are performing the work of a 38 trade), as distinguished from mental or managerial. The term laborer or mechanic includes apprentices, trainees, helpers, and, in the case of contracts subject to the Contract Work Hours and Safety Standards Act, watchmen or guards. viii. Section 1605 – Buy American Requirements for Construction Material – Buy American, Use of American Iron, Steel, and Manufactured Goods. None of the funds provided by this Contract may be used for a project for the construction, alteration, maintenance, or repair of a public building or public work unless all of the iron, steel, and manufactured goods used in the project are produced in the United States. 5. Contractor shall make available to the U.S. Comptroller General, the Health and Human Services awarding agency, HIN or any of their duly authorized representatives, any books, documents, papers and records of Contractor which are directly pertinent to the Services performed under this SOW for the purpose of making audits, examination, excerpts and transcriptions. 6. Contractor shall comply with E.O. 11246, “Equal Employment Opportunity,” as amended by E.O. 11375, “Amending Executive Order 11246 Relating to Equal Employment Opportunity,” and as supplemented by regulations at 41 CFR part 60, “Office of Federal Contract Compliance Programs, Equal Employment Opportunity, Department of Labor.” 7. In the event Contractor shall provide any construction or repair Services, Contractor shall comply with: 8. i. The Copeland “Anti-Kickback” Act, 18 U.S.C. 874, as supplemented by Department of Labor regulations, 29 CFR part 3, “Contractors and Subcontractors on Public Building or Public Work Financed in Whole or in Part by Loans or Grants from the United States.” Contractor shall report all suspected or reported violations to HIN. ii. The Davis-Bacon Act, 40 U.S.C. 276a to a–7, and as supplemented by Department of Labor regulations, 29 CFR part 5, “Labor Standards Provisions Applicable to Contracts Governing Federally Financed and Assisted Construction.” Contractor shall report all suspected or reported violations to HIN. In the event Contractor shall provide any construction Services or employ any mechanics or laborers, Contractor shall comply with sections 102 and 107 of the Contract Work Hours and Safety Standards Act, 40 U.S.C. 327–333, as supplemented by Department of Labor regulations, 29 CFR part 5. These requirements do not apply to the purchases of supplies or materials or articles 39 ordinarily available on the open market, or contracts for transportation or transmission of intelligence. B. 9. In the event Contractor’s Services include the performance of experimental, developmental, or research work Contractor shall comply with 37 CFR part 401, “Rights to Inventions Made by Nonprofit Organizations and Small Business Firms Under Government Grants, Contracts and Cooperative Agreements,” and any further implementing regulations issued by HHS. 10. Contractor shall comply with all applicable standards, orders or regulations issued pursuant to the Clean Air Act, 42 U.S.C. 7401 et seq., and the Federal Water Pollution Control Act, as amended 33 U.S.C. 1251 et seq. Violations shall be reported to the HHS and the appropriate Regional Office of the Environmental Protection Agency. 11. The Contractor agrees to use commercially reasonable efforts to comply with any modifications or additional requirements that may be imposed by law and future guidance and clarifications of Recovery Act requirements. Lobbying. The Contractor certifies, to the best of its knowledge and belief, that: 1. No federally appropriated funds have been paid or will be paid, by or on behalf of the undersigned, to any person for influencing or attempting to influence an officer or employee of an agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of any Federal contract, the making of any Federal grant, the making of any federal loan, the entering into of any cooperative agreement, and the extension, continuation, renewal, amendment, or modification of any federal contract, grant, loan, or cooperative agreement. 2. No federally appropriated funds have been paid or will be paid, by or on behalf of the undersigned, to any person for influencing or attempting to influence an officer or employee of an agency, a member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of any Federal contract, the making of any Federal grant, the making of any federal loan, the entering into of any cooperative agreement, and the extension, continuation, renewal, amendment, or modification of any federal contract, grant, loan, or cooperative agreement. This certification is a material representation of fact upon which reliance was placed when this transaction was made or entered into and is a prerequisite for making or entering into this transaction imposed by section 1352, title 31, U.S. Code. 40 Exhibit F SERVICE LEVEL AGREEMENTS 1. Definitions a. “Force Majeure Event” means any delay or failure in performance hereunder caused by reason of any occurrence or contingency beyond its reasonable control, including but not limited to acts of God, earthquake, labor disputes and strikes, riots, and war. b. “Scheduled Downtime” equals the aggregate total of all minutes of planned and scheduled maintenance performed during the month to perform any necessary hardware, OS, network, database, application software maintenance, repair, upgrades, and updates. ADV must provide fourteen (14) days prior notice for any maintenance to be included as Scheduled Downtime. ADV will work with HIN to determine and use commercially reasonable efforts to schedule downtime after regular business hours, during times that minimize the disruption to operations. Scheduled Downtime shall not exceed four (4) hours per month. c. “System Availability” will be calculated monthly during the term of the applicable Order Form using the following formula (and will be rounded to the nearest one-tenth of a percentage point): i. “System Availability” = [(Base Time – Unscheduled Downtime) / (Base Time)] x 100 ii. “Base Time” equals the product of the number of days in the applicable month multiplied by twenty-four (24) hours multiplied by sixty (60) minutes, less downtime resulting from a Force Majeure Event. d. “Unscheduled Downtime” equals the time (in minutes) during which the Service is not operational (excluding “Scheduled Downtime”). 2. Service Availability Commitment a. If the monthly System Availability for the Service falls below 99.9% and so long as HIN is current in paying all undisputed fees and operating within the scope of use limits set forth in the Agreement, ADV will refund to HIN within thirty (30) days of the end of such month an amount equal to such month’s fees. b. In the event System Availability falls below 99.9% for (i) two (2) consecutive calendar months in a rolling twelve (12) month period; or (ii) any three (3), or more, nonconsecutive months in any twelve (12) month period, then, notwithstanding anything in the Agreement to the contrary, HIN may terminate the Agreement, the applicable Order Form or SOW effective upon written notice to ADV. c. In the event that System Availability falls below 90% in any given month, then, notwithstanding anything in the Agreement to the contrary, HIN may terminate the Agreement, the applicable Order Form or SOW and/or the effected system components effective upon written notice to ADV. 3. Measuring System Availability. a. Equipment, network routers, switches, circuits, OS and other software provided by ADV will be monitored using automated monitoring tools. In addition, call center logs will be checked that show a resolution relating to System Availability issues. HIN may perform 41 its own System Availability monitoring to include live functional testing. For purposes of tracking downtime duration, the Unscheduled Downtime will begin at the time at which the impact is first identified by either: (1) ADV’s tracking tools; or (2) HIN’s tracking tools. Unscheduled Downtime ends at the point in time when users have the ability to access and use the production system. b. ADV will make available to HIN, upon HIN’s request, reports that are inclusive of data on the System Availability. 42 43