The URL can be used to link to this page

Home My WebLink AboutC22-335 Virtru CorporationPrivileged & Confidential BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement (this “Agreement”) is effective as of the Effective Date specified below by and between Virtru Corporation, a Delaware corporation (“Virtru”) and Eagle County (“Covered Entity”) for which Virtru provides services pursuant to one or more service agreements entered into between Virtru and Covered Entity (collectively the “Service Agreement”). WHEREAS, Covered Entity and Virtru mutually agree to the terms of this Agreement in order to facilitate compliance with the HIPAA Rules, as defined below. 1. DEFINITIONS. (a) “Breach” shall have the same meaning as the term “Breach” in 45 CFR 164.402. (b) “HIPAA” shall mean the Health Insurance Portability and Accountability Act of 1996, as amended by Subtitle D of the Health Information Technology for Economic and Clinical Health Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (Pub. L. No. 111-5) (the “HITECH Act”) and the federal regulations (“HIPAA Rules”) published at 45 CFR parts 160 and 164. (c) “Privacy Rule” means the privacy regulations at 45 CFR Part 160 and 45 CFR Part 164, Subparts A and E, as they exist now or as they may be amended. (d) “Security Rule” means the security regulations at 45 CFR Part 160 and 45 CFR Part 164, Subparts A and C, as they exist now or as they may be amended (e) “Individual” shall have the same meaning as the term “Individual” in 45 CFR 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g). (f) “Protected Health Information” shall have the same meaning as such term as defined in 45 CFR 160.103, but limited to information created, received, maintained or transmitted on behalf of Covered Entity by Virtru. (g) “Successful Security Incident” shall mean any Security Incident (as defined in 45 CFR 164.304) that results in the unauthorized use, access, disclosure, modification or destruction of electronic Protected Health Information. All capitalized terms used in this Agreement and not defined elsewhere herein or in the Services Agreement shall have the same meaning as those terms as used or defined in the HIPAA Rules. 2. USE AND DISCLOSURE OF PROTECTED HEALTH INFORMATION. (a) Compliance. Virtru agrees to satisfy and comply with the HIPAA Rules concerning the confidentiality, privacy, and security of Protected Health Information that apply to business associates. (b) General Prohibition on Use and Disclosure. Virtru shall not use or disclose Protected Health Information except as permitted or required by Section 3 of this Agreement or as Required by Law. (c) Certain Uses and Disclosures. Virtru may use and disclose Protected Health Information only if such use or disclosure is in compliance with the applicable requirement of 45 CFR 164.504(e). (d) Mitigation. Virtru agrees to mitigate: (i) any harmful effect resulting from a Successful Security Incident involving PHI or any use or disclosure of PHI in violation of the requirements of this Agreement or the HIPAA Rules; and (ii) any material risks identified or discovered as a result of a Security Incident that does not result in the unauthorized use, access, disclosure, modification or destruction of electronic Protected Health Information. (e) Agents. Virtru agrees to use its best efforts to ensure that any agent, including without limitation a Subcontractor, to whom it provides Protected Health Information will agree to substantially the same requirements that apply through this Agreement to Virtru with respect to such information and to enter into a Business Associate Agreement when such agent acts as a business associate. Virtru shall be liable to Covered Entity for any acts, failures or omissions of the agent or Subcontractor in providing the services as if they were Virtru’s own acts, failures or omissions, to the extent permitted by law. (f) Minimum Necessary. Virtru agrees that it shall request from Covered Entity, use itself, and disclose to its affiliates, subsidiaries, agents and Subcontractors or other third parties only the minimum necessary Protected Health Information to va-423934 perform or fulfill a specific function required or permitted hereunder. (g) Use and Disclosure Reports. Virtru agrees to report any use or disclosure of Protected Health Information not permitted by this Agreement and any Successful Security Incident to Covered Entity within a commercially reasonable period, but in no event later than within thirty (30) business days, after it is discovered (within the meaning of 45 CFR 164.410(a)(2)). Such report shall be made by email to Scott.lingle@eaglecounty.us. Virtru shall provide the information as required by 45 CFR 164.410(c). If such information is not available to Virtru at the time the report is due to Covered Entity, Virtru shall provide such information to Covered Entity promptly as it becomes available. Virtru shall report any Breach of Unsecured PHI to Covered Entity within a commercially reasonable period, but in no event later than thirty (30) days after it is discovered. Virtru shall maintain complete records regarding such reports for the period required by 45 CFR 164.530(j), and shall make such records available to Covered Entity promptly upon request, but in no event later than within seven (7) days. (h) Access to Personal Health Information. Within ten (10) business days of receipt of a request from Covered Entity, Virtru shall provide to Covered Entity or, at its direction, to an Individual, Protected Health Information relating to that individual held by Virtru or its agents or Subcontractors in a Designated Record Set in accordance with 45 CFR 164.524. In the event any Individual requests access to his or her Protected Health Information directly from Virtru, Virtru shall, within ten (10) business days of receipt of such request, forward the request to Covered Entity unless the Privacy Rule requires Virtru to receive and respond to such requests directly, in which case Virtru shall respond directly as required by and in accordance with 45 CFR 164.524, and shall send a copy of such response to Covered Entity. (i) Amendments to Personal Health Information. Within ten (10) business days of receipt of a request from Covered Entity, Virtru agrees to make any requested amendment(s) to Protected Health Information held in a Designated Record Set by it, or any of its agents or subcontractors in conjunction with any other measures necessary to satisfy the requirements set forth in 45 CFR § 164.526. In the event an individual requests an amendment to his or her Protected Health Information directly from Virtru, Business Associate shall within five (5) business days of receipt thereof, forward such request to Covered Entity. (j) Reports Required for Accounting. Within ten (10) business days after a request from Covered Entity, Virtru, its agents or Subcontractors shall prepare a list of any disclosure of Protected Health Information for which an accounting is required under 45 CFR 164.528, Virtru agrees to provide in writing via email to Scott.lingle@eaglecounty.us. In the event any Individual requests an accounting of disclosures under 45 CFR 164.528(a) directly from Virtru, Virtru shall, within ten (10) business days of receipt of such request, forward the request to Covered Entity unless the Privacy Rule requires or Covered Entity directs that Virtru to receive and respond to such requests directly, in which case Virtru shall respond directly as required by and in accordance with 45 CFR 164.528, and shall send a copy of such response to Covered Entity. (k) Compliance with Requests for Restriction or Confidential Communication. Within five (5) business days of receipt of a request from Covered Entity, Virtru agrees to comply with any request for confidential communication of, or restriction on the use or disclosure of, Protected Health Information held by it or any agent or Subcontractor as requested by Covered Entity and in accordance with 45 CFR 164.522. (l) Books and Records. Virtru agrees to make its internal practices, books, and records relating to the use and disclosure of Protected Health Information available to the Secretary of Health and Human Services or her/his designees or other government authorities in a time and manner designated by such governmental authorities, for purposes of determining compliance with the HIPAA Rules. (m) Documentation of Obligations. Virtru shall maintain documentation of its obligations hereunder to the extent and for the period required by the HIPAA Rules, including 45 CFR 164.530(j). 3. SECURITY OF PROTECTED HEALTH INFORMATION. (a) Security Measures. Virtru agrees to implement appropriate administrative, physical, and technical safeguards, as required by the HIPAA Rules. Without limiting the foregoing, Virtru agrees to comply with the requirements of 45 CFR 164.308, 2 va-423934 164.310, 164.312, and 164.316, as may be amended and interpreted in guidance from time to time. (b) Reviews. Virtru will perform periodic reviews of its security safeguards to ensure they are appropriate and operating as intended. (c) Documentation. Documentation of Virtru’s security assessments, including testing and any remediation efforts must be retained for a period of six (6) years following (i) termination hereof and (ii) destruction or return of Protected Health Information, whichever is last to occur, or such longer period as required by applicable law. (d) Training. Virtru shall train Workforce members on the responsibilities under the HIPAA Rules, and consequences for failing to do so. 4. PERMITTED USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION. (a) General Restriction. Virtru agrees not to use, store, or disclose Protected Health Information other than as permitted or required by this Agreement or as Required by Law. Subject to the limitations set forth in this Agreement, Virtru may use and disclose Protected Health Information as necessary in order to provide its services as described in the Services Agreement. (b) Certain Exceptions. Subject to the limitations set forth in this Agreement, Virtru may use Protected Health Information if necessary for its proper management and administration or to carry out its legal responsibilities. In addition, Virtru may disclose Protected Health Information as necessary for its proper management and administration or to carry out its legal responsibilities provided that: (i) Any such disclosure is Required by Law; or (ii) (A) Virtru obtains reasonable assurances, in the form of a written agreement, from the person to whom the Protected Health Information is disclosed that it will be held confidentially and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person; and (B) the person agrees to immediately notify Virtru (which shall immediately notify Covered Entity in accordance with Section 2 above) of any instances of which it is aware in which the confidentiality of the Protected Health Information has been breached. (c) De-Identification. Virtru may de-identify and use such de-identified Protected Health Information for Virtru’s purposes. Virtru is prohibited from disclosing such de-identified information to third parties who may re-identify such information, in violation of 45 CFR 164. Such disclosure shall constitute a breach of this agreement. 5. COVERED ENTITY’S PRIVACY PRACTICES AND RESTRICTIONS. (a) Limitations. Covered Entity shall notify Virtru of any limitation(s) in the notice of privacy practices of Covered Entity under 45 CFR 164.520, to the extent that such limitation may affect Virtru’s use or disclosure of Protected Health Information. (b) Changes. Covered Entity shall notify Virtru of any changes in, or revocation of, the permission by an Individual to use or disclose his or her Protected Health Information, to the extent that such changes may affect Virtru’s use or disclosure of Protected Health Information, within five (5) business days of such changes or revocation. (c) Restrictions on Use or Disclosure. Covered Entity shall notify Virtru of any restriction on the use or disclosure of Protected Health Information that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Virtru’s use or disclosure of Protected Health Information. (d) Requests to Virtru. Covered Entity shall not request Virtru to use or disclose Protected Health Information in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity, except to the extent that Virtru will use or disclose Protected Health Information for the management and administration and legal responsibilities of Virtru. 6. TERM AND TERMINATION. (a) Term. The term of this Agreement shall continue for so long as the Services Agreement remains in effect, except that Sections 6(a), 6(c), and 7(d) shall survive after the termination of the Services Agreement for as long as Virtru retains any Protected Health Information. (b) Termination for Cause. Upon Covered Entity’s determination that Virtru has violated or breached a material term of this Agreement, Virtru shall have thirty (30) days to cure 3 va-423934 the breach or end the violation, and Covered Entity may terminate this Agreement only if Virtru does not cure the breach or end the violation within such period. (c) Effect of Termination. (i) Exceptasprovidedin Section 6(c)(ii), upon termination of this Agreement for any reason, Virtru shall, at the election of Covered Entity, return to Covered Entity or destroy all Protected Health Information in its possession or that of its Subcontractors or agents. Virtru and its agents and Subcontractors shall retain no copies of the Protected Health Information. (ii) In the event that returning or destroying the Protected Health Information is infeasible, Virtru shall provide to Covered Entity written notification within ten (10) business days after termination of the Services Agreement of the conditions that make return or destruction infeasible. Upon agreement by Covered Entity that return or destruction of the Protected Health Information is infeasible, Virtru shall extend the protections of this Agreement to such Protected Health Information at Covered Entity’s cost and expense, and limit further uses and disclosures of it to those purposes that make the return or destruction infeasible, for so long as Virtru or its agents or Subcontractors hold such Protected Health Information. 7. INDEMNIFICATION AND LIABILITY. (a) Indemnification. To the extent allowable by law, Each Party will indemnify and hold harmless the other Party and any of its officers, directors, employees, or agents from and against any claim, cause of action, liability, damage, cost or expense, including reasonable attorneys’ fees and court or proceeding costs, arising out of or in connection with any breach of the terms of this Agreement. (b) Costs and Expenses. In the event of a Breach of Protected Health Information under the control of Virtru or its agents or subcontractors’, Virtru agrees to perform any reasonable mitigation and agrees to be responsible for the: (i) reasonable cost of providing required notice to individuals affected by the Breach of Protected Health Information; (ii) reasonable cost of providing required notice to government agencies, credit bureaus, and/or other required entities; and (iii) non-appealable fines or penalties assessed by governments or regulators. Any costs or expenses borne by Virtru pursuant to this subsection (b) shall not exceed the fees actually paid to Virtru by Covered Entity over the preceding twelve (12) months. 8. MISCELLANEOUS. (a) Effectiveness. This Agreement is effective on the effective date of the Services Agreement (such applicable date, the “Effective Date”). (b) Certain Amendments. Virtru agrees to take such reasonable action as necessary to amend this Agreement from time to time to comply with the requirements of any HIPAA Rules, as reasonably requested by Covered Entity. If Virtru disagrees with any such amendment proposed by Covered Entity, it shall so notify Covered Entity in writing no later than fifteen (15) business days after receipt of Covered Entity’s notice of the amendment. If the parties are unable to agree on an amendment, the proposed amendment shall not become effective and Covered Entity may, at its option, terminate the Services Agreement. (c) Certain Rules of Construction. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended, and as of its effective date. Any ambiguity in this Agreement shall be resolved to permit compliance with the HIPAA Rules. The terms and conditions of this Agreement shall override and control any conflicting term or condition of the Services Agreement. All non-conflicting terms and conditions of the Services Agreement remain in full force and effect. (d) Ownership of Protected Health Information. Any Protected Health Information provided by Covered Entity, its employees, agents, consultants, Subcontractors or business associates to Virtru, or created, obtained, procured, used or accessed by Virtru in Covered Entity’s name or on Covered Entity’s behalf, shall, as between the parties to this Agreement, at all times be and remain the sole property of Covered Entity, and Virtru shall not have or obtain any rights therein except as stated herein or in the Services Agreement. (e) Notices. Any notice, request, demand or other communication required or permitted hereunder shall be in writing, shall reference this Agreement and shall be deemed to be properly given: (a) when delivered personally; (b) 4 va-423934 seven (7) days after having been sent by registered or certified mail, return receipt requested, postage prepaid; or (c) two (2) business days after deposit with a private industry express courier, with written confirmation of receipt. All notices shall be sent to Scott Lingle, 500 Broadway, Post Office Box 850, Eagle, CO 81631, Telephone: 970-328-3581, with a copy to Eagle County Attorney, 500 Broadway, Post Office Box 850, Eagle, CO, 81631, Telephone: 970-328-8685, E-Mail: atty@eaglecounty.us. (f) Assignment. This Agreement may not be assigned, in whole or part, whether voluntarily, by operation of law or otherwise, by Covered Entity without the prior written consent of Virtru. Subject to the preceding sentence, the rights and liabilities of the parties hereto shall bind, and inure to the benefit of, their respective assignees and successors and is binding on the parties and their successors and assigns. Any attempted assignment other than in accordance with this Section 8(f) shall be null and void. (g) Governing Law, Jurisdiction and Venue.This Agreement is to be construed in accordance with and governed by the internal laws of Colorado. Any legal suit, action or proceeding arising out of or relating to this Agreement shall be commenced in the District Court of Eagle County, Colorado and each party hereto irrevocably submits to the exclusive jurisdiction and venue of any such court in any such suit, action or proceeding. (h) Severability. If the application of any provision of this Agreement to any particular facts or circumstances shall be held to be invalid or unenforceable by an arbitration panel or a court of competent jurisdiction, then (a) the validity and enforceability of such provision as applied to any other particular facts or circumstances and the validity of other provisions of this Agreement shall not in any way be affected or impaired thereby and (b) such provision shall be enforced to the maximum extent possible so as to effect the intent of the parties and reformed without further action by the parties to the extent necessary to make such provision valid and enforceable. (i) Relationship of Parties. It is expressly agreed that Virtru, its divisions, and its affiliates, including its employees and Subcontractors, are performing the services under this Agreement as independent contractors for Covered Entity. Neither Virtru nor of its affiliates, officers, directors, employees or Subcontractors is an employee or agent of Covered Entity. Nothing in this Agreement shall be construed to create (i) a partnership, joint venture or other joint business relationship between the parties or any of their affiliates, or (ii) an agency relationship for purposes of the HITECH Act. [Signatures on next page(s).] 5 va-423934 IN WITNESS WHEREOF, the parties hereto have caused this Agreement to be executed by their respective duly authorized officers or agents as of the Effective Date. VIRTRU:COVEREDENTITY: Virtru Corporation, a Delaware corporation COUNTY OF EAGLE, STATE OF COLORADO By and Though its COUNTY MANAGER BY: BY: ____________________________ NAME:NAME:JEFF SHROLL, COUNTY MANAGER TITLE: ADDRESS:1130 Connecticut Ave., #210 ADDRESS: 500 Broadway Washington, D.C. 20036 EAGLE, CO 81631 6 va-423934 *UDQG7RWDO 7RWDO3ULFH 'LVFRXQW 6XEWRWDO4XRWHIRU(DJOH&RXQW\WRSURFXUHWKHOLVWHG 9LUWUXSURGXFWVIRUDWKUHH\HDUWHUP 3OHDVHVXEPLWDVLJQHGTXRWHRUD32WR VLSD#FRVLSDJRYWRSURFXUH 'HVFULSWLRQ 32%R[ %URDGZD\6WUHHW (DJOH&2 6KLS7R (DJOH&RXQW\6KLS7R1DPH 32%R[ %URDGZD\6WUHHW (DJOH&2 86$ %LOO7R (DJOH&RXQW\%LOO7R1DPH VFRWWOLQJOH#HDJOHFRXQW\XV(PDLO 3KRQH 6FRWW/LQJOH&RQWDFW1DPH EHWK#FRVLSDJRY(PDLO 3KRQH %HWK-XVWLFH3UHSDUHG%\ 4XRWH1XPEHU ([SLUDWLRQ'DWH &UHDWHG'DWH%URDGZD\ 6XLWH 'HQYHU&2 86 &RPSDQ\$GGUHVV 6WDWHZLGH,QWHUQHW3RUWDO$XWKRULW\6,3$ 3URGXFW /LQH,WHP'HVFULSWLRQ 6DOHV3ULFH 4XDQWLW\7RWDO3ULFH 9LUWUX(QWHUSULVH'DWD3URWHFWLRQ3ODWIRUP <HDU 9LUWUX(QWHUSULVH'DWD3URWHFWLRQ*DWHZD\9LUWUX+RVWHG(QGSRLQW(PDLO )LOH <HDU 9LUWUX(QWHUSULVH'DWD3URWHFWLRQ3ODWIRUP <HDU 9LUWUX(QWHUSULVH'DWD3URWHFWLRQ*DWHZD\9LUWUX+RVWHG(QGSRLQW(PDLO )LOH <HDU 9LUWUX(QWHUSULVH'DWD3URWHFWLRQ3ODWIRUP <HDU 9LUWUX(QWHUSULVH'DWD3URWHFWLRQ*DWHZD\9LUWUX+RVWHG(QGSRLQW(PDLO )LOH <HDU "EEJUJPOBM%FUBJMT 3OHDVHQRWH/LFHQVHIHHVDUHQRWUHIXQGDEOH 3OHDVHQRWHb/LFHQVHIHHVPD\LQFUHDVHDWQH[WUHQHZDO 3OHDVHQRWH7KLVLVQRWDQLQYRLFH3OHDVHGRQRWVXEPLWSD\PHQWXQWLO\RXKDYHUHFHLYHGDQLQYRLFHb 7HUPVDQG&RQGLWLRQVbKWWSVZZZYLUWUXFRPWHUPVRIVHUYLFH %\VLJQLQJWKLVTXRWH\RXDUHDJUHHLQJWRSXUFKDVHbWKHDERYHPHQWLRQHGOLFHQVHVRUVHUYLFHVDQG\RXZLOOEHUHVSRQVLEOHIRUSD\PHQW XSRQLQYRLFLQJ<RXDOVRFHUWLI\bWKDW\RXKDYHDXWKRULW\WRHQWHULQWRWKLVDJUHHPHQWEHWZHHQ\RXUHQWLW\DQG6,3$ $GGLWLRQDO7HUPV &RPSHQVDWLRQ&RXQW\VKDOOFRPSHQVDWH&RQWUDFWRUIRUWKHSHUIRUPDQFHRIWKH6HUYLFHVLQDFFRUGDQFHZLWKWKHIHH VFKHGXOHVHWIRUWKLQDERYH7RWDOFRPSHQVDWLRQIRUDOO6HUYLFHVXQGHUWKLV$JUHHPHQWVKDOOQRWH[FHHG &RQWUDFWRUVKDOOQRWEHHQWLWOHGWRELOODWRYHUWLPHDQGRUGRXEOHWLPHUDWHVIRUZRUNGRQHRXWVLGHRIQRUPDOEXVLQHVVKRXUV XQOHVVVSHFLILFDOO\DXWKRUL]HGLQZULWLQJE\&RXQW\ 1RWZLWKVWDQGLQJDQ\WKLQJWRWKHFRQWUDU\FRQWDLQHGLQWKLV$JUHHPHQW&RXQW\VKDOOKDYHQRREOLJDWLRQVXQGHUWKLV $JUHHPHQWDIWHUQRUVKDOODQ\SD\PHQWVEHPDGHWR&RQWUDFWRULQUHVSHFWRIDQ\SHULRGDIWHU'HFHPEHURIDQ\\HDU ZLWKRXWDQDSSURSULDWLRQWKHUHIRUE\&RXQW\LQDFFRUGDQFHZLWKDEXGJHWDGRSWHGE\WKH%RDUGRI&RXQW\&RPPLVVLRQHUV LQFRPSOLDQFHZLWK$UWLFOHWLWOHRIWKH&RORUDGR5HYLVHG6WDWXWHVWKH/RFDO*RYHUQPHQW%XGJHW/DZ&56 HWVHTDQGWKH7$%25$PHQGPHQW&RORUDGR&RQVWLWXWLRQ$UWLFOH;6HF $FFHSWDQFH,QIRUPDWLRQ 'DWHBBBBBBBBBBBBBBBBBBBBB &2817<2)($*/(67$7(2) &2/25$'2%\DQG7KURXJK,WV&2817< 0$1$*(5 %\ BBBBBBBBBBBBBBBBBBBBBBBBBBBBBB -HII6KUROO&RXQW\0DQDJHU 9HQXH-XULVGLFWLRQDQG$SSOLFDEOH/DZ$Q\DQGDOOFODLPVGLVSXWHVRUFRQWURYHUVLHVUHODWHGWRWKLV$JUHHPHQWRUEUHDFK WKHUHRIVKDOOEHOLWLJDWHGLQWKH'LVWULFW&RXUWIRU(DJOH&RXQW\&RORUDGRZKLFKVKDOOEHWKHVROHDQGH[FOXVLYHIRUXPIRUVXFK OLWLJDWLRQ7KLV$JUHHPHQWVKDOOEHFRQVWUXHGDQGLQWHUSUHWHGXQGHUDQGVKDOOEHJRYHUQHGE\WKHODZVRIWKH6WDWHRI &RORUDGR ,QVXUDQFH&RQWUDFWRUDJUHHVWRSURYLGHDQGPDLQWDLQDW&RQWUDFWRU¶VVROHFRVWDQGH[SHQVHWKHIROORZLQJLQVXUDQFH FRYHUDJHZLWKOLPLWVRIOLDELOLW\QRWOHVVWKDQWKRVHVWDWHGEHORZ D &RPPHUFLDO*HQHUDO/LDELOLW\FRYHUDJHWRLQFOXGHSUHPLVHVDQGRSHUDWLRQVSHUVRQDODGYHUWLVLQJLQMXU\SURGXFWV FRPSOHWHGRSHUDWLRQVEURDGIRUPSURSHUW\GDPDJHZLWKOLPLWVRIOLDELOLW\QRWOHVVWKDQSHURFFXUUHQFHDQG DJJUHJDWHOLPLWV E 3URIHVVLRQDO/LDELOLW\(UURUVDQG2PLVVLRQVLQFOXGLQJ&\EHU/LDELOLW\ZLWKSULRUDFWVFRYHUDJHIRUDOOGHOLYHUDEOHV 6HUYLFHVDQGDGGLWLRQDOVHUYLFHVUHTXLUHGKHUHXQGHULQDIRUPDQGZLWKLQVXUHURULQVXUHUVVDWLVIDFWRU\WR&RXQW\ZLWK OLPLWVRIOLDELOLW\RIQRWOHVVWKDQSHUFODLPDQGLQWKHDJJUHJDWH7KHLQVXUDQFHVKDOOSURYLGH FRYHUDJHIRULOLDELOLW\DULVLQJIURPWKHIWGLVVHPLQDWLRQDQGRUXVHRIFRQILGHQWLDOLQIRUPDWLRQVWRUHGRUWUDQVPLWWHGLQ HOHFWURQLFIRUPLL1HWZRUN6HFXULW\/LDELOLW\DULVLQJIURPXQDXWKRUL]HGDFFHVVWRXVHRIRUWDPSHULQJZLWKFRPSXWHU V\VWHPVLQFOXGLQJKDFNHUDWWDFNVLQDELOLW\RIDQDXWKRUL]HGWKLUGSDUW\WRJDLQDFFHVVWR\RXU6RIWZDUHRU6HUYLFHV LQFOXGLQJGHQLDORIDFFHVVRU6HUYLFHVXQOHVVFDXVHGE\DPHFKDQLFDORUHOHFWULFDOIDLOXUHLLLOLDELOLW\DULVLQJIURPWKH LQWURGXFWLRQRIDFRPSXWHUYLUXVLQWRRURWKHUZLVHFDXVLQJGDPDJHWR&RXQW\RUDWKLUGSHUVRQ¶VFRPSXWHUFRPSXWHU V\VWHPQHWZRUNRUVLPLODUFRPSXWHUUHODWHGSURSHUW\DQGWKHGDWDVRIWZDUHDQGSURJUDPVWKHUHRQ F &ULPH&RYHUDJHVKDOOLQFOXGHHPSOR\HHGLVKRQHVW\IRUJHU\RUDOWHUDWLRQDQGFRPSXWHUIUDXG,I&RQVXOWDQWLVSK\VLFDOO\ ORFDWHGRQ&RXQW\SUHPLVHVWKLUGSDUW\ILGHOLW\FRYHUDJHH[WHQVLRQVKDOODSSO\7KHSROLF\VKDOOLQFOXGHFRYHUDJHIRUDOO GLUHFWRUVRIILFHUVDQGHPSOR\HHVRIWKH&RQVXOWDQW7KHERQGRUSROLF\VKDOOLQFOXGHFRYHUDJHIRUH[WHQGHGWKHIWDQG P\VWHULRXVGLVDSSHDUDQFH7KHERQGRUSROLF\VKDOOQRWFRQWDLQDFRQGLWLRQUHTXLULQJDQDUUHVWRUFRQYHUVLRQ/LPLWV VKDOOEHDPLQLPXPRISHUORVV &RQILGHQWLDO,QIRUPDWLRQ7KH3DUWLHVXQGHUVWDQG(DJOH&RXQW\LVVXEMHFWWRWKH&RORUDGR2SHQ5HFRUGV$FW&56 HWVHT(DJOH&RXQW\ZLOOUHVSRQGWRUHFRUGVUHTXHVWDVSURYLGHGE\ODZ7KHWHUPVRIWKLVDJUHHPHQWZLOOEH SXEOLVKHGRQWKH&RXQW\:HEVLWH /LPLWDWLRQRIOLDELOLW\6HFWLRQRIWKHWHUPVRIVHUYLFHLVKHUHE\DPHQGHGWRWKHH[WHQGDOORZDEOHE\ODZ9,5758¶6 (17,5(/,$%,/,7<$5,6,1*)520255(/$7,1*727+,6$*5((0(17257+(68%-(&7+(5(2)81'(5$1< /(*$/7+(25<:+(7+(5,1&2175$&77257,1'(01,7<2527+(5:,6(,)$1<6+$//127(;&(('$1< ,1685$1&(&29(5$*(65(48,5('81'(56(&7,21 9,5758 9LUWUX&RUSRUDWLRQD'HODZDUHFRUSRUDWLRQ %<BBBBBBBBBBBBBBBBBBBBBBBBBBBB 1$0( 7,7/( $''5(66&RQQHFWLFXW$YH$ :DVKLQJWRQ'&(