Skip to main content

Master Service Agreement

PLEASE READ THESE CUSTOMER TERMS OF SERVICE CAREFULLY. Our Customer Terms of Service is a contract that governs our customers' use of the ...

R
Written by Regina Rovira

PLEASE READ THESE CUSTOMER TERMS OF SERVICE CAREFULLY.

Our Customer Terms of Service is a contract that governs our customers' use of the Vitable Health Services, P.A. and it's Affiliates services. It consists of the following documents:

RECITALS

WHEREAS, Company provides services for treatment and/or assisting in treatment of primary care, urgent care, and mental health, as described in more detail herein (the “Services”), through duly licensed physicians and other qualified healthcare professionals (the “Providers”) via in-person examination and through telehealth technologies (the “Program”);

​

WHEREAS, Customer desires to offer the Program to its employees and their dependents; and

​

WHEREAS, Company desires to provide the Program to Customer’s employees and dependents pursuant to the terms of this Agreement.

NOW, THEREFORE, in exchange for the promises made hereunder and for other valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties hereto agree as follows:

  1. Recitals. The above recitals are incorporated herein by reference.

  2. Definitions. The following terms shall have the meanings set forth below:

    1. “Participant” means an individual who is an employee covered under the Program or an eligible dependent of an employee covered under the Program.

    2. “PEPM” is an abbreviation for “Per Employee Per Month”. For purposes of this Agreement, PEPM is defined as the applicable rate paid by Customer to Company on a monthly basis for each Employee.

    3. "Affiliate" of any person or entity means any other person or entity that, directly or indirectly, through one or more intermediaries, controls, is controlled by, owns, is owned by, or is under common control with, common ownership, or common management with, such person or entity

  3. The Program.

    1. The Program includes access to Company’s Providers to offer the Services to Participants. Specific Services offered under the Program are described in detail in Exhibit A. Services provided will be subject to the standards identified in Exhibit A and incorporated herein. The method of delivering the Services shall be via the Program, which may consist of synchronous and asynchronous communication modalities over the telephone or via a smart phone, tablet, the Internet or any other telecommunication device or network, whether now in existence or developed during the term of this Agreement. The use of Company mobile application software shall be subject to the conditions of use identified in Exhibit B.

    2. The Providers shall be appropriately licensed, registered, and/or certified to practice in their respective healthcare professions as required under state law. Furthermore, the Providers shall be technologically proficient and trained in telehealth Services. Provider Services under the Program are not delivered by online questionnaires.

    3. It is understood by the Parties that Company does not exercise control or direction over the means, methods, or manner by which the Providers exercise independent professional judgment in the provision of healthcare services provided through the Program and in accordance with this Agreement. The Providers deliver services based on their sole professional judgment. The Parties acknowledge and agree that the Providers shall not prescribe any controlled substances under this Agreement. Company does not guarantee any Participant will receive a prescription.

    4. Company and each Provider will prepare and maintain medical records in accordance with all applicable federal, state and local laws and regulations. All medical records generated under the Program shall be the property of Company.

    5. Only Participants who have completed the necessary steps to create a legally mandated Provider-patient relationship (as described in Exhibit A) will be eligible to receive Services under the Program.

  4. Customer Responsibilities. Customer shall:

    1. Use reasonable efforts to internally promote the Program and educate and engage Participants at the prices outlined in this Agreement, using Company’s Program content and materials (“Program Content”). Customer may provide Program Content to Participants by emailing, handing out, and/or posting Program Content in high-visibility areas, as well as uploading Program Content to Customer’s corporate intranet and HR sites and including Program Content in open enrollment and new hire materials. Customer acknowledges it has no authority to modify Program Content without the prior written approval of Company. In addition, Customer hereby authorizes Company to provide Program Content directly to Participants and to communicate directly with Participants for the purpose of: (A) promoting the Program to the Participants; and (B) treatment, payment, and health care operations of Company.

    2. At a minimum, co-promote Company’s Services to Customer’s Program-eligible population within the first twelve (“12”) months of usage (specific dates to be determined) via:

      1. Four (“4”) email campaigns (sent by Company, approved by Customer);

      2. Two (“2”) postcards (sent by Company, approved by Customer);

      3. One (“1”) online or onsite (preferred) presence during Customer’s Open Enrollment/Benefit Fair.

    3. Cooperate with Company regarding onboarding and implementation of the Program within sixty (60) days of the Execution Date. Onboarding and implementation processes are flexible and are defined based on the individual needs and direction of Customer.

    4. Customer will reasonably cooperate with Company in connection with the performance of this Agreement by making available such personnel and information as may be reasonably required and taking such other actions as Company may reasonably request to assist in its provision of the Services. This shall include provision of membership verification files, in the format requested by Company, for each Participant upon the Participant’s initial eligibility for the Program and thereafter within a reasonable time period after a request from Company. Such files shall include Participant names, emails, dates of birth, genders, addresses, phone numbers, and any other information required to ensure timely billing. Each Customer Participant of the Services must (a) be a current employee (or covered dependent), or a consultant, contractor or agent of Customer using the Services only on Customer’s behalf, and (b) be bound by the conditions of use set forth in Exhibit B. Customer will be directly responsible to Company with respect to all actions and/or inactions of its Participants of the Services.

    5. Customer represents as follows, and shall notify Company within five (5) business days upon becoming aware any of the representations below is no longer correct:

      1. Customer has the authority to enter into this Agreement.

      2. Customer is not bound by any agreement or arrangement that would preclude it from entering into this Agreement, or from fully satisfying the obligations set forth in this Agreement.

      3. Neither Customer nor any of its employees, officers or agents: (i) are “sanctioned persons” under any federal or state program or law; (ii) has been listed in the current List of Excluded Individuals and Entities by the Office of Inspector General for the U.S. Department of Health and Human Services; (iii) has been listed on the General Services Administration’s List of Parties Excluded from Federal Programs; (iv) has been listed on the U.S. Department of Treasury, Office of Foreign Assets Control’s Specially Designated Nationals and Blocked Persons List; or (v) has been convicted of a criminal offense related to health care.

    6. Subject to the terms and conditions hereof, Company will provide reasonable support to Customer for the Services as described herein. Customer will designate an employee who will be responsible for all matters relating to this Agreement (“Primary Contact”). Customer will notify Company of the name, title and contact information of Primary Contact within seven (7) days of the Execution Date. Customer may change the individual designated as Primary Contact at any time by providing written or email notice to Company.

    7. Customer understands, acknowledges and represents that (i) the Program is being offered as a benefit to Customer’s employees and their dependents and may be part of an existing group health plan or create a stand-alone group health plan, as defined under applicable laws (the “Customer Health Plan”), and (ii) Customer is solely responsible for complying with the Employee Retirement Income Security Act (“ERISA”), the Patient Protection and Affordable Care Act (“PPACA”), the Health Insurance Portability and Accountability Act (“HIPAA”), and other applicable law governing the Customer Health Plan, including, without limitation, any legal requirements or rules relating to annual or lifetime benefit limits, preventive care, maximum out-of-pocket or cost-sharing restrictions, continuation coverage requirements (including, without limitation, the Consolidated Omnibus Budget Reconciliation Act (“COBRA”)), eligibility for contributions into a health savings account (“HSA”), and any required coordination of the benefits provided through the Program with the benefits provided under the Customer Health Plan or any other benefit plan sponsored by Customer, as well as the tax treatment of the benefits provided under the Customer Health Plan and the Program.

    8. Customer understands and acknowledges that participation in the Program may make a Participant ineligible to make or receive contributions in an HSA. Customer agrees that to the extent Customer desires to preserve HSA eligibility for its employees, Customer shall communicate such to Company prior to the Effective Date and Customer will work with Company to develop an alternate fee structure for employees enrolled in a High Deductible Health Plan (“HDHP”), as needed. Customer shall be solely responsible for providing Company with current, up-to-date enrollment information for employees enrolled in HDHPs.

  5. Company Responsibilities. Company shall:

    1. Provide Customer with access to the Services through in-person interactions, telephone and/or the Internet, solely for Customer’s internal use (and the internal use of Customer’s Participants), subject to the other terms and conditions of this Agreement. The Services are subject to modification from time to time at Company’s sole discretion, for any purpose deemed appropriate by Company. Company will use reasonable efforts to give Customer prior written notice of any material modification.

    2. Provide and grant to Customer a non-exclusive, non-transferable, limited license to use the Company branded Program (including all materials developed or provided to Customer by Company related to the Program, its marketing, implementation and use) during the term of this Agreement. Notwithstanding the foregoing, Company’s toll-free telephone number shall not be a dedicated number solely for Customer’s Participants, and the telephone number shall remain property of Company at all times, including following termination of this Agreement.

    3. Provide and maintain an adequate system, forms, and other resources for Participants to: (a) complete the required medical history disclosure form, and (b) access and agree to Company’s informed consent form and other required patient agreements.

    4. Maintain a file of the Participants’ information and update the file periodically with information provided by Customer as new Participants are added;

    5. If Customer requests Company’s physical presence and participation in onsite activities such as health fairs, annual enrollment, benefit training, etc., commercially reasonable efforts will be made to accommodate Customer’s request. Company will bill Customer for usual and customary travel expenses including food, lodging, and transportation within ten (10) days after the onsite visit has occurred. Referral training will be provided to any applicable onsite healthcare providers or call center resources at Customer’s request.

    6. Maintain reasonable procedures to confirm Providers are duly licensed and qualified to practice their respective professions in the state where the Services are provided.

    7. Provide to Customer Program Content as described in Section 4 above.

    8. Company represents as follows, and shall notify Customer within five (5) business days upon becoming aware any of the representations below is no longer correct:

      1. Company has the authority to enter into this Agreement.

      2. Company is not bound by any agreement or arrangement that would preclude it from entering into this Agreement, or from fully satisfying the obligations set forth in this Agreement.

      3. Neither Company nor any Provider delivering services under this Agreement: (i) is a “sanctioned person” under any federal or state program or law; (ii) has been listed in the current List of Excluded Individuals and Entities by the Office of Inspector General for the U.S. Department of Health and Human Services; (iii) has been listed on the General Services Administration’s List of Parties Excluded from Federal Programs; (iv) has been listed on the U.S. Department of Treasury, Office of Foreign Assets Control’s Specially Designated Nationals and Blocked Persons List; or (v) has been convicted of a criminal offense related to health care.

  6. Data Transmission Security. Data transmission security is the process of sending data from one computer system to another in a secure manner so that only the intended recipient of the data receives the data and the data sent is identical to the data received. When ePHI (Electronic Personal Health Information) is transmitted over an electronic communications network between Customer and Company, the parties will utilize Secure File Transfer Protocol (SFTP).

  7. Payment Terms and Service Fees

    1. Customer agrees to pay Company the fees specified in Exhibit C, incorporated herein by reference. Company shall invoice Customer by the twentieth (20th) day of each month for the PEPM fees for the month and for Program Services provided in the period covered by the invoice. The invoice and fee calculations shall be based on (a) the reporting file Customer shall send to Company on the 1st day of each month in accordance with Section 7.2 below, and (b) fees for Services subject to other fees as identified in Exhibit C that were provided in such period covered by the invoice. Customer will be charged fees for Services provided to each Participant, regardless of whether a Participant is an employee or a dependent.

    2. The reporting file provided by Customer on the 1st day of each month shall identify the current number of employees. Calculation of the PEPM fee is based on the number of total employees in such month times the rate identified in Exhibit C. Should the total number of employees identified in any given month deviate by fifteen percent (15%) or more from the number of employees provided in Exhibit C, Company reserves the right to adjust the PEPM fee with thirty (30) days’ prior written notice to Customer. Customer shall have fourteen (14) days from the date of such written notice to confer with Company regarding the PEPM fee change; should Customer fail to contact Company within such fourteen (14) day period, Customer will be viewed as accepting the PEPM fee change.

    3. Invoices shall be electronically mailed to Customer at the address set forth in the Notice Section of this Agreement. Customer shall pay such fees in full net fifteen (15) days of receipt of said invoice. Payment shall be made via ACH or electronic means. Customer specifically acknowledges and agrees it is responsible for paying all applicable PEPM fees and other fees identified herein to Company. Fees under this Agreement are exclusive of all taxes, including national, state or provincial and local use, sales, value-added, property and similar taxes, if any. Customer agrees to pay such taxes (excluding taxes based on Company's net income) unless Customer has provided Company with a valid exemption certificate. In the case of any withholding requirements, Customer will pay any required withholding itself and will not reduce the amount paid to Company on account thereof.

    4. If Customer fails to make any required payment within forty-five (45) days of the date of Company’s invoice, Company shall have the right to cancel the Program. Unpaid fees are subject to a finance charge of one percent (1.0%) per month, or the maximum permitted by law, whichever is lower, plus all expenses of collection, including reasonable attorneys’ fees.

  8. Term. The initial period of the Subscription Term: (i) is as specified in the applicable Ordering Document; and (ii) shall automatically renew for successive renewal periods equal to the longer of (a) the Subscription Term initial period, or (b) one (1) year. For clarity, if an Ordering Document specifies a multi-year period (i.e., greater than one (1) year), the full multi-year period shall be deemed the “initial period” of the Subscription Term, and renewal periods shall commence after completion of the multi-year period. If an Ordering Document auto-renews, Fees applicable to each year of the renewal period shall be subject to a 6% annual increase year over year.

  9. Termination.

    1. Either Party may terminate this Agreement upon thirty (30) calendar days’ prior written notice in the event of any material breach of this Agreement by the other Party, including Customer’s failure to make a required payment in accordance with Section 7.4.

    2. Immediate Termination. Either Party may terminate this Agreement immediately without notice to the other Party upon the occurrence of any of the following events: (i) the other Party is listed by a federal agency as being disbarred, excluded, terminated, or otherwise ineligible for federal healthcare program participation; (ii) the other Party discontinues operations for at least fifteen (15) days or loses its required licensure or accreditation; or (iii) the other Party files a petition in bankruptcy, or makes an assignment for the benefit of creditors; if any involuntary petition in bankruptcy or petition for an arrangement pursuant to any bankruptcy laws is filed against the other Party and is not dismissed within ninety (90) days; or if a receiver is appointed for the business of all or part of the other Party.

    3. Effect of Termination. To the extent the Parties entered into any licensing or other agreements regarding the Program, such agreements shall immediately and automatically terminate concurrent with this Agreement. Within ten (10) days of the termination or expiration of this Agreement, each Party shall return to the other all equipment, software, and confidential information of the other Party, and Customer shall pay in full all fees due to Company.

    4. Suspension of Services. Company may, in its sole discretion, immediately suspend or terminate Customer’s access to the Services for any of the following reasons (a) to prevent damages or risk to, or degradation of, the Services; (b) to comply with any law, regulation, court order, or other governmental request; (c) to otherwise protect Company from potential legal liability; or (d) in the event an invoice remains unpaid for more than forty-five (45) days from the invoice date. Company will use reasonable efforts to provide Customer with notice prior to or promptly following any suspension of the Services. Company will promptly restore access to the Services as soon as the event giving rise to suspension has been resolved. This Section will not be construed as imposing any obligation or duty on Company to monitor use of the Services. Company may also terminate or suspend access of Customer or any Participant for violation of the conditions of use as set forth in Exhibit B.

    5. Early Cancellation. After the Initial Term, either Party may terminate this Agreement at any time by providing the other Party written notice of non-renewal. Written notice of non-renewal from the Employer must be delivered to contracts@vitablehealth.com at least one hundred and twenty (120) days prior to the end of the then-current Subscription Term period (the “Renewal Notice Date”). Failure to deliver timely notice of non-renewal on or before the Renewal Notice Date shall result in automatic renewal of such Ordering Document. Vitable will not provide any refunds of prepaid fees or unused Subscription Fees.

  10. Relationship of the Parties. Company and Customer are, and shall at all times function as, independent contractors under this Agreement. Neither Company nor Customer is an employee, principal, agent, or partner of the other Party. Neither Company nor Customer is authorized to assume or create any obligations or liabilities, express or implied, on behalf of or in the name of the other Party, except to the extent otherwise specifically contemplated herein. The employees, agents and representatives of a Party shall at all times be under the exclusive direction and control of that Party.

  11. Indemnification; Insurance.

    1. Each Party agrees that it is solely liable for any breach, negligence, misrepresentation, error, omission, or malfeasance by its employees, agents and representatives concerning the Program, or otherwise, made by such Party in fulfilling its obligations under this Agreement. Each Party agrees to indemnify and hold harmless the other Party, its directors, officers, affiliates, employees, agents, representatives, successors and assigns from and against any damages, losses, liabilities, settlements, expenses (including without limitation costs and attorneys’ fees) and regulatory fines or assessments, in each case, that are paid or payable to un-Affiliated third parties or regulatory agencies in connection with any claim or action that alleges any (i) infringement, violation or misappropriation of any intellectual property or proprietary right(s) in connection with this Agreement, including, without limitation, in connection with distribution and/or analysis thereof through the Services, and/or (ii) violation of applicable law(s) and/or regulations by Party in performance of its obligations and/or exercise of its rights pursuant to this Agreement; provided that the Party seeking indemnification promptly notifies the indemnifying Party of the event triggering indemnification. The indemnifying Party shall have control over the defense and settlement of any lawsuit pertaining to the event triggering indemnification, and the indemnified Party shall provide reasonable assistance with respect to such defense and settlement. “Affiliate” means any entity controlling, controlled by, or under common control with a Party, where “control” means the ownership of more than 50% of the voting securities in such entity. The foregoing obligations do not apply with respect to portions or components of the Services provided by Company (i) not created by or on behalf of Company, (ii) resulting in whole or in part in accordance from Customer specifications, (iii) that are modified by Customer after delivery by Company, (iv) combined with other products, processes or materials by the Customer where the alleged infringement arises out of such combination, (v) where Customer continues allegedly infringing activity after being notified thereof or after being informed of modifications that would have avoided the alleged infringement, or (vi) where Customer’s use of the Services is not strictly in accordance with this Agreement and all related documentation.

    2. During the performance of Services under this Agreement, Company and Customer shall each maintain general and professional liability insurance in amounts of not less than One Million Dollars ($1,000,000.00) per occurrence and Three Million Dollars ($3,000,000.00) in the aggregate for professional liability, commercial general liability, workers compensation, and cyber & privacy.

  12. Intellectual Property.

    1. Company IP. Company’s “Intellectual Property” shall mean the Services (as defined in Exhibit A), Documentation (as defined in Exhibit B), and all discoveries, ideas, concepts, designs, inventions (e.g., compositions of matter, machines, processes, algorithms, models, protocols, formulae, methods of doing business), source code, improvements, works, works of authorship (e.g., computer programs and associated documentation, drawings, flow charts, schematics and other works subject to copyright, design right or other like protection), trade secrets, patents, registered designs, works, copyrights, registrations, applications, and other intellectual property of Company. Company’s Intellectual Property shall also include its technology, knowledge and work product relating to the Services and Documentation, including formulation, design, ideas, inventions, innovations, discoveries, concepts, processes, techniques, architecture, user interfaces, know-how, engineering and research data, proprietary clinical service protocols, algorithms, database design and architecture, templates and associated macros, expert-developed content for patient care management, monitoring and reporting, medical record databases, preclinical and clinical data, specifications, drawings, diagrams, descriptions, reports, and records. Customer understands, acknowledges, and agrees it has no right to transfer or reproduce the Services, in whole or in part, or prepare any derivative works with respect to, or disclose Confidential Information pertaining to any Services or Intellectual Property. Customer further acknowledges and agrees that Company owns all right, title, and interest in and to the Services, Documentation, and Intellectual Property including any changes or modifications or improvements made thereto in connection with or independent of this Agreement. Under no circumstances will Customer be deemed to receive title to any portion of the Services or Intellectual Property, title to which at all times will vest exclusively in Company. This includes any suggestions or requests for changes or modifications or improvements made by Customer to Company, in writing or otherwise, it being agreed and understood that any such changes, modifications, or improvements are derivative of Company’s proprietary Services, and “know-how.” Customer will preserve all Services, and Intellectual Property from any liens, encumbrances, and claims of any individual or entity. Customer will not use any Confidential Information disclosed by Company to Customer to contest the validity of any intellectual property rights of Company or its licensors. Any such use of Company’s Confidential Information or data will constitute a material, non-curable breach of this Agreement. Customer will not copy, distribute, reproduce or use any of the foregoing except as expressly permitted under this Agreement. Except as expressly set forth herein, this Agreement is not a sale and does not convey to Customer any rights of ownership in or related to the Services or related software, or any intellectual property rights.

    2. Customer Content. Customer grants Company a non-exclusive, world-wide, royalty-free license to use the data and other information input by Customer on the landing page (the “Content”) for purposes of performing this Agreement, as directed or instructed by Customer and its Participants (e.g., in the context of support requests), Customer policies, and/or applicable law. Customer will be responsible for obtaining all rights, permissions, and authorizations with respect to the Content for use as contemplated under this Agreement. Except for the license granted in this Section, nothing contained in this Agreement will be construed as granting Company any right, title, or interest in the Content. Customer shall retain a copy of Content outside the Services. Customer shall comply with all intellectual property, marketing laws, advertising laws, privacy laws, and all other laws and regulations related to the Content and shall comply with all legal duties applicable to Customer. Customer shall provide the relevant Participants with all information or notices Customer is required by applicable privacy and data protection law to provide and, if necessary, obtain the consent of or provide choices to such Participants as required by such laws. Company and Customer shall apply reasonable technical, organizational and administrative security measures to keep Content protected in accordance with industry standards. Customer is solely responsible for the configuration of its Service account and configuration, operation, performance and security of its equipment, networks and other computing resources, including its gateways or other devices and networks used to connect to the Services. This Section states Company’s exclusive obligations with respect to Content.

    3. Usage Data. Subject to any applicable restrictions under HIPAA, Company shall have the right to collect and analyze data and other information relating to the provision, use, and performance of various aspects of the Services and related systems and technologies (including information concerning Content and data derived therefrom), and Company may (a) use such information and data to improve and enhance the Services and for other development, diagnostic, and corrective purposes in connection with the Services and other Company offerings, and (b) disclose such data solely in aggregated or other de-identified form in connection with its business, provided such data does not include (directly or by inference) any information identifying Customer or any identifiable individual. No rights or licenses are granted except as expressly set forth herein. Customer and its licensors shall (and Customer hereby represents and warrants that they do) have and retain all right, title and interest (including, without limitation, sole ownership of) all Content provided by or on behalf of Customer and/or its Participants and the intellectual property rights with respect to that Content. If Company receives any notice or claim that any Content, or activities hereunder with respect to any Content, may infringe or violate rights of a third party or any applicable law or regulation (a “Claim”), Company may (but is not required to) suspend activity hereunder with respect to that Content. Unless and until Customer notifies Company to the contrary in writing, Company is permitted to disclose that Customer is one of its customers to any third-party at its sole discretion, and to place Customer’s name and logo on its website and marketing materials for this purpose.

    4. Third Party Data. The Services and Documentation may contain material, data, or information provided by third parties (“Third Party Data”). Company does not control Third Party Data and is not responsible for its content. Company’s inclusion of Third Party Data in the Services does not imply any endorsement of the information and Company makes no representations or warranties with respect to any Third Party Data.

    5. Feedback. Customer may provide suggestions, comments or other feedback (collectively, “Feedback”) to Company’s Services. Feedback is voluntary. Company may use Feedback for any purpose without obligation of any kind. To the extent a license is required under Customer’s intellectual property rights to make use of the Feedback, Customer grants Company an irrevocable, non-exclusive, perpetual, fully-paid-up, royalty-free license to use the Feedback in connection with Company’s business, including the enhancement of the Services.

    6. Branding, Communications & Marketing Use. Customer grants Company a non-exclusive, royalty-free, revocable, worldwide license to use Customer's name, trademarks, and logos (collectively, "Brand Assets") for the following purposes: (a) email communications sent by Company on behalf of Customer for onboarding, promotion of the Services and Program, and related communications to eligible Participants, and (b) inclusion in Company's website, sales materials, investor decks, and other promotional content identifying Customer as a user of the Services. This includes use of the Customer's name to indicate the origin of promotional messages and use of Customer's logo in such communications, provided that such communications disclose that they are sent by Company on behalf of Customer. In addition, Company may use Customer's comments, care studies, or endorsements in its promotional materials. Customer may revoke permission for use of its logo with thirty (30) days' written notice. Upon receipt of such notice, Company shall discontinue use of Company's logo in new communications and shall take commercially reasonable steps to cease use of Company's logo in existing communications.

  13. Confidentiality.

    1. Proprietary Information. Each Party (the “Receiving Party”) understands that the other Party (the “Disclosing Party”) has disclosed or may disclose information relating to the Disclosing Party’s technology or business (hereinafter referred to as “Proprietary Information” of the Disclosing Party). Notwithstanding the foregoing, the Services are Company’s Proprietary Information, and the Content provided by Customer is Customer’s Proprietary Information.The Receiving Party agrees: (i) except as expressly provided herein, not to divulge to any third party any such Proprietary Information, (ii) to give access to such Proprietary Information solely to those employees and contractors with a need to have access thereto for purposes of this Agreement (and who are bound by written confidentiality obligations as protective of the Disclosing Party’s Proprietary Information as this Agreement), and (iii) to take the same security precautions to protect against disclosure or unauthorized use of such Proprietary Information that the party takes with its own proprietary information, but in no event will a party apply less than reasonable precautions to protect such Proprietary Information. The Disclosing Party agrees that the foregoing will not apply with respect to any information that the Receiving Party can document (a) is or becomes generally available to the public without any action by, or involvement of, the Receiving Party, or (b) was in its possession or known by it prior to receipt from the Disclosing Party, or (c) was rightfully disclosed to it without restriction by a third party, or (d) was independently developed without use of any Proprietary Information of the Disclosing Party. Nothing in this Agreement will prevent the Receiving Party from disclosing Proprietary Information pursuant to any judicial or governmental order, provided that the Receiving Party (to the extent legally permissible) gives the Disclosing Party reasonable prior notice of such disclosure to contest such order. Notwithstanding anything to the contrary, and subject to Company’s then-current Privacy Policy (available at https://vitablehealth.com/terms) (the “Privacy Policy”), Company may collect data with respect to, use, and report on, the aggregate response rate and other aggregate measures of the Services’ performance and Customer’s usage of the Services (including without limitation, the Content); provided that Company will not identify (or disclose any information or data that could reasonably be used to identify) Customer or any individual without Customer’s prior written consent. Both Parties will have the right to disclose the existence but not the terms and conditions of this Agreement, unless such disclosure is approved in writing by both Parties prior to such disclosure, or is included in a filing required to be made by a Party with a governmental authority (provided such party will use reasonable efforts to obtain confidential treatment or a protective order) or is made on a confidential basis as reasonably necessary to potential investors and/or acquirers.

    2. Privacy and Security Compliance. The Parties shall comply with all applicable federal and state laws and regulations relating to the maintenance, uses and disclosures of protected health information, including without limitation the Health Insurance Portability and Accountability Act of 1996, as codified at 42 USC § 1320d through d-8, as amended, including federal privacy regulations and security standards (“HIPAA Requirements”). The Parties shall enter into any further agreements as necessary to facilitate compliance with the HIPAA Requirements, including the Business Associate Agreement between Company and Customer included in Exhibit D.

  14. Compliance; Referrals. Each Party agrees to comply with all applicable laws and regulations in performing its obligations hereunder, including but not limited to the federal and state anti-kickback and self-referral laws and regulations at all times during the term of this Agreement. Although Company is obligated to provide the Program services specified in this Agreement, neither Party is required to refer patients to, or otherwise generate business for, the other Party. The Parties intend this Agreement to comply with 42 U.S.C. § 1320a-7b(b) (the Anti-Kickback Statute), 42 U.S.C. § 1395nn (the Stark Law) and any other federal or state law provision governing healthcare fraud and abuse. The fees herein have been determined through good faith and arm’s length bargaining to be commercially reasonable and consistent with the fair market value of the Program. The fees do not include any discount, rebate, kickback or other reduction in charge, nor is it intended to be an inducement or payment for referral of patients from one Party to another.

  15. Audit. During the term of this Agreement and for a period of two (2) years thereafter, Customer shall keep and maintain records relating to the number of Participants entitled to access the Program. Upon reasonable advance written notice by Company, Company or an independent audit firm may, on its behalf, inspect any such records to verify Customer’s compliance and the accuracy of the PEPM fee calculation. If Company discovers any errors or underpayments associated with Customer’s reporting, Customer shall pay any underpaid amount within thirty (30) days after Customer’s receipt of an invoice.

  16. General Warranties.

    1. Customer Warranty. Customer represents and warrants that (a) it has full power, capacity, and authority to enter into this Agreement and to grant the license set forth in Section 12.2 (Customer Content); (b) any Content provided by Customer for use in connection with the Services does not and will not infringe the intellectual property, publicity, or privacy rights of any person and is not defamatory, obscene, or in violation of applicable foreign, federal, state and local laws, rules and regulations (including but not limited to applicable policies and laws related to spamming, such as CAN-SPAM, privacy, and consumer protection); (c) its use of the Services will be in compliance with all applicable law; (d) neither Customer nor any Participants shall make any representations with respect to Company, the Services, or this Agreement (including, without limitation, that Company is a warrantor or co-seller or provider of any of Customer’s services); and (e) neither Customer nor any of its respective officers, directors, employees, or contractors is or has ever been: (i) convicted of a criminal offense related to health care or the provision of items and services payable by a federal or state health care program (for example, Medicare and Medicaid); (ii) assessed civil money penalties for an offense related to health care or to the provision of items or services payable by a federal or state health care program; (iii) excluded from participation in any federal or state health care program; or (iv) excluded by any federal agency from receiving federal contracts. Customer shall notify Company immediately of any breach of any representation or warranty in this section or any other section under this Agreement or of any information or situation which could reasonably lead to a breach of this section.

    2. Company Warranty. During the Term, Company represents and warrants the Services will substantially comply with the specifications, if any, described in the then current Documentation. In the event of a breach of the warranty, Company’s sole and exclusive liability and Customer’s sole and exclusive remedy will be to provide restored or replacement service which conforms to this warranty. In the event Company is unable through reasonable efforts to provide restored or replacement service within thirty (30) calendar days from receipt of notice from Customer of the failure of the Services to comply with the warranty, Customer may elect to terminate this Agreement and receive a pro-rated refund of any pre-paid, unused recurring fees for the non-conforming aspect of the Services.

  17. DISCLAIMER OF WARRANTIES. EXCEPT AS PROVIDED IN SECTION 16.2 (COMPANY WARRANTY), THE SERVICES, SOFTWARE AND/OR DEVICE LICENSED AND/OR PURCHASED BY CUSTOMER THROUGH COMPANY, COVERED BY THIS AGREEMENT, ARE PROVIDED “AS IS” AND “AS-AVAILABLE,” WITH ALL FAULTS, AND WITHOUT WARRANTIES OF ANY KIND. EXCEPT AS PROVIDED IN SECTION 16.2 (COMPANY WARRANTY), COMPANY AND ITS VENDORS AND LICENSORS DISCLAIM ALL OTHER WARRANTIES, EXPRESS AND IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT, QUALITY OF INFORMATION, TITLE, AND NON-INFRINGEMENT. CUSTOMER EXPRESSLY AGREES AND ACKNOWLEDGES THAT USE OF THE SERVICES IS AT CUSTOMER’S SOLE RISK. COMPANY DOES NOT WARRANT THAT THE SERVICES WILL MEET CUSTOMER’S REQUIREMENTS, OR THAT THE SERVICES ARE COMPATIBLE WITH ANY PARTICULAR HARDWARE OR SOFTWARE, OR THAT THE OPERATION OF THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT DEFECTS IN THE SERVICES WILL BE CORRECTED. FURTHERMORE, COMPANY DOES NOT WARRANT OR MAKE ANY REPRESENTATION REGARDING THE USE OR THE RESULTS OF THE USE OF THE SERVICES IN TERMS OF THEIR CORRECTNESS, ACCURACY, QUALITY, RELIABILITY, SECURITY, APPROPRIATENESS FOR A PARTICULAR TASK OR APPLICATION, CURRENTNESS, OR OTHERWISE. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY COMPANY OR ITS AUTHORIZED REPRESENTATIVES WILL CREATE A WARRANTY OR IN ANY WAY INCREASE THE SCOPE OF COMPANY’S OBLIGATIONS HEREUNDER. THE SERVICES MAY BE USED TO ACCESS AND TRANSFER INFORMATION OVER THE INTERNET. CUSTOMER ACKNOWLEDGES AND AGREES THAT COMPANY AND ITS VENDORS AND LICENSORS DO NOT OPERATE OR CONTROL THE INTERNET AND THAT: (I) VIRUSES, WORMS, TROJAN HORSES, OR OTHER UNDESIRABLE DATA OR SOFTWARE; OR (II) UNAUTHORIZED USERS (E.G., HACKERS) MAY ATTEMPT TO OBTAIN ACCESS TO AND DAMAGE CUSTOMER’S DATA, WEBSITES, COMPUTERS, OR NETWORKS. COMPANY WILL NOT BE RESPONSIBLE FOR SUCH ACTIVITIES. COMPANY DOES NOT WARRANT ANY DATA PROVIDED BY COMPANY OR THROUGH THE SERVICES WILL BE ACCURATE OR COMPLETE. CUSTOMER IS RESPONSIBLE FOR PRESERVING AND MAKING ADEQUATE BACKUPS OF ITS DATA.

  18. LIMITATION OF LIABILITY. IN NO EVENT WILL EITHER PARTY HERETO OR THEIR LICENSORS BE LIABLE FOR ANY INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR IN ANY WAY CONNECTED WITH THE USE OF THE SERVICES, OR ANYTHING PROVIDED IN CONNECTION WITH THIS AGREEMENT, ANY DELAY OR INABILITY TO USE THE SERVICES OR ANYTHING PROVIDED IN CONNECTION WITH THIS AGREEMENT OR OTHERWISE ARISING FROM THIS AGREEMENT, INCLUDING WITHOUT LIMITATION, LOSS OF REVENUE OR ANTICIPATED PROFITS OR LOST BUSINESS OR LOST SALES, WHETHER BASED IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF DAMAGES. THE TOTAL LIABILITY OF EACH PARTY AND ITS LICENSORS, WITH RESPECT TO THIS AGREEMENT, AND/OR ANY SERVICES PROVIDED, WHETHER BASED IN CONTRACT, TORT (INCLUDING NEGLIGENCE OR STRICT LIABILITY), OR OTHERWISE, WILL NOT EXCEED, IN THE AGGREGATE, THE GREATER OF (A) FEES PAID TO COMPANY HEREUNDER IN THE TWELVE-MONTH PERIOD ENDING ON THE DATE THAT A CLAIM OR DEMAND IS FIRST ASSERTED, OR (B) $1,000. THE FOREGOING LIMITATIONS WILL APPLY NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY.

  19. Entire Agreement; Amendment. This Agreement sets forth the entire agreement between the Parties with regard to the subject matter hereof, and supersedes all prior or contemporaneous oral or written agreements. This Agreement and Exhibits may be amended only by a written agreement signed by both Parties, provided however, that Company may amend this Agreement from time to time upon 15 days' written notice to Customer, provided that such amendment does not materially change the scope or manner of Services or the Program that Company provides to Customer under the Agreement.

  1. Governing Law. This Agreement will be governed by the laws of the State of Florida, U.S. without regard to its conflict of laws provisions. The federal and state courts sitting in Hillsborough County, Florida, U.S. will have proper and exclusive jurisdiction and venue with respect to any disputes arising from or related to the subject matter of this Agreement.

  2. Notices. All notices shall be in writing, delivered personally, by certified or registered mail, return receipt requested, or by overnight courier, and shall be deemed to have been received when delivered in person or as of the date recorded on a signature card or similar proof of receipt, to the address on the signature blocks at the end of this Agreement. Notices also can be provided via electronic mail (“e-mail”). An e-mail notice shall not be deemed to have been received until the e-mail recipient acknowledges receipt with a response e-mail or acknowledges receipt via a return receipt function (if applicable).

  3. Assignment; Binding Effect. Customer may not assign or transfer this Agreement without the prior written consent of Company, such consent shall not be unreasonably withheld. Company may assign or transfer this Agreement, and/or any of its rights, duties, or obligations hereunder to any entity that is an Affiliate or subsidiary of Company or any successor organization assuming a controlling interest in Company or its assets. Company may use Providers employed or contracted by Company, including subcontracted third party provider groups. This Agreement shall inure to the benefit of and bind the Parties hereto and their respective heirs, representatives, successors and permitted assigns.

  4. Publicity.

    1. Generally. Other than as provided in this Agreement, neither Party will use for publicity, promotion or otherwise, any logo, name or mark of the other Party without that Party’s prior, written, express consent. Notwithstanding the foregoing, Company may use, without Customer’s consent, Customer’s name, logo and marks in marketing materials shared with individual prospective customers to identify Customer as a user of Company’s Services, but may not use Customer’s name, logo and marks in publicly shared materials unless Company receives Customer’s prior, written, express consent or Company follows the requirements of Section 23.2 or Section 23.3 below. Neither Party shall disclose the specific terms of this Agreement (including pricing) to any third party.

    2. Press Releases. Upon execution of this Agreement, the Parties shall collaborate on creation and distribution of a joint press release announcing their business relationship to be issued after the Execution Date, at a time mutually agreed to by the Parties. The written approval of both Parties will be required before the dissemination of any such press release. If Customer is satisfied with the Services provided, then Customer agrees to additional press releases, case studies, presentations, and other marketing and promotional materials in conjunction with Company.

    3. Promotional Communications. Company shall submit for Customer review any new promotional communications that substantially feature Customer's Brand Assets. Customer shall have five (5) business days to review and object to such communications. Customer's failure to timely respond shall constitute approval of such communications.

  5. Miscellaneous. Severability. The invalidity or unenforceability of any term or provision of this Agreement shall not affect the validity or unenforceability of any other term(s) or provision(s). Waiver. No waiver, including any waiver of breach, shall be valid unless in writing and signed by the Parties. Recitals/Captions. The recitals are incorporated into this Agreement, but the captions are used solely for convenience. Non-Discrimination. Each Party agrees that, in the performance of this Agreement, services will be provided without discrimination toward any patients, employees, or other persons to the extent prohibited by law. Force Majeure. Either Party shall be excused from delays in performing its obligations if resulting from causes beyond the reasonable control of the party, including default of vendors, acts of God, governmental actions, fire, flood, epidemic, pandemic, and embargoes. Counterparts. This Agreement may be executed in one or more counterparts, all of which together shall constitute only one agreement. Survival. The following sections shall survive expiration, nonrenewal, or termination of this Agreement: Sections 3.4, 9.3, 11.1, 12 through 22, and 24.

Exhibit A

Services

The Services to be provided under this Agreement include telemedicine, in person, and mental health (see Exhibit B for “Conditions of Use of Mobile App and Services”), as further described below.

Service

Description

Telemedicine

Primary Care and Urgent Care visits begin with telemedicine to speak with a provider for either diagnosis or next steps in treatment. Most primary care labs associated with a visit are covered under membership.

All memberships include 1 flu shot at a partner location.

Prescriptions listed in the Vitable Formulary are included at no cost when prescribed by a Vitable provider. Others are eligible for discounted rates.

In Person*

For available markets, providers will come in home or to the work site to conduct an annual physical or biometric screens.

Mental Health Coaching

Unlimited mental health coaching.

Therapy*

For available markets, members will receive 10 bi-weekly therapy sessions with a Vitable provider.

*These services are included in Vitable Primary Care Enhanced Plans only
​
​

Technical Standards for Services

  • Technical Support Services.

Company will provide phone/email support 9AM-6PM in the time zone where the Customer is operating unless specifically agreed otherwise, for the duration of this Agreement with a 48-hour response time when it comes to email support.

  • Availability of Services

Company will undertake commercially reasonable efforts to make the Services available 99.9% of the time, excluding any time referred to in the next sentence. Notwithstanding the foregoing, Company reserves the right to suspend Customer’s access to the Services: (i) for scheduled or emergency maintenance, or (ii) in the event Customer is in breach of this Agreement, including without limitation, failure to pay any amounts due to Company. Company will use reasonable efforts to give Customer prior written notice of suspension.

Provider Standards for Services

  • Licensing.

Company physician Providers shall be licensed in the State where the Participant is located at the time of the Service) to practice medicine. Similarly, any non-physician Providers shall be duly licensed, certified, or registered in the State where the Participant is located at the time of the Service) to practice their respective healthcare profession.

  • For each provision of Service, the Provider shall:

  • Conduct a medical or healthcare consult to assess the Participant’s clinical needs; and

  • Based upon the medical or healthcare consult, respond as follows:

    • Determine that the Participant’s condition is a life-threatening emergency, and direct the Participant to the nearest emergency facility;

    • Determine that the Participant’s condition is urgent but not a life-threatening emergency, and advise the Participant how to treat the condition, prescribe medication as necessary and allowed, and make a determination whether the Participant should contact his/her primary care physician or a specialist focused on the specific medical problem, as applicable; or

    • Determine that the Participant’s condition is not urgent and not a life-threatening emergency, and advise the Participant how to treat the condition, prescribe medication as necessary and allowed, advise the Participant to follow up with his/her primary care physician or a specialist focused on the specific medical problem, as applicable, and advise enrollment in the Program, when appropriate.

  • Provider Patient Relationship.

Only Participants who have completed the necessary steps to create a legally mandated Provider-patient relationship will receive Services by Company Providers. Necessary steps include:

  • Agreeing to Company’s informed consent form, conditions of use, and release of information policies including confirming an understanding that the Provider is not obligated to accept the Participant as a patient;

  • Completing a comprehensive medical history disclosure (MHD), via the Program platform or in-person as applicable. In the event the Participant fails to complete the MHD, Company will not assign the Participant to a Provider; and

  • Completing a documented patient evaluation, including history and examination to establish the diagnosis for which any drug is prescribed.

  • Prescriptions.

All prescribing shall be done in accordance with applicable federal and State law. Providers do not guarantee that any Participant will receive a prescription.

  • Participant Complaints.

The number of legitimate service complaints handled by Company related to how a Service was delivered by the Providers in any month should be less than 0.50% of the entire Participant database. Company shall respond to such complaints immediately and shall use best efforts to resolve such complaints within 48 business hours.
​

Exhibit B

Conditions of Use of Mobile App and Services

Access to all the features and/or functionalities of the Services may require the Customer to download and/or install certain Company mobile application software (“Mobile App”.) Subject to Customer’s compliance with all of the terms and conditions of this Agreement, Company hereby grants Customer a limited, personal, non-sublicensable, non-transferable, nonexclusive license to internally use the Mobile App, only in accordance with any accompanying documentation, specifications, and instruction made available by Company (the “Documentation”) and only as required to access the Services in accordance with this Agreement.

Customer will not, and will not permit any third party to: reverse engineer, decompile, disassemble or otherwise attempt to discover the source code, object code or underlying structure, ideas or algorithms of the Services or any software (including without limitation, the Mobile App), documentation or data related to the Services (provided that reverse engineering is prohibited only to the extent such prohibition is not contrary to applicable law); modify, translate, or create derivative works based on the Services or software; except as expressly permitted herein, use the Services or software for timesharing or service bureau purposes; use the Services or software other than in accordance with this Agreement and in compliance with all applicable laws and regulations (including but not limited to any privacy laws, and laws and regulations concerning intellectual property, consumer and child protection, obscenity or defamation); except as expressly permitted by the functionalities of the Services, run or use any processes that run or are activated while Customer is not logged on to the Services or that “crawl,” “scrape,” or “spider” the Services; or use the Services or software in any manner that (1) is harmful, fraudulent, deceptive, threatening, abusive, harassing, tortious, defamatory, vulgar, obscene, libelous, or otherwise objectionable (including without limitation, accessing any computer, computer system, network, software, or data without authorization, breaching the security of another user or system, and/or attempting to circumvent any user authentication or security process), (2) impersonates any person or entity, including without limitation any employee or representative of Company, or (3) contains a virus, trojan horse, worm, time bomb, unsolicited bulk, commercial, or “spam” message, malware, or other harmful computer code, file, or program (including without limitation, password guessing programs, decoders, password gatherers, keystroke loggers, cracking tools, packet sniffers, and/or encryption circumvention programs).

Exhibit C

Payment Schedule

Due Date: All fees will be invoiced to Customer on a monthly basis and payment due net thirty (30) days from receipt of invoice.

PEPM Fee: The total PEPM Fee shall equal = per employee fee times the number of employees, which is a total of the first month of the Term. In accordance with Section 7.2 of the Agreement, should the total number of employees in a month deviate from the number provided in this Exhibit D by fifteen percent (15%) or more, Company reserves the right to adjust the PEPM fee.

Fees For Services: Customer shall be subject to fees for specific services provided to Participants after their limit is reached (10 visits per year):

  • Mental Health: $90/visit

Individual Occupational Health Voucher Fees*:

  • Labcorp QTF Tests: $80

  • Quest QTF Tests: $99

  • Labcorp Drug/Alcohol Tests: $60

  • CVS Physicals: $120

*Fee Schedule is subject to change to accommodate price increases incurred by Vitable from vendor partners. Customer will receive 30 days notice before any Fee Schedule changes.

Exhibit D

BUSINESS ASSOCIATE AGREEMENT
​

This Business Associate Agreement (hereinafter “BAA”) is made and entered into by and between Vitable Health Services, P.A.(the “Business Associate”) and Customer on behalf of itself and as a plan sponsor of one or more group health plans (“Covered Entity”)(collectively, “Customer”). Customer desires to offer certain health services to its employees. Because Business Associate may be considered a business associate of Customer under HIPAA (defined below) in its provision of these health services to the extent Business Associate assists in Customer’s health plan operations, the terms of this BAA shall govern the sharing and use of PHI (defined below) by the parties.

RECITALS

WHEREAS, Business Associate may be acting as a business associate to Customer under the Standards for Privacy of Individually Identifiable Health Information under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations including the 2013 HIPAA Omnibus Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and the Genetic Information Nondiscrimination Act; (collectively referred to as “HIPAA”) to the extent Business Associate assists in Customer’s health plan operations, and the Customer and Business Associate are obliged to comply with certain requirements set forth in HIPAA; and

WHEREAS, Business Associate and Customer have entered into a Master Services Agreement (“Agreement”) pursuant to which Business Associate provides certain telehealth services described in the Agreement (the “Services”) for the benefit of Customer’s employees and dependents; and

WHEREAS, Business Associate employs health care providers to provide the Services; and

WHEREAS, in the course of managing the Services, Business Associate may receive, host, use and transmit Protected Health Information (“PHI”); and

WHEREAS, the Customer anticipates that it may disclose PHI to Business Associate; and

WHEREAS, this BAA sets forth the terms and conditions pursuant to which PHI will be handled between the Business Associate and the Customer and with third parties during the term of this BAA and thereafter.

NOW, THEREFORE, in consideration of the mutual promises below, and the exchange of PHI contemplated by this BAA, Business Associate and Customer agree as follows:

DEFINITIONS

The following terms shall have the meaning set forth below. Capitalized terms used in this BAA and not otherwise defined shall have the meanings ascribed to them in the HIPAA Regulations.

“Breach” shall have the meaning given under and 45 C.F.R. § 164.402.

“Designated Record Set” shall have the meaning given such term under 45 C.F.R. § 164.501.

“Disclose” and “Disclosure” mean, with respect to PHI, the release, transfer, provision of access to, or divulging in any other manner of PHI outside of Business Associate or to other than member of its Workforce, as set forth in 45 C.F.R. § 160.103.

“Electronic PHI” or “e-PHI” means PHI that is transmitted or maintained in electronic media, as set forth in 45 C.F.R. § 160.103.

“Protected Health Information” and “PHI” mean any information, whether oral or recorded in any form or medium, provided by Customer to Business Associate, that: (a) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual, or the past, present or future payment for the provision of health care to an individual; (b) identifies the individual (or for which there is a reasonable basis for believing that the information can be used to identify the individual); and (c) shall have the meaning given to such term under 45 C.F.R. § 160.103. Protected Health Information includes e-PHI.

“Required by Law” shall have the meaning given to such term under 45 C.F.R. § 160.103.

“Security Incident” shall have the meaning given to such term under 45 C.F.R. § 164.304.

“Services” shall mean the services for or functions on behalf of Customer performed by Business Associate pursuant to the Agreement that constitute a Business Associate relationship, as set forth in 45 C.F.R. § 160.103.

“Unsecured PHI” shall have the meaning given to such term under 42 U.S.C. § 17932(h), 45 C.F.R. § 164.402, and guidance issued pursuant to the HITECH Act including, but not limited to the guidance issued on April 17, 2009 and published in 74 Federal Register 19006 (April 27, 2009) by the Secretary.

“Use” or “Uses” mean, with respect to PHI, the sharing, employment, application, utilization, examination or analysis of such PHI within Business Associate’s internal operations, as set forth in 45 C.F.R. § 160.103.

“Workforce” shall have the meaning given to such term under 45 C.F.R. § 160.103.

OBLIGATIONS OF BUSINESS ASSOCIATE

2.1.Permitted Uses and Disclosures of Protected Health Information. Business Associate shall not Use or Disclose PHI received, accessed, maintained, or created for or on behalf of Customer except to perform the Services required by the Agreement, or as permitted by this BAA or Required by Law. Business Associate shall not Use or Disclose PHI in any manner that would constitute a violation of the HIPAA Regulations if so Used or Disclosed by Customer. Without limiting the generality of the foregoing, Business Associate is permitted to (i) Use PHI for the proper management and administration of Business Associate; (ii) Use and Disclose PHI to carry out the legal responsibilities of Business Associate, provided that with respect to any such Disclosure either: (a) the Disclosure is Required by Law; or (b) Business Associate obtains an agreement from the person to whom the PHI is to be Disclosed that such person will hold the PHI in confidence and will not Use and further Disclose such PHI except as Required by Law and for the purpose(s) for which it was Disclosed by Business Associate to such person, and that such person will notify Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached; (iii) Use PHI for Data Aggregation purposes in connection with the Health Care Operations of Customer; and (iv) Use PHI for purposes of de-identification of the PHI.

2.2.Adequate Safeguards of PHI. Business Associate shall comply with Subpart C of 45 C.F.R. Part 164 with respect to PHI, to reasonably and appropriately protect the confidentially, integrity, and availability of e-PHI that it creates, receives, maintains or transmits on behalf of Customer.

2.3.Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in violation of the requirements of this BAA.

2.4.Reporting Security Incidents and Non-Permitted Uses or Disclosures.

Business Associate shall notify Customer of any Use or Disclosure by Business Associate or its Subcontractors that is not specifically permitted by this BAA no later than ten (10) business days after becoming aware of such Security Incident or non-permitted Use or Disclosure, in accordance with the notice provisions set forth herein. Notwithstanding the foregoing, Business Associate and Customer acknowledge the ongoing existence and occurrence of attempted but ineffective Security Incidents that are trivial in nature, such as pings and other broadcast service attacks, and Customer acknowledges and agrees that no additional notification to Customer of such ineffective Security Incidents is required, as long as no such incident results in unauthorized access, Use or Disclosure of PHI. If Business Associate determinates that a Breach of Unsecured PHI has occurred, Business Associate shall provide a written report to Customer without unreasonable delay but no later than thirty (30) calendar days after discovery of the Breach. To the extent that information is available to Business Associate, Business Associate’s written report to Customer shall be in accordance with 45 C.F.R. § 164.410(c).

2.5.Delegated Responsibilities. To the extent that Business Associate carries out one or more of Customer’s obligations under Subpart E of 45 C.F.R. Part 164, Business Associate must comply with the requirements of Subpart E that apply to Covered Entities in the performance of such obligations.

2.6.Availability of Internal Practices, Books, and Records to Government. Business Associate agrees to make its internal practices, books and records relating to the Use and Disclosure of Customer’s PHI available to the Secretary for purposes of determining Customer’s compliance with HIPAA, the HIPAA Regulations, and the HITECH Act.

2.7.Access to and Amendment of Protected Health Information. To the extent that Business Associate maintains a Designated Record Set on behalf of Customer, Business Associate shall make the PHI it maintains (or which is maintained by its Subcontractors) in such Designated Record Set available to Customer for inspection and copying to enable Customer to fulfill its obligations under 45 C.F.R. § 164.524 within fifteen (15) business days of a request by Customer. To the extent that Business Associate maintains a Designated Record Set on behalf of Customer, Business Associate shall amend the PHI it maintains (or which is maintained by its Subcontractors) in such Designated Record Sets to enable the Customer to fulfill its obligations under 45 C.F.R. § 164.524(c)(2) within fifteen (15) business days of a request by Customer.

2.8.Accounting. To the extent that Business Associate maintains a Designated Record Set on behalf of Customer, within thirty (30) calendar days of receipt of a request from Customer or an individual for an accounting of disclosures of PHI, Business Associate and its Subcontractors shall make available to Customer the information required to provide an accounting of disclosures to enable Customer to fulfill its obligations under 45 C.F.R. § 164.528.

2.9.Use of Subcontractors. Business Associate shall require each of its Subcontractors that creates, receives, maintains, or transmits PHI on behalf of Business Associate, to execute a written agreement that includes substantially the same restrictions and conditions that apply to Business Associate under this BAA with respect to PHI.

2.10.Minimum Necessary. Business Associate (and its Subcontractors) shall, to the extent practicable, limit its request, Use, or Disclosure of PHI to the minimum amount of PHI necessary to accomplish the purpose of the request, Use or Disclosure, in accordance with 42 U.S.C. § 17935(b) and 45 C.F.R. § 164.502(b)(1) or any other guidance issued thereunder.

TERM AND TERMINATION

3.1.Term. Subject to the provisions of Section 3.2, the term of this BAA shall be effective as of the Execution Date and shall terminate as of the date that all of the PHI provided by Customer to Business Associate, or created or received by Business Associate on behalf of Customer is destroyed or returned to Customer, or if it is infeasible to return or destroy the PHI, protections are extended to such information.

3.2.Termination for Cause. In addition to and notwithstanding the termination provisions set forth in the Agreement, upon Customer’s or Business Associate’s knowledge of a material breach or violation of this BAA by the other Party, the non-breaching Party shall either: (a) Notify the breaching Party of the breach in writing, and provide an opportunity for the breaching Party to cure the breach or end the violation within thirty (30) calendar days of such notification; provided that if the breaching Party fails to cure the breach or end the violation within such time period to the satisfaction of non-breaching Party, non-breaching Party may immediately terminate this BAA and the Agreement upon written notice to the breaching Party; or (b) Upon thirty (30) calendar days written notice to breaching Party, immediately terminate this BAA and the Agreement if the non-breaching Party determines that such breach cannot be cured.

3.3.Disposition of Protected Health Information Upon Termination. Upon termination or expiration of this BAA, Business Associate shall either return or destroy all PHI received from, or created or received by Business Associate on behalf of Customer, that Business Associate still maintains in any form and retain no copies of such PHI. If Customer. If return or destruction is not feasible, Business Associate shall continue to extend the protections of this BAA to the PHI for as long as Business Associate retains the PHI and limit further Uses and Disclosures of such PHI to those purposes that make the return or destruction of the PHI infeasible.

MISCELLANEOUS

4.1.Amendment to Comply with Law. This BAA shall be deemed amended to incorporate any mandatory obligations of Customer or Business Associate under the HITECH Act and its implementing HIPAA Regulations. Additionally, the Parties agree to take such action as is necessary to amend this BAA from time to time as necessary for Customer to implement its obligations pursuant to HIPAA, the HIPAA Regulations, or the HITECH Act.

4.2.Relationship to Agreement Provisions. In the event that a provision of this BAA is contrary to a provision of the Agreement, the provision of this BAA shall control. Otherwise, this BAA shall be construed under, and in accordance with, the terms of such the Agreement, and shall be considered an amendment of and supplement to such the Agreement, subject to Section 4.3 below.

4.3.Notices. Any notices or communications hereunder shall be in writing by certified mail, return receipt requested, or delivered by a nationally recognized courier service with delivery confirmation, such as FedEx, or by facsimile (with evidence of receipt) at the addresses that follow the signature blocks at the end of this BAA.

4.4.Relationship of Parties. Notwithstanding anything to the contrary in the Agreement, Business Associate is an independent contractor and not an agent of Customer under this BAA. Business Associate has the sole right and obligation to supervise, manage, contract, direct, procure, perform or cause to be performed all Business Associate obligations under this BAA.

4.5.Interpretation. This BAA shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HIPAA Regulations and the HITECH Act. The parties agree that any ambiguity in this BAA shall be resolved in favor of a meaning that complies and is consistent with such laws.

4.6.No Third Party Beneficiaries. Nothing express or implied in this BAA is intended to confer, nor shall anything herein confer, upon any person other than the Parties and the respective successors or assigns of the Parties, any rights, remedies, obligations, or liabilities whatsoever.

4.7.Choice of Law. This BAA shall be governed by the laws of the State of Florida regardless of the choice of law rules of any jurisdiction. Any ambiguities in this BAA shall be resolved in a manner that allows Customer and Business Associate to comply with the Privacy Rule, and, if applicable, the Security Rule. The parties hereby agree and consent that the exclusive venue and jurisdiction for any and all disputes arising under or related to this BAA shall be in the federal or state courts in Hillsborough County, Florida and waive any contention that any such court is an improper venue for such disputes.

4.8.Counterparts; Electronic Signatures. This BAA may be executed in one or more counterparts, all of which together shall constitute only one agreement. If any signature is delivered by facsimile or email or is signed in any electronic format, such signature shall create a valid and binding obligation with the same force and effect as if such signature were handwritten.

The Parties hereto have executed this BAA as of the Execution Date.

Did this answer your question?