LICENSE AGREEMENT

I. LICENSE

III. IMPLEMENTATION SERVICES AND TRAINING

MEDITAB shall provide Implementation Services and Training for the lump sum fee set forth in System Cost Summary subject to the following terms and conditions: 

A.  MEDITAB reserves the right to increase the fees if the project is not completed within six (6) months of execution of the Agreement, or if CLIENT changes the scope of the project.

B.  The fees set forth in System Cost Summary are for MEDITAB’s standard implementation services and initial training. MEDITAB reserves the right to increase fees if the standard implementation services are modified to accommodate CLIENT requirements or due to delays beyond MEDITAB’s control.

C.  Should CLIENT request MEDITAB assistance for onsite hardware set-up and/or network configuration, additional fees will apply. Meditab will be reimbursed for travel and other reasonable business expenses when incurred. Such expenses must be approved in advance by the client.

D.  CLIENT will receive an Implementation Plan that includes all services required to complete this implementation and it will identify any necessary work outside of standard business hours. In the event additional services are required outside of the scope of the Implementation Plan, additional fees will apply. Services provided at the request of the CLIENT outside of standard business hours (8:30 am to 5:00 pm Monday through Friday), Saturday, Sunday, observed holiday, evening and rush rates are available at a surcharge. Implementation and training services are rendered online or via electronic media.  CLIENT will be responsible for all costs associated with any changes outside the original scope of work.

E.  CLIENT will be solely responsible for allocating recommended training time for all staff prior to Go-Live Date. The training schedule will be mutually agreed upon. CLIENT will be billed for any training canceled without giving at least a 48-hour notice to Meditab or if more than 3 scheduled training are canceled.

F.  CLIENT’s full cooperation with all of MEDITAB’s hardware, software, implementation and training recommendations are material requirements of this Agreement.  Minimum hardware and software requirements can be found at https://www.meditab.com/pdf/system_requirements.pdf

G.  Additional implementation and training information and terms can be found at https://www.meditab.com/pdf/Training-and-implementation.pdf

IV. SUPPORT AND ENHANCEMENTS

A. Provided CLIENT is not in breach of this Agreement, MEDITAB shall support and maintain the SYSTEM in conformity with the Warranty described below. MEDITAB, or its authorized representative, shall use commercially reasonable efforts consistent with prevailing industry standards to correct any problems that materially impact on CLIENT’s use of the SYSTEM if such problems result from demonstrable and repeatable errors or defects in the SYSTEM licensed pursuant to this Agreement. CLIENT is not responsible for any expenses incurred by MEDITAB to remedy such problems. Whenever possible, remote diagnostics will be used to expedite the correction of any programming error. Support shall not cover problems caused by CLIENT modifications to the executable code or database compromising the SYSTEM, or caused by CLIENT’s hardware, internet service, software or improper use of the SYSTEM. SYSTEM may be unavailable while MEDITAB performs routine maintenance and enhancements.

B. MEDITAB reserves the right to change support and enhancement fees for a renewal year, with ninety (90) days prior written notice. Any increase shall not exceed 5% of such charges in the previous year fees. Fees for third party products or services may be subject to increase at any time.

C.  MEDITAB provides SYSTEM support 24 hours a day, 7 days a week.  The aforementioned hours of support are not material to this Agreement and may be modified at MEDITAB’s own discretion with prior notice.  Support for services provided by third parties is subject to the vendors’ support schedule.  MEDITAB shall not be held in breach under this Agreement or liable for its and its vendors’ support unavailability due to force majeure and other reasons beyond MEDITAB’s control. 

D. The following are not included in the support and enhancement quote, and will be billed separately: (i) failure to operate the SYSTEM in accordance with MEDITAB’s recommendations, including power and environmental specifications; (ii) alteration of the SYSTEM by CLIENT or CLIENT representative without prior written approval from MEDITAB; (iii) SYSTEM failure caused by device or equipment failures not covered hereunder (including power failures, network failures, and hardware failures); and (iv) training of new staff after the initial training period.

E. If CLIENT does not renew the support and enhancements, a re-entry fee will apply should CLIENT wish to receive any enhancements or support services as provided in this Agreement. The re-entry fee is calculated as follows: 125% of all previous Support and Enhancement fees at the time of re-entry. CLIENT shall be responsible at all times for any third party fees associated with usage of the SYSTEM and Ancillary Services.

F.  If any hardware has been purchased by CLIENT from MEDITAB, such hardware is not covered by support and enhancements services. MEDITAB hereby passes through to CLIENT any and all warranties provided by the manufacturer for that hardware.

G. MEDITAB reserves the right to discontinue support on older software versions with ninety (90) days prior written notice.

H.  MEDITAB will provide all enhancements made to the SYSTEM, and any related materials, to the CLIENT, during the term of this Agreement and any renewals thereof. Enhancements will be provided online or via media that can be easily loaded on the CLIENT’s system by the CLIENT. CLIENT is responsible for familiarizing employees with the changes.

I.  MEDITAB is not responsible for providing hardware, operating system software or third party software (e.g. MS Excel, Sybase, etc.) that may be required by any enhancements to the SYSTEM.

J.  CLIENT agrees that modified or enhanced versions of the licensed SYSTEM do not constitute a program different from the licensed SYSTEM, and as such, fall under the terms and conditions of this Agreement.

K. Software Updates Company may, from time to time and in its sole discretion, develop and provide updates to the Services, which may include, but not be limited to, upgrades, bug fixes, patches and other error corrections and/or new features (collectively, "Updates"). Updates may also modify or delete in their entirety certain features and functionalities of the Services. Customer understands and agrees that Customer is hereby required to keep current with the Services licensed from Company and to install all Updates and new versions on a timeline approved by Company. This timeline will be communicated by Company to Customer in writing. No Support services will be provided for versions of the Services beyond the two most-recent versions (the “Supported Releases”), nor Company warrants that versions prior to the Supported Releases would function properly or be compatible with newer versions of the Services. Failure by Customer to install all Updates or new versions of the Services shall be considered a material breach of this Agreement and subject to termination by Company pursuant to the terms of Section 11(b)(2).

V. CLIENT’S RESPONSIBILITIES

A.  CLIENT shall comply with all terms and conditions of this Agreement, including links thereto.

B. CLIENT shall timely pay all invoices, and continue to pay for all support and maintenance/enhancement charges, and other due charges for the purchased License(s) and other services and products received by CLIENT under this Agreement. 

C. CLIENT shall comply with all HIPAA and HITECH rules/regulations.

D. CLIENT is responsible for maintaining and storing in a safe and secure location backup copies of all data files CLIENT may place in the SYSTEM. In no event shall MEDITAB be liable for the loss or destruction of CLIENT’s data for any reason.

E. CLIENT is solely responsible for acquiring, servicing, maintaining, and updating all equipment, computers, software and communications services not owned or operated by or on behalf of MEDITAB, that allow CLIENT to access and use the SYSTEM in accordance with any and all operating instructions or procedures that may be issued by MEDITAB and that meet the minimum requirements specified by MEDITAB.  CLIENT understands and agrees that the operation and availability of the systems used for accessing and interacting with the SYSTEM, including, power supply, telephones, computer networks and the internet or to transmit information, whether or not supplied by CLIENT, MEDITAB, or MEDITAB’s partner/vendor, can be unpredictable and may, from time to time, interfere with or prevent the access to and/or the use or operation of the SYSTEM.  MEDITAB and its partners, affiliates and third party vendors are not in any way responsible for any such interference with or prevention of CLIENT’s access and/or use of the SYSTEM.

F. CLIENT shall comply with all implementation, training, hardware specifications, and software recommendations of MEDITAB.  CLIENT shall be solely responsible to ensure that all employees, including new employees, and users of the SYSTEM are properly trained.

G. CLIENT shall take reasonable steps to ensure the security of the SYSTEM and CLIENT data.  CLIENT shall be responsible for system and network password management and for ensuring that no virus/malware is loaded onto or may corrupt the SYSTEM.

H. CLIENT shall promptly notify MEDITAB before CLIENT adds user(s) beyond those specifically licensed to use the SYSTEM under this Agreement or amended Agreement, if any.

I. CLIENT shall not solicit for employment any employee of MEDITAB who is employed by MEDITAB on or after the Effective Date of this Agreement.

J. CLIENT shall promptly notify MEDITAB of any change in address, billing email or CLIENT’s business status.

K. CLIENT shall be solely responsible to use the SYSTEM in accordance with its user documentation and MEDITAB’s recommendations.

L. CLIENT shall be considered the sole and exclusive custodian of patient data, and be solely responsible to respond to any subpoena or record request from any third party or government entity.  CLIENT shall indemnify MEDITAB for any fees/costs incurred. 

M. CLIENT is solely responsible to verify with all appropriate authorities the right to use the SYSTEM, the rules and regulations for using the SYSTEM in accordance to their state and federal laws and regulations, including HIPAA and other privacy regulations, and obtain all prior approvals, if any, before using the SYSTEM. CLIENT is responsible to make its own independent and informed decision for when and how the SYSTEM is utilized.  CLIENT SHALL INDEMNIFY, HOLD HARMLESS AND DEFEND MEDITAB FROM ANY AND ALL CLAIMS, LIABILITIES, MATTERS, FINES OR SUITS INCLUDING ALL FEES AND COSTS FOR COMPLYING WITH SUBPOENAS, BROUGHT BY ANY THIRD PARTY, AGENCY, ENTITY, PATIENT, INCLUDING PATIENT’S HEIR OR ASSIGNS, AGAINST MEDITAB ARISING OUT OF CLIENT’S MATERIAL BREACH OF ANY RESPONSIBILITY SET FORTH IN THIS AGREEMENT.

VI. LIMITED WARRANTY

A. MEDITAB REPRESENTS THAT DURING THE TERM OF THIS AGREEMENT, THE SYSTEM WILL SUBSTANTIALLY PERFORM INTENDED CENTRAL FUNCTIONS (as listed in Attachment “A” hereto).  CLIENT MUST TIMELY NOTIFY MEDITAB IN WRITING OF THE DISCOVERY OF ANY MATERIAL DEFECTS IN THE SOFTWARE.

B. THE FOREGOING LIMITED WARRANTY DOES NOT APPLY TO THE SYSTEM IF USED, IN WHOLE OR IN PART, WITH COMPUTER EQUIPMENT OR SOFTWARE OTHER THAN AS RECOMMENDED, OR USED BY UNLICENSED USERS. SUCH WARRANTIES SHALL BE NULL AND VOID TO THE EXTENT THAT CLIENT OR ANYONE OTHER THAN MEDITAB OR ITS EMPLOYEES SHALL MODIFY OR ATTEMPT TO MODIFY THE SYSTEM SOFTWARE (EXECUTABLE CODE) OR ANY PART THEREOF, AND SUCH MODIFICATION CAUSES THE SYSTEM TO NOT FUNCTION AS WARRANTED, OR IN THE EVENT CLIENT SHALL USE OR ALLOW THE SYSTEM TO BE USED IN A MANNER INCONSISTENT WITH THE SPECIFICATION OF THE SYSTEM FOUND IN THE DOCUMENTATION PROVIDED TO CLIENT.

C. THE FOREGOING WARRANTY IS IN LIEU OF ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE AND ALL SUCH OTHER WARRANTIES ARE EXPRESSLY DISCLAIMED. MEDITAB DOES NOT REPRESENT THAT THE SYSTEM WILL MEET ALL CLIENT REQUIREMENTS OR THAT THE OPERATION OF THE SYSTEM WILL BE UNINTERRUPTED OR ERROR-FREE.

VII. LIMITATION OF LIABILITY

A. MEDITAB’S TOTAL LIABILITY FOR ANY CLAIMS AND DAMAGES, WHETHER DIRECT, INDIRECT, SPECIAL, INCIDENTAL AND/OR CONSEQUENTIAL, OR FOR ANY LOST PROFITS, FUNDING, SAVINGS OR REVENUES OF ANY KIND, HOWEVER SUCH DAMAGES AND LOSSES MAY BE CAUSED (EXCEPT FOR FRAUD, WILLFUL INJURY TO THE PERSON OR PROPERTY, OR VIOLATION OF THE APPLICABLE LAW) SHALL BE LIMITED TO THE AMOUNT OF THE LICENSE FEES, AND EXCLUDING VENDOR AND THIRD PARTY FEES AND COSTS, ACTUALLY PAID BY THE CLIENT AND RECEIVED BY MEDITAB IN THE LAST TWELVE (12) MONTHS. MEDITAB SHALL NOT BE LIABLE FOR ANY FAILURE OR DELAY IN PERFORMANCE DUE TO ANY CAUSE BEYOND ITS CONTROL. IN NO EVENT WILL MEDITAB BE LIABLE FOR ANY DAMAGE CAUSED BY CLIENT’S FAILURE TO PERFORM CLIENT’S OBLIGATIONS AND RESPONSIBILITIES, OR FOR LOST PROFITS, TRAINING COSTS, IMPLEMENTATION COSTS, HARDWARE (IF ANY), AND OTHER CONSEQUENTIAL DAMAGES, EVEN IF THE POSSIBILITY OF SUCH DAMAGES WAS KNOWN TO MEDITAB, OR FOR ANY CLAIM AGAINST CLIENT BY ANY THIRD PARTY.

B. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CONSEQUENTIAL DAMAGES; SUBSECTION “A” APPLIES ONLY TO THE EXTENT AVAILABLE BY APPLICABLE LAW.

C. WITHOUT LIMITING THE FOREGOING, CLIENT AGREES THAT THE USE OF THE SYSTEM BY CLIENT OR CLIENT’S PERSONNEL FOR ANY PURPOSE RELATED TO PATIENT CARE CANNOT BE CONTROLLED BY MEDITAB AND MUST NOT BE SUBSTITUTED FOR CLIENT’S PROFESSIONAL SKILL AND JUDGMENT. CLIENT ACKNOWLEDGES THAT MEDITAB IS IN NO WAY RESPONSIBLE FOR ANY PHARMACEUTICAL, MEDICAL, LEGAL OR SIMILAR INFORMATION CONTAINED IN, ENTERED INTO, OR USED IN CONNECTION WITH THE SYSTEM, AND CLIENT INDEPENDENTLY WILL VERIFY THE ACCURACY AND COMPLETENESS OF SUCH INFORMATION.

VIII. TERMINATION OF LICENSE AND TITLE

A. MEDITAB may terminate this Agreement upon the occurrence of any of the following events:

1. CLIENT shall be considered in breach of this Agreement if CLIENT fails to pay for all due fees and charges, other SYSTEM fees/costs, third party fees, specified equipment, implementation, training and travel fees/costs, and other charges due under this Agreement, and if such breach is not cured within ten (10) days after receipt of notice of such breach.

2. MEDITAB may, at its sole discretion, immediately terminate this Agreement if CLIENT breaches any other provision of this Agreement, or CLIENT sells its business, transfers all or part of its business to a third party, becomes insolvent or files for bankruptcy protection. 

B.  In the event of termination of this Agreement, CLIENT shall not be entitled to any refunds of paid fees and costs, and other charges incurred pursuant to this Agreement.

C. Upon the termination of the Agreement for any reason, CLIENT shall cease to use the SYSTEM, and shall return to MEDITAB all tangible documentation for the SYSTEM. The provisions of this Agreement regarding confidentiality and non-disclosure, and sections IX and XII(I) shall survive the termination by either Party.

D. Upon termination of this Agreement, CLIENT will not be able to access patient data or other information stored in the SYSTEM.  Upon receipt of a written request from CLIENT, MEDITAB will provide a quote for read-only access or data conversion.  Converted data may be limited to patient demographics from Patient Entry Window.  Should CLIENT request conversion of any other data or other services, MEDITAB will provide a formal fee and cost proposal to CLIENT and an estimate of time to complete.

E. Title to the SYSTEM will at all times remain with MEDITAB irrespective of the ownership of the media on which the SYSTEM or related materials are contained.

IX. PROPRIETARY RIGHTS 

A. The SYSTEM furnished to CLIENT, documentation and links herein are the property of MEDITAB. CLIENT acknowledges that MEDITAB represents that the SYSTEM constitutes a valuable asset and is a trade secret of MEDITAB. CLIENT agrees to:

1. Take reasonable steps to hold the SYSTEM and associated System Cost Summary in confidence;

2. Instruct its officers, directors, managers, employees, contractors, affiliates and agents not to sell, sublease, assign, transfer or otherwise make available the SYSTEM or the benefits thereof to others without the prior written consent of MEDITAB;

3. Not copy or duplicate by any means, the SYSTEM or any documentation or other materials furnished by MEDITAB to CLIENT with or as part of the SYSTEM, except for copies as specifically permitted in this Agreement. Client may not make any modifications or enhancements to the SYSTEM without MEDITABs prior written consent;

4. Not remove or permit to be removed from any item included in the SYSTEM any notice placed thereon by MEDITAB indicating the confidential nature of, or the property right of MEDITAB in such item;

5. Not modify or remove the copyright notice of MEDITAB on all copies, in any form, including partial copies of the SYSTEM or any documentation or materials furnished by MEDITAB to CLIENT with or as part of the SYSTEM;

6. Limit access to the SYSTEM to only those of its employees, agents and consultants of CLIENT who need access to the SYSTEM in order to use the product thereof for CLIENT’s business, and to government inspectors, as required, and if requested by MEDITAB, it will require its employees and consultants to execute a reasonable non-disclosure agreement;

7. Instruct its agents and employees not to use any information, in tangible or intangible form, which has been disclosed or may be disclosed to it or its employees by MEDITAB which has been marked “confidential” under or in connection with this Agreement for the purpose of creating or duplication or attempting to create or duplicate the SYSTEM or any documentation marked “confidential” furnished with or included in the SYSTEM.

B. Rights in Derivative Works. Any modifications, revisions, updates, bug fixes, customization, templates or enhancements to the SYSTEM ("Derivative Works") created by or with the assistance of CLIENT or any of its officers, directors, employees, contractors, affiliates or agents, shall be "works for hire" within the meaning of the copyright laws of the United States, and MEDITAB shall be considered the author for hire of such Derivative Works, and MEDITAB shall be the sole owner of all intellectual property rights, including copyright, in them. To the extent that any Derivative Works are found not to be works for hire, CLIENT agrees to, and hereby does, without compensation of any kind, convey exclusively and irrevocably to MEDITAB all right, title and interest it may possess in such Derivative Works, and further agrees, upon MEDITAB’s request and at CLIENT’s own expense, to execute any document or instrument evidencing such conveyance, or which may be necessary to perfect MEDITAB’s exclusive title in such Derivative Works.

C. MEDITAB shall exercise the same degree of care to preserve the proprietary nature of all CLIENT confidential information as it exercises to protect its own confidential information of like kind, so long as the confidential nature of such information is identified to MEDITAB prior to disclosure of it.

D. MEDITAB may refer to CLIENT by name in advertising and promotional materials in connection with MEDITAB’s SYSTEM. CLIENT may not advertise, market, promote or publicize in any manner its use and access to MEDITAB’s SYSTEM or its participation in this Agreement without the express consent of MEDITAB in each instance. MEDITAB may contact CLIENT regarding goods, services, or promotional offers that may be of interest to CLIENT that are offered by Meditab or by third parties, which may be related or unrelated to Meditab.  MEDITAB shall require the recipient to both keep CLIENT’s information confidential and not use it for any purpose except for such purposes.  CLIENT may opt-out at any time by sending an email to marketing@meditab.com.

X. HIPAA PROVISION

The Parties agree to execute a Business Associate Agreement (BAA), attached to this Agreement as Exhibit A.

XI. ARBITRATION

THE PARTIES ACKNOWLEDGE THAT THEY HAVE A RIGHT TO SUBMIT ANY CONTROVERSY, CLAIM OR DISPUTE TO CIVIL LITIGATION AND TO HAVE SUCH MATTER RESOLVED BY A JURY.  AS FURTHER CONSIDERATION TO ENTER INTO THIS AGREEMENT, THE PARTIES AGREE THAT ANY CONTROVERSY, CLAIM, OR DISPUTE BETWEEN THE PARTIES WHICH ARISES OUT OF THIS AGREEMENT SHALL BE SUBMITTED TO AND RESOLVED EXCLUSIVELY BY BINDING ARBITRATION IN SACRAMENTO COUNTY, CALIFORNIA, IN ACCORDANCE WITH THE RULES SET FORTH IN THE CALIFORNIA CODE OF CIVIL PROCEDURE, TITLE 9, SECTION 1280 ET SEQ., USING A SINGLE NEUTRAL ARBITRATOR.  IN ANY LEGAL ACTION, ARBITRATION OR PROCEEDING EACH PARTY SHALL BE RESPONSIBLE FOR ITS COSTS AND ATTORNEYS FEES.  HOWEVER, IN ANY ARBITRATION, PROCEEDING, ACTION OR COLLECTION CLAIM TO (I) SOLELY AND EXCLUSIVELY COLLECT PAST DUE FEES OR INVOICE FROM CLIENT, AND/OR (II) ANY ACTION OR PROCEEDING TO ENFORCE THE ARBITRATION PROVISION SPECIFIED IN THIS SECTION, IN ADDITION TO THE REMEDIES AND RIGHTS CREATED HEREIN AND WITHOUT WAIVING THE SAME, THE PREVAILING PARTY SHALL BE ENTITLED TO COLLECT THE REASONABLE ATTORNEY’S FEES AND COSTS.

XII. GENERAL

A. ASSIGNMENT. This Agreement is not assignable by CLIENT. Any attempt by CLIENT to sublicense, assign or transfer any of the rights, duties or obligations under this Agreement is void. CLIENT shall be liable to MEDITAB for all fees, costs and damages for SYSTEM use or access by any party not expressly authorized by MEDITAB to use or access the SYSTEM licensed to CLIENT.

B. RESERVATIONS OF RIGHTS.  MEDITAB reserves the rights, title and interest in and to the SYSTEM and services provided under this Agreement, including all related intellectual property rights.  MEDITAB reserves the right to utilize data contained within or derived from SYSTEM in a HIPAA-compliant manner in an effort to improve the SYSTEM and services, and to lower overall costs of operations.  No rights are granted to CLIENT hereunder other than as expressly set forth herein. 

C. MODIFICATION. The terms of this Agreement may be modified only by written agreement duly signed by persons authorized to sign agreements on behalf of MEDITAB and CLIENT. Third party fees and costs are not subject to this modification provision.

D. FORCE MAJEURE. MEDITAB is not responsible for failure to fulfill its obligations under this Agreement due to causes beyond its control.

E. NOTICES. All notices to MEDITAB required under sections II(a), VI(A), VIII and IX(A)(2) hereunder shall be personally delivered or sent by the U.S. certified or registered mail, return receipt requested. All notices to MEDITAB shall be sent to Meditab Software, Inc., PO Box 255687, Sacramento, California 95865, or its corporate headquarters (if different), and sent Attention: Chief Executive Officer. All notices to CLIENT shall be sent to the address noted in Client Information (below) or via the electronic method.

F. SEVERABILITY. If any provision of this Agreement is held unenforceable or in conflict with the law of any jurisdiction, the validity of the remaining provisions shall not be affected by such holding.  The Parties agree to negotiate and amend in good faith such provision in a manner consistent with the intentions of the Parties as expressed in the Agreement, if any invalid or unenforceable provision affects the consideration of either Party.

G. GOVERNING LAW. This Agreement will be governed by the laws of the State of California.

H. CONSENT TO JURISDICTION. Without waiver of the Arbitration provision in Section XI, CLIENT and MEDITAB hereby consent and agree that the Superior Court of the State of California for the County of Sacramento shall have personal jurisdiction and proper venue with respect to any injunctive relief or legal proceeding between MEDITAB and CLIENT. This location may be changed by MEDITAB with thirty (30) days’ notice but only in the event that MEDITAB’s corporate headquarter is moved.

I. SECURITY INTEREST. CLIENT grants MEDITAB, and MEDITAB reserves, a security interest, covering all CLIENT’s obligations under this Agreement (including any liability for breach of CLIENT’s obligations), and applying to all of CLIENT’s right, title and interest in the SYSTEM and all information and materials placed into or produced by the SYSTEM, together with all accessions to the SYSTEM and any proceeds that may arise in connection with the sale or disposition of it. CLIENT shall cooperate with MEDITAB in the filing of Financing Statements to perfect such security interests; furthermore, CLIENT authorizes MEDITAB to execute and file Financing Statements without the CLIENT’s signature in any jurisdiction in which such procedure is necessary and/or authorized.

J. ATTACHMENTS/LINKS/SCHEDULES. All attachments, links and schedules to this Agreement are deemed incorporated herein by reference and may be updated or revised from time to time by MEDITAB with prior notice to CLIENT.

K. NO WAIVER. No waivers of or exceptions to any term, condition or provision of this Agreement, including timely billing CLIENT or acceptance of a late payment from CLIENT, in any one or more instances, shall be deemed to be, or construed as, a waiver and/or further or continuing waiver of any such term, condition or provision.

L. COMPLETE AGREEMENT. THE PARTIES ACKNOWLEDGE THAT THEY HAVE READ THIS AGREEMENT, and agree to be bound by all of its provisions. This Agreement, together with any Exhibits, Addendums, and Amendments, which are incorporated herein by this reference, constitutes the complete and exclusive statement of the agreement between the Parties and supersedes all prior oral and written communications, quotes, representations, promises and guarantees concerning the subject matter of this Agreement. Any Amendments and/or Addendums to this Agreement executed between the parties shall be considered part of this Agreement and shall be incorporated herein by reference.

M. HEADINGS. The headings in this Agreement are for convenience only and shall not affect the interpretation hereof. Whenever the context may permit, any pronoun used herein shall include the corresponding, masculine, feminine or neuter forms, and the singular form of any noun or pronoun, including any capitalized term defined herein, shall include the plural and vice versa.

XIII. ANCILLARY SERVICES

EXHIBIT A

1. PREAMBLE AND DEFINITIONS.

1.1  Pursuant to the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), Customer (“Covered Entity”) and Company, or any of its corporate affiliates (“Business Associate”) enter into this Business Associate Agreement (“BAA”) as on the Effective Date that addresses the HIPAA requirements with respect to “business associates,” as defined under the privacy, security, breach notification, and enforcement rules at 45 C.F.R. Part 160 and Part 164 (“HIPAA Rules”). A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended.

1.2 This BAA is intended to ensure that Business Associate will establish and implement appropriate safeguards for the Protected Health Information (“PHI”) (as defined under the HIPAA Rules) that Business Associate may receive, create, maintain, use, or disclose in connection with the functions, activities, and services that Business Associate performs for Covered Entity. The functions, activities, and services that Business Associate performs for Covered Entity are defined in the IMS License/SaaS Agreement (the “Underlying Agreement”).

1.3  Pursuant to changes required under the Health Information Technology for Economic and Clinical Health Act of 2009 (the “HITECH Act”) and under the American Recovery and Reinvestment Act of 2009 (“ARRA”), this BAA also reflects federal breach notification requirements imposed on Business Associate when “Unsecured PHI” (as defined under the HIPAA Rules) is acquired by an unauthorized party and the expanded privacy and security provisions imposed on business associates.

1.5  A reference in this BAA to the Privacy Rule means the Privacy Rule, in conformity with the regulations at 45 C.F.R. Parts 160-164 (the “Privacy Rule”) as interpreted under applicable regulations and guidance of general application published by HHS, including all amendments thereto for which compliance is required, as amended by the HITECH Act, ARRA, and the HIPAA Rules.

2. GENERAL OBLIGATIONS OF BUSINESS ASSOCIATE.

2.1  Business Associate agrees not to use or disclose PHI, other than as permitted or required by this BAA or as Required by Law, or if such use or disclosure does not otherwise cause a Breach of Unsecured PHI.

2.2  Business Associate agrees to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to ePHI to prevent use or disclosure of PHI other than as provided for by the BAA.

2.3  Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate as a result of a use or disclosure of PHI by Business Associate in violation of this BAA’s requirements or that would otherwise cause a Breach of Unsecured PHI.

2.4  The Business Associate agrees to the following breach notification requirements:

2.4.1  Business Associate agrees to report to Covered Entity any Breach of Unsecured PHI not provided for by the BAA of which it becomes aware within sixty (60) calendar days of “discovery” within the meaning of the HITECH Act. Such notice shall include the identification of each individual whose Unsecured PHI has been or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed in connection with such Breach. In addition, Business Associate shall provide any additional information reasonably requested by Covered Entity for purposes of investigating the Breach and any other available information that Covered Entity is required to include to the individual under 45 C.F.R. § 164.404(c) at the time of notification or promptly thereafter as information becomes available. Business Associate’s notification of a Breach of Unsecured PHI under this Section shall comply in all respects with each applicable provision of Section 13400 of Subtitle D (Privacy) of ARRA, the HIPAA Rules, and related guidance issued by the Secretary or the delegate of the Secretary from time to time.‌

2.4.2  In the event of Business Associate’s use or disclosure of Unsecured PHI in violation of HIPAA, the HITECH Act, or ARRA, Business Associate bears the burden of demonstrating that notice as required under this Section 2.4 was made, including evidence demonstrating the necessity of any delay, or that the use or disclosure did not constitute a Breach of Unsecured PHI.

2.5  Business Associate agrees, in accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, to require that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information.

2.6  Business Associate agrees to make available PHI in a Designated Record Set to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.524.‌

2.6.1  Business Associate agrees to comply with an individual’s request to restrict the disclosure of their personal PHI in a manner consistent with 45 C.F.R. § 164.522, except where such use, disclosure, or request is required or permitted under applicable law.

2.6.2  Business Associate agrees that when requesting, using, or disclosing PHI in accordance with 45 C.F.R. § 164.502(b)(1) that such request, use, or disclosure shall be to the minimum extent necessary, including the use of a “limited data set” as defined in 45 C.F.R. § 164.514(e)(2), to accomplish the intended purpose of such request, use, or disclosure, as interpreted under related guidance issued by the Secretary from time to time.‌

2.7  Business Associate agrees to make any amendments to PHI in a Designated Record Set as directed or agreed to by the Covered Entity pursuant to 45 C.F.R. § 164.526 or take other measures as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.526.‌

2.8  Business Associate agrees to maintain and make available the information required to provide an accounting of disclosures to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.528.

2.9  Business Associate agrees to make its internal practices, books, and records, including policies and procedures regarding PHI, relating to the use and disclosure of PHI and Breach of any Unsecured PHI received from Covered Entity, or created or received by the Business Associate on behalf of Covered Entity, available to Covered Entity (or the Secretary) for the purpose of Covered Entity or the Secretary determining compliance with the Privacy Rule (as defined in Section 8). To the extent that Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 C.F.R. Part 164, Business Associate agrees to comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s).

2.10  Business Associate agrees to account for the following disclosures:

2.10.1  Business Associate agrees to maintain and document disclosures of PHI and Breaches of Unsecured PHI and any information relating to the disclosure of PHI and Breach of Unsecured PHI in a manner as would be required for Covered Entity to respond to a request by an individual or the Secretary for an accounting of PHI disclosures and Breaches of Unsecured PHI.

2.10.2  Business Associate agrees to provide to Covered Entity, or to an individual at Covered Entity’s request, information collected in accordance with this Section 2.11, to permit Covered Entity to respond to a request by an individual or the Secretary for an accounting of PHI disclosures and Breaches of Unsecured PHI.

2.10.3  Business Associate agrees to account for any disclosure of PHI used or maintained as an Electronic Health Record (as defined in Section 5) (“EHR”) in a manner consistent with 45 C.F.R. § 164.528 and related guidance issued by the Secretary from time to time; provided that an individual shall have the right to receive an accounting of disclosures of EHR by the Business Associate made on behalf of the Covered Entity only during the three years prior to the date on which the accounting is requested whether from Covered Entity or directly from the Business Associate.‌

2.10.4  In the case of an EHR that the Business Associate acquired on behalf of the Covered Entity as of January 1, 2009, paragraph 2.11.3 above shall apply to disclosures with respect to PHI made by the Business Associate from such EHR on or after January 1, 2014. In the case of an EHR that the Business Associate acquires on behalf of the Covered Entity after January 1, 2009, paragraph 2.11.3 above shall apply to disclosures with respect to PHI made by the Business Associate from such EHR on or after the later of January 1, 2011, or the date that it acquires the EHR.‌

2.11  Business Associate agrees to comply with the “Prohibition on Sale of Electronic Health Records or Protected Health Information,” as provided in Section 13405(d) of Subtitle D (Privacy) of ARRA, and the “Conditions on Certain Contacts as Part of Health Care Operations,” as provided in Section 13406 of Subtitle D (Privacy) of ARRA and related guidance issued by the Secretary from time to time.‌

2.12  Business Associate acknowledges that, effective on the Effective Date of this BAA, it shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. § 1320d-5 and 1320d-6, as amended, for failure to comply with any of the use and disclosure requirements of this BAA and any guidance issued by the Secretary from time to time with respect to such use and disclosure requirements.‌

3. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE.

3.1  General Uses and Disclosures. Business Associate agrees to receive, create, use, or disclose PHI only in a manner that is consistent with this BAA, the Privacy Rule, or Security Rule (as defined in Section 5) and only in connection with providing services to Covered Entity; provided that the use or disclosure would not violate the Privacy Rule, including 45 C.F.R. § 164.504(e), if the use or disclosure would be done by Covered Entity. For example, the use and disclosure of PHI will be permitted for “treatment, payment, and health care operations,” in accordance with the Privacy Rule.

3.2  Business Associate may use or disclose PHI as Required By Law.

3.4  Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by the Covered Entity.‌

3.5  Business Associate may create, use, and disclose de-identified information from PHI, as defined under 45 CFR § 164.514, for research, analytics, and other purposes as permitted by law, provided that such data has been appropriately de-identified in accordance with HIPAA standards.

3.6  Specific Other Uses and Disclosures:

3.6.1  Except as otherwise limited in this BAA, Business Associate may use PHI to provide Data Aggregation Services to Covered Entity as permitted by HIPAA.

3.6.2  Except as otherwise provided in this BAA, Business Associate may use PHI for its proper management and administration or carry out its legal responsibilities as permitted under applicable law.

3.6.3  Business Associate shall not directly or indirectly receive remuneration in exchange for any PHI of an individual without Covered Entity’s prior written approval and notice from Covered Entity that it has obtained from the individual, in accordance with 45 C.F.R. § 164.508, a valid authorization that includes a specification of whether the PHI can be further exchanged for remuneration by Business Associate. The foregoing shall not apply to Covered Entity’s payments to Business Associate for services delivered by Business Associate to Covered Entity.

3.6.4  Business Associate may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 C.F.R. § 164.502(j)(1).

3.6.5  Business Associate may use PHI for Marketing purposes in accordance to 45 CFR § 164.501 and 164.508(a)(3) following the due diligences for such use.

4. OBLIGATIONS OF COVERED ENTITY.

4.1  Covered Entity shall:

4.1.1  Provide Business Associate with the Notice of Privacy Practices that Covered Entity produces in accordance with the Privacy Rule, and any changes or limitations to such notice under 45 C.F.R. § 164.520, to the extent that such changes or limitations may affect Business Associate’s use or disclosure of PHI.

4.1.2  Notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI under this BAA.

4.1.3  Notify Business Associate of any changes in or revocation of permission by an individual to use or disclose PHI, if such change or revocation may affect Business Associate’s permitted or required uses and disclosures of PHI under this BAA.

4.2  Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy and Security Rule if done by Covered Entity, except as provided under Section 3 of this BAA.

5.  COMPLIANCE WITH SECURITY RULE.

5.1  Effective April 20, 2005, Business Associate shall comply with the HIPAA Security Rule, which shall mean the Standards for Security of Electronic Protected Health Information at 45 C.F.R. Part 160 and Subparts A and C of Part 164, as amended by ARRA and the HITECH Act. The term “Electronic Health Record” or “EHR” as used in this BAA shall mean an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff.‌

5.2  In accordance with the Security Rule, Business Associate agrees to:

5.2.1  Implement the administrative safeguards set forth at 45 C.F.R. § 164.308, the physical safeguards set forth at 45 C.F.R. § 164.310, the technical safeguards set forth at 45 C.F.R. § 164.312, and the policies and procedures set forth at 45 C.F.R. § 164.316, to reasonably and appropriately protect the confidentiality, integrity, and availability of the ePHI that it creates, receives, maintains, or transmits on behalf of Covered Entity as required by the Security Rule. Business Associate acknowledges that, effective on the Effective Date of this BAA, (a) the foregoing safeguards, policies, and procedures requirements shall apply to Business Associate in the same manner that such requirements apply to Covered Entity, and (b) Business Associate shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. § 1320d-5 and 1320d-6, as amended from time to time, for failure to comply with the safeguards, policies, and procedures requirements and any guidance issued by the Secretary from time to time with respect to such requirements;

5.2.2  Require that any agent, including a Subcontractor, to whom it provides such PHI agrees to implement reasonable and appropriate safeguards to protect the PHI; and

5.2.3  Report to the Covered Entity any Security Incident of which it becomes aware.

5.3  Covered Entity and Business Associate acknowledge that the 21st Century Cures Act (45 CFR Part 171) prohibits knowingly engaging in any practice that is likely to interfere with, prevent, discourage access, exchange, or use of electronic health information (“Information Blocking”). Business Associate shall not engage in any practice that would constitute Information Blocking, shall cooperate in good faith with Covered Entity to prevent or mitigate any practice that would constitute Information Blocking, shall make all reasonable efforts to avoid causing Covered Entity to engage in Information Blocking, and otherwise shall comply with all laws regulating Information Blocking.

5.4  Business Associate shall implement appropriate policies to ensure the timely access, exchange, or use of Electronic Health Information (EHI) and will work with Covered Entity to prevent or mitigate any practice that could be construed as Information Blocking.

6.  INDEMNIFICATION; LIMITATION OF LIABILITY.

6.1  Business Associate shall indemnify, defend, and hold harmless the Covered Entity, and Covered Entity’s affiliates (“Indemnified Parties”), from and against any and all losses, expense, damage, or injury (including, without limitation, all costs and reasonable attorneys’ fees) that the Indemnified Parties may sustain as a result of, or arising out of (a) a breach of this BAA by Business Associate or its agents or Subcontractors, including but not limited to any unauthorized use, disclosure, or breach of PHI, (b) Business Associate’s failure to notify any and all parties required to receive notification of any Breach of Unsecured PHI pursuant to Section 2.4, or (c) any negligence or wrongful acts or omissions by Business Associate or its agents or Subcontractors, including without limitations, failure to perform Business Associate’s obligations under this BAA, the Privacy Rule, or the Security Rule. Notwithstanding the foregoing, nothing in this Section shall limit any rights any of the Indemnified Parties may have to additional remedies under the Underlying Agreement or under applicable law for any acts or omissions of Business Associate or its agents or Subcontractors. Business Associates liability for the use of new and emerging technologies, including but not limited to artificial intelligence (AI), machine learning, and cloud-based health systems, shall be limited to the extent permitted by applicable law and shall not exceed the amount of fees paid by Covered Entity for such services in the twelve (12) months preceding the claim.

6.2  NOTWITHSTANDING ANYTHING TO THE CONTRARY CONTAINED HEREIN, NEITHER PARTY WILL BE LIABLE TO THE OTHER UNDER THIS BAA FOR CONSEQUENTIAL, INCIDENTAL, PUNITIVE, SPECIAL, EXEMPLARY OR INDIRECT DAMAGES, OR LOST PROFITS IN CONNECTION WITH CLAIMS MADE BY ANY PARTY, REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT OR TORT. EACH PARTY’S MAXIMUM AGGREGATE LIABILITY TO THE OTHER PARTY OR ANY THIRD PARTY FOR ANY LOSSES, DAMAGES OR OTHER LIABILITIES, WHETHER BASED ON WARRANTY, CONTRACT, NEGLIGENCE, OR OTHERWISE, WILL NOT EXCEED THE SUM OF ALL FEES PAID BY CLIENT TO BUSINESS ASSOCIATE DURING THE TWELVE (12) MONTH PERIOD PRIOR TO THE OCCURRENCE OF THE EVENT(s) GIVING RISE TO THE CLAIM. THE FOREGOING LIMITATION OF LIABILITY SHALL APPLY REGARDLESS OF THE CAUSE OF ACTION ASSERTED BY CLIENT OR ANY THIRD PARTY IN ANY JURISDICTION IN WHICH THE FOREGOING LIMITATION OF LIABILITY IS RESTRICTED. BUSINESS ASSOCIATE’S LIABILITY SHALL BE LIMITED TO THE GREATEST EXTENT PERMITTED BY LAW. THE PROVISIONS OF THIS SECTION SHALL SURVIVE TERMINATION OF THIS AGREEMENT FOR ANY REASON.

7. TERM AND TERMINATION.

7.1  This BAA shall be in effect as of the Effective Date above and shall terminate on the earlier of the date that:

7.1.1  Either party terminates the Underlying Agreement.

7.1.2  Either party terminates the BAA for cause as authorized under Section 7.2.

7.1.3  All of the PHI received from Covered Entity or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity. If it is not feasible to return or destroy PHI, protections are extended in accordance with Section 7.3.

7.2  Upon either party’s knowledge of a material breach by the other party, the non-breaching party shall provide an opportunity for the breaching party to cure the breach or end the violation; or terminate the BAA. If the breaching party does not cure the breach or end the violation within a reasonable timeframe not to exceed thirty (30) days from the notification of the breach, or if a material term of the BAA has been breached, and a cure is not possible, the non-breaching party may terminate this BAA and the Underlying Agreement, upon written notice to the other party.

7.3  Upon termination of this BAA for any reason, the parties agree that Business associate shall return to Covered Entity or, if agreed to by Covered Entity, destroy all PHI received from Covered Entity or created, maintained, or received by Business Associate on behalf of Covered Entity, that the Business Associate still maintains in any form. The PHI shall be returned in a format that is reasonably expected to preserve its accessibility and usability. Business Associate shall retain no copies of the PHI.

7.4  The obligations of Business Associate under this Section 7 shall survive the termination of this BAA.

8. MISCELLANEOUS.‌

8.1  This BAA shall automatically incorporate any change or modification as of the effective date of the change or modification to comply with the requirements of the Privacy Rule, the Security Rule, HIPAA, ARRA, the HITECH Act, the HIPAA Rules, and any other applicable law. The Business Associate agrees to maintain compliance with all changes or modifications.

8.2  The respective rights and obligations of Business Associate under Section 6 and Section 7 of this BAA shall survive the termination of this BAA.

8.3  This BAA shall be interpreted in the following manner:

8.3.1  Any ambiguity shall be resolved in favor of a meaning that permits Covered Entity to comply with the HIPAA Rules.

8.3.2  Any inconsistency between the BAA’s provisions and the HIPAA Rules, including all amendments, as interpreted by the HHS, a court, or another regulatory agency with authority over the Parties, shall be interpreted according to the interpretation of the HHS, the court, or the regulatory agency.

8.3.3  Any provision of this BAA that differs from those required by the HIPAA Rules, but is nonetheless permitted by the HIPAA Rules, shall be adhered to as stated in this BAA.

8.4  This BAA constitutes the entire agreement between the parties related to the subject matter of this BAA, except to the extent that the IMS License/SaaS Agreement (the "Underlying Agreement") imposes more stringent requirements related to the use and protection of PHI upon Business Associate. This BAA supersedes all prior negotiations, discussions, representations, or proposals, whether oral or written. This BAA may not be modified unless done so in writing and signed by a duly authorized representative of both parties. If any provision of this BAA, or part thereof, is found to be invalid, the remaining provisions shall remain in effect.

8.5  This BAA will be binding on the successors and assigns of the Covered Entity and the Business Associate. However, this BAA may not be assigned, in whole or in part, without the written consent of the other party. Any attempted assignment in violation of this provision shall be null and void.

8.6  This BAA may be executed in two or more counterparts, each of which shall be deemed an original.

8.7  Except to the extent preempted by federal law, this BAA shall be governed by and construed in accordance with the same internal laws as that of the Underlying Agreement.