HomeMy WebLinkAboutC20-408 Quality Health NetworkPage 1 of 12 Electronic Commerce Agreement (Revised 7-28 2020) ELECTRONIC COMMERCE AGREEMENT (“Agreement”) QUALITY HEALTH NETWORK, a Colorado nonprofit corporation (herein “QHN”) Address of QHN: 744 Horizon Court, Suite 210 Grand Junction, CO 81506 (970) 248-0033 _______________________________________ , (herein “PARTICIPANT”) Address of Participant: _______________________________________ _______________________________________ Tax I.D. No.: ___________________________ RECITALS A.QHN provides the QHN System to facilitate the exchange of electronic data, coordinate care and improve the quality of health in the community. QHN may also provide other products or services from time to time. Participant desires to use the QHN System. B.The placement and use of information in the QHN System and the sharing of such information using the QHN System are subject to various Information Privacy and Protection Laws. By placing information in the QHN System, Participant agrees such information can be disclosed and used as allowed by the QHN System. Participant shall comply with all applicable laws when using or disclosing information through use of the QHN System. Such compliance is required of all persons who are authorized to use the QHN System. NOW, THEREFORE, in consideration of the recitals set forth above and the mutual promises set forth below, the parties agree as follows: A.Products and Services Provided and Fees. So long as this Agreement is in effect and Participant and Participant Users comply with all terms of this Agreement, QHN will provide Participant and Participant Users access to use the QHN System as well as other products and services. Access and use of the QHN System and products and services will be described in an order (“Order”). Orders are further described in attached Exhibit B, and all Orders are considered as part of this Agreement. B. Agreement to Terms and Conditions. QHN and Participant agree to all Terms and Conditions, attached. This Agreement is dated and shall be effective on the date set forth below by QHN as the effective date. QUALITY HEALTH NETWORK, a Colorado nonprofit corporation PARTICIPANT _________________________________________ (print/type name of Participant) By: ___________________________________ (signature) By: ___________________________________ (signature) Name/Title: ____________________________ (print/type name and title of signatory) Name/Title: ______________________________ (print/type name and title of signatory) Effective Date: __________________________ Eagle County Government 551 Broadway Eagle, CO 81631 84-6000762 Eagle County Government DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Jeff Shroll County ManagerJustin Aubert CFO 11/10/2020 C20-408 Page 2 of 12 Electronic Commerce Agreement (Revised 7-28 2020) TERMS AND CONDITIONS: 1. Definitions. Capitalized terms in this Agreement are defined as follows: 1.1. “Board of Directors” shall mean the Board of Directors of QHN. 1.2. “Breach” as it relates to HIPAA and PHI shall have the meaning given to such term in Section 13400 of HITECH and 45 C.F.R. 164.402 and as related to other Information Privacy and Protection Laws shall mean the unlawful disclosure of PHI or CSI which results in a requirement to provide notices to Individuals or a governmental entity or requires the taking of other actions related to the unlawful disclosure. 1.3. “Business Associate” shall mean with respect to a Covered Entity, a person who is defined in 45 C.F.R. 160.103. 1.4. “Community Services Information” or “CSI” means information created, maintained, or received by a public, governmental or private entity, including information that relates to the past, present or future need for or provision of services related to an Individual. CSI is information which is not subject to the requirements of HIPAA. 1.5. “Covered Entity” shall have the meaning of the term “Covered Entity” as defined in 45 C.F.R. 160.103. 1.6. “De-identification” shall mean to remove, encode, encrypt, or otherwise eliminate or conceal data which identifies an Individual, or modifies information so that there is no reasonable basis to believe that the information can be used to identify an Individual. De-identification includes, without limitation, any process meeting the requirements for De-identification set forth in 45 C.F.R. § 164.514, as such provision is currently drafted and as it may be subsequently updated, amended, or revised. 1.7. “Designated Record Set” means Protected Health Information maintained by or for Participant that is: (a) the medical records and billing records about Individuals maintained by or for a covered health care provider; (b) the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (c) used, in whole or in part, by or for Participant to make decisions about Individuals. 1.8. “Disclose,” “Disclosing,” or “Disclosure” means the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information. 1.9. “DURSA” shall mean the Data Use and Reciprocal Support Agreement between QHN and eHealth Exchange. 1.10. “DURSA Permitted Purposes” shall mean any reason for exchanging Message Content through the eHealth Exchange which is expressly allowed by the terms of the DURSA and as may be allowed QHN’s Standards. 1.11. “eHealth Exchange” shall mean the data sharing network which was developed under the auspices of the Office of the National Coordinator for Health Information Technology and consists of governmental and non- governmental exchange partners who share information under a multi-purpose set of standards and services which are designed to support a broad range of information exchange activities using various technical platforms and solutions. 1.12. “HITECH” means the Health Information Technology for Economic and Clinical Health Act in the American Recovery and Reinvestment Act of 2009, including any implementing regulations. 1.13. “Individual” means a natural person who is the subject of PHI or CSI. 1.14. “Information Privacy and Protection Laws” mean: (a) the Health Insurance Portability and Accountability Act of 1996, as amended and including any implementing regulations (“HIPAA”); (b) HITECH; (c) the Gramm-Leach- Bliley Act, as amended and including any implementing regulations; (d) any statute, regulation, administrative or judicial ruling requiring a party to protect the privacy or security of information pertaining to an Individual, and/or the payment for care for an Individual; (e) any statute, regulation, administrative or judicial DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Page 3 of 12 Electronic Commerce Agreement (Revised 7-28 2020) ruling requiring a party to protect the privacy of information pertaining to the financial or credit status or condition of an individual; (f) any statute, regulation, administrative or judicial ruling requiring a party to protect information pertaining to individuals based upon the individuals’ status as consumers; and (g) any other statute, regulation, administrative or judicial ruling requiring a party to protect the confidentiality, privacy and/or security of information pertaining to individuals; all to the extent that such Information Privacy and Protection Laws have been enacted, promulgated, issued or published by any federal or state governmental authority with jurisdiction over a Covered Entity, a Business Associate, an individual, Participant or QHN. 1.15. “Message Content” shall mean that information which is requested or sent by a QHN participant to another user of the QHN System through the eHealth Exchange, including but not limited to, PHI, individually identifiable information, de-identified data, pseudonymized data, metadata, digital certificates issued by eHealth Exchange to any participant of eHealth Exchange, and schema. 1.16. “Network Account” shall mean the right given to Participant to access and use the QHN System by Participant and Participant Users. 1.17. “Participant User” shall mean any person accepted by QHN and who is authorized to use the QHN System through Participant’s right of use set forth in this Agreement. Participant shall designate Participant Users. 1.18. “Protected Health Information,” or “PHI,” shall have the same meaning as the term “protected health information” in 45 C.F.R. 160.103 and 164.501. 1.19. “QHN participant” shall mean a person or entity which has entered into an Electronic Commerce Agreement with QHN to allow such person or entity to use the QHN System. 1.20. “QHN System” shall mean the technology tools, application, software, services and systems QHN provides and/or maintains for use by Third Parties to facilitate the electronic exchange of information or other lawful purposes as may be determined by QHN. 1.21. “QHN’s Standards” shall mean those standards, policies and procedures adopted by QHN, which address requirements and standards with regard to Use of the QHN System. QHN’s Standards may address and include, but are not limited to: activity on the QHN System, operating rules, definitions and specifications of format, content, and transmission of electronic data, support descriptions and details of connecting to the QHN System. 1.22. “Receive,” “Receiving,” and “Receipt” means: (a) to take physical delivery of media containing information; or (b) in the case of electronic delivery, for information to come into existence in a party’s information processing system in a form capable of being processed by or perceived from a system of that type by the Receiving party if the Receiving party has designated that system or address as a place for Receipt of information to a Disclosing party and the Disclosing party does not know that the information cannot be accessed from the particular system. 1.23. “Security Incident” shall mean the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in Participant’s or QHN’s information system, as applicable. 1.24. “Security Rule” means the Security Standards for Protection of Electronic Protected Health Information at 45 C.F.R. Part 164, Subpart C. 1.25. “Third Party” means any individual, person, or organization not a party to this Agreement. 1.26. “Transaction” means the Transmission of information between parties to this Agreement. 1.27. “Transmit,” “Transmitted,” or “Transmission” means the transfer of information by one party to another, regardless of the method or technology used to transfer the information. 1.28. “Use” shall mean the sharing, employment, application, utilization, examination, analysis, De-identification, or commingling with other information, of information by a party that holds that information. DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Page 4 of 12 Electronic Commerce Agreement (Revised 7-28 2020) Terms used but not otherwise defined in this Agreement but used in relation to HIPAA shall have the same meaning as those terms are given under HIPAA. 2. Duties and Obligations of QHN. 2.1. Use of QHN System. Subject to all terms of this Agreement, QHN grants Participant a nonexclusive, nontransferable, and non- sublicensable right for Participant and Participant Users to access and use the QHN System for the uses described in an Order. 2.2. Data Storage and Distribution. PHI and CSI within the QHN System will be available to Participant and Participant Users in accordance with this Agreement, QHN’s Standards and applicable laws. 2.3. Data Backup. QHN shall maintain requisite disk space for the storage of software and data as determined in QHN’s Standards. Backups will be regularly performed and stored in a secured off-site location. 2.4. Data and Information Uses and Disclosures. QHN may use and disclose PHI and CSI provided by Participant (a) to operate the QHN System and for purposes of Treatment, Payment and Health Care Operations (as those terms are defined in HIPAA) (b) for quality improvement programs, practice management, research, and (c) for such other uses as may be allowed by applicable law provided that such use is consistent with QHN’s Standards and requirements of applicable law. Participant authorizes QHN to facilitate establishment of care coordination teams, and Use and Disclose PHI and CSI to facilitate care coordination by and among such care coordination teams as allowed by applicable law. Care coordination teams may be composed of Covered Entities and social welfare/human service organizations that provide services to Individuals. Social welfare/human service organizations that provide services to Individuals may be added to such Individual’s care coordination team in compliance with this agreement. 2.5. Inquiries from Individuals. Should QHN receive from an Individual, or a person with a proper authorization, a request for data specific to such Individual, QHN shall either redirect the Individual or person, to the Participant or provide such data as allowed by applicable law. 2.6. Right to Audit. QHN shall have the right to audit Participant’s and Participant Users’ use of the QHN System to ascertain compliance with QHN’s Standards and applicable law with regard to use of the QHN System. The results of such audits may be shared with Participant and the QHN Board of Directors. 2.7. Right to Impose Sanctions. QHN shall have the right to impose sanctions on Participant and a Participant User should Participant or Participant User’s use of the QHN System be in violation of this Agreement, QHN’s Standards or applicable law. 2.8. Liability Insurance. QHN shall purchase and/or maintain general liability insurance or a self-insurance plan which provides coverage to QHN of not less than one million dollars ($1,000,000) per incident per year. 2.9. Indemnity. QHN agrees to indemnify Participant from any and all claims, demands, actions, and causes of action asserted by a Third Party against Participant which may result or arise out of any actions or omissions of QHN or any of QHN’s agents, employees, or representatives due to QHN’s failure to comply with privacy or security obligations under this Agreement or imposed by law or QHN’s failure to comply with the terms of this Agreement. This indemnity shall include the payment to Participant for attorney’s fees, court costs and expert witness fees Participant incurs in defending itself from any such claims, demands, actions or cause of action. For this indemnity obligation to apply, Participant shall: (a) provide QHN notice in writing upon the discovery of the claim; (b) fully cooperate with QHN in the defense of the claim; and (c) not settle the claim without the prior written consent of QHN, which consent shall not be unreasonably withheld. If there is a Breach by QHN and/or QHN’s agents or subcontractors in the course of QHN providing services to Participant and Participant is required by law to notify the involved Individual(s) of whom such Breach pertains and/or any governmental entity as may be required by law, QHN shall pay all Participant’s reasonable notification costs and, as mutually agreed by the parties, reasonable costs associated DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Page 5 of 12 Electronic Commerce Agreement (Revised 7-28 2020) with mitigating any harmful effects of such Breach. For purposes of this paragraph, a QHN agent or subcontractor shall mean those persons or entities that have a contract with QHN to provide QHN with products or services. QHN’s liability under this paragraph shall not exceed one million dollars ($1,000,000) or the limits of QHN’s available insurance coverage, whichever is greater. 2.10. DISCLAIMER. QHN MAKES NO WARRANTIES, EXPRESS OR IMPLIED, WITH REGARD TO THE QHN SYSTEM, INCLUDING BUT NOT LIMITED TO, ANY WARRANTY OF NONINFRINGEMENT, OR THE IMPLIED WARRANTY OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE REGARDLESS OF THE SERVICES OR RESOURCES PROVIDED BY IT. QHN DISCLAIMS ANY LIABILITY FOR THE FAILURE OF PERSON WHO USES THE QHN SYSTEM TO COMPLY WITH QHN’S STANDARDS OR APPLICABLE LAW OR THE CONTENT OR USE OF THE QHN SYSTEM BY ANY SUCH PERSON. QHN DOES NOT WARRANT UNINTERRUPTED OR ERROR FREE OPERATION OF THE QHN SYSTEM OR THE COMPATIBILITY OF THE QHN SYSTEM WITH ANY PARTICULAR HARDWARE, SOFTWARE OR INTER- CONNECTIVITY WITH OTHER NETWORKS OR SERVICES. 2.11. LIMITATION OF LIABILITY. EXCEPT FOR QHN’S LIABILITY OBLIGATIONS AS EXPRESSLY SET FORTH IN THE INDEMNITY PARAGRAPH OF THIS AGREEMENT, REGARDLESS OF WHETHER ANY REMEDY FAILS OF ITS ESSENTIAL PURPOSE, THE MAXIMUM LIABILITY OF QHN UNDER THIS AGREEMENT SHALL NOT EXCEED THE TOTAL AMOUNT PAID BY PARTICIPANT TO QHN TO OBTAIN SERVICES UNDER THIS AGREEMENT FOR THE TWELVE (12) MONTH PERIOD PRECEDING THE DATE THE LIABILITY AROSE. IN NO EVENT, AND WHETHER OR NOT QHN WAS OR SHOULD HAVE BEEN AWARE OR ADVISED OF THE POSSIBILITY OF SUCH DAMAGE, SHALL QHN BE LIABLE FOR SPECIAL, INDIRECT, INCIDENTAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES INCLUDING WITHOUT LIMITATION, LOST DATA OR INFORMATION, LOST PROFITS, COSTS OF PROCUREMENT OF SUBSTITUTE SERVICES, OR INJURY TO REPUTATION. 3. Duties and Obligations of Participant. 3.1. Assistance and Cooperation with QHN in Providing Products and Services. Participant, at its sole cost and expense, shall assist, cooperate and work in good faith with QHN to provide the products and services described in an Order. 3.2. Complying with QHN’s Standards In Use of QHN System. When using the QHN System, Participant and Participant Users shall comply with this Agreement, QHN’s Standards and applicable law. Participant specifically agrees to be subject to QHN’s Standards. QHN’s Standards are subject to amendment, revision and modification by QHN solely in its discretion. Changes to QHN’s Standards may reflect changes in applicable law or the need to adopt new technologies, systems, or desired functionality or changes in QHN’s operational policies. Participant is encouraged to provide input to QHN regarding QHN’s Standards and to propose changes. QHN’s Standards may be reviewed upon request. 3.3. eHealth Exchange / DURSA Compliance. Participant specifically agrees to: (a) reasonably cooperate with QHN on issues related to the DURSA; (b) submit and receive Message Content through the eHealth Exchange only for DURSA Permitted Purposes; (c) use Message Content in accordance with the terms and conditions of the DURSA; and (d) shall, to the extent required by the DURSA, exchange Message Content for Treatment with any other eHealth Exchange participant. Any use of the QHN System for exchange of Message Content under the DURSA shall be subject to QHN’s Standards. 3.4. Registries. Participant’s Use of the QHN System constitutes authorization for QHN to forward PHI or CSI placed in the QHN System by the Participant to public health registries as may be allowed by applicable law and receive DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Page 6 of 12 Electronic Commerce Agreement (Revised 7-28 2020) information from such registries on behalf of Participant. 3.5. Participant Restrictions. Participant will not, and will not permit any Participant User or Third Party to: (a) alter, modify, reverse engineer, decompile, disassemble, or otherwise attempt to derive the method of operation of the QHN System; (b) interfere in any manner with the hosting of the QHN System; (c) use the QHN System for other than Participant’s or the Participant User’s own business purposes; (d) use the QHN System for purposes of providing outsourcing, service bureau, hosting, application service provider or online services to Third- Parties, or otherwise make access to the QHN System available to any Third-Party not related to or affiliated with Participant; or (e) use the QHN System for any purpose that is illegal in any way, or that advocates illegal activity. Participant will keep intact and will not alter, obscure or remove any notices or legends provided on or in connection with the QHN System. 3.6. Participant Responsibility for Data. QHN provides tools for Participant Users to use the QHN System but otherwise does not act in any other way for Participant. Participant’s decision to place certain data in and use the QHN System is based on Participant’s sole discretion. By placing PHI or CSI in the QHN System, Participant is certifying to QHN that such PHI or CSI can be Disclosed to and Used: (a) by Covered Entities for purposes of treatment, payment and healthcare operations; (b) by organizations for care coordination purposes; (c) for purposes of improving the health or well-being of an Individual; and (d) for uses allowed under this Agreement. Except as may otherwise be agreed to by QHN in writing, Participant shall not at any time place any record in the QHN System if that record is subject to disclosure restrictions under 42 U.S.C. 290dd which concerns substance abuse records. As between Participant and QHN, Participant is solely responsible for establishing the connection to the QHN System, the proper transmission and receipt of data, for implementing sufficient safeguards and procedures to satisfy particular requirements for access, security, privacy and accuracy of data placed in or transmitted by Participant in Using the QHN System. If a Participant User works at multiple practice locations, the Participant User is responsible for ensuring that any PHI or CSI routed between locations for the Participant User will be maintained and Used in compliance with Information Privacy and Protection Laws at each location. Backup of data located on Participant’s own computer components is Participant’s responsibility. In some instances, QHN may interpret data, provide data analytics or provide other data that may be Used by Participant or Participant Users. QHN disclaims any warranty or representation as to the accuracy or completeness of this data and any other data in the QHN System. Participant and Participant Users are responsible for verifying the accuracy and completeness of data Used. QHN is not responsible for the contents of data that Participant or any other person or entity places in or obtains from the QHN System. Participant and Participant Users hereby release QHN from any claims whatsoever as to the completeness or accuracy of data in the QHN System. 3.7. Contact Information. Participant agrees to notify QHN in writing as soon as possible as to any change in status of a Participant User. Participant is responsible for and shall provide QHN with the most current name and contact information for Participant and all Participant Users. 3.8. Training of Staff. Compliance with applicable federal and state laws, rules and regulations concerning adequate training of staff is the sole responsibility of the Participant. 3.9. Resources. Participant, at Participant’s own expense: (a) shall cooperate and work in good faith with QHN to establish connectivity to the QHN System and to allow QHN to provide the products and services described in Orders; and (b) shall provide, install and maintain necessary hardware, software, equipment and services necessary to connect to, access or use the QHN System. 3.10. Responsibility for Network Account. Participant shall be solely responsible for all Use of its Network Account, for payment of charges incurred for such Use, and for violations of the terms of this Agreement by anyone using the Network Account. DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Page 7 of 12 Electronic Commerce Agreement (Revised 7-28 2020) 3.11. Warranties with Use. By its Use of the QHN System, Participant warrants: (a) that Participant’s and Participant Users’ use of the QHN System is in compliance with the terms of this Agreement; (b) that Participant’s and Participant Users’ Use of the QHN System and placement of information in the QHN System is in compliance with applicable laws; (c) that Participant has obtained any and all consents or authorizations from Individuals as may be necessary, whether required by law, QHN Standards, or other applicable requirements, before Participant engages in any Use or Disclosure of or access to PHI or CSI; and (d) that Participant and Participant Users shall only Use and Disclose PHI and CSI as allowed by law. 3.12. Liability Insurance. Participant shall purchase and/or maintain general liability insurance or a self-insurance plan which provides coverage to Participant of not less than one million dollars ($1,000,000) per incident per year. 3.13. Indemnity. Participant agrees to indemnify QHN and hold QHN harmless from any and all claims, demands, actions, and causes of action asserted by a Third Party against QHN which may result or arise out of any actions of Participant or any Participant User who becomes an authorized user through this Agreement or any use through Participant’s Network Account. This indemnity shall include the payment to QHN for attorney’s fees, court costs and expert witness fees QHN incurs in defending itself from any such claims, demands, actions or cause of action. For this indemnity obligation to apply, QHN shall: (a) provide Participant notice in writing upon the discovery of the claim; (b) fully cooperate with Participant in the defense of the claim; and (c) not settle the claim without the prior written consent of Participant, which consent shall not be unreasonably withheld. If there is a Breach by Participant and/or Participant’s agents or subcontractors in the course of QHN providing services to Participant and QHN is required by law to notify the involved Individual(s) of whom such Breach pertains and/or any governmental entity as may be required by law, Participant shall pay all QHN’s reasonable notification costs and, as mutually agreed by the parties, reasonable costs associated with mitigating any harmful effects of such Breach. For purposes of this paragraph, a Participant agent or subcontractor shall mean those persons or entities that have a contract with Participant to provide Participant with products or services. Participant’s liability under this paragraph shall not exceed one million dollars ($1,000,000) or the limits of Participant’s available insurance coverage, whichever is greater. 3.14. Rights in Products and Confidential Information. Participant shall not assert and shall not have any ownership rights or other property rights in any of QHN’s Standards, the QHN System or any information or materials furnished by QHN to Participant. Participant agrees that the parties from whom QHN licenses the software products and related documentation (“Products”) which may be used in the QHN System, own all right, title and interest in such Products. Participant will not delete or in any manner alter the copyright, trademark or other proprietary rights or notices of the parties from whom QHN licenses the Products or from QHN appearing on the Products as delivered to Participant. Participant will reproduce such notices on all copies it makes of the Products. Participant will treat this Agreement, source codes and other business and technical information relating to the Products and relating to QHN’s Standards or the QHN System as confidential information and will not disclose the same except as may be required under applicable law or as may be necessary to perform its duties and obligations under this Agreement. 3.15. Compliance with QHN’s E-Commerce Agreement with Participants. Participant shall not take any action that would result in QHN’s violation of requirements of the Electronic Commerce Agreements QHN has entered into with other participants. 4. Confidentiality and Privacy-Covered Entity and Business Associates. If Participant is a Covered Entity for which QHN is performing functions as a Business Associate of Participant, then QHN and Participant agree to be bound to the terms of the Business Associate Agreement attached as Exhibit A to this Agreement. DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Page 8 of 12 Electronic Commerce Agreement (Revised 7-28 2020) 5. Confidentiality and Privacy-CSI. 5.1. Terms Applicable if Participant is Not Acting in the Capacity of a Covered Entity or Business Associate. This Section 5 shall apply (a) if Participant is not a Covered Entity or a Business Associate of a Covered Entity, and (b) to the extent Participant is not acting in the capacity of a Covered Entity or Business Associate of a Covered Entity in its use of the QHN System to access CSI (even if Participant is a Covered Entity or Business Associate for other purposes and activities). 5.2. Permitted Uses and Disclosures of an Individual’s Community Services Information by QHN. The scope of CSI that may be Used, Disclosed, or accessed and/or the functions performed by QHN includes CSI necessary to perform functions and uses permitted or required by this Agreement. QHN may Use, Disclose, and access CSI for the proper management and administration of QHN, to carry out legal responsibilities of QHN, or to analyze CSI and create de-identified information for purposes of data analysis, research and in furtherance of generalizable knowledge as may be allowed by applicable law. QHN may Use, Disclose and access CSI in providing care coordination and data aggregation services for the Participant, Covered Entities, and other QHN participants that have entered agreements that are identical to, or substantially similar to, this Agreement. QHN will not Use, Disclose, or access CSI in violation of any applicable law. 5.3. Authority to Access and Use CSI. Participant warrants and represents that it is authorized or permitted by applicable law to have access to and use CSI. Participant shall immediately notify QHN if Participant is no longer permitted by applicable law to access CSI. In such case, Participant will cease all access to the QHN System. 5.4. Amendment to Records. QHN agrees to allow Participant to make any amendment(s) to CSI in QHN’s possession that Participant initially provided for inclusion in the QHN System in the time and manner designated by Participant. Participant shall only make such amendments as may be allowed or required by applicable law. 5.5. Privacy Practices. Before placing an Individual’s CSI in the QHN System, Participant shall, to the extent required by law, obtain any permission or consent from the Individual necessary to allow such placement. Before accessing, Using or Disclosing an Individual’s CSI that was not placed in the QHN System by the Participant, the Participant shall, to the extent required by law or applicable QHN Standards, confirm that an authorization from the Individual allowing such access, Use and Disclosure has been obtained. Such authorization shall allow the Individual’s CSI to be Used by or Disclosed to other QHN participants as allowed by this Agreement. If Participant obtained such authorization, Participant shall provide documentation of such authorization to QHN upon request, maintain a copy of the authorization on behalf of QHN and upload a copy of the authorization to the QHN System as required by QHN Standards. Participant shall notify QHN of any changes in, or revocation of, the authorization by an Individual to Use or Disclose his or her CSI. Participant’s access to and use of CSI in the QHN System shall be limited to use of CSI for the purposes authorized by law and for no other purposes. 5.6. Notice of Security Incidents or Breach. Participant shall notify QHN of: (a) any Security Incident involving CSI of which it becomes aware; (b) any Use or Disclosure of CSI not permitted by or contrary to the terms of this Agreement of which Participant becomes aware; and (c) any Breach of unsecured CSI following the discovery of such Breach. In any event, such notice of the above events will be provided without unreasonable delay and in no case later than five (5) days after discovery. QHN and Participant will cooperate with each other with regard to reporting of any such events or a Breach as required by law. 5.7. Incorporation of Additional Requirements; Construction. The requirements of applicable law pertaining to CSI are, to the extent not adequately provided for in this Agreement, hereby incorporated by this reference and shall become a part of this Agreement. This Agreement shall be construed as broadly as necessary to implement and comply with Information Privacy and Protection Laws and other laws that may be DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Page 9 of 12 Electronic Commerce Agreement (Revised 7-28 2020) applicable to certain types or categories of CSI. Notwithstanding the foregoing, QHN shall not be responsible for ensuring compliance with any legal requirements that apply to Participant, including but not limited to requirements to obtain consent or authorization from Individual’s prior to CSI being placed in the QHN System and being Disclosed to other QHN participants as allowed by this Agreement. 6. Confidentiality and Privacy-PHI. 6.1. Terms Applicable if Participant is Not a Covered Entity. If Participant is authorized by applicable law to have access to and use PHI and is not a Covered Entity or Business Associate then this Section 6 shall apply to such access and use. If Participant is authorized to have access and use of PHI as a Covered Entity or a Business Associate, then this Section 6 shall not apply to Participant’s access and use. 6.2. Authorization. If Participant is not specifically allowed by HIPAA to have access to PHI without authorization from the Individual, then before accessing an Individual’s PHI in the QHN System, Participant shall confirm that an authorization from the Individual allowing such access has been obtained. Such authorization shall allow the Individual’s PHI to be Used by or Disclosed to other QHN participants as allowed by this Agreement. If Participant obtained such authorization, Participant shall provide documentation of such authorization to QHN upon request, maintain a copy of the authorization on behalf of QHN and upload a copy of the authorization to the QHN System as required by QHN Standards. Participant shall notify QHN of any changes in, or revocation of, the authorization by an Individual to Use or Disclose his or her PHI, to the extent that such changes may affect the Use or Disclosure of PHI under this Agreement. 6.3. Use of PHI and HIPAA Compliance. Participant’s access to and use of PHI shall be limited to use of PHI for the purpose authorized by law, and for no other purposes whatsoever. Although Participant is not a Covered Entity, Participant shall comply with privacy and security requirements of HIPAA as though such laws are fully applicable to Participant, and with all other applicable laws. 6.4. PHI Safeguards. At all times following the Receipt of PHI or data pursuant to this Agreement, until such time as the PHI is no longer in Participant’s possession or subject to Participant’s control, Participant shall implement administrative, physical, and technical safeguards, as required by the Security Rule, as though such rule were fully applicable to Participant. Such safeguards shall reasonably and appropriately protect the confidentiality, integrity and availability of PHI. Such safeguards shall be implemented to prevent any Use or Disclosure of PHI other than those permitted under the Agreement. 6.5. Notice of Security Incidents or Breach. Participant shall notify QHN of: (a) any Security Incident involving PHI of which it becomes aware; (b) any Use or Disclosure of PHI not permitted by or contrary to the terms of this Agreement of which Participant becomes aware; and (c) any Breach of unsecured PHI following the discovery of such Breach. In any event, such notice of the above events will be provided without unreasonable delay and in no case later than five (5) days after discovery. QHN and Participant will cooperate with each other with regard to reporting of any such events or a Breach as required by law. 6.6. Disclosure of PHI to Third Parties. Participant may not Disclose PHI to Third Parties unless the Disclosure is of the “minimum necessary” (as that term is defined in HIPAA) information for the purposes of the Disclosure and the Disclosure is necessary to accomplish a purpose for which the PHI was Disclosed to Participant. 6.7. Reporting Legally Required Disclosures. If Participant is ordered by a Court to disclose PHI or is the recipient of a subpoena or civil discovery request compelling disclosure of PHI obtained pursuant to this Agreement, Participant shall immediately give notice to QHN and not make any disclosure of PHI until at least five (5) business days have passed to allow QHN an opportunity to formally object to the disclosure, or QHN has indicated that it does not object to the disclosure. DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Page 10 of 12 Electronic Commerce Agreement (Revised 7-28 2020) 7. Arbitration. 7.1. Agreement to Arbitrate. Except to recover unpaid fees for use of the QHN System in amounts up to twenty thousand dollars ($20,000.00) or to obtain injunctive relief, any claim arising out of or in any way related to the rights, duties and obligations described in this Agreement shall be submitted to final and binding arbitration in accordance with this paragraph, and such claim shall be submitted to arbitration within one (1) year of the event on which the claim is based. QHN may sue in any court of competent jurisdiction to recover unpaid fees in amounts up to twenty thousand dollars ($20,000.00) or to obtain injunctive relief. 7.2. Arbitration Procedures. The arbitration shall be governed by the Colorado Uniform Arbitration Act, section 13-22-201, et seq., C.R.S., except as otherwise expressly provided herein. The panel of arbitrators shall consist of three arbitrators. One arbitrator shall be selected by one party, one arbitrator shall be selected by the other party, and the third arbitrator shall be selected by the two arbitrators that have been chosen. If the two arbitrators are unable to agree to the selection of a third arbitrator, the third arbitrator shall be selected in accordance with the Colorado Uniform Arbitration Act. Each party shall be required to make “Disclosures” as set forth in Colorado Rule of Civil Procedure (C.R.C.P.) 26(a)(1), which disclosures shall be made within ten (10) days after a date is selected for the arbitration hearing. In addition to such disclosures, each party shall disclose to the other party the “Disclosure of Expert Testimony” as set forth in C.R.C.P. 26(a)(2)(A) and 26(a)(2)(B), which disclosures shall be made at least twenty (20) days prior to the date of the arbitration hearing. The arbitration shall be conducted in Mesa County, Colorado. The arbitrators shall follow Colorado law in making an award. Written findings of fact and conclusions of law shall be issued by the arbitrators. 7.3. Powers of Arbitrators -- Enforcement of Award. The arbitrators shall have all powers as set forth in section 13-22-201, et seq., C.R.S. The decision or award of the arbitrators shall be binding upon the parties to the same extent and to the same degree as if the matter had been adjudicated by a court of competent jurisdiction. The party in whose favor any award shall be made may file the same with the Clerk of the Mesa County, Colorado District Court, which may enter a judgment thereon, and if such award requires the payment of money, the Clerk may issue execution therefore. Each party, however, shall pay its own attorneys’ fees and costs of arbitration, including filing fees, arbitration fees, and other costs. Fees and expenses incurred by the arbitrator that each party chooses shall be paid by that party. Each party shall pay one-half of the fees and expenses incurred by the arbitrator chosen by the other two arbitrators. 7.4. Jurisdiction and Venue. No court shall have subject matter jurisdiction over any claim set forth in paragraph 7. The dispute procedure in this paragraph 7 is the exclusive and mandatory dispute resolution procedure under this Agreement. In the event any claim set forth in paragraph 7 is attempted to be resolved in any court by either party, the venue of such matter shall only be in Mesa County, Colorado. 7.5. Time Requirements. All time periods to take or request action provided or required under this paragraph 7 shall be strictly construed and shall be of the essence of this Agreement. 8. Termination. 8.1. Unilateral Termination. This Agreement may be terminated by QHN or Participant with or without cause on at least sixty (60) days’ prior written notice to the other party. 8.2. Participant’s Right to Termination. 8.2.1. Participant may terminate this Agreement upon thirty (30) days’ prior written notice to QHN should QHN’s Standards change regarding Use of the QHN System in a manner that Participant reasonably believes lessens the safeguards on accessing the data that is available through Use of the QHN System. 8.2.2. Participant may terminate this Agreement upon thirty (30) days’ prior written notice to QHN should QHN change the fees referenced on attached Exhibit B. Notice of termination under this subparagraph must be given by Participant within thirty (30) days of QHN changing the fees. DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Page 11 of 12 Electronic Commerce Agreement (Revised 7-28 2020) 8.3. Termination for Material Breach. Notwithstanding anything to the contrary in this Agreement, upon gaining knowledge of a material breach of the terms of this Agreement by a party to this Agreement, the non-breaching party may: (a) if the breach cannot be cured, terminate this Agreement upon thirty (30) days written notice to the breaching party; or (b) if the breach can be cured, provide at least ten (10) business days written notice of the breach to the breaching party and the opportunity to cure the same within the ten (10) day period or be subject to termination of this Agreement within thirty (30) days. 8.4. QHN’s Right to Termination / Suspension. 8.4.1. QHN may terminate this Agreement upon written notice to Participant should QHN determine or become aware that: (a) Participant or Participant Users have not complied with QHN’s Standards, Information Privacy and Protection Laws or requirements of applicable law with regard to Use of the QHN System and fail to cure such noncompliance within ten (10) business days after receiving notice of such noncompliance from QHN; (b) Participant’s license, if any, to provide health care services is terminated or suspended; or (c) Participant has engaged in any pattern or practice that would constitute a violation of this Agreement and Participant fails to discontinue such conduct within ten (10) business days after receiving notice of such noncompliance from QHN. 8.4.2. QHN may terminate this Agreement upon written notice to Participant if Participant fails to pay amounts owed to QHN when due, and such failure to pay continues for thirty (30) days after written notice from QHN. 8.4.3. QHN may also immediately suspend a Participant or Participant User’s access to the QHN System, without terminating this Agreement, pursuant to terms of QHN’s Standards. 8.5. Participant Rights Upon Termination. Upon termination of this Agreement, QHN may retain data received from Participant. If such data is PHI, QHN will continue to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI to protect Use or Disclosure of the PHI for as long as QHN retains the PHI, and for data that is not PHI, QHN shall comply with all applicable laws to safeguard the confidentiality of such data. Such PHI retained by QHN shall be subject to the same conditions of this Agreement which applied prior to termination. The provisions of paragraphs 4, 5 and 6 of this Agreement shall survive termination of this Agreement and continue to apply to Participant’s data not removed from the QHN System. Upon notice of termination for reasons other than termination by QHN under paragraph 8.3 or paragraph 8.4.1 of this Agreement, QHN and Participant shall agree upon a reasonable time (not to exceed one hundred eighty (180) days from the effective date of termination) and terms and conditions within which Participant may continue use of the QHN System. During this time period, Participant may continue use of the QHN System in accordance with this Agreement, and the parties shall be subject to all terms of this Agreement and any agreement between the parties regarding the termination, including payment of all amounts that may be owed to QHN. 9. General Provisions. 9.1. Compliance with Law. QHN, Participant and each Participant User shall comply with applicable laws regarding use of the QHN System. This Agreement shall be interpreted to the maximum extent possible as being consistent with such laws. 9.2. Independent Contractor. This Agreement is intended to create the relationship of independent contractor between Participant and QHN. Nothing contained herein shall be interpreted to create any relationship of agency, employment, partnership or joint venture between QHN and Participant. Neither party shall represent or hold themselves out to any person or entity other than is consistent with the relationship of independent contractor. 9.3. Entire Agreement. This Agreement, and the Exhibits attached to this Agreement, constitute the entire understanding and agreement of the parties, and shall supersede all prior understandings and agreements of the parties on the subject matter of this Agreement. DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Page 12 of 12 Electronic Commerce Agreement (Revised 7-28 2020) 9.4. Amendment. Except as otherwise set forth in this Agreement, this Agreement shall not be changed, modified or altered except by amendment, which, to be valid and enforceable, shall be in writing and signed by the parties. Notwithstanding the foregoing, QHN may unilaterally amend this Agreement to comply with any applicable federal or state laws or regulations, including but not limited to Information Privacy and Protection Laws, effective immediately upon written notice to the Participant, and may otherwise amend the terms of this Agreement effective upon ninety (90) days prior written notice to the Participant. Participant’s use of the QHN System after the effective date specified in such notice shall constitute acceptance of the amendment. Notwithstanding the foregoing, QHN’s Standards may be modified as provided in this Agreement. 9.5. Notices. Either party may send any notices required pursuant to this Agreement, except notices of termination and notices regarding indemnity obligations, by first class mail, electronic transmission, certified mail or a recognized overnight delivery service, to the last known physical or electronic address for Participant in QHN’s records. All termination notices under this Agreement by either party, and all notices regarding indemnity obligations, shall be made in writing and sent via certified mail, return receipt requested, or a recognized overnight delivery service, to the addresses of the parties set forth above. 9.6. Assignment. Neither party’s rights, duties and responsibilities pursuant to this Agreement may be assigned or delegated without the prior written consent of the other party, except for a transfer or assignment to a parent, subsidiary or affiliate or an entity with which it is merged or consolidated, or the purchaser of all or substantially all of its assets provided that the transferee assumes all of its obligations under this Agreement. 9.7. Severability. If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect, unless the invalid or unenforceable provision is material to this Agreement and its invalidity or unenforceability results in substantial economic detriment to either party to this Agreement. 9.8. Governing Law. This Agreement shall be governed by the laws of the State of Colorado. 9.9. Benefit. The terms and provisions of this Agreement shall bind and benefit Participant and permitted assigns and shall bind and benefit QHN and its permitted assigns. There shall be no third-party beneficiaries of this Agreement. 9.10. Interpretation. Any ambiguity or inconsistency in this Agreement shall be resolved in favor of a meaning that permits both parties to comply with applicable laws. 9.11. Non-Exclusion. Each party represents and warrants that it and its employees are not and have not been sanctioned, debarred, excluded or otherwise declared ineligible to participate in any state or federal health care program. If a party is ever sanctioned, debarred, excluded or otherwise declared ineligible for participation in any state or federal health care program, the other party to this Agreement may immediately terminate this Agreement by providing written notice of such termination. ATTACHMENTS: Exhibit A: Business Associate Agreement— Covered Entity Exhibit B: Orders Copyright 2020, QHN. © All rights reserved. DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Exhibit A – BAA—Covered Entity (Revised 7-28-2020) 1 EXHIBIT A TO ELECTRONIC COMMERCE AGREEMENT Applicability: If Participant is a Covered Entity for which QHN is performing functions as a Business Associate of Participant, then QHN and Participant agree to be bound to the terms of this Business Associate Agreement. This Business Associate Agreement is only applicable if Participant is such a Covered Entity. BUSINESS ASSOCIATE AGREEMENT—Covered Entity This Business Associate Agreement (“Agreement”) is agreed to by Quality Health Network, Inc. (herein, “QHN”) and “Participant” named in the Electronic Commerce Agreement (“Services Agreement”) to which this Agreement is attached. RECITALS: WHEREAS, Participant is a health care provider or health plan. Participant desires to Use the QHN System provided by QHN for purposes of promoting the improvement of health care treatment, payment and operations. WHEREAS QHN and Participant have entered into the Services Agreement, pursuant to which QHN will have access to Protected Health Information. WHEREAS, the relationship between QHN and Participant created under the terms of this Services Agreement results in QHN’s classification as a “Business Associate” under HIPAA. The HIPAA regulations require Participant to enter agreements that include certain mandated provisions, which are included in this Agreement, with all vendors and contractors that are classified as “Business Associates. WHEREAS, the purpose of this Agreement is to comply with a federal law, “HIPAA,” as defined below, that applies to QHN and Participant. THEREFORE, In consideration of the mutual promises below and any fees paid pursuant to the Services Agreement, and the exchange of information pursuant to this Agreement, the parties agree as follows: I. Definitions. The definitions in the Services Agreement are incorporated herein by this reference. Terms used but not otherwise defined in this Agreement shall have the same meaning as those terms in 45 C.F.R. parts 160 and 164. II. QHN and Participant Obligations. A. Permitted Uses and Disclosures of PHI by QHN. The scope of PHI that may be Used, Disclosed, or accessed and/or the functions performed by QHN includes PHI necessary to perform functions permitted or required by the Services Agreement, or to take other measures to satisfy the Participant’s obligations under 45 C.F.R. 164.524, as such measures are described in this Agreement. QHN may, if necessary, Use PHI for the proper management and administration of QHN, or to carry out legal DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Exhibit A – BAA—Covered Entity (Revised 7-28-2020) 2 responsibilities of QHN, as may be allowed by the Information Privacy and Protection Laws. QHN may Disclose PHI for the proper management and administration of QHN or to carry out the legal responsibilities of QHN, provided the Disclosures are required by law, or QHN obtains reasonable assurances from the person to whom the information is Disclosed that the information will remain confidential and Used or further Disclosed only as required by law, or for purposes for which it was Disclosed to the person, and the person notifies QHN of any instances of which it is aware in which the confidentiality of the information has been Breached. QHN may Use and Disclose PHI in providing data aggregation services relating to the health care operations of the Participant. QHN may Use and Disclose PHI as required by law and for public health activities, as provided in 45 C.F.R. 164.512. QHN will not Use, Disclose, or access PHI in violation of any applicable Information Privacy and Protection Laws. QHN further agrees to not Use or further Disclose PHI other than as permitted or required by this Agreement or by law. QHN shall comply with the requirements of HITECH applicable to QHN as a Business Associate. Except as set forth above, QHN may not Use or Disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Participant. B. Access to Records. To the extent QHN has possession of PHI in a Designated Record Set, upon a request made by an Individual QHN agrees to provide access: (i) at the request of Participant to PHI in a Designated Record Set to Participant (but not to an Individual) as may be necessary to meet the requirements under 45 CFR 164.524; or (ii) directly to the Individual in a manner consistent with QHN Policies and in compliance with the requirements of 45 C.F.R. 164.524. C. Amendment to Records. QHN agrees to allow Participant (but not an Individual) to make any amendment(s) to PHI in a Designated Record Set in QHN’s possession that Participant may be required to make pursuant to 45 CFR 164.526 in the time and manner designated by Participant. Participant shall make such amendments as may be required by applicable law. QHN will assist Participant as required by law with regard to such amendments. QHN is not responsible for making any amendments to medical records, or for the accuracy of any amendments made to medical records. D. Accounting for Disclosure of Records. QHN shall maintain an accounting or record of all Disclosures of PHI it makes only as required by and in accordance with 45 C.F.R 164.528. Records of Disclosures shall be retained by QHN for a period of time that complies with HIPAA and other applicable federal or state law requirements pertaining to record retention. The record of the Disclosure shall include the following information: (a) the date of the Disclosure; (b) the name and address of the organization and/or individual receiving the information; (c) a brief description of the information Disclosed; and (d) a copy of all requests for Disclosures. QHN agrees to provide to Participant (but not an Individual), in the time and manner designated by Participant, information collected in accordance with this section, to permit Participant to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR 164.528. E. Mitigation. QHN agrees to mitigate, to the extent practicable, any harmful effect that is known to QHN of a Use or Disclosure of PHI by QHN in violation of the requirements of this Agreement. DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Exhibit A – BAA—Covered Entity (Revised 7-28-2020) 3 F. Safeguards and Security Incidents. At all times following the Receipt of PHI, until such time as the PHI is no longer in QHN’s possession or subject to its control: 1. QHN shall implement administrative, physical, and technical safeguards, as required by the Security Rule, that reasonably and appropriately protect the confidentiality, integrity and availability of PHI that it Receives, maintains, or Transmits on behalf of Participant. Such administrative, physical, and technical safeguards shall be implemented in order to prevent any Use or Disclosure of PHI other than those permitted under this Agreement; 2. QHN shall notify Participant of any Use or Disclosure of PHI not permitted by or contrary to the terms of this Agreement of which QHN becomes aware; 3. QHN shall notify Participant of any Security Incident of which it becomes aware; 4. QHN shall comply with the requirements of the Information Privacy and Protection Laws in order to notify Participant of any Breach of unsecured PHI following the discovery of such Breach. In any event, such notice will be provided without unreasonable delay and in no case later than thirty (30) days after discovery of a Breach of unsecured PHI. Such notice shall include the identification of each Individual whose unsecured protected health information has been, or is reasonably believed by QHN to have been, accessed, acquired or disclosed during such Breach. QHN and Participant will cooperate with each other with regard to reporting of such a Breach if such reporting is required by law. G. Disclosure of PHI to Third Parties. QHN may not Disclose PHI to Third Parties except under the following conditions: 1. The Disclosure is of the “minimum necessary” (as that term is defined in HIPAA) information for the purposes of the Disclosure, if such standard is required by applicable law; and 2. The Disclosure is necessary to accomplish a purpose for which the PHI was Disclosed to the Receiving party and is permitted under applicable Information Privacy and Protection Laws and this Agreement. For purposes of this Agreement, a Participant or Participant User’s access and Use of the QHN System shall not be considered a Disclosure of PHI by QHN under this Agreement. H. Subcontractors. In accordance with 45 C.F.R. 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, QHN agrees to ensure that any agent or subcontractor of QHN agrees to the same restrictions, conditions and requirements as regards PHI that apply to QHN throughout this Agreement when such agents or subcontractors are performing any of the tasks, duties, or obligations required of QHN by this Agreement. DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Exhibit A – BAA—Covered Entity (Revised 7-28-2020) 4 I. De-identified PHI. QHN is authorized to Use PHI to de-identify the information in accordance with 45 C.F.R. 164.514(a)-(c). Once de-identified, such information may be used or disclosed as allowed by applicable law. J. Privacy Practices and Restrictions. Participant shall notify QHN of any limitation(s) in the notice of privacy practices of Participant under 45 C.F.R. 164.520, to the extent that such limitation may affect QHN’s Use or Disclosure of PHI. Participant shall notify QHN of any changes in, or revocation of, the permission by an Individual to Use or Disclose his or her PHI, to the extent that such changes may affect QHN’s Use or Disclosure of PHI. Participant shall notify QHN of any restriction on the Use or Disclosure of PHI that Participant has agreed to or is required to abide by under 45 C.F.R. 164.522, to the extent that such restriction may affect QHN’s Use or Disclosure of PHI. K. Auditing of Records. QHN agrees to make its internal practices, books, and records relating to its access to, Use, and Disclosure of PHI received from or on behalf of Participant or created by QHN on behalf of Participant available to Participant or, at the request of Participant, to the U.S. Secretary of the Department of Health and Human Services (“Secretary”) in a time and manner designated by Participant or the Secretary for purposes of determining compliance with Information Privacy and Protection Laws. L. Breach Notification by Participant in eHealth Exchange. At all times while subject to this Agreement and when accessing data from the eHealth Exchange through use of the QHN System: 1. As soon as reasonably practicable, but no later than five (5) business days after determining that a Breach occurred and is likely to have an adverse impact on the QHN System or another user, Participant will notify QHN, and will assist and cooperate with QHN in the notification by QHN of any other user of the QHN System likely impacted by the Breach and the eHealth Exchange Coordinating Committee. The notification by Participant to QHN shall include all information required by QHN’s Standards. Participant shall supplement the information contained in the notification as it becomes available. 2. Notwithstanding the above, within one (1) hour of discovering information that leads Participant to reasonably believe that a Breach may have occurred and that such Breach involves a federal government user, Participant will alert QHN and will work with QHN to provide notification to the federal government user of the discovery of the Breach. Further, within twenty-four (24) hours of determining that a Breach has occurred and is likely to have an adverse impact on a federal government user, Participant shall assist and cooperate with QHN to provide notification to all such federal government users that are likely impacted by the Breach and the eHealth Exchange Coordinating Committee. M. Compliance with Law and Agreement. To the extent QHN is to carry out one or more of the Participant’s obligations under Subpart E of 45 C.F.R. Part 164, QHN DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Exhibit A – BAA—Covered Entity (Revised 7-28-2020) 5 shall comply with the requirements of Subpart E that apply to Participant’s performance of such obligations. Each party to this Agreement shall comply with, and as applicable shall require its directors, officers and employees to comply with, all applicable Information Privacy and Protection Laws and with each party’s duties and obligations pursuant to this Agreement. N. Incorporation of Additional Requirements; Construction. The requirements of applicable law pertaining to PHI are, to the extent not adequately provided for in this Agreement, hereby incorporated by this reference and shall become a part of this Agreement. This Agreement shall be construed as broadly as necessary to implement and comply with Information Privacy and Protection Laws. III. Obligations of Participant. A. If necessary for QHN to perform its obligations under the terms of the Services Agreement, Participant shall provide QHN with the notice of privacy practices that Participant produces in accordance with 45 CFR 164.520, as well as any changes to such notice. B. Participant shall provide QHN with any changes in, or revocation of, permission by an Individual to Use or Disclose PHI, if such changes affect QHN’s permitted or required Uses and Disclosures. C. Participant shall notify QHN of any restriction to the Use or Disclosure of PHI that Participant has agreed to or any alternate means of communication requirements with an Individual that Participant must comply with in accordance with 45 CFR 164.522. IV. Term and Termination. A. Effective Date. The Effective Date of this Agreement shall be the Effective Date of the Services Agreement. B. Term. Except as otherwise agreed, this Agreement shall be in effect for the term of the Services Agreement and shall remain in effect until all of the PHI provided by Participant to QHN, or created or Received by QHN on behalf of Participant, is destroyed or returned to Participant, or if it is not feasible to return or destroy PHI, protections are extended to such information in accordance with the termination provisions of this Agreement. C. Termination for Cause. Notwithstanding anything to the contrary in this Agreement or the Services Agreement, upon gaining knowledge of a material breach by QHN of the terms of this Agreement, including but not limited to a pattern or practice that would constitute a breach of this Agreement, Participant may at its sole discretion: 1. Immediately terminate this Agreement and the Services Agreement, and suspend all services (without penalty) immediately upon written notice to QHN without any term of notice and/or judicial intervention being required, and without liability on behalf of Participant for such suspension; or, 2. Allow QHN an opportunity to cure the breach. DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Exhibit A – BAA—Covered Entity (Revised 7-28-2020) 6 D. Participant Rights Upon Termination. Upon termination of this Agreement, QHN may retain data received from Participant. With regard to such data that is PHI, QHN will continue to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI to protect Use or Disclosure of the PHI for as long as QHN retains the PHI and for data that is not PHI, QHN shall comply with all applicable laws to safeguard the confidentiality of such data. QHN will not Use or Disclose such PHI retained by QHN, other than for the purposes for which such PHI or CSI was retained and subject to the same conditions of this Agreement which applied prior to termination. V. Miscellaneous. A. Amendment of Agreement. Except as otherwise set forth in this Agreement, this Agreement shall not be changed, modified or altered except by amendment, which, to be valid and enforceable, shall be in writing and signed by the parties. Notwithstanding the foregoing, QHN may unilaterally amend this Agreement in order to comply with any applicable federal or state laws or regulations, including but not limited to Information Privacy and Protection Laws, effective immediately upon written notice to Participant. Upon the addition of, change, or amendment to any applicable federal or state laws or regulations, including but not limited to Information Privacy and Protection Laws, which would require an amendment to this Agreement, this Agreement shall be deemed to be amended to comply with such addition, change or amendment. B. Interpretation. The requirements of applicable law pertaining to PHI are, to the extent not adequately provided for in this Agreement, hereby incorporated by this reference and shall become a part of this Agreement. This Agreement shall be construed as broadly as necessary to implement and comply with Information Privacy and Protection Laws. DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Exhibit B – Orders (Revised 7-28-2020) EXHIBIT B TO ELECTRONIC COMMERCE AGREEMENT Orders I. Fees. One time and/or recurring fees for use of the QHN System and other products and services shall be those set forth on an Order which QHN will provide to Participant. Participant shall pay QHN the fees set forth on the Order pursuant to the payment terms of the Order and this Agreement. Any amounts owed to QHN which are not paid when due shall bear interest at the rate of eighteen percent (18%) per annum. The payment amount and interest rate are subject to change upon sixty (60) days written notice to Participant from QHN, subject to Participant’s right to terminate the Agreement as provided herein. QHN may refuse Participant and Participant Users access to uses of the QHN System if payment is not timely made by Participant. II. Uses, Products and Services. The Order shall describe Participant’s access and use of the QHN System or other products and services provided by QHN. III. Order Issuance and Acceptance. Orders are issued by QHN. Orders shall be binding upon QHN and Participant upon execution by Participant and acceptance by QHN. IV. Termination. Either QHN or Participant may terminate an Order upon sixty (60) days prior written notice. Participant shall pay QHN for any work completed up to the date of the termination. Termination of an Order shall not terminate this Agreement. DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Page 1 of 3 QHN Amendment for Governmental Entities (07-17) (279405).doc AMENDMENT TO ELECTRONIC COMMERCE AGREEMENT FOR GOVERNMENTAL ENTITIES QUALITY HEALTH NETWORK, a Colorado nonprofit corporation (herein “QHN”) Eagle County Government print/type name of contracting entity (herein “Participant”) Address of QHN: 744 Horizon Court, Suite. 210 Grand Junction, CO 81506 (970) 248-0033 dthompson@qualityhealthnetwork.org Address of Participant: 551 Broadway Eagle, CO 81631 QHN and Participant are parties to an Electronic Commerce Agreement dated ____________________, (the “Electronic Commerce Agreement”) and amendments thereto (“Prior Amendments”). The Electronic Commerce Agreement and Prior Amendments shall collectively be referred to as the “Agreement.” All definitions and terms of the Agreement are in corporated herein by this reference. QHN and Participant desire to enter into this Amendment for the purpose of addressing legal matters that involve Participant’s status as a public entity. Participant and QHN agree to all attached Terms and Conditions. This Amendment is dated and shall be effective on the date set forth below by QHN as the effective date. QUALITY HEALTH NETWORK, a Colorado nonprofit corporation Eagle County Government (print/type name of Participant) By: __________________________________ (signature) By: _________________________________ (signature) Name/Title: __________________________ (print/type name of signatory and title) Effective Date: ________________________ (To be completed by QHN) Name/Title: Jeff Shroll County Manager (print/type name of signatory and title) DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 11/10/2020 11/10/2020 CFOJustin Aubert Page 2 of 3 QHN Amendment for Governmental Entities (07-17) (279405).doc TERMS AND CONDITIONS 1. Indemnity. Any provisions of the Agreement wherein Participant indemnifies QHN or QHN indemnifies Participant are hereby deleted. 2. Arbitration. All provisions of the Agreement regarding submitting claims to arbitration are hereby deleted. Venue for any legal actions concerning this Agreement shall only be in Mesa County, Colorado. 3. Inapplicable Sections. Section 4 of the Agreement shall not apply if and to the extent that Participant is not a Covered Entity. Section 5 of the Agreement shall not apply to Participant if and to the extent that Participant does not have access to Community Services Information through use of the QHN System. 4. Remote Access to Participant’s Internal Network. To the extent that any provision of the Agreement allows or requires QHN to connect to Participant’s internal network via remote access technology, QHN agrees that such access shall be conditioned on compliance with reasonable written policies of Participant related to such remote access. 5. Additions to Agreement. The following provisions are added to the Agreement. A. Colorado Open Records Act. QHN understands that certain information, including this Agreement and all Exhibits thereto, may be public records available for public inspection and copying under the Colorado Open Records Act (“CORA”) and other applicable laws. Nothing in the Agreement shall in any way limit the ability of the Participant to comply with any laws or legal process concerning disclosures by public entities. Any information subject to CORA as a public record may be released to third parties in compliance with CORA. The parties further agree that any such release by the Participant will not constitute a breach or threatened breach of this Agreement. B. Colorado Taxpayers Bill of Rights. Financial obligations of the Participant payable after the current fiscal year are contingent upon funds for that purpose being appropriated, budgeted, and otherwise made available. The parties acknowledge that appropriation of moneys by the Participant is a governmental function which the Participant cannot contractually commit to in advance and that this Agreement does not constitute: (i) a multiple fiscal year direct or indirect debt or financial obligation; or (ii) an obligation payable in any fiscal year beyond the fiscal year for which funds are lawfully appropriated; or (iii) an obligation creating a pledge of or a lien on Participant tax or general revenues. If the Participant’s board does not approve an appropriation of funds at any time during the term of this Agreement for any payment due or to become due for a fiscal year during the term of this Agreement, the Participant shall have the right to terminate the Agreement on the last day of the fiscal period for which sufficient appropriations were received, without penalty or expense. The Participant may terminate this Agreement by giving notice in writing that (a) funds have not been appropriated for the fiscal period, and (b) the Participant has exhausted all funds legally available for the payment. C. Colorado Governmental Immunity Act. Nothing contained in this Agreement will be construed as an express or implied waiver by Participant of its governmental immunity or an express or implied acceptance by Participant of liabilities in excess of the liabilities allowable under the Colorado Governmental Immunity Act (“CGIA”), to the extent the provisions of the CGIA apply to this Agreement. Any liability of Participant (including indemnification) is DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Page 3 of 3 QHN Amendment for Governmental Entities (07-17) (279405).doc strictly limited by the provisions of the CGIA, to the extent those provisions apply to this Agreement. 6. Effect. Except as set forth in this Amendment, all terms, covenants and conditions of the Agreement shall remain in full force and effect. DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 Product/Services Order Dated: 11/10/2020 Exhibit B Addendum of QHN eCommerce Agreement Dated: Quality Health Network Product/Services Order Form. Revised January 2019. Page 1 of 1 9Sold To Name: Eagle County Government Address: PO Box 660, Eagle, CO 81631 Contact: Rebecca Larson Contact Phone: (970) 471-0112 Contact Email: Rebecca.larson@ealgecounty.us QHN Products and Services One Time Fees Monthly Fees Set Up, Training, Monthly Access Fees: 5 users will have access to QHN Results. PAID FOR BY GRANT PAID FOR BY GRANT QHN Set Up, Implementation and Training Fees: Statement of Work (SOW) detail below or attached: QHN will create a process by which COVID19 lab results for Eagle County patients received by QHN from its sources will be assembled into a batch that will run once a day in a batch .CSV file. The file will be sent to a secure QHN Direct email account for the Eagle County Public Health Dept. PAID FOR BY GRANT PAID FOR BY GRANT Sub Total: $0 $0 Adjustments: PAID FOR BY GRANT PAID FOR BY GRANT Total Amount Due: $0 $0 Amounts will be due under this Order when Specified work is complete. Work is considered complete when system is available for productive use. License and Services Fees are delivered pursuant to the eCommerce Agreement with QHN. Special Fee Schedules may apply for special situations. Travel & out-of-pocket expenses are invoiced to Participant as incurred. Add-on Users to be invoiced per the current QHN fee schedule. QHN is not responsible for any Participant vendor fees that may apply. Signature below authorizes delivery of products and services listed pursuant to eCommerce Agreement. Executed by: ____________________________________________________ Date: Enter date here. Authorized Participant Signature Printed name: ____________________________________________________ Date: Enter date here. Printed Name and Title Notes: Creation of report for distribution of information will be covered by the grant as long as funds are available. At the completion of the grant, July 1st, 2021, a new order will be signed indicating monthly fees for each user. Those monthly fees are $53 per month per user. Monthly fees will increase annually by a least 2% or Consumer Price Index- whichever is greater. DocuSign Envelope ID: 3B5D9A68-6EB9-4258-9BF3-02AE54A55660 11/10/2020 11/10/2020 11/10/2020County ManagerJeff Shroll