Schedule APrepared For: MercedPrepared By: Don Bertucci Pricing Valid Through:05/10/23HealthEMSTerm:60 MonthsAnnual Incidents:8,800HealthEMS Subscription Fees - ePCR ONLYHealthEMS ComponentsTotalPeriod Monthly AnnualePCR 1,320$ Year 1 1,483$ 17,796$ EHR Connectivity-Standard 163$ Year 2 1,558$ 18,696$ Year 3 1,636$ 19,632$ Total Subscribed Monthly Fees 1,483$ Year 4 1,718$ 20,616$ 0.0% -$ Year 5 1,804$ 21,648$ Year 1 Net Monthly Subscription 1,483$ Total Subscription Fees 98,388$ Optional Extension Transaction FeesDescription UM PriceHealthEMS SanFax Transaction FeesActual usage will be chargedPage $0.10One-Time Activation Fee - ePCR ONLYIncludes System setup, configuration and training $4,395.00ECG Monitor Integration0.0%$765.00CAD Integration $875.00Billing Export $1,315.00EHR Connectivity Hospital Integration- 3 hospitals @ $300 each $900.00Total $8,250.00HERE for Stryker Software Hosting AgreeClick HERE for Stryker Business Associate Agreement The undersigned agrees to pricing terms identified above. This Schedule A forms part of the Subscription Agreement and pricing is based on acceptance of the standard Subscription Agreement. The terms and conditions of the Subscription Agreement in effect are incorporated into this Order Form, the parties agree to be bound by those terms and conditions.
Ver. 220525 (v2022.3) HEALTHEMS QUOTE PAGE 1
Sansio - Confidential v 2022.3 Revised 4/6/2022 2
2.3.1 System Maintenance. Sansio will provide software updates, upgrades, and enhancements at the same time as generally available to other licensees. Sansio is responsible for deploying upgrades and enhancements for Customer’s use at no additional charge to Customer. Customer may not have access to the System during times of scheduled maintenance. Prior to providing any update, upgrade, or enhancement, Sansio shall have used commercially reasonable efforts to test such item to ensure that it functions properly and in conformance with all specifications and warranties. 2.3.2 Backups. Backups of hosted applications and data are performed on a nightly (incremental) and weekly (full) basis. Backups will be scheduled at times so as to provide minimal impact to Customer’s business activity. Sansio will maintain at least one full backup copy until after the next backup is performed. Backup will be maintained on a rolling basis and Sansio will not be responsible for archiving more than the most recent full backup. Sansio will take commercially reasonable steps to maintain data integrity in any backup, but Sansio is not responsible for loss of data or data integrity so long as Sansio has performed the backup in a commercially reasonable manner. 2.3.3 System Access Level. Sansio is not responsible for loss of access to the Data Center for reasons that are beyond Sansio’s reasonable control. With the exception for loss of access that is beyond Sansio’s reasonable control, Sansio shall maintain a level of access to the Data Center (excluding periods of emergency maintenance) of 99.9% Access Availability (“Access Availability”), 24 hours a day, 7 days a week, including holidays. System Access Unavailable (“System Access Unavailable”) is defined as the reported unscheduled inability of all subscribed users of Customer to access the Data Center and verification that the problem is within the Data Center. Total System Access Unavailable minutes are calculated by adding the period of time beginning when the Customer reports System Access Unavailable to Sansio’s Solution Center and ending when Sansio’s Solution Center corrects the unavailable status and closes the incident with the Customer. If the Customer does not initiate a Solution Center call, Sansio will not be obligated to issue a System Access Unavailable Credit (“System Access Unavailable Credit”) for the System Access Unavailability. Sansio will compute any System Access Unavailability on a quarterly average basis and apply a System Access Unavailable Credit to the next Customer invoice in the event that the stated Access Availability commitment was not met. This occurs on a pro-rated basis limited to the maximum of the total invoice charges based on the total billing period. System Access Unavailable Credits will not be given for events occurring during any period in which the Customer’s account has an undisputed past due balance or the Customer is otherwise in breach of Agreement. The System Access Unavailable Credit will be calculated according to the following schedule: 99.9% - 100% Covered under Agreement 99.5% - 99.89% (1) day credit98.5% - 99.49% (2) days credit97.5% - 98.49% (1) week credit96.5% - 95.00% (2) weeks credit 0% - 94.49% (1) month credit3. PROFESSIONAL SERVICES. Sansio shall provide Professional Services on a fee-for-service basis(“Professional Services”) to assist the Customer with successful implementation and effective utilization of theSystem. Any Professional Services performed by Sansio, including without limitation to, consulting, mapping,migration, configuration, and implementation services, shall be performed under a statement of work defined inan applicable Professional Services Engagement and shall be subject to the terms and conditions in thisSubscription Agreement.3.1 Project Manager Services. Sansio Project Managers provide Professional Services on a fee-for-servicebasis, assisting Customers to operationalize the solution to meet specific organizational objectives (“Project Manager Services”). Project Manager Services include, but may not be limited to, Training, Implementation, and Consulting that requires specific knowledge of the Customer’s data set, research goals, and operational objectives. Project Manager Services may be provided web-based, at Sansio offices, or onsite at Customer location. 3.2 Resources to be Provided by Customer. Customer shall provide, maintain and make available to Sansio, at Customer’s expense and in a timely manner, the resources described in this section 3, the Statement of Work, and such other additional resources as Sansio may from time-to-time reasonably request in connection with Sansio performance of the Services. Delays in the provision of these resources may result in delays in the performance of the Services, or an increase in the Price. Customer will designate qualified Customer personnel or representatives to consult with Sansio on a regular basis in connection with the Services. Customer will furnish such documentation and other information as is reasonably necessary to perform the Services. Customer shall furnish access to Customer’s network, premises, and appropriate workspace for any Sansio personnel working at Customer’s premises, as necessary for performance of Sansio - Confidential v 2022.3 Revised 4/6/2022 3
those portions of the Services to be performed at Customer’s premises. Customer shall meet any additional assumptions noted on the Statement of Work. 3.3 Intellectual Property. Customer and Sansio shall each retain ownership of, and all right, title and interest in and to, their respective pre-existing Intellectual Property, and no license therein, whether express or implied, is granted by this Agreement or as a result of the Professional Services performed hereunder. To the extent the parties wish to grant to the other rights or interests in pre-existing or developed Intellectual Property, separate license agreements on mutually acceptable terms will be executed. The Professional Services performed, code developed, and any Intellectual Property produced pursuant to this Subscription Agreement or any Statement of Work are not “works for hire.” As used herein, “Intellectual Property” shall mean inventions (whether or not patentable), works of authorship, trade secrets, copyright, techniques, know-how, ideas, concepts, algorithms, and other intellectual property incorporated into any Statement of Work whether or not first created or developed by Sansio in providing the Services. 4. CUSTOMER REQUIREMENTS.4.1 Internet Connectivity. Customer must provide Internet connectivity to the System web site withsufficient bandwidth to meet Customer’s utilization demands. System performance is a function of bandwidth and latency time from client desktop to the System web site. Customer must connect with Sansio supported browsers and client software. 4.2 Named User Identification and Authentication. The System requires a unique user name and password for each authorized individual Customer representative (“Named User”) to access the System via Sansio’s Data Center(s). Customer is responsible for administration and management of Named User accounts, including the appropriate technical and administrative safeguards to prevent unauthorized access. Sansio shall have no responsibility for unauthorized access to Customer's Data or Confidential Information that results from Customer's failure to prevent unauthorized access. 5. LICENSE AND FEES.5.1 License. During the term of this Agreement, and subject to the terms and conditions of this Agreement,Sansio hereby grants to Customer a non-exclusive, non-transferable (except as provided in this Agreement) license to access and use the System. 5.2 Fees. 5.2.1 Activation Fee. The Activation Fee set forth in Schedule A is non-refundable and due upon execution of Schedule A. 5.2.2 Subscription Fees. Customer agrees to pay Subscription Fees as set forth in this Section and Schedule A. Sansio will invoice Customer for Monthly Subscription Fees as set forth in Schedule A during the Subscription Term. 5.2.2.1 Incident Fees. Customer’s pricing is identified in Schedule A based on Customer projections of incident volume (“Estimated Annual Incident Volume”). In the event the Customer’s actual annual incident volume varies from Estimated Annual Incident Volume, as identified in Schedule A, by more than 5%, Sansio reserves the right to adjust the Subscription Fees, applicable to actual incident volume, provided the Customer is given 45 days prior written notice of such adjustment. Subscription Fees include: Data Center Services, Data Collection Services, Application Licensing, System Maintenance, and Upgrades, Application Support, Integration Fees, and optional Extension usage. Should Customer not agree to adjustment, Customer may choose to terminate the Agreement as set forth in Section 6.3. 5.2.2.2 RevNet Fees. Customer’s pricing is identified in Schedule A based on Customer projections of annual net collections. In the event the Customer’s actual annual net collections varies from the annual net collections identified in Schedule A, by more than 5%, Sansio reserves the right to make adjustments to the Subscription Fees, applicable to actual annual net collections, provided the Customer is given 45 days prior written notice of such adjustment. Subscription Fees include: Data Center Services, Data Collection Services, Application Licensing, System Maintenance, and Upgrades, Application Support, Integration Fees, and optional Extension usage. Should Customer not agree to adjustment, Customer may choose to terminate the Agreement as set forth in Section 6.3. 5.2.2.3 Subscription Fee Invoicing. Following Term Start Date, Sansio will invoice the Customer as set forth in Schedule A. Customer will be invoiced monthly Subscription Fees 30 days in Sansio - Confidential v 2022.3 Revised 4/6/2022 4
advance, due and payable by the first of the month during the Term identified in Section 6 and in Schedule A. 5.2.3 Optional Extension Fees. Customer agrees to pay optional Extension fees as set forth in Extension Addendum(s) and/or Schedule A. Optional Extension fees are based on the actual transaction usage for the optional Extensions. 5.2.3.1 Optional Extension Fee Invoicing. Optional Extension fees will be invoiced monthly for the previous month's actual use at the Unit Price listed in Schedule A or applicable Extension Addendum. 5.2.4 Professional Services Fees. Customer agrees to pay Professional Services fees as set forth in applicable Professional Services engagements. Payment terms and conditions are as follows: 5.2.4.1 Professional Services Invoicing. Professional Services will be invoiced monthly for the previous month's actual use at the Unit Price listed in applicable Professional Services engagements. Professional Services time will be logged and made electronically available to Customer with a minimum activity time of fifteen (15) minutes, rounded up to the nearest fifteen (15) minute increment, for hourly-based Professional Services. 5.2.4.3 Cancellations. Cancellation within 24 hours of scheduled Professional Services appointments will result in a minimum charge of one (1) hour for Web-based Professional Services or two (2) days for Onsite Professional Services plus any non-cancellable expenses.5.2.4.4 Modifications. In the event that Professional Services result in greater Sansio duties than contemplated by the Statement of Work, Customer will work closely and in good faith with Sansio to modify the Statement of Work to ensure that the Customer’s requirements are addressed and Sansio’s fees shall be adjusted to reflect increased Customer requirements. Unless specifically addressed in the Statement of Work, all travel and expenses incurred will be extra and billed at the time of incurrence. Invoiced amounts are due and payable 30 days from the date of the invoice. 5.2.4.4 Travel and Expenses. Sansio shall invoice Customer for such reimbursable expenses, as authorized with receipt of signed Professional Services Engagements. Actual charges will be based upon hours consumed and expenses incurred in engagement. Travel Fees, as set forth on the Professional Services Engagements, include but may not be limited to airfare, lodging, ground transportation, staff per diem, and other related travel expenses.5.2.5 Taxes: Sansio is required to collect sales tax from products and services provided to customers in certain states. Sansio reserves the right to invoice the Customer those taxes now or at any time in the future, including interest and penalties imposed by any governmental authority which are imposed upon the sale or delivery of items purchased or licensed. Customer is required to provide a tax exempt status form in order for Sansio to correctly identify tax status. If a certificate of exemption or similar document or proceeding is to be made in order to exempt the sale from sales or use tax liability, Customer will obtain and purchase such certificate, document or proceeding. 5.2.6 Payment. All invoiced fees shall be due and payable within 30 days of the date of an invoice. For Professional Services, invoices shall be sent either monthly or upon completion of milestones (as defined in the statement of work). 5.2.7 Default. Customer will be considered delinquent if payment in full is not received 30 days from the date of the invoice. Sansio reserves the right to suspend or terminate this Agreement and Customer access to the Service if the Customer account becomes delinquent and is not cured within 10 days of notice of delinquency. Customer will continue to be charged and hereby agrees to pay for Service during any period of suspension. Customer’s failure to pay any invoice after this 10-day period shall constitute a material default hereunder and shall entitle Sansio to exercise any and all rights and remedies provided herein or at law including a suspension of Services under the Agreement. In the event of a dispute between the parties that does not result in a termination of the Agreement, Customer agrees to make all Monthly Service Fee payments due under the Agreement pending the resolution of the dispute. 5.2.8 Interests and Costs. Undisputed amounts not paid when due will bear interest at the rate of 1.5% on the unpaid balance each month, or such lesser rate of interest as shall be the maximum amount Sansio - Confidential v 2022.3 Revised 4/6/2022 5
chargeable with respect to this account under the law in effect in the state of Customer’s location. In the event of non-payment or default by Customer, Customer agrees that all costs of enforcement and collection, including reasonable attorneys’ fees, will be paid by Customer. 6. TERM AND TERMINATION.6.1 Term Start Date. Customer’s Term Start Date is the date of customer signature date on Schedule A, or,in the case of renewal, the first day after expiration of previous Term. The Term Start Date represents the first day of the Subscription Term. 6.2 Term Initiation. This Agreement takes effect on the date of last signature date on Schedule A and continues through the conclusion of the Subscription Term or any subsequent Renewal Subscription Term. The Subscription Term (the “Term”) begins on the Term Start Date and ends at the conclusion of the Term as noted in Schedule A or any subsequent renewal Schedule A’s. Subscription Fees commence on the Term Start Date and continue throughout the Term of this Agreement. Upon acceptance of this Agreement, Sansio will provide Customer with an access code to use the Licensed Software via Sansio’s Data Center and the Internet. 6.3 Term Renewal. This Agreement shall automatically renew upon expiration of the then current Term, at the current System price list for the same Term, unless Customer notifies Sansio of its intention of nonrenewal by written notification at least 60 days prior to the end of the then current Term, or unless Sansio requires a new Agreement to be executed by the parties. If Sansio requires a new Agreement, it will be provided to Customer at least 60 days prior to the end of the then current Term. Customer may decline to enter into a new Agreement in its sole and absolute discretion, and if Customer so declines, then Customer shall not be responsible for Early Termination Fees as set forth in Section 6.4. 6.4 Termination. Either party may terminate the Agreement upon the other party’s material breach of this Agreement, if within 30 days of receipt of written notification of breach (10 days in the case of non-payment), the breaching party has failed to cure its breach. Sansio may terminate Customer’s access to the System immediately upon Termination of the Agreement. In the event of early Termination due to material breach by Customer, Customer shall be responsible for Early Termination Fee per Section 6.4 of this Agreement. In the event of early Termination due to material breach by Sansio, Customer shall not be responsible for Early Termination Fee as set forth in Section 6.5. Notwithstanding anything in this Section 6 or in this Agreement to the contrary, Customer may terminate this Agreement and Customer obligations hereunder during the initial Term or any subsequent renewal Term, without cause, for any reason, or for no reason, and in Customer’s sole and absolute discretion by payment to Sansio of the Early Termination Fee as set forth in Section 6.4. Sansio acknowledges and agrees that payment of such Early Termination Fee shall be Sansio’s sole remedy therefor. Customer must notify Sansio of its intention for early Termination by written notification at least 90 days before the desired Termination date. Early Termination must occur on a monthly anniversary of the then current Term. Notwithstanding any term or provision in this Agreement to the contrary, if Customer is current on all payments due to Sansio, upon termination of this Agreement, Sansio will make available to Customer Customer’s raw data in in its then existing, native format for a period of thirty days post termination of this Agreement. Additionally, Sansio can produce for Customer an export of their data in its then existing, native format and provide that export to Customer within 90 days of Termination or expiration of this Agreement for a fee of $500. Requests for Customer data in a form other than its existing format shall be performed under a mutually agreeable statement of work. Customer directs, and Sansio shall delete all Customer Data upon the earlier of (a) delivery to Customer or (b) 90 days from the date of termination of this Agreement. 6.5 Early Termination Fee. Upon early Termination for breach by Customer or for such other early Termination as described in Section 6.3 of this Agreement, Sansio reserves the right to charge Customer a pro-rated Early Termination Fee based on the percentage of the current Term utilized. The percentage will be applied to the remaining Subscription Fees for the current Term as selected by Customer on Schedule A. Sansio acknowledges and agrees the Early Termination Fee will be Sansio’s sole remedy therefor. Example: Current Term Length: 36 month Desired Early Termination Date: end of month 30 Percentage of Term Utilized: 83% Pro-Rated Termination Percentage: 17% Monthly Subscription Fee: $ 2,000 (Per Schedule A) Remaining Subscription Fees per current Term: $12,000 (6 months @ $2,000) Early Termination Fee: $ 2,040 (17% of $12,000) Sansio - Confidential v 2022.3 Revised 4/6/2022 6
7. PROPRIETARY RIGHTS OF SANSIO IN THE LICENSED SOFTWARE AND DOCUMENTATION.7.1 Nature of Rights and Title. Customer acknowledges that the System and Documentation supplied bySansio to Customer are proprietary and shall remain the property of Sansio and nothing in this Agreement shall be construed as transferring any aspect of such rights to Customer or any third party. Any changes, additions, and enhancements in the form of new or partial programs or Documentation as may be provided under this Agreement shall remain the proprietary property of Sansio. Customer agrees with Sansio that the System, Documentation and all other proprietary information or data supplied by Sansio are trade secrets of Sansio, are protected by civil and criminal law, and by the law of copyright, are very valuable to Sansio, and that their use and disclosure must be carefully and continuously controlled. Customer further understands that operator manuals, training aids, and other written materials regarding the System are subject to the Copyright Act of the United States. Customer shall keep each and every item to which Sansio retains title free and clear of all claims, liens and encumbrances except those of Sansio and any act of Customer, voluntary or involuntary, purporting to create a claim, lien or encumbrance on such an item shall be void. 7.2 Unauthorized Acts. Customer agrees to notify Sansio promptly of the unauthorized possession, use, or knowledge of any item supplied under this license and of other proprietary information made available to Customer under this Agreement, by any person or organization not authorized by this Agreement to have such possession, use or knowledge. Customer will promptly furnish full details of such possession, use or knowledge to Sansio, will assist in preventing the continuation or recurrence of such possession, use or knowledge, and will cooperate with Sansio in any litigation against third parties deemed necessary by Sansio to protect its proprietary rights. Customer's compliance with this subparagraph shall not be construed in any way as a waiver of Sansio’s right, if any, to recover damages or obtain other relief against Customer for its negligent or intentional harm to Sansio’s proprietary rights, or for breach of contractual rights. 7.3 Remedies. If Customer attempts to use, copy, license, sub-license, or otherwise transfer the Licensed Software or access to the System supplied by Sansio under this Agreement, in a manner contrary to the terms of this Agreement or in competition with Sansio or in derogation of Sansio’s proprietary rights, whether these rights are explicitly stated, determined by law, or otherwise, Sansio shall have the right to injunctive relief enjoining such action, in addition to any other remedies available. Customer acknowledges that other remedies are inadequate. 7.4 Infringement Indemnification. Sansio shall indemnify and defend Customer from and against any and all loss, cost, damage or liability, including reasonable attorneys’ fees and expenses, arising out of or relating to any third party claim or cause of action for patent, copyright, and/or other intellectual property infringement (“Infringement Claim”) asserted against Customer by virtue of the System, Software or Documentation or Customer’s use or possession of the System, Software or Documentation pursuant to this Agreement. Sansio shall defend and settle at its sole expense all suits and proceedings arising out of the foregoing, provided that Customer gives Sansio reasonably prompt notice of any such Infringement Claim of which it learns. In all events, Customer shall have the right to participate at its own expense in the defense of any such suit or proceeding through counsel of its own choosing. In the event any Infringement Claim is asserted by a third party with respect to the System or Customer’s use thereof, then and in that event, Customer may terminate its use of the System and/or this Agreement without payment of any Early Termination Fee. 8. CONFIDENTIALITY AND DATA USE.8.1 Confidential Information. The parties agree that any Confidential Information provided under thisAgreement shall be held and maintained in strict confidence. Each party agrees to protect the Confidential Information of the other party in a manner consistent with the protections used to protect its own Confidential Information, including, without limitation, informing its employees of its obligations under this Agreement and taking such steps as are reasonable in the circumstances, or as reasonably requested by the other party, to prevent any unauthorized disclosure, copying or use of Confidential Information. Confidential Information means any proprietary material that the disclosing party designates as confidential (“Confidential Information”). Confidential Information shall also include, without limitation, all information in any form which relates to the business, expertise and/or operations of the disclosing party, including without limitation, information in any form generally understood to be trade secret, proprietary or confidential and/or that is related to products and services, commercial and financial information, system functionality charts and descriptions, program code logic, trade secret information, and information about health care providers, customers and/or business partners. Confidential Information shall also include Protected Health Information as defined in HIPAA and its rules and regulations promulgated here under. Sansio will not use Confidential Information except as expressly provided in this Agreement. Confidential Information does not include information that (i) is already known to the receiving party at the time it is Sansio - Confidential v 2022.3 Revised 4/6/2022 7 disclosed and has not been obtained wrongfully, (ii) becomes publicly known without the fault of the receiving party, (iii) is independently developed by the receiving party, (iv) is approved for release in writing by the disclosing party, (v) is disclosed without restriction by the disclosing party to a third party, or (vi) is disclosed pursuant to applicable statutory or other legal or accreditation obligation beyond the control of the receiving party. 8.2 Unauthorized Disclosure. The recipient of any Confidential Information shall, upon discovery of any unauthorized use or disclosure of such Confidential Information, or any other breach of these confidentiality obligations by the recipient, fully cooperate with the disclosing party to assist the disclosing party to regain possession of the Confidential Information and prevent the further unauthorized use or disclosure of the Confidential Information. 8.3 Remedies. The parties acknowledge and agree that in the event of a breach of this Section 8 the non-breaching party will suffer irreparable injuries not compensable by money damages alone and therefore the non-breaching party will not have an adequate remedy at law. The non-breaching party shall be entitled to seek injunctive relief without the necessity of posting any bond or undertaking to prevent any further breach. Such remedy shall be in addition to any other remedy the non-breaching party may have. 8.4 Data Use. Sansio recognizes the importance in identifying issues and improvements surrounding the functionality, integration, performance, and reliability of the System. Customer agrees that Sansio may collect, maintain, and use technical information related to the System, including but not limited to, its usage, functionality, integration, performance, and reliability. Sansio may use this information to improve its products or to provide customized services or technologies. Customer retains all ownership rights to System data it generates through use of the System during the Term, except that Customer grants Sansio a perpetual, royalty-free license to compile, sell, analyze, use, and distribute de-identified aggregated data to the extent necessary to fulfill Sansio’s obligations under any agreement or for any other lawful purpose. Sansio represents and warrants that it will only employ methods to de-identify the data that do not involve actual disclosure of Protected Health Information to Sansio. 9. LIMITED WARRANTY. For the duration of this Agreement (the “Warranty Period”), Sansio will checkout, document, and deliver any amendments or alterations to the Licensed Software or other System components that may be required to correct errors which significantly affect performance. This warranty is contingent upon Customer advising Sansio in writing of such errors. Sansio shall not be responsible for maintaining Customer-modified portions of the Licensed Software or other System components. Corrections for difficulties or defects traceable to Customer errors or System changes made by Customer will be billed at standard Sansio’s time and materials rates. THE LIMITED WARRANTY SET FORTH IN THIS AGREEMENT IS THE ONLY WARRANTY MADE BY SANSIO. SANSIO EXPRESSLY DISCLAIMS, AND CUSTOMER HEREBY EXPRESSLY WAIVES, ALL OTHER WARRANTIES EXPRESS, IMPLIED OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE. SANSIO DOES NOT WARRANT THAT THE LICENSED SOFTWARE OR SYSTEM WILL MEET CUSTOMER’S REQUIREMENTS OR THAT THE OPERATION OF THE LICENSED SOFTWARE WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT, EXCEPT AS REQUIRED HEREIN TO ADDRESS ERRORS THAT SIGNIFICANTLY AFFECT PERFORMANCE, ERRORS IN THE LICENSED SOFTWARE OR SYSTEM WILL BE CORRECTED. SANSIO’S LIMITED WARRANTY IS IN LIEU OF ALL LIABILITIES OR OBLIGATIONS OF SANSIO FOR THE DAMAGES ARISING OUT OF OR IN CONNECTION WITH THE INSTALLATION, USE OR PERFORMANCE OF THE LICENSES SOFTWARE OR SYSTEM. 10. LIMITATION OF LIABILITY.A PARTY’S LIABILITY FOR ANY ACTIONS, CLAIMS OR DAMAGES ARISING OUT OF OR RESULTING FROM THIS AGREEMENT OR THE SYSTEM IS LIMITED TO THE AMOUNTS PAID BY CUSTOMER IN THE 12-MONTH PERIOD PRECEDING THE DATE ON WHICH THE CLAIM AROSE. IN NO EVENT WILL SANSIO BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL, ECONOMIC, CONSEQUENTIAL OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOST REVENUE, LOST PROFITS, REPLACEMENT GOODS, LOSS OF TECHNOLOGY RIGHTS OR SERVICES, LOSS OR CORRUPTION OF DATA, OR INTERRUPTION OR LOSS OF USE OF SOFTWARE OR ANY PORTION THEREOF REGARDLESS OF THE LEGAL THEORY UNDER WHICH SUCH DAMAGES ARE SOUGHT EVEN IF SANSIO HAS BEEN ADVISED OF THE LIKELIHOOD OF SUCH DAMAGES, AND NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY. NOTWITHSTANDING THE FOREGOING, AND NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT TO THE CONTRARY, NO LIMITATION OF LIABILITY OR LIMITATION OF WARRANTY OR DISCLAIMER SHALL BE APPLICABLE TO CUSTOMER’S BREACH OF ITS OBLIGATIONS UNDER SECTION 5 LICENSE FEES, SECTION 7.4 INFRINGEMENT INDEMNIFICATION, OR TO A PARTY’S BREACH OF ITS OBLIGATIONS UNDER SECTION 8.
Sansio - Confidential v 2022.3 Revised 4/6/2022 8
11. HIPAA.The parties understand, acknowledge, and agree that the System provides access to Protected HealthInformation (“PHI”) pursuant to and in compliance with the Health Insurance Portability and Accountability Actof 1996, Public Law 104-191 (“HIPAA”), and the regulations promulgated there under, the HIPAA PrivacyRegulations, including, but not limited to, 45 C.F.R. Parts 160 and 164, Subpart A and Subpart E (hereinafterthe “Privacy Rule”), and HIPAA Security Regulations, including but not limited to, 45 C.F.R. Parts 160 and164, Subpart A and Subpart C (hereinafter the “Security Rule”), the Health Information Technology forEconomic and Clinical Health Act, as incorporated in the American Recovery and Reinvestment Act of 2009 (the“HITECH Act”), and its implementing regulations and guidance issued by the Secretary of the Department ofHealth and Human Services (the “Secretary”), and all other applicable state and federal laws, as all amendedfrom time to time, including as amended by the Final Rule of 2013, titled “Modifications to the HIPAA Privacy,Security, Enforcement, and Breach Notification Rules under the HITECH and the Genetic Information Non-Discrimination Act (“GINA”) (“Omnibus Rule”).The Sansio Customer Business Associate Agreement can be found at www.sansio.com/terms/ which is herebyincorporated by reference to this Agreement. The parties agree to be bound by the Sansio Customer BusinessAssociate Agreement.12. GENERAL.12.1 Assignment. This Agreement, and any related obligation of other party, may not be assigned in whole orin part without the prior written consent of the other party which shall not be unreasonably withheld. 12.2 Amendment. This Agreement can only be modified by a written agreement duly signed by persons authorized to sign agreements on behalf of Customer and of Sansio, and variance from the terms and conditions of this Agreement in any order or other written notification from the Customer will be of no effect. 12.3 Severability. If any provision or provisions of this Agreement shall be held to be invalid, illegal or unenforceable, the validity, legality and enforceability of the remaining provisions shall not in any way be affected or impaired thereby. 12.4 Governing Law. This Agreement will be governed by the laws of the state where the Customer is located.12.5 Schedules. All schedules are attached hereto and incorporated by reference herein. 12.6 Entire Agreement. Customer acknowledges that its undersigned representative has read this Agreement, understands it, and agrees on behalf of Customer to be bound by its terms and conditions. Further, Customer agrees that this Agreement constitutes the complete and exclusive statement of the agreement between the parties, which supersedes all proposals or prior agreements, oral or written, and all other communications between the parties relating to the subject matter of this Agreement. 12.7 Conflicting Terms. Unless otherwise mutually agreed in writing, in the event that any terms and/or conditions in this Agreement conflict or are inconsistent with any terms and/or conditions in any attached and incorporated agreement, including but not limited to amendments, addendums, exhibits and SOW’s, then the terms and conditions of this Agreement shall control.12.8 Notices. All notices, demands, requests, and other communications made or required pursuant to the terms of this Agreement shall be in writing and shall be (1) personally delivered, sent by nationally recognized courier service, or sent by certified mail, return receipt requested, and shall be deemed to have been received upon the earlier of actual receipt or five (5) business days after deposit with the nationally recognized courier service or deposit in the mail; (2) sent by facsimile and deemed to have been received on the date of the facsimile confirmation; (3) sent by electronic means and shall be deemed to have been received upon return of a read receipt. Unless another address for a party has been specified by providing notice as set forth herein, such notices, demands, requests and other communications permitted or allowed under this Agreement must be sent to Customer at the address set forth on the applicable order form and to Sansio at: Sansio, Inc. 525 South Lake Ave., Suite 405 Duluth, MN 55802 Attn: Legal Sansio - Confidential v 2022.3 Revised 4/6/2022 9
This Subscription Agreement is executed by: Sansio, Inc. By: By: ______________________________________ ________________________________ Printed Name Printed Name ______________________________________ ________________________________ Signature Signature ______________________________________ ________________________________ Date Date ______________________________________ ________________________________ Title Title APPROVED AS TO FORM:By: ____________________________ Assistant City Attorney Date4/20/23Digitally signed by: Laurie Avedisian-FaviniDN: CN = Laurie Avedisian-Favini email = [email protected] C = US O = Lozano SmithDate: 2023.04.20 14:10:25 -07'00'Laurie Avedisian-Favini Sansio - Confidentialv 2022.2 Revised 2/7/20221
Business Associate AgreementPursuant to and in compliance with the Health Insurance Portability and Accountability Act of1996, Public Law 104-191 (“HIPAA”), and the regulations promulgated there under, the HIPAAPrivacy Regulations, including, but not limited to, 45 C.F.R. Parts 160 and 164, Subpart A andSubpart E (hereinafter the “Privacy Rule”), and HIPAA Security Regulations, including but notlimited to, 45 C.F.R. Parts 160 and 164, Subpart A and Subpart C (hereinafter the “SecurityRule”), the Health Information Technology for Economic and Clinical Health Act, asincorporated in the American Recovery and Reinvestment Act of 2009 (the “HITECH Act”),and its implementing regulations and guidance issued by the Secretary of the Department ofHealth and Human Services (the “Secretary”), and all other applicable state and federal laws,as all amended from time to time, including as amended by the Final Rule of 2013, titled“Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rulesunder the HITECH and the Genetic Information Non-Discrimination Act (“GINA”) (“OmnibusRule”), all business associates of entities such as Customer must agree in writing to certainmandatory provisions regarding the use and disclosure of certain Individually IdentifiableHealth Information. Sansio and Customer agree that this Agreement replaces in its entirety any previous BusinessAssociate Agreement between the parties and/or Section 12 of any Subscription Agreementexecuted on or before September 23, 2013. In order to satisfy the above applicablerequirements, the Parties agree as follows effective as of the Compliance Date(s): A. Terms used, but not otherwise defined, in this Agreement shall have the same meaningas those terms in the Privacy Rule, Security Rule, the HITECH Act, and the OmnibusRule:a. Administrative Safeguards. “Administrative Safeguards” shall mean administrativeactions, policies, and procedures to manage the selection, development,implementation, and maintenance of security measures to protect Electronic PHIand to manage the conduct of the workforce in relation to the protection of thatinformation.b. Breach. “Breach” shall mean the unauthorized acquisition, access, use, ordisclosure of unsecured PHI which compromises the security or privacy of suchinformation, except where an unauthorized person to whom such information isdisclosed would not reasonably have been able to obtain such information.c. Business Associate. "Business Associate" shall mean Sansio.d. Covered Entity. "Covered Entity" shall mean the Customer.e. Designated Record Set. “Designated Record Set” shall mean a group of recordsmaintained by or for Sansio or Customer that is: (i) the medical records and billingrecords about individuals maintained by Sansio or Customer; (ii) the enrollment,payment, claims adjudication, and case or medical management record systemsmaintained by or for a health plan; or (iii) used, in whole or in part, by or forCustomer to make decisions about individuals. As used herein, the term "Record" Sansio - Confidentialv 2022.2 Revised 2/7/20222
means any item, collection, or grouping of information that includes PHI and iscreated, received, maintained, or transmitted by or for Sansio or Customer. f. Electronic Health Record. “Electronic Health Record” shall mean an electronicrecord of health-related information on an individual that is created, gathered,managed, and consulted by authorized health care clinicians and staff.g. Electronic Protected Health Information. “Electronic Protected Health Information”shall have the same meaning as the term “electronic protected health information”in 45 C.F.R. § 160.103, limited to the information that Business Associate creates,receives, maintains, or transmits on behalf of Covered Entity.h. HIPAA. “HIPAA” shall mean the Health Insurance Portability and Accountability Actof 1996, and any amendments thereto.i. HITECH. “HITECH” shall mean the Health Information Technology for Economic andClinical Health Act, which is Title XIII of the American Recovery and ReinvestmentAct of 2009, and any amendments, regulations, rules, and guidance issued theretoand the relevant dates for compliance, including amendments to HIPAA asapplicable.j. Individual. "Individual" shall have the same meaning as the term "individual" in 45CFR § 164.501 and shall include a person who qualifies as a personalrepresentative in accordance with 45 CFR § 164.502(g).k. Individually Identifiable Health Information. “Individually Identifiable HealthInformation” shall mean information that is a subset of health information,including demographic information collected from an individual, and(i) is created or received by a healthcare provider, health plan, employer, orhealthcare clearinghouse; and(ii) relates to the past, present, or future physical or mental health or conditionof an individual; the provision of healthcare to an individual; and (i) identifiesthe individual, or (ii) with respect to which there is a reasonable basis to believethe information can be used to identify the individual.l. Omnibus Rule. “Omnibus Rule” shall mean the Final Rule of 2013, titled“Modifications to the HIPAA Privacy, Security, Enforcement, and Breach NotificationRules under HITECH and the Genetic Information Non-discrimination Act (“GINA”).m. “Physical Safeguards” shall mean physical measures, policies, and procedures toprotect electronic information systems and related facilities and equipment fromnatural and environmental hazards and unauthorized intrusion.n. Privacy Rule. "Privacy Rule" shall mean the Standards for Privacy of IndividuallyIdentifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A andE.o. Protected Health Information. "Protected Health Information" or “PHI” shall meanIndividually Identifiable Health Information that is (i) transmitted by electronic Sansio - Confidentialv 2022.2 Revised 2/7/20223
media; (ii) maintained in any medium constituting electronic media; or (iii)transmitted or maintained in any other form or medium. "PHI" shall not includeeducation records covered by the Family Educational Right and Privacy Act, asamended, 20 U.S.C. § 1232g, or records described in 20 U.S.C. § 1232g(a)(4)(B)(iv). “PHI” shall have the same meaning as the term "protectedhealth information" in 45 CFR § 164.501, limited to the information created orreceived by Sansio from or on behalf of Customer.p. Required By Law. "Required By Law" shall have the same meaning as the term"required by law" in 45 CFR § 164.501.q. Secretary. "Secretary" shall mean the Secretary of the United States Departmentof Health and Human Services or his/her designee.r. Security Incident. "Security Incident” shall mean the attempted or successfulunauthorized access, use, disclosure, modification, or destruction of information orinterference with system operations in an information system.s. Security Rule. “Security Rule” shall mean the Standards for Security of IndividuallyIdentifiable Health Information at 45 CFR parts 160 and 164, subparts A and C.t. Technical Safeguards. “Technical Safeguards” shall mean the technology, and thepolicy and procedures for its use that protects Electronic PHI and controls accessto it.u. Transaction Standards. "Transaction Standards" shall mean the Standards forElectronic Transactions, 45 C.F.R. 160 and 162.v. Unsecured PHI. "Unsecured PHI" shall mean PHI not secured through the use of atechnology or methodology specified in guidance by the Secretary that renders PHIunusable, unreadable, or indecipherable to unauthorized individuals.B. Compliance with Applicable Law. Sansio acknowledges and agrees that in the courseof performance of Sansio’s obligations under this Agreement, Sansio might be givenor obtain access to information which contains Protected Health Information. Beginningwith the relevant effective dates, Sansio shall comply with its obligations under thisAgreement and with all obligations of a business associate under HIPAA, HITECH, theOmnibus Rule, and other related laws and any implementing regulations, as they existat the time this Agreement is executed and as they are amended, for so long as thisAgreement is in place.C. Uses and Disclosures of PHI. Except as otherwise limited in this Business AssociateAgreement, Sansio may use and disclose Protected Health Information for, or on behalfof, Customer as specified in the Sansio Subscription Agreement. Sansio will not, andshall ensure that its directors, officers, employees, and agents do not, use or furtherdisclose PHI received from Customer other than as permitted or required by thisAgreement or as required by law. All uses and disclosures of and requests by Sansiofor PHI are subject to the minimum necessary rule of the Privacy Standards and shallbe limited to the information contained in a limited data set, to the extent practical,unless additional information is needed to accomplish the intended purpose, or as Sansio - Confidentialv 2022.2 Revised 2/7/20224
otherwise permitted in accordance with Section 13405(b) of HITECH and anyimplementing regulations. Customer will provide Sansio with any changes in, or revocation of, permission by anIndividual to use or disclose PHI, if such changes affect Sansio’s permitted or requireduses or disclosures. D. Customer Responsibilities. Customer will notify Sansio of any restrictions to the use ordisclosure of PHI that Customer has agreed to in accordance with 45 C.F.R. § 164.522,to the extent such restrictions affect Sansio permitted or required uses or disclosures.Customer shall not request Sansio to use or disclose Protected Health Information inany manner that would not be permissible under HIPAA if done by a Covered Entity(unless permitted by HIPAA for a Business Associate).Customer is responsible for implementing appropriate privacy and security safeguardsto protect its Protected Health Information in compliance with HIPAA. Withoutlimitation, it is Customer’s obligation to not include Protected Health Information innon-secure channels such as email or information Customer submits to Sansiotechnical support personnel through a technical support request.E. Required Safeguards To Protect PHI. Sansio will use appropriate safeguards to preventuse or disclosure of PHI other than as provided for by this Agreement. Sansio agreesto use appropriate administrative, physical, and technical safeguards to protect theconfidentiality, integrity, and availability of any electronic PHI in accordance with thePrivacy Rule, the Security Rule, and in accordance with Section 13401(a) of HITECHand any implementing Regulations.Sansio will maintain liability coverage indemnifying Sansio against losses or damagesarising out of its treatment of PHI in performing this Agreement, with per occurrencelimits not less than $2,000,000.F. Ownership of PHI. Under no circumstances shall Sansio be deemed in any respect tobe the owner of any PHI used or disclosed by or to Sansio pursuant to the terms ofthe Agreement. Sansio acknowledges that all rights, title, and interest in and to anyPHI furnished to Sansio rests solely and exclusively with the Customer or the Individualto whom such PHI relates.G. Reporting of Improper Use and Disclosures of PHI. Sansio will report to Customer, assoon as reasonably practical, any use or disclosure of PHI not provided for by thisAgreement of which Sansio becomes aware.H. Reporting of Breaches of Unsecured PHI. Sansio shall report to Customer, as soon asreasonably practical, a breach of Unsecured PHI, of which it reasonably becomesaware, in accordance with Section 13402(b) of HITECH.
Sansio - Confidentialv 2022.2 Revised 2/7/20225
I. Agreements by Third Parties. Sansio will ensure that any agent, including asubcontractor, to whom Sansio provides electronic PHI created by, received from,maintained for or transmitted by Sansio on behalf of Customer agrees to the samebusiness associate restrictions, terms, conditions, and requirements that apply toSansio with respect to such information, including without limitation compliance withSection D hereof.J. Access to Protected Health Information. Sansio will, at the request of Customer, makeavailable PHI maintained by Sansio in a Designated Record Set to Customer in orderfor Customer to meet the requirements under 45 C.F.R. § 164.524. In the event anyIndividual delivers directly to Sansio a request for access to PHI, Sansio will forwardsuch request to Customer in order for Customer to respond to such Individual.K. Availability of PHI for Amendment. Sansio will, at the request of Customer, makeavailable for amendment, and allow Customer to incorporate any amendment(s) in,any Protected Health Information in a Designated Record Set maintained by Sansio,which the Customer directs or agrees to pursuant to 45 C.F.R. § 164.526. In the eventany Individual delivers directly to Sansio a request to amend PHI, Sansio will forwardsuch request to Customer, in order for Customer to respond to such Individual.L. Documentation of Disclosures. Sansio agrees to document disclosures of PHI andinformation related to such disclosures as would be required for Customer to respondto a request by an Individual for an accounting of disclosures of PHI in accordance with45 C.F.R. § 164.528. At a minimum, Sansio shall provide Customer with the followinginformation: (i) the date of the disclosure; (ii) the name of the entity or person whoreceived the PHI, and if known, the address of such entity or person; (iii) a briefdescription of the PHI disclosed; and (iv) a brief statement of the purpose of suchdisclosure which includes an explanation of the basis for such disclosure.M. Accounting of Disclosures. Within ten (10) days of notice by Customer to Sansio thatit has received a request for an accounting of disclosures of PHI regarding an Individualduring the six (6) years prior to the date on which the accounting was requested,Sansio shall make available to Customer information collected in accordance withSection K of this Agreement, to permit Customer to respond to the request for anaccounting of disclosures of PHI, as required by 45 C.F.R. § 164.528. In the case ofan Electronic Health Record maintained or hosted by Sansio on behalf of Customer,the accounting period shall be three (3) years and the accounting shall includedisclosures for treatment, payment, and healthcare operations, in accordance with theapplicable effective date of Section 13402(a) of HITECH. In the event an Individualdirectly requests an accounting of disclosures, Sansio shall forward such request toCustomer in order for Customer to respond to such Individual. Sansio hereby agreesto implement an appropriate record keeping process to enable it to comply with therequirements of this Section.N. Compliance with HIPAA Transaction Standards. Customer and Sansio each agree tocomply with all applicable HIPAA standards and requirements, (including without Sansio - Confidentialv 2022.2 Revised 2/7/20226
limitation, those specified in C.F.R. § 162) with respect to the transmission of healthinformation in electronic form in connection with any transaction for which theSecretary has adopted a standard under HIPAA (“Covered Transactions”). O. Availability of Books and Records. Sansio agrees to make Sansio’s internal practices,books, and records relating to the use and disclosure of PHI received from, or createdor received by Sansio on behalf of, Customer available to the Secretary for purposesof determining Customer’s compliance with the Privacy Rule, Security Rule and theHITECH Act.P. Effect of Termination of Agreement. Upon termination of this Agreement for anyreason, if feasible, Sansio will return or destroy all Protected Health Informationcreated by, received from or maintained by Sansio on behalf of Customer. In theevent that Sansio determines that returning or destroying the Protected HealthInformation is infeasible, Sansio will extend the protections of this Agreement to suchProtected Health Information and limit further uses and disclosures of such ProtectedHealth Information to those purposes that make the return or destruction infeasible,for so long as Sansio maintains such Protected Health Information.Q. Red Flag Rules. So long as Sansio retains any confidential or non-public IndividuallyIdentifiable Information, Sansio will develop, maintain, and implement policies andprocedures designed to ensure the privacy, confidentiality, and security of suchinformation, and to prevent, detect, and mitigate against the reasonably foreseeablerisks of personal and medical identity theft in compliance with the requirements of law,including, without limitation, the Identity Theft, Red Flags and Address Discrepanciesunder the Fair and Accurate Credit Transaction Act of 2003 ("Red Flag Rules"). Sansiowill cooperate with Customer in evaluating, investigating, and responding to Red Flagsor any possible data breach or Identity Theft activity. Notwithstanding anything to thecontrary in this Agreement or any other document, this provision shall survive theexpiration or sooner termination of this Agreement, and shall inure to the benefit ofCustomer and its affiliates and agents.R. Changes in the Law. Sansio may amend this Agreement as appropriate, to conformto any new or revised legislation, rules and regulations to which Sansio is subject nowor in the future including, without limitation, HIPAA, HITECH, the Privacy Standards,Security Standards, or Transaction Standards.
Sansio - Confidentialv 2022.2 Revised 2/7/20227
_______________________________ _____________________________ Agency Name, City & State Sansio Representative Name (Print) _______________________________ _____________________________ Agency Representative Name (Print) Sansio Representative Signature _______________________________ _____________________________ Agency Representative Signature Title _______________________________ _____________________________ Title Date _______________________________ Date APPROVED AS TO FORM:By: ____________________________ Assistant City Attorney Date4/20/23Digitally signed by: Laurie Avedisian-FaviniDN: CN = Laurie Avedisian-Favini email = [email protected] C = US O = Lozano SmithDate: 2023.04.20 14:10:10 -07'00'Laurie Avedisian-Favini