Master Subscription and License Agreement

THIS AGREEMENT is entered into as of the effective date of the applicable quote (the “Quote”) (the “Effective Date”) by and between the customer identified on such quote (hereinafter referred to as “CUSTOMER”) and EPR Systems USA, Inc., a Delaware corporation, (hereinafter referred to as “EPR” or “Vendor”).

WHEREAS EPR is engaged in the business of designing and developing computer software systems and related products and has created and developed a software package called EPR FireWorks that is capable of supplying emergency agencies with an innovative, comprehensive, and integrated records management solution; and

WHEREAS CUSTOMER is engaged in providing emergency and rescue services and desires to utilize such Software to support the management of its Fire & EMS operations; and

WHEREAS EPR and CUSTOMER believe it is in their mutual interest and desire to enter into an agreement whereby CUSTOMER would use EPR’s Software pursuant to the terms and conditions hereinafter provided.

The above recitals are hereby incorporated and made a part of this Agreement as if fully recited hereby.

NOW, THEREFORE, for and in consideration of the mutual promises and covenants contained herein, the sufficiency of which is hereby mutually acknowledged, the parties hereto hereby agree as follows

1. Purchase.

1.1 CUSTOMER shall purchase, and EPR shall sell the goods and/or services set forth in the applicable Quote.

2. Terms; Compensation.

2.1 This Agreement shall be subject to the terms and conditions contained herein and as provided by the Quote and Exhibit A, attached hereto and made a part hereof. The total fees payable by CUSTOMER for the initial term of this Agreement shall be set forth in the applicable Quote and may include subscription services and any applicable one-time implementation and training fees described therein.

2.2 Uplift on Renewal: Provider reserves the right to adjust subscription fees at the time of renewal upon written notice to Customer at least thirty (30) days prior to the renewal date. Any annual increase will not exceed three percent (3%).

3. Definitions.

3.1 In this Agreement, unless the context otherwise requires:

a) “Acceptance” means the acceptance of the Deliverables in accordance with the Section entitled Inspection of the Deliverables of this Agreement.

b) “Confidential Information” means those confidential, scientific, technical, financial, business and other information, manufacturing, marketing, sales and distribution data, scientific and test data, documents, methods, techniques, formulations, operations, know-how, experience, skills, trade secrets, computer programs and systems, processes, practices, ideas, inventions, designs, samples, plans and drawings recognized as exempt or immune from disclosure pursuant to applicable federal or State law;

c) “Contract Price” means the amounts referred to or expressed in the applicable Quote to be payable by CUSTOMER to EPR for the Deliverables.

d) “EPR FireWorks” means computer software, converted data, system interfaces, databases and documentation that are to be supplied by ·EPR and implemented by CUSTOMER, including the Deliverables to be provided by EPR to CUSTOMER all as contemplated hereunder, as the same may be upgraded, enhanced, or otherwise modified or adapted from time to time.

e) “Deliverables” means the whole of the services including, without limitation, system set-up, data conversion, training, maintenance, and software programs required to be done, furnished, or performed by EPR in accordance with the terms of this Agreement.

f) “SaaS” means software-as-a-service that EPR hosts (directly or indirectly) for Customer’s use on a periodic subscription basis.

g) “Improvements” means any improvements, updates, variations, modifications, alterations, additions, error corrections, enhancements, functional changes or other changes to the licensed computer programs and documentation, including, without limitation:

(i) improvements and upgrades to improve software efficiency and maintainability.

(ii) improvements and upgrades to improve operational integrity and efficiency.

(iii) functional improvements or changes which support legislation, regulatory or other lawful requirements.

(iv) changes or modifications to correct errors; and

(v) additional licensed computer programs to otherwise update the licensed computer programs.

h) “Live Production” means use of EPR Fireworks system in the regular business operation of CUSTOMER, which shall be twenty-four (24) hours per day, seven (7) days per week. “Maintenance Access Period”, unless otherwise specified in the Agreement, means an uninterrupted time period of hours each day beginning Sunday from 2:00 AM – 2 PM, and weekdays Monday to Friday, between 8:00 a.m. and 5:00 p.m. EST, during which EPR shall have personnel available to receive/respond to email and/or telephone support for maintenance services including remote connect. All requests for support generate a ticket that is trackable by the customer, and metrics are available upon request.

i) 24/7 support is available for Severity Level 1 as defined below.

Severity Level 1	Mission-critical customer business process(s) unable to function – The System is not functioning, and no workaround is acceptable to the Customer, thereby preventing a department or workgroup from performing a mission-critical business function(s).
Severity Level 2	Significant impact to Mission critical Customer business process(s) – A major problem impedes the ability to perform mission critical business function(s) due to major functionality not working. A temporary work-around that is acceptable to the customer is available.
Severity Level 3	Not able to accomplish all functions – Minor function(s) not working causing non-critical work to back up.
SeverityLevel 4	Inconvenience – The System is causing a minor disruption in the way tasks are performed but does not stop workflow. Able to accomplish all functions, but not as efficiently as normal. May include cosmetic issues – especially in constituent- facing application

Table 4: Service Level Standards Measure	Metric	Standard
Availability	System is available for use	99.95%
Performance	System response time	100 percent response time during User Acceptance Testing.
Problem Management	Severity Level 1 Problem Resolved	99 percent resolved within 1 business day.
	Severity Level 2 Problem Resolved	99 percent resolved within 2 business days.
	Severity Level 3 Problem Resolved	80 percent resolved in 5 business days. 100 percent in 15 business days.
	Severity Level 4 Problem Resolved	80 percent resolved in 30 business days. 100 percent in 60 business days.
Vendor Help Desk	Help Desk call wait time, during hours of support.	At least 90 percent of calls are answered in 2 minutes or less (a call pick system may be used). At Least 90 percent of Help Desk emails are answered in 30 min or less.
	Help Desk call busy signal.	Less than 5 percent of calls get a busy signal.
	Help Desk calls for Severity Level 1 or 2	Severity Level 1 or 2 call back time less than 30 min.

j) “Response Time” means the period of time beginning with a bona fide attempt to reach EPR by telephone, or other oral means, or email written means has been made by CUSTOMER during a Maintenance Access Period, and ending with the response of EPR;

k) “Time to Repair” means that portion of the time that EPR FireWorks system cannot be used because of error, defect, deficiency, failure, problem or non-conformance to functional specifications, starting from the response of EPR and ending with the turnover of the Deliverables to CUSTOMER in proper working order.

l) “Unapproved Modifications” means modifications to the licensed computer programs not approved by EPR but made by CUSTOMER or on its behalf by someone other than EPR.

4. Representations.

4.1 EPR represents and warrants, and it is a condition of this Agreement, that:

(a) EPR is a corporation duly organized and existing in good standing under the laws of Florida and registered to carry on business as may be contemplated hereunder.

(b) EPR has the ability and authority to enter into this Agreement, and the execution and performance of this Agreement or any part of this Agreement by EPR has been duly authorized by all requisite corporate action.

(c) The execution and performance of this Agreement or any part of this Agreement by EPR does not and will not violate any contract or other obligation of EPR, and EPR knows of no circumstances which would prevent EPR’s performance of this Agreement or any part thereof.

(d) EPR is competent to perform its obligations hereunder, and has sufficient manpower, resources, skills, experience, and all such other materials as may be required to meet its obligations on or before the required date(s).

(e) EPR has the necessary qualifications (including knowledge, experience, and skill) to provide the Deliverables, and will provide the Deliverable in a diligent, professional and timely manner; and

(f) The representations and warranties made by EPR herein, including the recitals and all schedules hereto (in particular, in EPR’s Proposal), are reasonable and correct, and may be relied upon by CUSTOMER and shall continue to be reasonable and correct, and may be relied upon by CUSTOMER throughout the performance of this Agreement.

5. Grant of Subscription.

5.1 Grant of Subscription: Saas. For SaaS, during the term of this Agreement, Customer may access and use the SaaS and Reporting Services, subject to Customer’s compliance with the Use

Restrictions and other limitations contained in this Agreement.

6. Ownership of Data.

6.1 As between EPR and Customer, all Customer Data shall be owned by Customer.

7. Term.

7.1 This Agreement shall have an initial term of One (1) year, commencing on the Effective Date. Thereafter, the Agreement may be renewed for successive one-year terms upon the mutual written agreement of the parties, subject to the appropriation and availability of funds.

8. Trademarks and Proprietary Notices.

8.1 EPR expressly reserves all rights to its own tradenames, logos, trademarks, other identifying symbols and all of its proprietary rights in its product packaging or labelling of any licensed computer programs. CUSTOMER shall not acquire any right, title or interest in or to any such tradename, logo, trade- mark, or other identifying symbols of EPR.

8.2 Notwithstanding anything to the contrary provided for herein, CUSTOMER shall retain exclusive ownership of all CUSTOMER generated and/or supplied data. In no event shall such CUSTOMER-related data or information be used by EPR without the prior written consent of the CUSTOMER.

9. Payment by a 3rd Party Payer.

9.1 Third-Party Payer. If Customer desires to use a third-party entity, including, without Limitation, Digitech Computer, LLC, to pay some or all of the Fees on behalf of Customer (a”Third-Party Payer“), then (i) CUSTOMER shall notify EPR in writing of the designated Third Party Payer and the terms of the arrangement, (ii) the Third-Party Payer will enter into a written agreement with EPR regarding such arrangement, (iii) Customer may replace the Third-Party Payer by written notice to EPR (provided that no such change shall be made until the then-current Term’s renewal), (iv) references within this Section 9 to Customer’s responsibility for Fees shall be understood to refer to the Third-Party Payer when applicable, and (v) Customer shall remain responsible for payment if the Third-Party Payer does not pay the Fees.

9.2 Either CUSTOMER or the Third-Party Payer, if applicable, shall pay EPR in accordance with the Payment Schedule described in the applicable Quote within forty-five (45) days of receipt of a proper invoice. Any undisputed amount not paid within forty-five (45) days shall accrue interest at the lesser of 1.5% per month or the maximum rate permitted by law.

9.3 CUSTOMER shall notify EPR, within Fifteen (15) days of receipt of a proper invoice, of any inadequacy of the invoice or of the supporting documentation, and where any such notice is given within that period, the date for payment of the amount invoiced shall be postponed until EPR remedies the inadequacy to the satisfaction of CUSTOMER, at no additional cost to CUSTOMER. Payment will be made by CUSTOMER within forty-five (45) days of receipt of a proper invoice issued by EPR.

10. Piggybacking Clause.

10.1 It is understood and agreed by Customer and EPR Systems that any governmental entity may purchase the services specified herein in accordance with the prices, terms, and conditions of this agreement. It is also understood and agreed that each local entity will establish its own contract with EPR Systems, be invoiced therefrom and make its own payments to EPR Systems in accordance with the terms of the contract established between the new governmental entity and EPR Systems. It is also hereby mutually understood and agreed that the Customer is not a legally bound party to any contractual agreement made between EPR Systems and any entity other than Customer.

11. Confidentiality.

11.1 Definition. “Confidential Information” means any non-public information disclosed by either party (the “Disclosing Party”) to the other party (the “Receiving Party”), whether orally, in writing, or in any other form, that is designated as confidential or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure – including, without limitation, each party’s business, financial, and technical information and, in the case of EPR, its software, source code, system architecture, security documentation, and pricing, and in the case of CUSTOMER, information exempt or immune from disclosure under applicable public records law.

11.2 Obligations. Each party shall (a) protect the other party’s Confidential Information using at least the same degree of care it uses to protect its own confidential information of a similar nature, but in no case less than a reasonable degree of care; (b) not disclose the other party’s Confidential Information to any third party except as permitted herein; and (c) use the other party’s Confidential Information solely to perform its obligations or exercise its rights under this Agreement.

11.3 Exceptions. Confidential Information does not include information that (a) is or becomes publicly available through no fault of the Receiving Party; (b) was rightfully known to the Receiving Party prior to disclosure; (c) is rightfully received from a third party without breach of any confidentiality obligation; or (d) is independently developed by the Receiving Party without use of or reference to the Disclosing Party’s Confidential Information.

11.4 Compelled Disclosure. A Receiving Party’s good faith compliance with a valid subpoena, court order, or applicable public records law (including, for CUSTOMER, the Louisiana Public Records Law, La. R.S. 44:1 et seq., or other applicable federal or state disclosure requirements) shall not constitute a breach of this Agreement, provided that, to the extent legally permitted, the Receiving Party gives the Disclosing Party prompt notice of the requirement so the Disclosing Party may seek a protective order or other appropriate remedy.

11.5 Return or Destruction. Upon termination or expiration of this Agreement, each party shall, upon the other party’s written request, return or destroy all Confidential Information of the other party in its possession, except to the extent retention is required by law or a party’s bona fide document retention policy.

12. Law and Jurisdictions.

This Agreement shall be governed by and construed in accordance with the laws of the State of Louisiana. Exclusive venue for any action arising out of or relating to this Agreement shall lie in the Fourth Judicial District Court for the Parish of Ouachita, State of Louisiana.

13. Notice.

Any notice required under this Agreement shall be in writing and may be given by personal delivery, first-class mail, courier, or email to the address or email address designated by the applicable party in the Quote or otherwise provided in writing. Notice shall be deemed effective upon personal delivery, upon transmission by email, or five (5) days after deposit in the United States mail, postage prepaid.

14. Modification.

This Agreement may only be modified or amended by written instrument signed by all parties hereto.

15. Interest.

EPR hereby waives any and all claims or rights to interest on money claimed to be due pursuant to this Agreement and waives any and all such rights to interest to which it may otherwise be entitled pursuant to law, including, but not limited to, pursuant to the Local Government Prompt Payment Act, as amended. The provisions of this paragraph shall survive any expiration, completion and/or termination of this Agreement.

16. Severability.

The terms of this Agreement shall be severable. In the event any of the terms or the provisions of this Agreement are deemed to be void or otherwise unenforceable for any reason, the remainder of this Agreement shall remain in full force and effect.

17. Compliance with Law.

Notwithstanding any other provision of this Agreement, it is expressly agreed and understood that in connection with the performance of this Agreement, EPR shall comply with all applicable federal, state, and other requirements of law, including, but not limited to, any applicable requirements regarding prevailing wages, minimum wage, workplace safety and legal status of employees. Without limiting the foregoing, EPR hereby certifies, represents, and warrants to the customer that all EPR employees and/or agents who will be providing products and/or services with respect to this Agreement shall be legally authorized to work in the United States. EPR shall also, at its expense, secure all permits and licenses, pay all charges and fees, and give all notices necessary and incident to the due and lawful prosecution of the work, and/or the products and/or services to be provided for in this Agreement. CUSTOMER shall have the right to audit any records in the possession or control of EPR to determine EPR’s compliance with the provisions of this section. In the event CUSTOMER proceeds with such an audit, EPR shall make available to CUSTOMER EPR’s relevant records at no additional cost. CUSTOMER shall pay any and all costs associated with any such audit.

18. Execution.

This Agreement may be executed by execution of the applicable Quote referencing this Agreement. The Quote may be executed in counterparts, each of which shall be an original, and all of which shall constitute one and the same Agreement. Signatures transmitted electronically, including by PDF, electronic signature platform, or other electronic means, shall be deemed original signatures and shall be binding for all purposes. No party shall contest the validity or enforceability of this Agreement or any Quote based on the method of transmission or execution. Upon request of either party, any electronically executed document may be re-executed in original form, but failure to do so shall not affect its validity or enforceability.

19. Conflict.

In the event of any conflict between the terms and provisions of this Agreement and the applicable Quote and Exhibit A hereto, the terms and provisions of this Agreement shall supersede and control.

20. Limitation of Damages.

Except for (i) either party’s indemnification obligations under this Agreement, (ii) either party’s breach of its confidentiality obligations, (iii) EPR’s breach of its data security or HIPAA obligations, or (iv) damages arising from a party’s gross negligence, willful misconduct, or violation of applicable law, in no event shall either party’s aggregate monetary liability arising out of or relating to this Agreement exceed the total fees paid or payable by CUSTOMER to EPR under this Agreement in the twelve (12) months preceding the event giving rise to the claim. In no event shall either party be liable to the other for any consequential, special, incidental, or punitive damages, or damages resulting from loss of profits, revenue, or data, even if advised of the possibility of such damages.

21. Transfer of Title/Risk.

Transfer of title, and risk of loss shall pass to CUSTOMER upon delivery of the goods. All transportation and delivery shall be at EPR’s sole expense

22. Indemnification.

To the fullest extent permitted by law, EPR agrees to and shall indemnify, defend and hold harmless CUSTOMER, its officers, employees, boards and commissions from and against any and all claims, suits, judgments, costs, attorney’s fees, damages or any and all other relief or liability arising out of or resulting from or through any acts or negligent acts or omissions of EPR or EPR’s officers, employees, agents or subcontractors in the performance of this Agreement, including but not limited to, all goods delivered or services or work performed hereunder. In the event of any action against CUSTOMER, its officers, employees, agents, boards or commissions covered by the foregoing duty to indemnify, defend and hold harmless, such action shall be defended by legal counsel of CUSTOMER’s choosing.

23. Relationship Between the Parties.

This Agreement shall not be construed so as to create a joint venture, partnership, employment or other agency relationship between the parties hereto.

24. Waiver.

Neither party hereto shall be responsible for any consequential, indirect, punitive or incidental damages, for any reason whatsoever. Any delay or failure to enforce any rights by either party arising out of or pursuant to this Agreement shall not constitute, and shall not be construed as, a waiver of any such rights.

Notwithstanding the foregoing, nothing in this Section shall be construed to waive or otherwise limit EPR’s indemnification obligations under this Agreement; provided that the limitations on consequential, indirect, punitive, and incidental damages set forth herein shall continue to apply. Nothing in this Section shall limit EPR’s obligation to reimburse CUSTOMER for costs expressly recoverable under Exhibit A.

25. Limitation of Actions

Except for claims arising from (i) a party’s payment obligations under this Agreement, (ii) a party’s indemnification obligations, or (iii) a party’s breach of its confidentiality obligations, neither party shall bring any cause of action or claim for damages against the other party or its affiliates, officers, employees, agents, or attorneys arising out of or relating to this Agreement more than two (2) years after the date the claim accrued, regardless of the form of action or forum in which it is brought.

26. No Other Agreements.

This Agreement, together with the applicable Quote and any exhibits expressly incorporated herein, constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior or contemporaneous proposals, discussions, communications, and agreements, whether oral or written. This Agreement may be amended only by a written instrument executed by both parties, except that additional Quotes referencing this Agreement may be executed in accordance with its terms.

27. Appropriation of Funds.

The obligations of the CUSTOMER under any contract for any fiscal year are subject to and contingent upon the appropriation of funds sufficient to discharge the obligations which accrue in that fiscal year and authorization to spend such funds for the purposes of the contract. If, for any fiscal year the term of the Contract, sufficient funds for the discharge of the CUSTOMER’s obligations under this Agreement are not appropriated and authorized, then this Agreement shall terminate as of the last day of the preceding fiscal year, or when such appropriated and authorized funds are exhausted, whichever is later, without liability to CUSTOMER for damages, penalties, or other charges on account of such termination.

The person executing this Agreement certifies that s/he has been authorized by CUSTOMER to commit CUSTOMER contractually and has been authorized to execute this Agreement on its behalf.

The person executing this Agreement on behalf of EPR certifies that s/he has been authorized by EPR to commit EPR contractually and has been authorized to execute this Agreement on its behalf.

28. HIPAA Compliance.

The Business Associate Agreement between EPR and the CUSTOMER, attached hereto as Exhibit A, is made part of this Agreement.

29. System Backup.

The parties agree and acknowledge that all EPR FireWorks system data shall be housed in the secure Amazon Web Services cloud environment, with security, back up and disaster recovery built-in.

30. Data Conversion.

CUSTOMER agrees to provide EPR with a copy of CUSTOMER’s database for data conversion purposes, and EPR agrees to destroy such data upon completion of the conversion.

31. Compatibility.

EPR guarantees compatibility with Microsoft Entra ID SSO.

32. Scrutinized Companies and Business Operations Certification; Termination. (FL Customers) Certification(s).

By its execution of this Agreement, the Vendor hereby certifies to the Customer that the Vendor is not on the Scrutinized Companies that Boycott Israel List, created pursuant to Section 215.4725, Florida Statutes, nor is the Vendor engaged in a boycott of Israel, nor was the Vendor on such List or engaged in such a boycott at the time it submitted its bid, proposal, quote, or other form of offer, as applicable, to the Customer with respect to this Agreement.

Additionally, if the value of the goods or services acquired under this Agreement are greater than or equal to One Million Dollars ($1,000,000), then the Vendor further certifies to the Customer as follows:

the Vendor is not on the Scrutinized Companies with Activities in Sudan List, created pursuant to Section 215.473, Florida Statutes; and
the Vendor is not on the Scrutinized Companies with Activities in the Iran Petroleum Energy Sector List, created pursuant to Section 215.473, Florida Statutes; and
the Vendor is not engaged in business operations (as that term is defined in Florida Statutes, Section 287.135) in Cuba or Syria; and
the Vendor was not on any of the Lists referenced in this subsection A(ii), nor engaged in business operations in Cuba or Syria when it submitted its proposal to the Customer concerning the subject of this Agreement.

The Vendor hereby acknowledges that it is fully aware of the penalties that may be imposed upon the Vendor for submitting a false certification to the Customer regarding the foregoing matters.

33. Termination.

33.1 Termination for Cause. Either party may terminate this Agreement upon written notice if the other party materially breaches this Agreement and fails to cure such breach within thirty (30) days after receipt of written notice describing the breach. If the breach is not reasonably capable of cure within thirty (30) days, the breaching party shall commence cure within such period and diligently pursue cure to completion.

33.2 Service Failure. CUSTOMER may terminate this Agreement upon written notice if EPR repeatedly fails to meet the service level obligations set forth in this Agreement and such failures materially impair CUSTOMER’s use of the Software.

33.3 Non-Appropriation. Nothing in this Section shall limit CUSTOMER’s right under section 27.

33.4 Effect of Termination. Upon expiration or termination of this Agreement, EPR shall provide CUSTOMER a complete copy of CUSTOMER Data in a commercially reasonable and usable format and shall reasonably cooperate with CUSTOMER in transitioning such data to CUSTOMER or its designee. Thereafter, EPR shall return or destroy CUSTOMER Data as required by this Agreement and applicable law.

33.5 Survival. Termination shall not affect any rights or obligations that accrued prior to termination or any provision that by its nature is intended to survive termination.

EXHIBIT A

HIPAA BUSINESS ASSOCIATE ADDENDUM

Customer and EPR Systems (“Business Associate”) agree that this HIPAA Business Associate Addendum is entered into for the benefit of Customer, which is a covered entity under the Privacy Standards (“Covered Entity”).

Pursuant to the Master Subscription and License Agreement (the “Agreement”) into which this HIPAA Business Associate Addendum (this “Addendum”) has been incorporated, Business Associate may perform functions or activities involving the use and/or disclosure of PHI on behalf of the Covered Entity, and therefore, Business Associate may function as a business associate. Business Associate, therefore, agrees to the following terms and conditions

Scope. This Addendum applies to and is hereby automatically incorporated into all present and future agreements and relationships, whether written, oral or implied, between Covered Entity and Business Associate, pursuant to which PHI is created, maintained, received or transmitted by Business Associate from or on behalf of Covered Entity in any form or medium whatsoever.
Definitions. For purposes of this Addendum, the terms used herein, unless otherwise defined, shall have the same meanings as used in the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), or the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and any amendments or implementing regulations, (collectively “HIPAA Rules”).
Compliance with Applicable Law. The parties acknowledge and agree that, beginning with the relevant effective date, Business Associate shall comply with its obligations under this Addendum and with all obligations of a business associate under HIPAA, HITECH, the HIPAA Rules, and other applicable laws and regulations, as they exist at the time this Addendum is executed and as they are amended, for so long as this Addendum is in place.
Permissible Use and Disclosure of PHI. Business Associate may use and disclose PHI as necessary to carry out its duties to a Covered Entity pursuant to the terms of the Agreement and as required by law. Business Associate may also use and disclose PHI (i) for its own proper management and administration, and (ii) to carry out its legal responsibilities. If Business Associate discloses Protected Health Information to a third party for either above reason, prior to making any such disclosure, Business Associate must obtain: (i) reasonable assurances from the receiving party that such PHI will be held confidential and be disclosed only as required by law or for the purposes for which it was disclosed to such receiving party; and (ii) an agreement from such receiving party to immediately notify Business Associate of any known breaches of the confidentiality of the PHI.
Limitations on Use and Disclosure of PHI. Business Associate shall not, and shall ensure that its directors, officers, employees, subcontractors, and agents do not, use or disclose PHI in any manner that is not permitted by the Agreement or that would violate Subpart E of 45 C.F.R. 164 (“Privacy Rule”) if done by a Covered Entity. All uses and disclosures of, and requests by, Business Associate for PHI are subject to the minimum necessary rule of the Privacy Rule.
Required Safeguards to Protect PHI. Business Associate shall use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 (“Security Rule”) with respect to electronic PHI, to prevent the use or disclosure of PHI other than pursuant to the terms and conditions of this Addendum.
Reporting to Covered Entity. Business Associate shall report to the affected Covered Entity without unreasonable delay, and in no event later than five business days after discovery: (a) use or disclosure of PHI not provided for by the Agreement of which it becomes aware; (b) any breach of unsecured PHI in accordance with 45 C.F.R. Subpart D of 45 C.F.R. 164 (“Breach Notification Rule”); and (c) any security incident of which it becomes aware. With regard to Security Incidents caused by or occurring to Business Associate, Business Associate shall cooperate with the Covered Entity’s investigation, analysis, notification and mitigation activities, and except for Security Incidents caused by Covered Entity, shall be responsible for reasonable costs incurred by the Covered Entity for those activities. Notwithstanding the foregoing covered Entity acknowledges and shall be deemed to have received advanced notice from Business Associate that there are routine, unsuccessful and immaterial attempts to penetrate computer networks or services maintained by Business Associate, including routine “pinging” or similar activity, provided that such activity does not result in unauthorized access to, use or disclosure of PHI, or material disruption of Business Associate’s systems or services.
Mitigation of Harmful Effects. Business Associate agrees to mitigate, to the extent practicable, any harmful effect of a use or disclosure of PHI by Business Associate in violation of the requirements of the Agreement, including, but not limited to, compliance with any state law or contractual data breach requirements.
Agreements by Third Parties. Business Associate shall enter into an agreement with any subcontractor of Business Associate that creates, receives, maintains, or transmits PHI on behalf of Business Associate. Pursuant to such agreement, the subcontractor shall agree to be bound by the same or greater restrictions, conditions, and requirements that apply to Business Associate under this Addendum with respect to such PHI.
Access to PHI. Within five business days of a request by a Covered Entity for access to PHI about an individual contained in a Designated Record Set, Business Associate shall make available to the Covered Entity such PHI for so long as such information is maintained by Business Associate in the Designated Record Set, as required by 45 C.F.R. 164.524. In the event any individual delivers directly to Business Associate a request for access to PHI, Business Associate shall within five (5) business days forward such request to the Covered Entity.
Amendment of PHI. Within five business days of receipt of a request from a Covered Entity for the amendment of an individual’s PHI or a record regarding an individual contained in a Designated Record Set (for so long as the PHI is maintained in the Designated Record Set), Business Associate shall provide such information to the Covered Entity for amendment and incorporate any such amendments in the PHI as required by 45 C.F.R. 164.526. In the event any individual delivers directly to Business Associate a request for amendment to PHI, Business Associate shall within five business days forward such request to the Covered Entity.
Documentation of Disclosures. Business Associate agrees to document disclosures of PHI and information related to such disclosures as would be required for a Covered Entity to respond to a request by an individual for an accounting of disclosures of PHI in accordance with 45
C.F.R. 164.528 and HITECH.
Accounting of Disclosures. Within five business days of notice by a Covered Entity to Business Associate that it has received a request for an accounting of disclosures of PHI, Business Associate shall make available to a Covered Entity information to permit the Covered Entity to respond to the request for an accounting of disclosures of PHI, as required by 45 C.F.R. 164.528 and HITECH.
Other Obligations. To the extent that Business Associate is to carry out one or more of a Covered Entity’s obligations under the Privacy Rule, Business Associate shall comply with such requirements that apply to the Covered Entity in the performance of such obligations.
Judicial and Administrative Proceedings. In the event Business Associate receives a subpoena, court or administrative order or other discovery request or mandate for release of PHI, the affected Covered Entity shall have the right to control Business Associate’s response to such request, provided that, such control does not have an adverse impact on Business Associate’s compliance with existing laws. Business Associate shall notify the Covered Entity of the request promptly upon receipt and, unless prohibited by law, before producing or disclosing and PHI in response to the request.
Availability of Books and Records. Business Associate hereby agrees to make its internal practices, books, and records available to the Secretary of the Department of Health and Human Services for purposes of determining compliance with the HIPAA Rules.
Breach of Contract by Business Associate. In addition to any other rights a party may have in the Agreement, this Addendum or by operation of law or in equity, either party may: i) immediately terminate the Agreement if the other party has violated a material term of this Addendum; or ii) at the non-breaching party’s option, permit the breaching party to cure or end any such violation within the time specified by the non-breaching party. The non-breaching party’s option to have cured a breach of this Addendum shall not be construed as a waiver of any other rights the non-breaching party has in the Agreement, this Addendum or by operation of law or in equity.
Effect of Termination of Agreement. Upon the termination of the Agreement or this Addendum for any reason, Business Associate shall return to a Covered Entity or, at the Covered Entity’s direction, destroy all PHI received from the Covered Entity that Business Associate maintains in any form, recorded on any medium, or stored in any storage system. This provision shall apply to PHI that is in the possession of Business Associate, subcontractors, and agents of Business Associate. Business Associate shall retain no copies of the PHI. Business Associate shall remain bound by the provisions of this Addendum, even after termination of the Agreement or Addendum, until such time as all PHI has been returned or otherwise destroyed as provided in this Section. For the avoidance of doubt, de- identified Customer Data shall not be subject to this provision.
Injunctive Relief. Business Associate stipulates that its unauthorized use or disclosure of PHI while performing services pursuant to this Addendum would cause irreparable harm to a Covered Entity, and in such event, the Covered Entity shall be entitled to institute proceedings in any court of competent jurisdiction to obtain damages and injunctive relief.
Owner of PHI. Under no circumstances shall Business Associate be deemed in any respect to be the owner of any PHI created or received by Business Associate on behalf of a Covered Entity.
Safeguards and Appropriate Use of Protected Health Information. Covered Entity is responsible for implementing appropriate privacy and security safeguards to protect its PHI in compliance with HIPAA. Without limitation, it is Covered Entity’s obligation to:
21.1. Not include PHI in information Covered Entity submits to technical support personnel through a technical support request or to community support forums. In addition, Business Associate does not act as, or have the obligations of a Business Associate under the HIPAA Rules with respect to Customer Data transmitted by Covered Entity over the public Internet using a communication method not approved or provided by Business Associate. Notwithstanding the foregoing, Business Associate shall remain responsible for PHI transmitted to or from Business Associate through any secure communication method or support channel approved or provided by Business Associate.
21.2. Implement privacy and security safeguards in the systems, applications, and software Covered Entity controls, configures and connects to EPR’s Software.
Third Party Rights. The terms of this Addendum do not grant any rights to any parties other than Business Associate and Covered Entity.
Signatures. The signatures to the Agreement (or the document evidencing the parties’ adoption thereof) indicate agreement hereto and shall be deemed signatures hereof, whether manual, or electronic