Terms and Conditions

Sansio Subscription Agreement and Business Associate Agreement

SUBSCRIPTION AGREEMENT

This HealthEMS® Subscription Agreement (the “Agreement”), is between Sansio, Inc., a Delaware corporation, (“Sansio”), and the undersigned customer (“Customer”).

1. HealthEMS® SYSTEM. (“System”)

1.1 Licensed Software. The Licensed Software is the HealthEMS® software, a remote-hosted, web-based organization management solution (“Licensed Software”) for the Fire/Emergency Medical Services industry. Sansio owns all rights to this Licensed Software, including the software comprising Data Collection Services as described in Section 1.4, and Extensions as described in Section 1.5.

1.2 Professional Services. Sansio makes available numerous Professional Services (“Professional Services”) as set forth in Section 3 to help maximize the Customer’s investment in the System.

1.3 Data Center Services. Data Center Services (“Data Center Services”) are comprised of infrastructure and services that host, manage, and support the Licensed Software. Sansio is responsible for Data Center Services as defined in Section 2.3 up to the point of external Internet access. It is the responsibility of Customer to procure applicable hardware, software, and Internet connectivity with sufficient bandwidth to meet user demands.

1.4 Data Collection Services. Sansio provides flexible point-of-service (POS) data collection solutions and a secure file transfer program that uploads data via the Internet (“Data Collection Services”). Certain Data Collection Services require Customer to procure and support hardware that meets the specifications set forth by Sansio.

1.5 Extensions. Sansio may make available optional Extensions (“Extensions”) designed to extend the functionality of Licensed Software. Extensions may include, but not be limited to, myPatientEncounters, RevNet, XchangeER, SanFax, and Data Xport for integration with third parties. Third parties may include, but not be limited to, billing vendors, payers, clearinghouses, CAD (Computer-Aided Dispatch) vendors, medical devices (such as ECG), HIE’s, state reporting systems, and hospitals. Customer is responsible for acquiring licenses and paying fees to applicable third parties as required. Extension descriptions, terms, and applicable fees for setup and use, are as set forth in Extension Addendums and/or Schedule A, all of which form part of this Agreement.

1.6 Documentation. The term Documentation (“Documentation”) means any users’ manual(s), specifications, any documents attached to or referenced in this Agreement, any RFP response, proposal or similar document provided by Sansio and other materials accompanying the System or any of its components.

2. SYSTEM SERVICES.

2.1 Account Management Services. Sansio will assign a primary account manager to assist Customer in their commercial relationship with Sansio (“Account Management Services”). Account Management Services include, but may not be limited to, informing Customer of new Extensions or System features, identifying needs for supplemental assistance from Professional Services, advocating for Customer needs, and contract management.

2.2 Solution Center Services. Sansio’s Solution Center Specialists provide telephone and web-based Solution Center Services (“Application Support”) at no additional cost to Customers who are active Users. Application Support is defined as help with application navigation or troubleshooting arising from the use of the System, as designed. Application Support excludes supporting Customer procured hardware, OS, and Internet connectivity.

2.3 Data Center Services.

2.3.1 System Maintenance. Sansio will provide software updates, upgrades, and enhancements at the same time as generally available to other licensees. Sansio is responsible for deploying upgrades and enhancements for Customer’s use at no additional charge to Customer. Customer may not have access to the System during times of scheduled maintenance. Prior to providing any update, upgrade, or enhancement, Sansio shall have used commercially reasonable efforts to test such item to ensure that it functions properly and in conformance with all specifications and warranties.

2.3.2 Backups. Backups of hosted applications and data are performed on a nightly (incremental) and weekly (full) basis. Backups will be scheduled at times so as to provide minimal impact to Customer’s business activity. Sansio will maintain at least one full backup copy until after the next backup is performed. Backup will be maintained on a rolling basis and Sansio will not be responsible for archiving more than the most recent full backup. Sansio will take commercially reasonable steps to maintain data integrity in any backup, but Sansio is not responsible for loss of data or data integrity so long as Sansio has performed the backup in a commercially reasonable manner.

2.3.3 System Access Level. Sansio is not responsible for loss of access to the Data Center for reasons that are beyond Sansio’s reasonable control. With the exception for loss of access that is beyond Sansio’s reasonable control, Sansio shall maintain a level of access to the Data Center (excluding periods of emergency maintenance) of 99.9% Access Availability (“Access Availability”), 24 hours a day, 7 days a week, including holidays. System Access Unavailable (“System Access Unavailable”) is defined as the reported unscheduled inability of all subscribed users of Customer to access the Data Center and verification that the problem is within the Data Center. Total System Access Unavailable minutes are calculated by adding the period of time beginning when the Customer reports System Access Unavailable to Sansio’s Solution Center and ending when Sansio’s Solution Center corrects the unavailable status and closes the incident with the Customer. If the Customer does not initiate a Solution Center call, Sansio will not be obligated to issue a System Access Unavailable Credit (“System Access Unavailable Credit”) for the System Access Unavailability. Sansio will compute any System Access Unavailability on a quarterly average basis and apply a System Access Unavailable Credit to the next Customer invoice in the event that the stated Access Availability commitment was not met. This occurs on a pro-rated basis limited to the maximum of the total invoice charges based on the total billing period. System Access Unavailable Credits will not be given for events occurring during any period in which the Customer’s account has an undisputed past due balance or the Customer is otherwise in breach of Agreement. The System Access Unavailable Credit will be calculated according to the following schedule:

99.9% - 100% Covered under Agreement
99.5% - 99.89% (1) day credit
98.5% - 99.49% (2) days credit
97.5% - 98.49% (1) week credit
96.5% - 95.00% (2) weeks credit
0% - 94.49% (1) month credit

 

3. PROFESSIONAL SERVICES. Sansio shall provide Professional Services on a fee-for-service basis (“Professional Services”) to assist the Customer with successful implementation and effective utilization of the System. Any Professional Services performed by Sansio, including without limitation to, consulting, mapping, migration, configuration, and implementation services, shall be performed under a statement of work defined in an applicable Professional Services Engagement and shall be subject to the terms and conditions in this Subscription Agreement.

3.1 Project Manager Services. Sansio Project Managers provide Professional Services on a fee-for-service basis, assisting Customers to operationalize the solution to meet specific organizational objectives (“Project Manager Services”). Project Manager Services include, but may not be limited to, Training, Implementation, and Consulting that requires specific knowledge of the Customer’s data set, research goals, and operational objectives. Project Manager Services may be provided web-based, at Sansio offices, or onsite at Customer location.

3.2 Resources to be Provided by Customer. Customer shall provide, maintain and make available to Sansio, at Customer’s expense and in a timely manner, the resources described in this section 3, the Statement of Work, and such other additional resources as Sansio may from time-to-time reasonably request in connection with Sansio performance of the Services. Delays in the provision of these resources may result in delays in the performance of the Services, or an increase in the Price. Customer will designate qualified Customer personnel or representatives to consult with Sansio on a regular basis in connection with the Services. Customer will furnish such documentation and other information as is reasonably necessary to perform the Services. Customer shall furnish access to Customer’s network, premises, and appropriate workspace for any Sansio personnel working at Customer’s premises, as necessary for performance of those portions of the Services to be performed at Customer’s premises. Customer shall meet any additional assumptions noted on the Statement of Work.

3.3 Intellectual Property. Customer and Sansio shall each retain ownership of, and all right, title and interest in and to, their respective pre-existing Intellectual Property, and no license therein, whether express or implied, is granted by this Agreement or as a result of the Professional Services performed hereunder. To the extent the parties wish to grant to the other rights or interests in pre-existing or developed Intellectual Property, separate license agreements on mutually acceptable terms will be executed. The Professional Services performed, code developed, and any Intellectual Property produced pursuant to this Subscription Agreement or any Statement of Work are not “works for hire.” As used herein, “Intellectual Property” shall mean inventions (whether or not patentable), works of authorship, trade secrets, copyright, techniques, know-how, ideas, concepts, algorithms, and other intellectual property incorporated into any Statement of Work whether or not first created or developed by Sansio in providing the Services.

4. CUSTOMER REQUIREMENTS.

4.1 Internet Connectivity. Customer must provide Internet connectivity to the System web site with sufficient bandwidth to meet Customer’s utilization demands. System performance is a function of bandwidth and latency time from client desktop to the System web site. Customer must connect with Sansio supported browsers and client software.

4.2 Named User Identification and Authentication. The System requires a unique user name and password for each authorized individual Customer representative (“Named User”) to access the System via Sansio's Data Center(s). Customer is responsible for administration and management of Named User accounts, including the appropriate technical and administrative safeguards to prevent unauthorized access. Sansio shall have no responsibility for unauthorized access to Customer's Data or Confidential Information that results from Customer's failure to prevent unauthorized access.

5. LICENSE AND FEES.

5.1 License. During the term of this Agreement, and subject to the terms and conditions of this Agreement, Sansio hereby grants to Customer a non- exclusive, non-transferable (except as provided in this Agreement) license to access and use the System.

5.2 Fees.

5.2.1 Activation Fee. The Activation Fee set forth in Schedule A is non- refundable and due upon execution of Schedule A.

5.2.2 Subscription Fees. Customer agrees to pay Subscription Fees as set forth in this Section and Schedule A. Sansio will invoice Customer for Monthly Subscription Fees as set forth in Schedule A during the Subscription Term.

5.2.2.1 Incident Fees. Customer’s pricing is identified in Schedule A based on Customer projections of incident volume (“Estimated Annual Incident Volume”). In the event the Customer’s actual annual incident volume varies from Estimated Annual Incident Volume, as identified in Schedule A, by more than 5%, Sansio reserves the right to adjust the Subscription Fees, applicable to actual incident volume, provided the Customer is given 45 days prior written notice of such adjustment. Subscription Fees include: Data Center Services, Data Collection Services, Application Licensing, System Maintenance, and Upgrades, Application Support, Integration Fees, and optional Extension usage. Should Customer not agree to adjustment, Customer may choose to terminate the Agreement as set forth in Section 6.3.

5.2.2.2 RevNet Fees. Customer’s pricing is identified in Schedule A based on Customer projections of annual net collections. In the event the Customer’s actual annual net collections varies from the annual net collections identified in Schedule A, by more than 5%, Sansio reserves the right to make adjustments to the Subscription Fees, applicable to actual annual net collections, provided the Customer is given 45 days prior written notice of such adjustment. Subscription Fees include: Data Center Services, Data Collection Services, Application Licensing, System Maintenance, and Upgrades, Application Support, Integration Fees, and optional Extension usage. Should Customer not agree to adjustment, Customer may choose to terminate the Agreement as set forth in Section 6.3.

5.2.2.3 Subscription Fee Invoicing. Following Term Start Date, Sansio will invoice the Customer as set forth in Schedule A. Customer will be invoiced annually, bi-annually or quarterly for Subscription Fees 30 days in advance, due and payable by the first of the month during the Term identified in Section 6 and in Schedule A.

5.2.2.4 Optional Extension Fees. Customer agrees to pay optional Extension fees as set forth in Extension Addendum(s) and/or Schedule A. Optional Extension fees are based on the actual transaction usage for the optional Extensions.

5.2.2.5 Optional Extension Fee Invoicing. Optional Extension fees will be invoiced monthly for the previous month's actual use at the Unit Price listed in Schedule A or applicable Extension Addendum.

5.2.3 Professional Services Fees. Customer agrees to pay Professional Services fees as set forth in applicable Professional Services engagements. Payment terms and conditions are as follows:

5.2.3.1 Professional Services Invoicing. Professional Services will be invoiced monthly for the previous month's actual use at the Unit Price listed in applicable Professional Services engagements. Professional Services time will be logged and made electronically available to Customer with a minimum activity time of fifteen (15) minutes, rounded up to the nearest fifteen (15) minute increment, for hourly-based Professional Services.

5.2.3.2 Cancellations. Cancellation within 24 hours of scheduled Professional Services appointments will result in a minimum charge of one (1) hour for Web-based Professional Services or two (2) days for Onsite Professional Services plus any non-cancellable expenses.

5.2.3.3 Modifications. In the event that Professional Services result in greater Sansio duties than contemplated by the Statement of Work, Customer will work closely and in good faith with Sansio to modify the Statement of Work to ensure that the Customer’s requirements are addressed and Sansio’s fees shall be adjusted to reflect increased Customer requirements. Unless specifically addressed in the Statement of Work, all travel and expenses incurred will be extra and billed at the time of incurrence. Invoiced amounts are due and payable 30 days from the date of the invoice.

5.2.3.4 Travel and Expenses. Sansio shall invoice Customer for such reimbursable expenses, as authorized with receipt of signed Professional Services Engagements. Actual charges will be based upon hours consumed and expenses incurred in engagement. Travel Fees, as set forth on the Professional Services Engagements, include but may not be limited to airfare, lodging, ground transportation, staff per diem, and other related travel expenses.

5.2.4 Taxes. Sansio is required to collect sales tax from products and services provided to customers in certain states. Sansio reserves the right to invoice the Customer those taxes now or at any time in the future, including interest and penalties imposed by any governmental authority which are imposed upon the sale or delivery of items purchased or licensed. Customer is required to provide a tax exempt status form in order for Sansio to correctly identify tax status. If a certificate of exemption or similar document or proceeding is to be made in order to exempt the sale from sales or use tax liability, Customer will obtain and purchase such certificate, document or proceeding.

5.2.5 Payment. All invoiced fees shall be due and payable within 30 days of the date of an invoice. For Professional Services, invoices shall be sent either monthly or upon completion of milestones (as defined in the statement of work).

5.2.6 Default. Customer will be considered delinquent if payment in full is not received 30 days from the date of the invoice. Sansio reserves the right to suspend or terminate this Agreement and Customer access to the Service if the Customer account becomes delinquent and is not cured within 10 days of notice of delinquency. Customer will continue to be charged and hereby agrees to pay for Service during any period of suspension. Customer’s failure to pay any invoice after this 10-day period shall constitute a material default hereunder and shall entitle Sansio to exercise any and all rights and remedies provided herein or at law including a suspension of Services under the Agreement. In the event of a dispute between the parties that does not result in a termination of the Agreement, Customer agrees to make all Monthly Service Fee payments due under the Agreement pending the resolution of the dispute.

5.2.7 Interests and Costs. Undisputed amounts not paid when due will bear interest at the rate of 1.5% on the unpaid balance each month, or such lesser rate of interest as shall be the maximum amount chargeable with respect to this account under the law in effect in the state of Customer’s location. In the event of non-payment or default by Customer, Customer agrees that all costs of enforcement and collection, including reasonable attorneys’ fees, will be paid by Customer.

6. TERM AND TERMINATION.

6.1 Term Start Date. Customer’s Term Start Date is the date of customer signature date on Schedule A, or, in the case of renewal, the first day after expiration of previous Term. The Term Start Date represents the first day of the Subscription Term.

6.2 Term Initiation. This Agreement takes effect on the date of last signature date on Schedule A and continues through the conclusion of the Subscription Term or any subsequent Renewal Subscription Term. The Subscription Term (the “Term”) begins on the Term Start Date and ends at the conclusion of the Term as noted in Schedule A or any subsequent renewal Schedule A’s. Subscription Fees commence on the Term Start Date and continue throughout the Term of this Agreement. Upon acceptance of this Agreement, Sansio will provide Customer with an access code to use the Licensed Software via Sansio’s Data Center and the Internet.

6.3 Term Renewal. This Agreement shall automatically renew upon expiration of the then current Term, at the current System price list for the same Term, unless Customer notifies Sansio of its intention of nonrenewal by written notification at least 60 days prior to the end of the then current Term, or unless Sansio requires a new Agreement to be executed by the parties. If Sansio requires a new Agreement, it will be provided to Customer at least 60 days prior to the end of the then current Term. Customer may decline to enter into a new Agreement in its sole and absolute discretion, and if Customer so declines, then Customer shall not be responsible for Early Termination Fees as set forth in Section 6.5.

6.4 Termination. Either party may terminate the Agreement upon the other party’s material breach of this Agreement, if within 30 days of receipt of written notification of breach (10 days in the case of nonpayment), the breaching party has failed to cure its breach. Sansio may terminate Customer’s access to the System immediately upon Termination of the Agreement. In the event of early Termination due to material breach by Customer, Customer shall be responsible for Early Termination Fee per Section 6.5 of this Agreement. In the event of early Termination due to material breach by Sansio, Customer shall not be responsible for Early Termination Fee as set forth in Section 6.5.

Notwithstanding anything in this Section 6 or in this Agreement to the contrary, Customer may terminate this Agreement and Customer obligations hereunder during the initial Term or any subsequent renewal Term, without cause, for any reason, or for no reason, and in Customer’s sole and absolute discretion by payment to Sansio of the Early Termination Fee as set forth in Section 6.5. Sansio acknowledges and agrees that payment of such Early Termination Fee shall be Sansio’s sole remedy therefor. Customer must notify Sansio of its intention for early Termination by written notification at least 90 days before the desired Termination date. Early Termination must occur on a monthly anniversary of the then current Term.

Notwithstanding any term or provision in this Agreement to the contrary, if Customer is current on all payments due to Sansio, upon termination of this Agreement, Sansio will make available to Customer Customer’s raw data in in its then existing, native format for a period of thirty days post termination of this Agreement. Additionally, Sansio can produce for Customer an export of their data in its then existing, native format and provide that export to Customer within 90 days of Termination or expiration of this Agreement for a fee of $500. Requests for Customer data in a form other than its existing format shall be performed under a mutually agreeable statement of work. Customer directs, and Sansio shall delete all Customer Data upon the earlier of (a) delivery to Customer or (b) 90 days from the date of termination of this Agreement.

6.5 Early Termination Fee. Upon early Termination for breach by Customer or  for  such  other  early  Termination  as  described  in  Section  6.4  of  this Agreement, Sansio reserves the right to charge Customer a pro-rated Early Termination Fee based on the percentage of the current Term utilized. The percentage will be applied to the remaining Subscription Fees for the current Term  as  selected  by  Customer  on  Schedule  A.  Sansio  acknowledges  and agrees the Early Termination Fee will be Sansio’s sole remedy therefor.

Early Termination Fee Example

Current Term Length 36 months
Desired Early Termination Date End of [Month] 30
Percentage of Term Utilized 83%
Pro-rated Termination Percentage 17%
Monthly Subscription Fee $2,000 (Per Schedule A)
Remaining Subscription Fees per current Term $12,000 (6 months at $2,000 per month)
Early Termination Fee $2,040 (17% of $12,000)

 

7. PROPRIETARY RIGHTS OF SANSIO IN THE LICENSED SOFTWARE AND DOCUMENTATION.

7.1 Nature of Rights and Title. Customer acknowledges that the System and Documentation supplied by Sansio to Customer are proprietary and shall remain the property of Sansio and nothing in this Agreement shall be construed as transferring any aspect of such rights to Customer or any third party. Any changes, additions, and enhancements in the form of new or partial programs or Documentation as may be provided under this Agreement shall remain the proprietary property of Sansio. Customer agrees with Sansio that the System, Documentation and all other proprietary information or data supplied by Sansio are trade secrets of Sansio, are protected by civil and criminal law, and by the law of copyright, are very valuable to Sansio, and that their use and disclosure must be carefully and continuously controlled. Customer further understands that operator manuals, training aids, and other written materials regarding the System are subject to the Copyright Act of the United States. Customer shall keep each and every item to which Sansio retains title free and clear of all claims, liens and encumbrances except those of Sansio and any act of Customer, voluntary or involuntary, purporting to create a claim, lien or encumbrance on such an item shall be void.

7.2 Unauthorized Acts. Customer agrees to notify Sansio promptly of the unauthorized possession, use, or knowledge of any item supplied under this license and of other proprietary information made available to Customer under this Agreement, by any person or organization not authorized by this Agreement to have such possession, use or knowledge. Customer will promptly furnish full details of such possession, use or knowledge to Sansio, will assist in preventing the continuation or recurrence of such possession, use or knowledge, and will cooperate with Sansio in any litigation against third parties deemed necessary by Sansio to protect its proprietary rights. Customer's compliance with this subparagraph shall not be construed in any way as a waiver of Sansio’s right, if any, to recover damages or obtain other relief against Customer for its negligent or intentional harm to Sansio’s proprietary rights, or for breach of contractual rights.

7.3 Remedies. If Customer attempts to use, copy, license, sub-license, or otherwise transfer the Licensed Software or access to the System supplied by Sansio under this Agreement, in a manner contrary to the terms of this Agreement or in competition with Sansio or in derogation of Sansio’s proprietary rights, whether these rights are explicitly stated, determined by law, or otherwise, Sansio shall have the right to injunctive relief enjoining such action, in addition to any other remedies available. Customer acknowledges that other remedies are inadequate.

7.4 Infringement Indemnification. Sansio shall indemnify and defend Customer from and against any and all loss, cost, damage or liability, including reasonable attorneys’ fees and expenses, arising out of or relating to any third party claim or cause of action for patent, copyright, and/or other intellectual property infringement (“Infringement Claim”) asserted against Customer by virtue of the System, Software or Documentation or Customer’s use or possession of the System, Software or Documentation pursuant to this Agreement. Sansio shall defend and settle at its sole expense all suits and proceedings arising out of the foregoing, provided that Customer gives Sansio reasonably prompt notice of any such Infringement Claim of which it learns. In all events, Customer shall have the right to participate at its own expense in the defense of any such suit or proceeding through counsel of its own choosing. In the event any Infringement Claim is asserted by a third party with respect to the System or Customer’s use thereof, then and in that event, Customer may terminate its use of the System and/or this Agreement without payment of any Early Termination Fee.

8. CONFIDENTIALITY AND DATA USE.

8.1 Confidential Information. The parties agree that any Confidential Information provided under this Agreement shall be held and maintained in strict confidence. Each party agrees to protect the Confidential Information of the other party in a manner consistent with the protections used to protect its own Confidential Information, including, without limitation, informing its employees of its obligations under this Agreement and taking such steps as are reasonable in the circumstances, or as reasonably requested by the other party, to prevent any unauthorized disclosure, copying or use of Confidential Information. Confidential Information means any proprietary material that the disclosing party designates as confidential (“Confidential Information”). Confidential Information shall also include, without limitation, all information in any form which relates to the business, expertise and/or operations of the disclosing party, including without limitation, information in any form generally understood to be trade secret, proprietary or confidential and/or that is related to products and services, commercial and financial information, system functionality charts and descriptions, program code logic, trade secret information, and information about health care providers, customers and/or business partners. Confidential Information shall also include Protected Health Information as defined in HIPAA and its rules and regulations promulgated here under. Sansio will not use Confidential Information except as expressly provided in this Agreement. Confidential Information does not include information that (i) is already known to the receiving party at the time it is disclosed and has not been obtained wrongfully, (ii) becomes publicly known without the fault of the receiving party, (iii) is independently developed by the receiving party, (iv) is approved for release in writing by the disclosing party, (v) is disclosed without restriction by the disclosing party to a third party, or (vi) is disclosed pursuant to applicable statutory or other legal or accreditation obligation beyond the control of the receiving party.

8.2 Unauthorized Disclosure. The recipient of any Confidential Information shall, upon discovery of any unauthorized use or disclosure of such Confidential Information, or any other breach of these confidentiality obligations by the recipient, fully cooperate with the disclosing party to assist the disclosing party to regain possession of the Confidential Information and prevent the further unauthorized use or disclosure of the Confidential Information.

8.3 Remedies. The parties acknowledge and agree that in the event of a breach of this Section 8 the nonbreaching party will suffer irreparable injuries not compensable by money damages alone and therefore the non-breaching party will not have an adequate remedy at law. The non-breaching party shall be entitled to seek injunctive relief without the necessity of posting any bond or undertaking to prevent any further breach. Such remedy shall be in addition to any other remedy the non-breaching party may have.

8.4 Data Use. Sansio recognizes the importance in identifying issues and improvements surrounding the functionality, integration, performance, and reliability of the System. Customer agrees that Sansio may collect, maintain, and use technical information related to the System, including but not limited to, its usage, functionality, integration, performance, and reliability. Sansio may use this information to improve its products or to provide customized services or technologies. Customer retains all ownership rights to System data it generates through use of the System during the Term, except that Customer grants Sansio a perpetual, royalty-free license to compile, sell, analyze, use, and distribute de- identified aggregated data to the extent necessary to fulfill Sansio’s obligations under any agreement or for any other lawful purpose. Sansio represents and warrants that it will only employ methods to de-identify the data that do not involve actual disclosure of Protected Health Information to Sansio.

9. LIMITED WARRANTY.

For the duration of this Agreement (the “Warranty Period”), Sansio will checkout, document, and deliver any amendments or alterations to the Licensed Software or other System components that may be required to correct errors which significantly affect performance. This warranty is contingent upon Customer advising Sansio in writing of such errors. Sansio shall not be responsible for maintaining Customer-modified portions of the Licensed Software or other System components. Corrections for difficulties or defects traceable to Customer errors or System changes made by Customer will be billed at standard Sansio’s time and materials rates.

THE LIMITED WARRANTY SET FORTH IN THIS AGREEMENT IS THE ONLY WARRANTY MADE BY SANSIO. SANSIO EXPRESSLY DISCLAIMS, AND CUSTOMER HEREBY EXPRESSLY WAIVES, ALL OTHER WARRANTIES EXPRESS, IMPLIED OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE. SANSIO DOES NOT WARRANT THAT THE LICENSED SOFTWARE OR SYSTEM WILL MEET CUSTOMER’S REQUIREMENTS OR THAT THE OPERATION OF THE LICENSED SOFTWARE WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT, EXCEPT AS REQUIRED HEREIN TO ADDRESS ERRORS THAT SIGNIFICANTLY AFFECT PERFORMANCE, ERRORS IN THE LICENSED SOFTWARE OR SYSTEM WILL BE CORRECTED. SANSIO’S LIMITED WARRANTY IS IN LIEU OF ALL LIABILITIES OR OBLIGATIONS OF SANSIO FOR THE DAMAGES ARISING OUT OF OR IN CONNECTION WITH THE INSTALLATION, USE OR PERFORMANCE OF THE LICENSES SOFTWARE OR SYSTEM.

10. LIMITATION OF LIABILITY.

A PARTY’S LIABILITY FOR ANY ACTIONS, CLAIMS OR DAMAGES ARISING OUT OF OR RESULTING FROM THIS AGREEMENT OR THE SYSTEM IS LIMITED TO THE AMOUNTS PAID BY CUSTOMER IN THE 12-MONTH PERIOD PRECEDING THE DATE ON WHICH THE CLAIM AROSE. IN NO EVENT WILL SANSIO BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL, ECONOMIC, CONSEQUENTIAL OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOST REVENUE, LOST PROFITS, REPLACEMENT GOODS, LOSS OF TECHNOLOGY RIGHTS OR SERVICES, LOSS OR CORRUPTION OF DATA, OR INTERRUPTION OR LOSS OF USE OF SOFTWARE OR ANY PORTION THEREOF REGARDLESS OF THE LEGAL THEORY UNDER WHICH SUCH DAMAGES ARE SOUGHT EVEN IF SANSIO HAS BEEN ADVISED OF THE LIKELIHOOD OF SUCH DAMAGES, AND NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY. NOTWITHSTANDING THE FOREGOING, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT TO THE CONTRARY, NO LIMITATION OF LIABILITY OR LIMITATION OF WARRANTY OR DISCLAIMER SHALL BE APPLICABLE TO CUSTOMER’S BREACH OF ITS OBLIGATIONS UNDER SECTION 5 LICENSE FEES, SECTION 7.4 INFRINGEMENT INDEMNIFICATION, OR TO A PARTY’S BREACH OF ITS OBLIGATIONS UNDER SECTION 8.

11. HIPAA.

The parties understand, acknowledge, and agree that the System provides access to Protected Health Information (“PHI”) pursuant to and in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (“HIPAA”), and the regulations promulgated there under, the HIPAA Privacy Regulations, including, but not limited to, 45 C.F.R. Parts 160 and 164, Subpart A and Subpart E (hereinafter the “Privacy Rule”), and HIPAA Security Regulations, including but not limited to, 45 C.F.R. Parts 160 and 164, Subpart A and Subpart C (hereinafter the “Security Rule”), the Health Information Technology for Economic and Clinical Health Act, as incorporated in the American Recovery and Reinvestment Act of 2009 (the “HITECH Act"), and its implementing regulations and guidance issued by the Secretary of the Department of Health and Human Services (the “Secretary”), and all other applicable state and federal laws, as all amended from time to time, including as amended by the Final Rule of 2013, titled “Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the HITECH and the Genetic Information NonDiscrimination Act (“GINA”) (“Omnibus Rule”).

The Sansio Customer Business Associate Agreement can be found on this same webpage which is hereby incorporated by reference to this Agreement. The parties agree to be bound by the Sansio Customer Business Associate Agreement.

12. GENERAL.

12.1 Assignment. This Agreement, and any related obligation of other party, may not be assigned in whole or in part without the prior written consent of the other party which shall not be unreasonably withheld.

12.2 Amendment. This Agreement can only be modified by a written agreement duly signed by persons authorized to sign agreements on behalf of Customer and of Sansio, and variance from the terms and conditions of this Agreement in any order or other written notification from the Customer will be of no effect.

12.3 Severability. If any provision or provisions of this Agreement shall be held to be invalid, illegal or unenforceable, the validity, legality and enforceability of the remaining provisions shall not in any way be affected or impaired thereby.

12.4 Governing Law. This Agreement will be governed by the laws of the state where the Customer is located.

12.5 Schedules. All schedules are attached hereto and incorporated by reference herein.

12.6 Entire Agreement. Customer acknowledges that its undersigned representative has read this Agreement, understands it, and agrees on behalf of Customer to be bound by its terms and conditions. Further, Customer agrees that this Agreement constitutes the complete and exclusive statement of the agreement between the parties, which supersedes all proposals or prior agreements, oral or written, and all other communications between the parties relating to the subject matter of this Agreement.

12.7 Conflicting Terms. Unless otherwise mutually agreed in writing, in the event that any terms and/or conditions in this Agreement conflict or are inconsistent with any terms and/or conditions in any attached and incorporated agreement, including but not limited to amendments, addendums, exhibits and SOW’s, then the terms and conditions of this Agreement shall control.

12.8 Notices. All notices, demands, requests, and other communications made or required pursuant to the terms of this Agreement shall be in writing and shall be (1) personally delivered, sent by nationally recognized courier service, or sent by certified mail, return receipt requested, and shall be deemed to have been received upon the earlier of actual receipt or five (5) business days after deposit with the nationally recognized courier service or deposit in the mail; (2) sent by facsimile and deemed to have been received on the date of the facsimile confirmation; (3) sent by electronic means and shall be deemed to have been received upon return of a read receipt.

Unless another address for a party has been specified by providing notice as set forth herein, such notices, demands, requests and other communications permitted or allowed under this Agreement must be sent to Customer at the address set forth on the applicable order form and to Sansio at:

Sansio, Inc.

525 South Lake Ave., Suite 405

Duluth, MN 55802 Attn: Legal

BUSINESS ASSOCIATE AGREEMENT

Pursuant to and in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (“HIPAA”), and the regulations promulgated there under, the HIPAA Privacy Regulations, including, but not limited to, 45 C.F.R. Parts 160 and 164, Subpart A and Subpart E  (hereinafter the “Privacy Rule”), and HIPAA Security Regulations, including but not limited to,  45 C.F.R. Parts 160 and 164, Subpart A and Subpart C (hereinafter the “Security Rule”), the Health Information Technology for Economic and Clinical Health Act, as incorporated in the American Recovery and Reinvestment Act of 2009 (the “HITECH Act”), and its implementing regulations and guidance issued by the Secretary of the Department of Health and Human Services (the “Secretary”), and all other applicable state and federal laws, as all amended from time to time, including as amended by the Final Rule of 2013, titled “Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the HITECH and the Genetic Information Non-Discrimination Act (“GINA”) (“Omnibus Rule”), all business associates of entities such as Customer must agree in writing to certain mandatory provisions regarding the use and disclosure of certain Individually Identifiable Health Information.

Sansio and Customer agree that this Agreement replaces in its entirety any previous Business Associate Agreement between the parties and/or Section 12 of any Subscription Agreement executed on or before September 23, 2013. In order to satisfy the above applicable requirements, the Parties agree as follows effective as of the Compliance Date(s):

A. Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the Privacy Rule, Security Rule, the HITECH Act, and the Omnibus Rule:

a. Administrative Safeguards. “Administrative Safeguards” shall mean administrative actions, policies, and procedures to manage the selection, development, implementation, and maintenance of security measures to protect Electronic PHI and to manage the conduct of the workforce in relation to the protection of that information.

b. Breach. “Breach” shall mean the unauthorized acquisition, access, use, or disclosure of unsecured PHI which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to obtain such information.

c. Business Associate. "Business Associate" shall mean Sansio.

d. Covered Entity. "Covered Entity" shall mean the Customer.

e. Designated Record Set. “Designated Record Set” shall mean a group of records maintained by or for Sansio or Customer that is: (i) the medical records and billing records about individuals maintained by Sansio or Customer; (ii) the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) used, in whole or in part, by or for Customer to make decisions about individuals. As used herein, the term "Record" means any item, collection, or grouping of information that includes PHI and is created, received, maintained, or transmitted by or for Sansio or Customer.

f. Electronic Health Record.  “Electronic Health Record” shall mean an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff.

g. Electronic Protected Health Information.  “Electronic Protected Health Information” shall have the same meaning as the term “electronic protected health information” in 45 C.F.R. § 160.103, limited to the information that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity.

h. HIPAA. “HIPAA” shall mean the Health Insurance Portability and Accountability Act of 1996, and any amendments thereto.

i. HITECH. “HITECH” shall mean the Health Information Technology for Economic and Clinical Health Act, which is Title XIII of the American Recovery and Reinvestment Act of 2009, and any amendments, regulations, rules, and guidance issued thereto and the relevant dates for compliance, including amendments to HIPAA as applicable.

j. Individual. "Individual" shall have the same meaning as the term "individual" in 45 CFR § 164.501 and shall include a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g).

k. Individually Identifiable Health Information. “Individually Identifiable Health Information” shall mean information that is a subset of health information, including demographic information collected from an individual, and

(i) is created or received by a healthcare provider, health plan, employer, or healthcare clearinghouse; and

(ii) relates to the past, present, or future physical or mental health or condition of an individual; the provision of healthcare to an individual; and (i) identifies the individual, or (ii) with respect to which there is a reasonable basis to believe the information can be used to identify the individual.

l. Omnibus Rule. “Omnibus Rule” shall mean the Final Rule of 2013, titled “Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under HITECH and the Genetic Information Non-discrimination Act (“GINA”).

m. “Physical Safeguards” shall mean physical measures, policies, and procedures to protect electronic information systems and related facilities and equipment from natural and environmental hazards and unauthorized intrusion.

n. Privacy Rule. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E.

o. Protected Health Information. "Protected Health Information" or “PHI” shall mean Individually Identifiable Health Information that is (i) transmitted by electronic media; (ii) maintained in any medium constituting electronic media; or (iii) transmitted or maintained in any other form or medium. "PHI" shall not include education records covered by the Family Educational Right and Privacy Act, as amended, 20 U.S.C. § 1232g, or records described in 20 U.S.C. § 1232g(a)(4)(B)(iv). “PHI” shall have the same meaning as the term "protected health information" in 45 CFR § 164.501, limited to the information created or received by Sansio from or on behalf of Customer.

p. Required By Law. "Required By Law" shall have the same meaning as the term "required by law" in 45 CFR § 164.501.

q. Secretary. "Secretary" shall mean the Secretary of the United States Department of Health and Human Services or his/her designee.

r. Security Incident. "Security Incident” shall mean the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

s. Security Rule.  “Security Rule” shall mean the Standards for Security of Individually Identifiable Health Information at 45 CFR parts 160 and 164, subparts A and C.

t. Technical Safeguards. “Technical Safeguards” shall mean the technology, and the policy and procedures for its use that protects Electronic PHI and controls access to it.

u. Transaction Standards. "Transaction Standards" shall mean the Standards for Electronic Transactions, 45 C.F.R. 160 and 162.

v. Unsecured PHI. "Unsecured PHI" shall mean PHI not secured through the use of a technology or methodology specified in guidance by the Secretary that renders PHI unusable, unreadable, or indecipherable to unauthorized individuals.

B. Compliance with Applicable Law. Sansio acknowledges and agrees that in the course of performance of Sansio’s obligations under this Agreement, Sansio might be given or obtain access to information which contains Protected Health Information. Beginning with the relevant effective dates, Sansio shall comply with its obligations under this Agreement and with all obligations of a business associate under HIPAA, HITECH, the Omnibus Rule, and other related laws and any implementing regulations, as they exist at the time this Agreement is executed and as they are amended, for so long as this Agreement is in place.

C. Uses and Disclosures of PHI. Except as otherwise limited in this Business Associate Agreement, Sansio may use and disclose Protected Health Information for, or on behalf of, Customer as specified in the Sansio Subscription Agreement. Sansio will not, and shall ensure that its directors, officers, employees, and agents do not,  use or further disclose PHI received from Customer other than as permitted or required by this Agreement or as required by law.  All uses and disclosures of and requests by Sansio for PHI are subject to the minimum necessary rule of the Privacy Standards and shall be limited to the information contained in a limited data set, to the extent practical, unless additional information is needed to accomplish the intended purpose, or as otherwise permitted in accordance with Section 13405(b) of HITECH and any implementing regulations.

Customer will provide Sansio with any changes in, or revocation of, permission by an Individual to use or disclose PHI, if such changes affect Sansio’s permitted or required uses or disclosures.

Sansio is authorized to aggregate and de-identify Protected Health Information (PHI) received from or created on behalf of Covered Entity under the terms of this Agreement, solely for the purpose of product development that benefits the healthcare community, subject to the terms and conditions set forth herein. Sansio may use de-identified information for the purpose of developing, testing, and deploying products or improvements to products intended to enhance the quality, safety, or efficiency of healthcare delivery, provided that such use complies with applicable laws and regulations. Business Associate shall not attempt to re-identify the de-identified information.

D. Customer Responsibilities. Customer will notify Sansio of any restrictions to the use or disclosure of PHI that Customer has agreed to in accordance with 45 C.F.R. § 164.522, to the extent such restrictions affect Sansio permitted or required uses or disclosures.

Customer shall not request Sansio to use or disclose Protected Health Information in any manner that would not be permissible under HIPAA if done by a Covered Entity (unless permitted by HIPAA for a Business Associate).

Customer is responsible for implementing appropriate privacy and security safeguards to protect its Protected Health Information in compliance with HIPAA.  Without limitation, it is Customer’s obligation to not include Protected Health Information in non-secure channels such as email or information Customer submits to Sansio technical support personnel through a technical support request.

E. Required Safeguards To Protect PHI. Sansio will use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this Agreement. Sansio agrees to use appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of any electronic PHI in accordance with the Privacy Rule, the Security Rule, and in accordance with Section 13401(a) of HITECH and any implementing Regulations.

Sansio will maintain liability coverage indemnifying Sansio against losses or damages arising out of its treatment of PHI in performing this Agreement, with per occurrence limits not less than $2,000,000.

F. Ownership of PHI. Under no circumstances shall Sansio be deemed in any respect to be the owner of any PHI used or disclosed by or to Sansio pursuant to the terms of the Agreement. Sansio acknowledges that all rights, title, and interest in and to any PHI furnished to Sansio rests solely and exclusively with the Customer or the Individual to whom such PHI relates.

G. Reporting of Improper Use and Disclosures of PHI. Sansio will report to Customer, as soon as reasonably practical, any use or disclosure of PHI not provided for by this Agreement of which Sansio becomes aware.

H. Reporting of Breaches of Unsecured PHI. Sansio shall report to Customer, as soon as reasonably practical, a breach of Unsecured PHI, of which it reasonably becomes aware, in accordance with Section 13402(b) of HITECH.

I. Agreements by Third Parties. Sansio will ensure that any agent, including a subcontractor, to whom Sansio provides electronic PHI created by, received from, maintained for or transmitted by Sansio on behalf of Customer agrees to the same business associate restrictions, terms, conditions, and requirements that apply to Sansio with respect to such information, including without limitation compliance with Section D hereof.

J. Access to Protected Health Information. Sansio will, at the request of Customer, make available PHI maintained by Sansio in a Designated Record Set to Customer in order for Customer to meet the requirements under 45 C.F.R. § 164.524. In the event any Individual delivers directly to Sansio a request for access to PHI, Sansio will forward such request to Customer in order for Customer to respond to such Individual.

K. Availability of PHI for Amendment. Sansio will, at the request of Customer, make available for amendment, and allow Customer to incorporate any amendment(s) in, any Protected Health Information in a Designated Record Set maintained by Sansio, which the Customer directs or agrees to pursuant to 45 C.F.R. § 164.526. In the event any Individual delivers directly to Sansio a request to amend PHI, Sansio will forward such request to Customer, in order for Customer to respond to such Individual.

L. Documentation of Disclosures. Sansio agrees to document disclosures of PHI and information related to such disclosures as would be required for Customer to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528. At a minimum, Sansio shall provide Customer with the following information: (i) the date of the disclosure; (ii) the name of the entity or person who received the PHI, and if known, the address of such entity or person; (iii) a brief description of the PHI disclosed; and (iv) a brief statement of the purpose of such disclosure which includes an explanation of the basis for such disclosure.

M. Accounting of Disclosures. Within ten (10) days of notice by Customer to Sansio that it has received a request for an accounting of disclosures of PHI regarding an Individual during the six (6) years prior to the date on which the accounting was requested, Sansio shall make available to Customer information collected in accordance with Section K of this Agreement, to permit Customer to respond to the request for an accounting of disclosures of PHI, as required by 45 C.F.R. § 164.528. In the case of an Electronic Health Record maintained or hosted by Sansio on behalf of Customer, the accounting period shall be three (3) years and the accounting shall include disclosures for treatment, payment, and healthcare operations, in accordance with the applicable effective date of Section 13402(a) of HITECH. In the event an Individual directly requests an accounting of disclosures, Sansio shall forward such request to Customer in order for Customer to respond to such Individual. Sansio hereby agrees to implement an appropriate record keeping process to enable it to comply with the requirements of this Section.

N. Compliance with HIPAA Transaction Standards. Customer and Sansio each agree to comply with all applicable HIPAA standards and requirements, (including without limitation, those specified in C.F.R. § 162) with respect to the transmission of health information in electronic form in connection with any transaction for which the Secretary has adopted a standard under HIPAA (“Covered Transactions”).

O. Availability of Books and Records. Sansio agrees to make Sansio’s internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Sansio on behalf of, Customer available to the Secretary for purposes of determining Customer’s compliance with the Privacy Rule, Security Rule and the HITECH Act.

P. Effect of Termination of Agreement. Upon termination of this Agreement for any reason, if feasible, Sansio will return or destroy all Protected Health Information created by, received from or maintained by Sansio on behalf of Customer.  In the event that Sansio determines that returning or destroying the Protected Health Information is infeasible, Sansio will extend the protections of this Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Sansio maintains such Protected Health Information.

Upon request of Covered Entity, Sansio shall maintain Protected Health Information for no longer than thirty (30) days following the termination of the services agreement to allow Covered Entity to download any and all Protected Health Information in its then existing, native format. Should Covered Entity require that Sansio (a) maintain Protected Health Information for a period of longer than thirty (30) days, (b) provide Protected Health Information in any other format, or (c) assist with the transfer of data to Covered Entity, such work shall be performed under a mutually agreed upon statement of work. Absent such statement of work, Covered Entity directs Sansio to permanently delete all Protected Health Information thirty (30) days following the termination of the services agreement.

Q. Red Flag Rules. So long as Sansio retains any confidential or non-public Individually Identifiable Information, Sansio will develop, maintain, and implement policies and procedures designed to ensure the privacy, confidentiality, and security of such information, and to prevent, detect, and mitigate against the reasonably foreseeable risks of personal and medical identity theft in compliance with the requirements of law, including, without limitation, the Identity Theft, Red Flags and Address Discrepancies under the Fair and Accurate Credit Transaction Act of 2003 ("Red Flag Rules"). Sansio will cooperate with Customer in evaluating, investigating, and responding to Red Flags or any possible data breach or Identity Theft activity. Notwithstanding anything to the contrary in this Agreement or any other document, this provision shall survive the expiration or sooner termination of this Agreement, and shall inure to the benefit of Customer and its affiliates and agents.

R. Changes in the Law. Sansio may amend this Agreement  as appropriate, to conform to any new or revised legislation, rules and regulations to which Sansio is subject now or in the future including, without limitation, HIPAA, HITECH, the Privacy Standards, Security Standards, or Transaction Standards.