VIRTUA HIE PARTICIPATION AGREEMENT

Transcription

1 VIRTUA HIE PARTICIPATION AGREEMENT THIS PARTICIPATION AGREEMENT (hereinafter, the Agreement ) is entered into as of the day of 2010 (hereinafter, the Effective Date ) and BY and BETWEEN: VIRTUA HEALTH INC., a New Jersey not-for-profit corporation with corporate offices located at 401 Route 73 North, 50 Lake Center Drive, Suite 400 ( Virtua ), on behalf of the VIRTUA HEALTH INFORMATION EXCHANGE (the Virtua HIE ), a health information exchange owned and operated by Virtua, which has the following contact information: AND Main Contact: Virtua HIE System Administrator Address: info@ Phone: ( ) [NAME OF PRACTICE] ( Practice Site ), a [insert type of entity] which has the following contact information: Main Contact: Address: Phone: ( ) Virtua and Practice Site may at times hereinafter be referred to individually, each as a Party and collectively, as the Parties. For purposes of this Agreement, whenever Virtua is referred to herein, it shall be read to mean Virtua on behalf of the Virtua HIE, unless specifically stated otherwise. RECITALS: WHEREAS, the United States Department of Health and Human Services ( HHS ) has determined that the widespread adoption of interoperable electronic health records will result in an improvement in the quality and efficiency of health care. WHEREAS, Virtua has entered into an agreement (the License Agreement ) with Wellogic, Inc. ( Wellogic or Software Vendor ) to license software ( Software ) for donated.doc Page 1 of 32

2 technology to be known as the Virtua HIE, a community-wide health information system to be principally used by Virtua s employees and physicians and other associated entities for the provision of healthcare and related services to patients in the community, provided that any such provider who desires to participate in the Virtua HIE (each, a Participant ) first executes a Participation Agreement and agrees to certain terms and conditions for transmitting and/or receiving electronic health records ( EHR ) and other patient information through the Virtua HIE in an authorized and secure manner; WHEREAS, Virtua s agreement with Wellogic includes a connection to Microsoft HealthVault, which will allow patients to also create and use a Personal Health Record ( PHR ) as a part of the Virtua HIE; WHEREAS, Practice Site wishes to participate in the Virtua HIE, and to engage Virtua to provide the technology and services needed in connection with the Virtua HIE; and WHEREAS, Virtua has the authority to authorize, and wishes to authorize Practice Site to use the Software and to participate in the Virtua HIE, subject to the terms and conditions set forth herein. NOW, THEREFORE, in consideration of the mutual covenants and promises set forth in this Agreement, and for other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties, intending to be legally bound, hereby agree as follows: AGREEMENT: 1. PURPOSE & COMPONENTS OF THE AGREEMENT 1.1. The purpose of this Agreement is to set forth the terms and conditions pursuant to which Practice Site may become a Participant of the Virtua HIE (and pursuant to which Practice Site s physicians and employees may become Authorized Users (as defined further herein)), and receive technical and other support services for the Virtua HIE This Agreement includes, and incorporates by reference: Authorized User Agreement, a form copy of which shall be attached hereto as Exhibit A, and with executed versions becoming a part of this Agreement; HIPAA Business Associate Agreement, a copy of which shall be signed by Virtua and attached hereto as Exhibit B ; donated.doc Page 2 of 32

3 2. DEFINITIONS Virtua HIE Policies, current copies of which shall be attached hereto as Exhibit C, and with updated versions found at HIE Technology & HIE Services, a description of which shall be attached hereto as Exhibit D, and will be provided by Virtua in connection with the Virtua HIE; Participant System & Security Requirements, a description of which shall be attached hereto as Exhibit E, and shall be met by Practice Site in order to become a participant in the Virtua HIE; and Any Project Addendum, including Schedules, signed by the parties and attached to this Agreement Authorized User means an individual designated by a Participant who has signed an Authorized User Agreement and is authorized to access and use Data in accordance with such Participant s registration as a particular Participant User Type Authorized User Agreement means a legally-binding agreement with an individual designated by a registered Participant pursuant to which such individual agrees to comply with the terms and conditions set forth in such agreement. An Authorized User Agreement shall be in substantially the same form and substance as attached hereto as Exhibit B, unless otherwise approved in advance by the Virtua HIE Council (defined below) Data means protected health information (PHI) or information that identifies a patient that is provided to the Virtua HIE Data Exchange means electronically providing or accessing Data through the Virtua HIE Data Receiver means an organization, such as a hospital, physician practice, clinical laboratory, pharmacy, governmental agency or other entity, that has entered into an agreement allowing them to receive Data that is PUSHED through the Virtua HIE and into such Data Receiver s electronic medical record ( EMR ). A Data Receiver also may, but is not required to be a Data Supplier Data Sharer means an organization, such as a hospital, physician practice or other qualifying entity, that has entered into a Virtua HIE Participation Agreement (or an donated.doc Page 3 of 32

4 equivalent type of agreement) and will, in accordance with the terms of such agreement, the Virtua HIE Policies and all applicable laws, make Data maintained in such Data Sharer s EMR available for access by other Participants through the Virtua HIE, and also has the authority to access and PULL Data from the Virtua HIE that is made available by other Participants Data Supplier means an organization, such as a hospital, physician practice, clinical laboratory, pharmacy claims aggregation company, governmental agency or other entity, that has entered into a Virtua HIE Participation Agreement (or an equivalent type of agreement) and will, in accordance with the terms of such agreement, the Virtua HIE Policies and all applicable laws, transmit Data to the Virtua HIE and make it available for access by authorized Participants through the Virtua HIE. A Data Supplier may also be a Data Receiver; however a Data Supplier shall not have authority to fully access and pull other Participant s Data through the Virtua HIE unless such Participant is registered as a full Data Sharer Health Care Provider means, for purposes of this Agreement, a physician, group practice, hospital or health system, or other health care organization or professional that provides treatment to Patients and has entered into a Virtua HIE Participation Agreement (or similar type of agreement). In connection with the Virtua HIE, the Health Care Provider will be either a Data Supplier or Data Receiver (or both), or a Data Sharer, as well as either a Participant (at entity-level) or Authorized User (at user-level) HIPAA means the Health Insurance Portability and Accountability Act of 1996 (HIPAA) collectively with the Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. Part 160 and Part 164, Subpart E (Privacy Rule), and the HIPAA Security Standards, 45 C.F.R. Part 160 and Part 164, Subpart C (Security Rule), as amended by the Health Information Technology for Economic and Clinical Health Act and regulations promulgated thereunder (HITECH). For the purposes of this Agreement, capitalized terms relating to privacy and security that are not otherwise defined herein shall have the meanings ascribed to such term under HIPAA Participant means a party that has entered into a Virtua HIE Participation Agreement and has registered with the Virtua HIE as a Participant User Type (e.g., Data Sharer), and shall include the Practice Site upon its successfully completed registration with the Virtua HIE Participant User Type shall mean the type of user of the Virtua HIE that a Participant is registered as in accordance with the Virtua HIE Policies. By way of example, a Participant User Type may register as a Data Supplier, Data Receiver, or a Data Sharer. donated.doc Page 4 of 32

5 2.12. Participation Agreement means this form of Virtua HIE Participation Agreement, or another similar type of agreement approved by the Virtua HIE Council, which sets forth the binding terms and conditions pursuant to which a Participant may supply, receive or share Data through the Virtua HIE Patient means an individual who has received or will receive treatment or health care services from a Health Care Provider Permitted Use(s) shall mean the permitted purpose(s) for which Data received through the Virtua HIE may be accessed and used, as more particularly set forth in the Virtua HIE Policies and in this Agreement, and in general will be limited to uses only in connection with treatment of a Patient, or any such other uses that may be separately agreed upon in writing between Participants and the Virtua HIE. Any use of Data that is not a Permitted Use shall be, for purposes of the Virtua HIE, considered a Prohibited Use, as defined further herein Personal Health Record or PHR means an electronic, universally available, resource of health information that may originate from either a Health Care Provider or the Patient, but is controlled and managed exclusively by the Patient Prohibited Use(s) shall mean any access or use of Data through the Virtua HIE for any reason or purpose other than a Permitted Use. Prohibited Uses include, but are not necessarily limited to, manipulating, aggregating, integrating, compiling, merging, reorganizing, regenerating, transferring or otherwise using or disclosing Data for any purpose except in connection with the care and treatment of a Patient, unless otherwise agreed upon in writing by the affected Participants and the Virtua HIE. Specific examples of Prohibited Uses shall be set forth in the Virtua HIE Policies. Prohibited Use may be considered a Breach of this Agreement and/or a Security Beach under applicable laws Registration means the process pursuant to which, upon execution of this Participation Agreement, that an entity or individual is registered as a Participant or Authorized User of the Virtua HIE, as the case may be, in accordance with the Virtua HIE Policies Virtua HIE means the technology and administrative infrastructure which facilitates the authorized and secure location, access and sharing of Data, including Patient s health, demographic and related information, held by multiple Health Care Providers by allowing Participants and their Authorized Users to authenticate and communicate securely over an entrusted network to provide access to and exchange of Data pursuant to and in accordance with the terms and conditions of executed agreements and the operating principals set forth in specific policies and procedures. donated.doc Page 5 of 32

6 2.19. Virtua HIE Council shall mean the governing and decision-making body for the Virtua HIE, as more specifically described in this Agreement and the Virtua HIE Policies Virtua HIE Policies shall mean the policies and procedures developed, and approved by the Virtua HIE Council, including as amended from time to time, that will apply to and must be complied with, as applicable, by each and all registered Participants and their Authorized Users of the Virtua HIE. 3. HIE TECHNOLOGY Availability of HIE Technology. Virtua shall provide and make available the Software and other technology, as more particularly described in Exhibit D (hereinafter, the HIE Technology ), necessary for Practice Site and its Authorized Users to access and use the Virtua HIE in accordance with this Agreement and applicable Authorized User Agreements. Except as otherwise set forth under Section 4 below, Virtua will take reasonable efforts to make the Virtua HIE available to Participants 24 hours a day, 7 days a week Grant of Right to Use. Upon its becoming approved and registered as a Participant, Virtua grants to Practice Site, and each of its registered Authorized Users, for the Term of this Agreement a royalty-free, non-exclusive, nontransferable, nonassignable, non-sub-licensable, and limited right to use the HIE Technology and Software for the sole purpose of participating in the Virtua HIE as a Data Supplier, Data Receiver, or Data Sharer, under the terms and conditions of this Agreement. THE SOFTWARE AND HIE TECHNOLOGY SHALL NOT BE USED FOR ANY OTHER PURPOSE WHATSOEVER, AND SHALL NOT BE COPIED OR INCORPORATED INTO ANY OTHER COMPUTER PROGRAM, HARDWARE, FIRMWARE OR PRODUCT, EXCEPT AS SPECIFICALLY PROVIDED FOR UNDER THIS AGREEMENT. THE SOFTWARE AND HIE TECHNOLOGY IS LICENSED AS IS AND VIRTUA DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES OF ANY KIND, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR TITLE Prohibited Modifications. Practice Site acknowledges and agrees that the HIE Technology includes the Software that constitutes a trade secret and confidential information of the Software Vendor. Practice Site shall not permit any person other than Practice Site and its Authorized Users, who are properly authorized in donated.doc Page 6 of 32

7 accordance with this Agreement and the Virtua HIE Policies, to access and/or use the HIE Technology, and Practice Site shall not, nor shall it permit any Authorized User or third party to, modify, adapt, translate, reverse engineer, decompile, disassemble or create a derivative work based on the HIE Technology No Transfer of Title or Ownership in Intellectual Property. No title to, ownership of, or any property rights to the Software or HIE Technology, or any component thereof offered or used under this Agreement, is granted, transferred or deemed assigned to Practice Site, any Authorized User, or any other third party. The Software Vendor and/or Virtua, as the case may be, retain all title and ownership of all intellectual property rights in and to the HIE Technology and Software, including any and all modifications to and derivative works therefrom that have been made or may be made by Virtua or Practice Site under this Agreement, or Virtua s underlying License Agreement with Software Vendor. Practice Site shall not at any time during the term of this Agreement or following termination or expiration of the term of this Agreement, contest or aid others in contesting or doing anything which impairs the validity of any proprietary or intellectual property rights or interests of Software Vendor or Virtua in the Software or HIE Technology, including but not limited to its trademarks, patents, copyrights, trade secrets, or any Confidential Information, as defined under the License Agreement. Practice Site and its Authorized Users shall have no ownership rights to any changes, additions or enhancements to the HIE Technology that may be provided by Virtua under this Agreement. All such changes, additions and enhancements shall be subject to the protections and restrictions applicable to the HIE Technology and Software under the terms of this Agreement and the License Agreement Controlling Terms. Practice Site acknowledges that the HIE Technology and Software has been licensed to Virtua by Wellogic, and agrees that the limited use license granted to it under this Agreement is subject in every respect to the terms and conditions of Virtua s License Agreement with Wellogic. In the event of a conflict between any provision of such License Agreement and this Agreement regarding the permissibility of a use, a question of property rights, and any other conditions or restrictions pertaining to the HIE Technology or Software, the terms of the License Agreement shall control. If there are any additional terms and conditions that govern the access and use of the HIE Technology or Software, the same shall be attached to this Agreement as a Schedule. To the best knowledge of Virtua, use of the HIE Technology and Software as described and specifically permitted under this Agreement does not breach or cause a default under the License Agreement Additional Software and Agreements. The parties acknowledge and agree that the HIE Technology may include certain third-party software, hardware, and services subject to separate licenses or subscription or other agreements, which may require Practice Site to enter into additional agreements with third-party vendors. Practice donated.doc Page 7 of 32

8 Site agrees to execute such agreements as may be required for it to use such software, hardware or services, and to comply with the terms of any applicable license or other agreement relating to third-party products included in the Virtua HIE. Any additional software developed by or for Virtua for the Virtua HIE, as applicable, shall become subject to this Agreement upon written notice to Practice Site, and such notice shall serve as and have the effect of an automatic amendment to this Agreement, without the need for further agreement from Practice Site, and shall be binding upon the parties. This section applies only to the HIE Technology and Software that is provided by Virtua to Practice Site, and not to any other third party software that Practice Site may use in providing treatment to Patients or for its business operations Fees. Except as may be specifically set forth elsewhere in this Agreement, including any Exhibits hereto, or unless otherwise mutually agreed to in writing by the Parties, Virtua shall not charge Practice Site any fees or costs for use of the HIE Technology, as described under this, provided that Practice Site accesses and uses the HIE Technology solely in connection with the Virtua HIE s purpose as a Community- Wide Health Information System (as defined in 13). To this end, it is the parties intent that Virtua s provision of and Practice Site s access to and use of the HIE Technology comports in all aspects with the Fraud and Abuse Laws, as more particularly set forth in HIE SERVICES Availability of HIE Services. Virtua shall, for the term of this Agreement, provide and make available services and ongoing support, as more particularly described in Exhibit D (hereinafter, the HIE Services ), necessary to support Practice Site s and its Authorized Users access to and use of the Virtua HIE in accordance with this Agreement and applicable Authorized User Agreements Uptime and Maintenance. Virtua agrees to use commercially reasonable efforts to ensure that the Virtua HIE is available 24 hours a day, 7 days a week, subject to temporary suspensions or periods of unavailability that will occur from time-to-time for maintenance purposes (hereinafter, Scheduled Downtime ). Virtua will endeavor to provide reasonable advance notice of foreseeable suspensions or interruptions in the availability of the Virtua HIE. With regard to unforeseen or unscheduled unavailability, suspensions or interruptions in the availability of the Virtua HIE (hereinafter, Unscheduled Downtime ), Virtua agrees to restore its availability for use as soon as reasonably possible. Practice Site acknowledges and agrees that Virtua shall not be responsible or liable for any instance of Unscheduled Downtime that is the result of an intervening third party or cause (e.g., downed electrical or data lines; a virus originating with Practice Site; Force Majeure etc.) or which is not within the sole and unfettered control of Virtua. donated.doc Page 8 of 32

9 4.3. Viruses. In the event that Practice Site notifies Virtua that there are reasons to believe that the Virtua HIE has been affected by a computer virus, Virtua will promptly notify the Software Vendor and take reasonable steps within Virtua s control to restore any negative effects that such virus may have caused to the Software or HIE Technology maintained and hosted on Virtua s servers. Notwithstanding the foregoing, this provision does not obligate Virtua or Software Vendor to remedy any virus within a Practice Site s locally-maintained computers, networks or other facility-based technologies Fees. Except as may be specifically set forth elsewhere in this Agreement, including any Exhibits hereto, or unless otherwise mutually agreed to in writing by the Parties, Virtua shall not charge Practice Site any fee or costs associated with providing it with the HIE Services, as described under this 4, provided that Practice Site accesses and uses the HIE Services solely in connection with the Virtua HIE s purpose as a Community-Wide Health Information System (see 13). To this end, it is the parties intent that Virtua s provision of and Practice Site s use of the HIE Services comports in all aspects with the Fraud and Abuse Laws (see 13). 5. REGISTRATION Participants Registration Required. Practice Site shall register with the Virtua HIE as a selected Participant User Type prior to being permitted to access the Virtua HIE. Within a reasonable period of time after the parties sign this Agreement, Virtua shall initiate the registration process with Practice Site. Practice Site must register as either a Data Sharer, Data Supplier or Data Receiver (or both) in accordance with the Virtua HIE Policies Approval or Disapproval of Registration. Practice Site shall be approved or disapproved as a Participant of the Virtua HIE in accordance with the Virtua HIE Policies. The Virtua HIE shall not be required to approve Practice Site s registration if it is determined that Practice Site does not meet the requisite criteria to become a qualified Participant of the Virtua HIE. In the event it is determined that Practice Site does not meet the requisite criteria for participating in the Virtua HIE, this shall be communicated to Practice Site as soon as reasonably practicable. If Practice Site is not approved as a Participant in the Virtua HIE, Practice Site shall not have any rights to access or use of the Virtua HIE under this Agreement Effect of Registration. If Practice Site is approved as a Participant of the Virtua HIE, the effect of such approval shall include, among other things, that Practice Site must comply with and ensure that its Authorized Users comply donated.doc Page 9 of 32

10 5.2. Authorized Users. with all Virtua HIE Policies applicable to the Participant User Type it has registered as Identification of Authorized Users. Practice Site will identify individuals who are employed by or otherwise have a need to access the Virtua HIE for or on behalf of the Practice Site. Practice Site shall select potential qualified individuals to become Authorized Users based upon the Role-Based Access restrictions set forth in the Virtua HIE Policies Registration Required; Authorized User Agreements; Training. Virtua will initiate the registration process with the individuals Practice Site identifies to become registered as Authorized Users. Practice Site acknowledges that each Authorized User must complete required training and sign an Authorized User Agreement agreeing to the terms and conditions of their use of the Virtua HIE prior to being permitted access the Virtua HIE. Individuals will be approved or disapproved in accordance with the Virtua HIE Policies. Practice Site shall promptly notify Virtua, in accordance with the Virtua HIE Policies, whenever an Authorized User is added, removed by reason of termination of employment, or an Authorized User s scope of need to access Data has changed in any way Passwords and Other Security Mechanisms. Virtua will be responsible for issuing user names and password to each Authorized User who satisfies applicable registration requirements. Practice Site and Authorized Users shall be responsible for selecting, managing and protecting the confidentiality of such passwords in accordance with the Virtua HIE Policies No Use by Anyone Other than Authorized Users. Practice Site shall restrict access to only to those individuals who have been identified and approved as Authorized Users. Practice Site shall ensure that none of its employees, agents, contractors, or other individual under its authority and control access or use the Virtua HIE unless they are approved as an Authorized User in accordance with the Virtua HIE Policies Termination of Authorized Users. Any Authorized User of Practice Site who fails to act in accordance with such requirements and restrictions shall be subject to sanctions, which may include having his or her access to the Virtua HIE suspended or terminated in accordance with Virtua HIE Policies. 6. PARTICIPANT OBLIGATIONS. donated.doc Page 10 of 32

11 As a Participant of the Virtua HIE, Practice Site agrees to the following: 6.1. Data Access and Use. Practice Site shall access and use (and ensure that its Authorized Users access and use) Data obtained through the Virtua HIE only for Permitted Uses and within the scope of access applicable to the Participant User Type (e.g., Data Sharer, Data Receiver, Data Supplier) that the Practice Site registered as with the Virtua HIE Prohibited Uses. Practice Site shall not access or use (and shall ensure that its Authorized Users, workforce, and other third parties within Practice Site s authority and control do not access or use) Data obtained through the Virtua HIE for any Prohibited Use, as described under this Agreement and the Virtua HIE Policies Responsibility for Conduct Authorized Users. Practice Site shall be solely responsible for all acts and omissions of its respective Authorized Users, and all other individuals who access the Virtua HIE either through Practice Site or by use of any password, identifier or log-on received or obtained, directly or indirectly, lawfully or unlawfully, from Practice Site or any of its Authorized Users, and/or any confidential and/or other information accessed in connection therewith, and all such acts and omissions shall be deemed to be the acts and omissions of the Practice Site Privacy and Security. Practice Site shall maintain sufficient administrative, technical and physical safeguards to adequately protect the privacy and security of Data as required under 8 of this Agreement, the Virtua HIE Policies, and applicable federal and state laws Patient Authorization. If Practice Site is registered as a Data Sharer, the parties acknowledge that when Data is made available for access through the Virtua HIE for a Permitted Use, the Participant and Authorized User accessing Data through the Virtua HIE solely shall be responsible for obtaining any patient authorization or approval if required by law or under the Virtua HIE Policies before ACCESSING such Data from the Virtua HIE. By way of example, a Data Sharer may be restricted from accessing HIV/AIDS information about a patient through the use of a technological safeguard called a break glass which may require the Authorized User to first obtain the patient s written authorization in order to shatter and access such sensitive information. If Practice Site is registered as a Data Receiver or Data Supplier, then the Data Supplier solely shall be responsible for obtaining any patient authorization or approval if required by law or the Virtua HIE Policies before PUSHING the Data into Practice Site s EMR Information Subject to Special Protection. If Practice Site is registered as a Data Sharer or Data Supplier, it is the obligation of the Practice Site to notify the Virtua HIE of any Data that it may handle or maintain that is not specifically identified in the donated.doc Page 11 of 32

12 Virtua HIE Polices as Information Subject to Special Protection. Practice Site also acknowledges and understands that unless such special information is specifically identified in the Virtua HIE Policies, adequate safeguards may not be in place within the HIE Technology in order to safeguard the information from unauthorized access by another Participant in the Virtua HIE, and hereby agrees to assume all risk and liability associated transmitting or making available any such information through or to the Virtua HIE Accuracy and Correction. If Practice Site is registered as a Data Supplier or Data Sharer, it shall ensure that the Data provided or transmitted can be related to and identified with source records maintained by Practice Site. Practice Site shall also promptly correct any mistakes or errors discovered in Data it may transmit to the Virtua HIE (such as Data attributed to an incorrect individual or an error in laboratory value) by promptly transmitting the Data as a corrected report or value and notifying Virtua of any such corrections pursuant to Virtua HIE Policies System Security. Practice Site shall implement the minimum system security requirements as set forth in Exhibit E. In no way limiting the foregoing, Practice Site agrees to use reasonable efforts to ensure that its connection to and use of the HIE Technology, including without limitation the medium containing any Data or other information provided to the HIE Technology, does not include, and that any method of transmitting such Data will not introduce, any program, routine, subroutine, or data (including without limitation malicious software or malware, viruses, worms, and Trojan Horses) which will disrupt the proper operation of the HIE Technology or any part thereof or any hardware or software used by the Virtua HIE in connection therewith, or which, upon the occurrence of a certain event, the passage of time, or the taking of or failure to take any action will cause the HIE Technology or any part thereof or any hardware, software or data used by the Virtua HIE or any other Participant in connection therewith, to be destroyed, damaged, or rendered inoperable Compliance with HIE Policies. Practice Site shall comply, and shall ensure that its Authorized Users, workforce and other agents comply with, all Virtua HIE Policies as currently drafted and adopted by the Virtua HIE Council, as well as with any and all subsequently updated, amended, revised or added policies that may be adopted in the future Compliance with Laws and Regulations. Without limiting any other provision in this Agreement or requirement under the Virtua HIE Policies, Practice Site shall conduct itself, and shall ensure that all of its registered Authorized Users conduct themselves, in compliance with all applicable federal, state, and local laws, ordinances and regulations that may affect or bear on use of the Virtua HIE. donated.doc Page 12 of 32

13 6.11. Training. Practice Site shall ensure that its Authorized Users and workforce receive appropriate and adequate training with regard to their responsibilities in connection with access and use of the Virtua HIE, including without limitation, training on the requirements set forth under this Agreement, the Virtua HIE Policies, and applicable laws and regulations, including, but not limited to, those governing the confidentiality, privacy, and security of protected health information. 7. VIRTUA OBLIGATIONS 7.1. Virtua s Roles. The parties hereby acknowledge and agree that Virtua s obligations and responsibilities with regard to the Virtua HIE and this Agreement arise from its following roles: (1) as a HIPAA Business Associate of Practice Site, for purposes of performing certain health care operations for or on behalf of Practice Site in connection with its participation in the Virtua HIE, (2) as a registered Participant (e.g., Data Sharer) of the Virtua HIE, and (3) as a Designated Agent (as defined below in Section 7.1.3) of Practice Site for the limited purpose of transmitting a Report of Record (defined in 7.1.3) in accordance with the Clinical Laboratory Improvement Act (CLIA). Virtua agrees to perform its obligations and abide by any restrictions applicable to its respective role as follows: Virtua as Business Associate. In connection with Virtua making available the HIE Technology, providing the HIE Services, and performing functions in connection with the Virtua HIE Council ( the BA Services ), the parties hereby acknowledge and agree that Virtua is and shall conduct such BA Services as a HIPAA Business Associate of the Practice Site. When providing the BA Services, Virtua agrees to limit its access to and use of any PHI that Practice Site may have supplied to the Virtua HIE (hereinafter, Practice Site s Data ) to only those purposes described and allowed under the HIPAA Business Associate Agreement ( BAA) attached hereto as Exhibit B, which shall be signed by Virtua and made a part of this Agreement Virtua as Participant. The Parties hereby acknowledge and agree that Virtua is also a Participant in the Virtua HIE, and that Virtua s Authorized Users will also have access to and use of Data through the Virtua HIE. In its capacity as a Participant, Virtua agrees to abide by all the terms and conditions of this Agreement and the Virtua HIE Policies which pertain to its role as a Participant, including not accessing or using any of Practice Site s PHI through the Virtua HIE or otherwise in a manner that is a Prohibited Use Virtua as Designated Agent CLIA Reports of Record. For the sole and limited purpose of facilitating a Report of Record to be transmitted from an donated.doc Page 13 of 32

14 originating laboratory, or other authorized source, to the Practice Site pursuant to and in accordance with CLIA, Virtua agrees to be, and by signing this Agreement Practice Site hereby designates Virtua to be, the Practice Site s Designated Agent. This designation is limited and transient such that Virtua shall be considered a Designated Agent of Practice Site ONLY during the window of time beginning with when a CLIA Report of Record has been received by the Virtua HIE and ending with the point at which the Report of Record is delivered to Practice Site (hereinafter, the Designated Agent Window ), and for the sole purpose of transmitting the Report of Record to the Practice Site. For all other purposes and during all other periods of time, Virtua and Practice Site shall be independent contractors and neither shall be considered an agent of, or responsible for the acts of the other. As used in this Agreement, the Report of Record shall mean the information contained in a document, electronic or otherwise, that is certified by the originating laboratory, or other authorized source, as containing the requisite information needed to satisfy CLIA s requirement for delivery of a test result to the ordering provider Access to and Use of Information in Report of Record. During the Designated Agent Window, Virtua will not access, use or modify the Report of Record for any purpose other than to further accomplish the delivery of the same to Practice Site. In addition, Virtua will ensure that the Report of Record is not accessed, used or modified by any other third party before the Report of Record is delivered to Practice Site. Once the Report of Record has been delivered to Practice Site, Practice Site acknowledges and agrees that the Report of Record and information contained therein are then subject to the same terms and conditions of access and use applicable under this Agreement to all other Data supplied or shared by Practice Site. In addition, IF Practice Site registers with the Virtua HIE as a Data Sharer, by signing this Agreement Practice Site hereby authorizes the Report of Record and information contained therein to be made available through the Virtua HIE to other Participants and Authorized Users for Permitted Uses (e.g., treatment purposes) in accordance with the Virtua HIE Policies and this Agreement Safeguards. Virtua hereby agrees to and shall implement adequate technical, administrative and physical safeguards to separate its two roles from one another and ensure that any Practice Site s PHI that Virtua s employees may donated.doc Page 14 of 32

15 need to access or handle in order to perform the BA Services for and on behalf of Practice Site are not inadvertently or otherwise disclosed to other individuals at Virtua who are not designated and authorized to perform such BA Services. The HIPAA BAA shall govern the scope of how Virtua may access and use the Practice Site s Data for the limited purposes of providing the BA Services to Practice Site Virtua HIE Operations HIE Technology and Services. Virtua shall make available such HIE Technology and HIE Services as described in this Agreement in 3 and 4, and as set forth in Exhibit D attached to and made a part of this Agreement Compliance with Policies and Procedures. Virtua shall require that all other practice sites or entities that wish to participate in the Virtua HIE enter into a Virtua HIE Participation Agreement (or an equivalent agreement approved by the Virtua HIE Council) and comply with all Virtua HIE Policies. Virtua will oversee the administration of such agreements (e.g., execution; termination; amendment etc.) Virtua HIE Policies. Virtua shall develop the Virtua HIE Policies to govern the Virtua HIE and its Participants, including procedures for implementation. A copy of the Table of Contents for the Virtua HIE Policies is attached to this Agreement as Exhibit C, and a full draft of the policies may be accessed at Audits and Reports. In its capacity as a Business Associate of Practice Site, Virtua shall perform certain security and other audit functions, such as tracking Data accessed by Authorized Users in order to meet accounting of disclosures obligations Virtua HIE Council Formation. Virtua shall establish the Virtua HIE Council as the governing and decision-making body for the Virtua HIE. The Virtua HIE Council shall be responsible for the management and oversight of the Virtua HIE, including, but not necessarily limited to, making decisions regarding HIE Technology, HIE Services, Virtua HIE Policies, approval of certain Participants, and performing other oversight functions Composition. The Virtua HIE Council shall consist of at least the Executive Vice President and Chief Medical Officer of Virtua Health, the Vice President and Chief Medical Officer, Virtua Medical Group, thevice President and donated.doc Page 15 of 32

16 Chief Information Officer of Virtua Health, the Vice President and Chief Legal Officer of Virtua Health, one of the Vice Presidents/Chief Operating Officers of a Virtua-owned hospital, and two (2) designated presidents of the Virtua Medical Staff. In addition, the Virtua HIE Council may establish committees and delegate certain tasks and functions as the board members may determine, in their sole discretion, to be appropriate and necessary Binding Effect. The Virtua HIE Council will manage and oversee the Virtua HIE in accordance with applicable bylaws, policies and agreements, including this Agreement. Practice Site acknowledges and agrees that, unless otherwise specified under this Agreement or the Virtua HIE Policies, the Virtua HIE Council s decisions and determinations relative to the Virtua HIE are binding on all Participants of the Virtua HIE, including Practice Site. 8. PRIVACY AND SECURITY Compliance with Privacy & Security Law. Practice Site shall comply with the standards for the confidentiality, security, and use of patient health information, including without limitation protected health information, as required by HIPAA, State law, and as required under the Virtua HIE Policies Reporting of Security Breaches & Other Violations. Without limiting any other requirement or obligation in this Agreement or the Virtua HIE Polices, Practice Site shall notify the Virtua HIE of any use or disclosure of Data in a manner not permitted or authorized by this Agreement, the Virtua HIE Policies, and federal or state law of which Practice Site becomes aware, as well any security incident that could compromise Data integrity or security. 9. CONFIDENTIAL BUSINESS INFORMATION Scope of Proprietary & Confidential Information. In the performance of their respective responsibilities, the Parties may come into possession of certain proprietary Confidential Business Information of the other Party. For the purposes of this Agreement, Confidential Business Information means all trade secrets, business plans, marketing plans, know-how, data, contracts, documents, scientific and medical concepts, member and customer lists, costs, financial information, profits and billings, and referral sources, existing or future services, products, operations, management, pricing, financial status, goals, strategies, objectives, and shareholder or partnership agreements, whether written or verbal, that are confidential in nature; provided, however, that Confidential Business Information shall not include any information that: (a) is in the public domain; (b) is already known or obtained by any other party other than in the course of the other party s performance pursuant to this Agreement; (c) is independently developed by the other party; and/or (d) becomes donated.doc Page 16 of 32

17 known from an independent source having the right to disclose such information and without similar restrictions as to disclosure and use and without breach of this Agreement, or any other confidentiality or nondisclosure covenant furnished by such other party Nondisclosure of Confidential Business Information. Each Party agrees that it shall (i) keep and maintain in strict confidence any and all Confidential Business Information received from the other, or from any of the other s employees, accountants, attorneys, consultants, or other agents and representatives, in connection with the performance of their respective obligations under this Agreement; (ii) not use, reproduce, distribute or disclose any such Confidential Business Information, except as otherwise permitted by this Agreement; and (iii) shall prevent its employees, accountants, attorneys, consultants, and other agents and representatives from making any such use, reproduction, distribution, or disclosure Advertising Exception. The foregoing notwithstanding, Virtua may publicize the fact of this Agreement through a press release, press conference and a listing on the Virtua public website. Other than pursuant to the preceding sentence or as required by law, Practice Site will not disclose the terms of this Agreement without the prior written consent of Virtua Equitable Remedies. All Confidential Business Information represents a unique intellectual product of the party disclosing such information (the Disclosing Party ). The unauthorized disclosure of Confidential Business Information would have a detrimental impact on the Disclosing Party. The damages resulting from said detrimental impact would be difficult to ascertain but would result in irreparable loss, and as such, the Disclosing Party shall be entitled to equitable relief in preventing a breach of this 9, and such equitable relief is in addition to any other rights or remedies available to the Disclosing Party. 10. TERM & TERMINATION Term and Termination. The Term of this Agreement will begin on the Effective Date and will continue until terminated as set forth in this 10 (the Termination Date ). This Agreement may be terminated as follows: For Cause: If either Party reasonably determines that the other Party or any of its employees, agents or contractors have materially breached this Agreement, then that Party may terminate this Agreement on 30 days advance written notice to the other Party, provided that such notice identifies such area of non-compliance and such non-compliance is not cured within 30 days of receipt of the notice of non-compliance. Virtua may terminate this Agreement upon written notice to any Participant, including Practice Site, if it determines donated.doc Page 17 of 32

18 in its sole discretion that such Participant, an Authorized User, employee or agent has used Data or the Virtua HIE for any purpose other than a Permitted Use, or in a manner that violates any security or privacy obligations set forth under this Agreement, the Virtua HIE Policies, or under federal or state law Without Cause: Either Party may terminate this Agreement without cause upon 180 days advance written notice of termination to the other Party Material Change to Policies Violation of Law or Regulation: If either Party to this Agreement reasonably determines that its continued participation in this Agreement and the Virtua HIE would cause it to violate any law or regulation applicable to it, or would place it at material risk of suffering any sanction, penalty, or liability, then that Party may terminate this Agreement immediately upon written notice to the other Party Termination of License Agreement: Virtua may terminate this Agreement with notice to Practice Site if its License Agreement with Software Vendor is terminated for any reason Bankruptcy or Insolvency: Either Party may terminate this Agreement immediately in the event that: (a) a Party becomes insolvent or makes an assignment for the benefit of its creditors; (b) a petition under any foreign, state or United States bankruptcy act, receivership statute or similar statute, is filed by a Party, or by any third party and such petition is not resolved in the Practice Site s favor within sixty (60) days; or (d) the Practice Site is named a defendant in a criminal proceeding Effect of Termination Access Terminated. As of the Termination Date, Virtua shall terminate access to the Virtua HIE for Practice Site and its Authorized Users, and Practice Site and its Authorized Users shall stop all access and use of the Virtua HIE Rights and Duties. Termination will not affect the rights or duties of the Parties with regard to the Data transmitted before the Termination Date. Upon termination of this Agreement, any obligation and provision under this Agreement, the Virtua HIE Polices or otherwise that by its nature extends beyond termination, cancellation or expiration of this Agreement, will survive such termination, cancellation or expiration and remain in full force and effect. donated.doc Page 18 of 32

19 Return of Proprietary Information. Within 30 days of the effective date of termination, each Party will return to the other all Confidential Business Information belonging to the other or certify the destruction of such information if agreed to by the Party who originated the Confidential Business Information. Within 30 days of the effective date of termination, Practice Site shall permit Virtua to de-install and return to the Virtua HIE all software provided by the Virtua HIE under this Agreement. No Data will be returned to Practice Site upon termination of the Agreement, except as otherwise may be provided for in the HIPAA Business Associate Agreement. 11. DISCLAIMERS; LIMITATION ON LIABILITY Carrier Lines. Practice Site acknowledges that access to the HIE Technology is to be provided over various facilities and communications lines, and information will be transmitted over local exchange and Internet backbone carrier lines and through routers, switches, and other devices (collectively, carrier lines ) owned, maintained, and serviced by third-party carriers, utilities, and Internet service providers, all of which are beyond Virtua s control. Virtua assumes no liability for or relating to the integrity, privacy, security, confidentiality, or use of any information while it is transmitted on the carrier lines, or any delay, failure, interruption, interception, loss, transmission, or corruption of any data or other information attributable to transmission on the carrier lines. Use of the carrier lines is solely at the risk of Practice Site and its Authorized Users, and is subject to all applicable local, state, national, and international laws No Warranties. The HIE Technology, HIE Services and Data that may be provided to Practice Site and its Authorized Users through the Virtua HIE are being provided AS IS and AS AVAILABLE without any warranty of any kind, expressed or implied, including but not limited to, the implied warranties of merchantability, fitness for a particular purpose, and non-infringement. Practice Site is solely responsible for any and all acts or omissions taken or made in reliance on the HIE Technology or the Data obtained through the Virtua HIE, including inaccurate or incomplete information. It is expressly agreed that in no event shall the Virtua HIE be liable for any special, indirect, consequential, or exemplary damages, including but not limited to, loss of profits or revenues, loss of use, or loss of information or data, whether a claim for any such liability or damages is premised upon breach of contract, breach of warranty, negligence, strict liability, or any other theories of liability, even if the Virtua has been apprised of the possibility or likelihood of such damages occurring. Virtua disclaims any and all liability for erroneous transmissions and loss of service resulting from communication failures by telecommunication service providers or the HIE Technology. donated.doc Page 19 of 32

20 11.3. No Liability for Other Participants. By using the Virtua HIE, Practice Site acknowledges that other Participants have access to the Virtua HIE and Data contained on the Virtua HIE. Although such other Participants shall be required by Virtua to execute Participation Agreement and to agree to comply with the Virtua HIE Policies concerning use of the Data made available through the Virtua HIE, Practice Site acknowledges and agrees that the actions of such other parties are beyond the control of Virtua. Accordingly, VIRTUA DOES NOT ASSUME ANY LIABILITY FOR ACTIONS OR FAILURE TO ACT BY SUCH PARTICIPANTS OR THEIR AUTHORIZED USERS Inaccurate Data. All Data that is made available through the Virtua HIE is subject to change arising from numerous factors, including without limitation, changes to patient health information made at the request of the patient, changes in the patient s health condition, the passage of time and other factors. Virtua neither initiates the transmission of any Data, nor monitors the specific content of Data being transmitted. Without limiting any other provision under this Agreement or the Virtua HIE, VIRTUA SHALL HAVE NO RESPONSIBILITY FOR OR LIABILITY RELATED TO THE ACCURACY, CONTENT, CURRENCY COMPLETENESS, CONTENT, OR DELIVERY OF ANY DATA PROVIDED BY A PARTICIPANT TO THE VIRTUA HIE Patient Care. Practice Site and its Authorized Users shall be SOLELY responsible for all decisions and actions taken or not taken involving patient care, utilization management, and quality management for their respective patients and clients. Practice Site agrees that Virtua has no responsibility whatsoever for the conduct of the Practice Site s business or patient care. The Practice Site agrees that any reliance upon the Virtua HIE and HIE Technology shall not diminish the Practice Site s responsibility for patient care. 12. INSURANCE; INDEMNIFICATION Insurance Practice Site shall be responsible for purchasing and maintaining, at its sole cost and expense, general liability insurance, cyber liability insurance, and professional liability insurance as follows: General liability insurance in an amount not less than One Million Dollars ($1,000,000); Cyber liability insurance in an amount not less than One Million Dollars ($1,000,000); Professional liability insurance in an amount not less than One Million Dollars ($1,000,000 for any one occurrence and Three Million Dollars in the aggregate; donated.doc Page 20 of 32