HEALTH INFORMATION EXCHANGE PARTICIPATION, SERVICES & FUNDING AGREEMENT.PDF
Extracted text (via pymupdf)
89718 characters
©2022 Contexture. All rights reserved.
Page 1 of 27
HEALTH INFORMATION EXCHANGE PARTICIPATION, SERVICES & FUNDING AGREEMENT
This Participation, Services & Funding Agreement (“Participation Agreement”) is entered into
between Health Current, on behalf of itself and its affiliate Contexture (“Health Current”) and Maricopa
County, dba Department of Correctional Health Services(“Participant”), with an effective date of the
later dated signature executing this Participation Agreement (“Effective Date”). Throughout this
Participation Agreement Health Current and Participant may be referred to individually as a “Party” and
collectively as the “Parties.”
RECITALS:
1.
Health Current is a non-profit organization providing a secure platform for sharing electronic
health information – the Health Information Exchange (“HIE”). The Health Current mission
is to help its partners realize their highest potential to transform care through the design
and implementation of integrated health information technology (“HIT”) that supports the
information needs of all health care stakeholders to reduce health care costs, improve
patient safety and improve the quality and efficiency of health care and public health in
Arizona.
2.
Participants in the HIE include Data Recipients and Data Suppliers, as defined below. A
participant in the HIE may be a Data Recipient, a Data Supplier, or both.
3.
This Participation Agreement sets forth the terms and conditions of Participant’s access to
the HIE.
AGREEMENT:
1.0
DEFINITIONS
Applicable Law means federal, state and local statutes and regulations that are applicable to the
Participant, or those applicable to Health Current.
Authorized User means an individual authorized by Participant under this Participation
Agreement to use the HIE to access or receive Data for a Permitted Use.
Data means any information transmitted to the HIE by Data Suppliers, including but not limited
to Protected Health Information (“PHI”).
Data Exchange means electronically providing, receiving, or accessing Data through the HIE.
Data Recipient means the legal entity that has entered into a Participation Agreement and
whose Authorized Users will access or receive Data using the HIE.
Data Supplier means an entity that makes Data available for access through the HIE and has
entered into a Participation Agreement.
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 2 of 27
Data Services means the services provided by Health Current to Participant upon execution of a
separate Statement of Work, including, but not limited to the administrative, operational, and
information system support services required to operate the HIE.
Patient or Individual means a person who has received or will receive treatment or health care
services from a Health Care Provider. For purposes of individual rights set forth in the Health Insurance
Portability and Accountability Act (“HIPAA”) Business Associate Agreement (“Business Associate
Agreement”) as at Exhibit A, the term "Patient" or “Individual” shall include, with respect to individuals
under legal disability, the parent(s), guardian or other legally authorized representative of such person.
Permitted Use includes treatment, care coordination, case or care management, transition of
care planning, or other purposes approved by the Health Current Board of Directors, which are
permitted by Applicable Law. Any such Permitted Use is subject, however, to an Individual’s right under
state or federal law to opt-out of permitting access to his/her Data.
Other Definitions: Unless otherwise defined in this Participation Agreement, all capitalized
terms in this Participation Agreement will have the same meaning as provided under the HIPAA
Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. Part 160 and Part 164,
Subpart E (the Privacy Rule), the HIPAA Security Standards, 45 C.F.R. Part 160 and Part 164, Subpart C
(the Security Rule), and the HIPAA Breach Notification Regulations, 45 C.F.R. Part 160 and Part 164,
Subpart D (the Breach Notification Rule), all as amended from time to time.
2.0
HEALTH CURRENT OBLIGATIONS
2.1
Services Provided by Health Current.
(a)
Network Operation and Data Management Services. Subject to the terms of
this Agreement, Applicable Law and Health Current Policies, Health Current shall provide to Participant
the Services described in the Statement(s) of Work that is attached and incorporated by reference
herein. Health Current will maintain and operate the HIE and provide the Data Services selected by
Participant (whether through its own resources or those of its Subcontractors or third party vendors).
Health Current is responsible for the hardware, operating system(s), applications, and interfaces
necessary to exchange clinical and administrative information with Participant’s designated systems
over a secure encrypted network connection (“VPN”) provided by the Participant. Participant is
responsible for Participant’s hardware, operating system(s), networks, applications and interfaces to
permit its designated systems to connect to the HIE by way of the Participant's VPN.
(b)
Use of Subcontractors and Third Party Vendors. Health Current may contract
with Subcontractors and third party vendors to maintain and operate Health Current hardware and
applications, or to provide the Data Services. Health Current will require that its Subcontractors and
third party vendors comply with the applicable terms and conditions of this Participation Agreement and
Applicable Law. Health Current will be responsible for the performance of its Subcontractors and third
party vendors when performing any Data Services under this Participation Agreement, as if Health
Current had directly performed such Data Services.
2.2
Health Current Records of Data Exchange; Use and Disclosure of Data.
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 3 of 27
(a) Health Current Records. Health Current will maintain records relating to the
operation of the HIE, including records of the date, time and records that are received, transmitted or
accessed by a Data Recipient or an Authorized User in each Data Exchange as set forth in the Health
Current Policies described in Section 2.3. Health Current will not be responsible for maintaining records
of the content of any Data Exchange or inspecting the content of Data.
(b)
Data Storage and Maintenance. Health Current will store Data (for example, for
a continuity of care record or certain demographic, imaging, laboratory or pharmaceutical information).
Health Current’s storage of such Data will be governed by this Participation Agreement.
(c)
Health Current Use and Disclosure of Data and Information Related to Data
Exchanges.
(i)
Health Current will not Use or Disclose Data or information relating to
Data Exchanges to third parties except: (i) for a Permitted Use; (ii) as required by law or subpoena in
accordance with A.R.S. § 36-3808; (iii) as directed in writing by the Data Supplier that provided the Data;
or (iv) to an individual in accordance with A.R.S. § 36-3802.
(ii)
If Health Current or any of its Subcontractors or third party vendors
receives a court order or subpoena for Data, or request for Data by a government entity pursuant to
Applicable Law, Health Current, to the extent permitted by Applicable Law, will provide notice to the
Data Supplier that provided the Data, if known, as soon as possible, but not more than 5 calendar days
from receipt of the request, so that the Data Supplier has an opportunity to object to the court order,
subpoena or governmental request. Health Current will not be responsible for contesting or objecting
to any such court order, subpoena or governmental request, but will reasonably assist a Data Supplier in
its efforts to do so at no cost to Health Current. Health Current will comply with A.R.S. § 36-3808 in
responding to subpoenas.
(iii)
Health Current and its Subcontractors and third party vendors may
access Data and information relating to Data Exchanges only to provide services to Health Current
participants, for the testing, operation and maintenance of the HIE, to conduct investigations and
actions relating to compliance with this Participation Agreement, and as permitted by this Participation
Agreement. Health Current and its subcontractors and third party vendors must comply with Health
Current Policies and Applicable Law.
2.3
Policies.
(a)
Establishment of Policies. The Health Current Board of Directors (the “Board”)
(or its delegates) will establish policies (“Policies”) that will govern Health Current and Participant
activity related to the HIE, and will make these Policies available to Health Current participants or
prospective participants upon request. Health Current will develop and maintain a process for
consultation with participants regarding such Policies, and encourages Participant to provide input into
the development of Policies through the Board of Directors or the working groups and committees to
which such efforts are delegated by the Board. These Policies may govern Health Current and
Participant use of the HIE, and the use, submission, transfer, access, privacy, security, and accuracy of
Data, as well as the standards for vendor contracting and quality control, and Patient notification and
consent. Participant will have no ownership or other property rights in the Policies or other materials or
services provided by Health Current.
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 4 of 27
(b)
Changes to Policies. The Health Current Board may change or amend the
Policies from time to time at its discretion. Health Current will provide Participant at least 30 days’
advance notice of material changes to Policies before their effective date, unless the Health Current
Board determines that an earlier effective date is required to address a legal requirement, a concern
relating to the privacy or security of Data, or an emergency situation. Health Current may also postpone
the effective date of a change if the Health Current Board determines, in its sole discretion, that
additional implementation time is required. If the Health Current Board amends the definition of
Permitted Use as set forth in Section 1.0, Participant may terminate this Participation Agreement with
30 days’ advance notice to Health Current, unless such amendment is required by Law.
(c)
Security. Health Current will implement Policies that are reasonable and
appropriate to protect Data from improper access, tampering or unauthorized disclosure and to secure
compliance with Applicable Law. Such Policies will include administrative procedures, physical security
measures, and technical security services that are reasonably necessary to assure the confidentiality,
integrity, and the availability of Data. Health Current and Participant will comply with all security
Policies established by Health Current. If Participant security requirements are more stringent than
Health Current Policies, Health Current will cooperate with Participant to accommodate more stringent
security requirements, to the extent feasible. Throughout the term of this Participation Agreement,
Health Current will assure that its Subcontractors and third party vendors:
(i)
Implement and maintain access controls to the HIE, such that Data will
be reasonably secured from intrusion, corruption, loss of integrity, or inappropriate access;
(ii)
Have the capability to report access to Data through the HIE at the
patient-level, at a level of detail to be reasonably determined by Health Current;
(iii)
Support the provision of unique user identification and passwords to
Authorized Users;
(iv)
Manage the HIE in accordance with the National Institute for Standards
and Technology Security Guidelines, and will employ at least industry-standard anti-virus software;
(v)
Encrypt Web-based Data transmissions sent through the HIE, as
appropriate, using VPN technology or other industry-standard encryption techniques in compliance with
guidance issued by the Secretary of United States Department of Health and Human Services in 74 Fed.
Reg. 19006 (2009);
(vi)
Logically separate each Data Supplier’s Data in test and production
environments;
(vii)
Implement, maintain, test and, as appropriate, trigger disaster
avoidance and recovery procedures in accordance with a disaster avoidance and recovery and continuity
of operations plan;
(viii)
Provide Participant the right to inspect and audit compliance with these
requirements, at Participant’s expense; and
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 5 of 27
(ix)
Ensure the security and privacy of the Data pertaining to Patients who
opt out of participation in Data Exchanges via Health Current.
(d)
Investigations, Corrections, Reports. Health Current will adopt Policies for the
investigation, resolution and reporting of Patient complaints, security breaches or other concerns
relating to compliance (“Compliance Concerns”) with this Participation Agreement, Health Current
Policies and Applicable Law. Health Current will provide notice to Participant, pursuant to Health
Current Policies and as required by Applicable Law, of any Compliance Concern related to Participant’s
Authorized Users’ use of the HIE, Data provided by Participant, or a Compliance Concern that may lead
to a claim, audit, investigation, or cause of action against Participant, and Participant will cooperate with
Health Current in its investigation of any Compliance Concern and any related corrective action.
(e)
Offshoring. Health Current will ensure that it and its employees,
Subcontractors, and third party vendors will not transmit Data outside the jurisdiction of the United
States of America or its territories. Any breach of the foregoing shall constitute a material breach of this
Participation Agreement. This section will not prohibit Health Current from releasing Data that is de-
identified in accordance with 45 C.F.R. § 164.514(b) to employees or contractors outside the United
States, for purposes of software development and testing on behalf of Health Current, as long as Health
Current requires such employees or contractors to destroy such de-identified Data upon completion of
such activities. This section does not prohibit Participant from allowing its Authorized Users to access
the HIE for a Permitted Use while outside the United States.
2.4
Obligations to Comply with Law. Health Current will comply with Applicable Law. Health
Current obligations as a HIPAA Business Associate are set forth in Exhibit A.
3.0
DATA RECIPIENT OBLIGATIONS.
The obligations of this Section 3.0 apply to a Health Current participant that is a “Data
Recipient.” These obligations do not apply to a participant that is only a “Data Supplier;” participants
that are only Data Suppliers will not have access to Data in the HIE.
3.1
Data Exchange. Data Recipient agrees that its participation in any Data Exchange, and
use of the HIE by Data Recipient and its Authorized Users, will comply with the terms of this
Participation Agreement, Policies, and Applicable Law, including but not limited to those governing the
use, privacy, and security of Data received through and stored within the HIE.
3.2
Permitted Use. Data Recipient and its Authorized Users will use the HIE only for
Permitted Uses.
3.3
Authorized Users. Data Recipient will identify and authenticate its Authorized Users, in
accordance with this Participation Agreement and Policies. Authorized Users will include only those
persons who require access to the HIE to facilitate Data Recipient’s use of the Data for a Permitted Use.
Participant is responsible to ensure its Authorized Users comply with the terms and conditions of this
Participation Agreement, Policies and Applicable Laws. Data Recipient will assure that each Authorized
User has received training on the requirements of this Participation Agreement and Policies that are
applicable to Authorized Users before Data Recipient permits such Authorized User to access the HIE.
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 6 of 27
3.4
System Operations. Data Recipient, at its own expense, will provide and maintain the
hardware, operating system(s), applications and interfaces required of a Participant in Section 2.1 and as
set forth in Policies.
3.5
Print Capability. Health Current will allow Participant to print the information viewed by
Authorized Users (whether through Print Screen or similar functionality). Participant is responsible for
determining whether information viewed by Authorized Users will be integrated into Participant’s
medical records.
3.6
Obligations to Comply with Law. Data Recipient will comply with Applicable Law related
to the use of the HIE and Data contained therein.
3.7
Payment. Data Recipient will pay the fees set forth in each Statement of Work for Data
Services selected by Participant.
4.0
DATA SUPPLIER OBLIGATIONS.
The obligations of this Section 4.0 apply to a Health Current participant that is a “Data Supplier.”
These obligations do not apply to a participant that is only a “Data Recipient.”
4.1
Data Exchange and Data Submission. By engaging in Data Exchanges, Data Supplier
agrees that: (a) it will supply Data in compliance with this Participation Agreement, Policies, and
Applicable Law; and (b) Data provided or transferred by Data Supplier can be related to and identified
with source records maintained by Data Supplier. Additionally, for each Data Exchange, Data Supplier
agrees that it will provide sufficient Patient identifying information to permit Health Current to match
such Patient Data with other Data of the same Patient already maintained by Health Current within the
HIE. Data Supplier will make Data available to the HIE in accordance with the scope, format, and
specifications set forth in Policies.
4.2
Data Status upon Termination of Data Supplier Participation. Health Current will return
or destroy Data that it stores or maintains on behalf of Data Supplier upon termination of Data
Supplier’s Participation Agreement at the request of Data Supplier, in a form and manner consistent
with industry standards, unless Health Current is required by Applicable Law to retain the
Data. Notwithstanding the foregoing, Participant understands that PHI provided to the HIE may be
integrated into the medical record of Data Recipients that access the HIE, and into records maintained
by Health Current, and it may not be feasible for Health Current to return or destroy PHI that has been
thus integrated upon termination of this Participation Agreement. If Health Current does not return or
destroy PHI upon termination, Health Current will continue to follow the provisions of Exhibit A, the
“Business Associate Agreement,” and will limit its Use or Disclosure of PHI to those purposes that make
the return or destruction of PHI infeasible.
4.3
System Operations. Data Supplier will provide and maintain the hardware, operating
system(s), applications and interfaces required of a Health Current participant in Section 2.1 and as set
forth in Policies.
4.4
Accuracy. Data Supplier will promptly correct any mistakes or errors discovered in Data
it transmits to the HIE (such as Data attributed to an incorrect individual or an error in laboratory value)
by transmitting the Data to the HIE as a corrected report or value in accordance with Policies. All
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 7 of 27
corrections will be clearly marked as a correction. However, Data Supplier does not warrant the
accuracy of the Data provided to the HIE.
4.5
Obligations to Comply with Law. Data Supplier will comply with all Applicable Law
related to providing Data to the HIE.
4.6
Payment. Data Supplier will pay the fees set forth in each Statement of Work for Data
Services selected by Participant.
5.0
COMPLIANCE WITH LAWS; CONFIDENTIALITY
Both Health Current and Participant, and their agents and employees, will comply with
Applicable Law, including without limitation, laws on the use and disclosure of Data, the security and
privacy of Data, Patient consent or authorization for the use and transfer of Data, and requirements for
Data Exchange, including the right to opt-out in accordance with A.R.S. § 36-3803, and the provision and
distribution of the Health Current Notice of Health Information Practices in accordance with A.R.S. § 36-
3804. Participant will assure that its Authorized Users comply with all Applicable Law. Health Current’s
use of Data will be subject to this Participation Agreement and the Business Associate Agreement set
forth in Exhibit A.
6.0
PROPRIETARY INFORMATION
Pursuant to this Participation Agreement, each Party may have access to information about the
other Party that: (a) relates to past, present or future business activities, practices, protocols, products,
services, information, content, and technical knowledge; and (b) has been identified as confidential
(collectively, “Proprietary Information”) by such Party. For the purposes of this provision, Proprietary
Information will not include PHI.
6.1
Non-disclosure. The Parties will: (a) hold Proprietary Information in strict confidence;
(b) not make Proprietary Information available for any purpose other than as specified in the
Participation Agreement or as required by Applicable Law or subpoena; and (c) take reasonable steps to
ensure that Proprietary Information is not disclosed or distributed by employees, agents, subcontractors
or third party vendors (who will have access to the same only on a “need-to-know” basis) to third parties
in violation of this Participation Agreement. If Health Current or Participant receives a request for
Proprietary Information, the Party receiving the request will provide the other Party notice of the
request and an opportunity to seek a protective order limiting the nature and scope of the information
to be disclosed; and the disclosing Party is only permitted to disclose Proprietary Information to the
extent required by Applicable Law.
6.2
Exclusions. Proprietary Information will not include information that: (a) at the time of
disclosure, is known or becomes known or available to the general public through no act or omission of
the receiving Party; (b) was in the receiving Party’s lawful possession before it was provided to the
receiving Party by the disclosing Party; (c) is disclosed to the receiving Party by a third party having the
right to make such disclosure; or (d) is independently developed by the receiving Party without
reference to the disclosing Party’s Proprietary Information.
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 8 of 27
6.3
Equitable Remedies. The Parties agree that a breach of this Section 6 will cause the
disclosing Party substantial and continuing damage, the value of which will be difficult or impossible to
ascertain, and other irreparable harm for which the payment of damages alone will be inadequate.
Therefore, in addition to any other remedy that the disclosing Party may have under this Participation
Agreement, at law or in equity, in the event of such a breach or threatened breach by the receiving
Party of the terms of this Section 6, the disclosing Party will be entitled, after notifying the receiving
Party in writing of the breach or threatened breach, to seek both temporary and permanent injunctive
relief without the need to prove damage or post bond.
6.4
Public Records. Notwithstanding the above provisions, in the event Proprietary
Information is requested for public release pursuant to A.R.S. § 39-121 et seq., from a Participant
subject to this statute (“Public Participant”), such Public Participant may release Proprietary Information
10 business days after Public Participant has notified the source of the Proprietary Information
(“Source”), unless the Source secures a protective order, injunctive relief or other appropriate order
from a court of competent jurisdiction enjoining the release of the records. For the purposes of this
paragraph, the day of the request for release shall not be counted in the time calculation. Public
Participant shall notify Source of any request for such release on the same day of the request for public
release or as soon thereafter as practicable. Public Participant shall not, under any circumstances, be
responsible for securing a protective order or other relief enjoining the release of Proprietary
Information, nor shall Public Participant be in any way financially responsible for any costs associated
with securing such an order.
7.0
SOFTWARE LICENSE
7.1
License Grant: Health Current represents and warrants that it has obtained all
necessary licenses and/or approvals to make available the Data Services and the HIE to Participant
under the terms and conditions of this Participation Agreement.
7.2
Third Party Software: Before making software provided by third parties (“Third Party
Software”) available to Participant, Health Current will obtain the right and ability to permit Health
Current and Participant to use the Third Party Software.
7.3
No Sublicensing: Participant shall not sublicense, export, rent, lease, grant a security
interest in, or otherwise transfer rights related to the HIE or any component of the Data Services,
without advance written permission from Health Current.
7.4
No Transfer or Modification. Except as permitted under this Participation Agreement,
Participant will not sell, rent, sublicense or otherwise share its right to use the Data Services or the HIE.
Participant will not modify, reverse engineer, decompile, disassemble or otherwise attempt to learn the
source code, structure or ideas upon which such software is based.
8.0
ELECTRONIC SIGNATURES
8.1
Signatures and Signed Documents. Participant, at Health Current’s request, will
implement for each of its Authorized Users a unique electronic identification consisting of symbols or
codes that are to be affixed to or contained in a Data Exchange made by the Authorized User(s) of the
Participant (“Electronic Signatures”). Participant agrees, and will require each of its Authorized Users to
agree, that any Electronic Signature of such Authorized User affixed to or contained in any Data
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 9 of 27
Exchange will be sufficient to verify that the particular Authorized User originated such Data Exchange.
Any properly transmitted Data Exchange made pursuant to this Participation Agreement shall be
considered a “writing” or “in writing” and any such Data Exchange containing, or to which there is
affixed, an Electronic Signature (“Signed Documents”) shall be deemed for all purposes: (a) to have been
“signed;” and (b) to constitute an original when printed from electronic files or records established and
maintained in the normal course of business.
8.2
Validity of Signed Documents. Participant will not contest the validity or enforceability
of Signed Documents under the provisions of any Applicable Law relating to whether certain agreements
are to be in writing or signed by the Party to be bound thereby. Signed Documents, if introduced as
evidence on paper in any judicial, arbitration, mediation, or administrative proceedings will be
admissible as between the Parties to the same extent and under the same condition as other business
records originated and maintained in paper form.
9.0
TERM AND TERMINATION
9.1
Term. The term of this Participation Agreement will begin on the Effective Date and will
continue until December 31 of that year (the “Initial Term”), or until terminated as set forth in Section
9.2. This Participation Agreement will automatically renew for additional one year terms (each a
“Renewal Term”) after the Initial Term for a period of ten years, unless terminated as set forth in Section
9.2.
9.2
Termination. Either Party may terminate this Participation Agreement under any of the
following circumstances:
(a)
Termination by Participant without Cause. Participant may terminate this Participation
Agreement by providing Health Current written notice of its intent to terminate this Participation
Agreement no later than November 1 of the Initial Term or the then current Renewal Term.
Termination pursuant to this Section 9.2(a) shall be effective as of December 31 of the Initial Term or
the then current Renewal Term, whichever is applicable.
(b)
Termination by Health Current without Cause. Health Current may terminate this
Agreement by providing Participant written notice of its intent to terminate this Participation
Agreement no later than December 1 of the Initial Term or the then current Renewal Term. Termination
pursuant to this Section 9.2(b) shall be effective as of December 31 of the Initial Term or the then
current Renewal Term, whichever is applicable.
(c)
Termination for Change in Fees. Currently this service is provided to Participant free of
charge. If fees are modified (i.e., if Health Current charges any fee for service under this contract), the
contract will automatically terminate.
(d)
Termination for Violation of Law or Regulation. If either Health Current or Participant
determines that its continued participation in this Participation Agreement would cause it to violate any
Applicable Law, or would place it at material risk of suffering any sanction, penalty, or liability, then that
Party may terminate this Participation Agreement immediately upon written notice to the other Party.
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 10 of 27
(e)
Termination for Breach of the Participation Agreement. If Health Current or Participant
determines that the other Party or any of its employees, agents or contractors have breached this
Participation Agreement, then the non-breaching Party may terminate this Participation Agreement with
advance written notice to the breaching Party, provided that such notice identifies the breach and such
breach is not cured within 30 days of receipt of the notice. Health Current may require Participant to
terminate access rights of any Authorized User if such Authorized User: (i) accesses or uses, or attempts
to access or use, Data in violation of this Participation Agreement; or (ii) accesses or uses the HIE in a
manner that disrupts, interferes with, or puts at risk the continued efficient operation of the HIE. Health
Current may terminate the Participation Agreement if Participant refuses to terminate the access rights
of an Authorized User as required by this Section 9.2(e).
(f)
Suspension or Termination of Vendor’s Services. Health Current may terminate this
Participation Agreement concurrently with the termination or suspension of any agreement with its
Subcontractors or third party vendors that provide any essential component of Data Services. Health
Current will promptly notify Participant following delivery of any notice of such termination or
suspension, and Health Current will require, upon written request, the Subcontractor or third party
vendor to cooperate to the extent feasible with the migration of Data and applicable services to an
alternative vendor.
(g)
Suspension of Data. Data Supplier may suspend providing Data to the HIE for
reasonable cause upon notice to Health Current, which notice shall describe the reason for such
suspension. Data Supplier will work with Health Current to resolve Data Supplier’s reason for the
suspension of providing Data, with the intent of resuming the provision of Data as soon as possible. In
the event Data Supplier’s suspension of Data continues for forty-five (45) days, Health Current may
terminate this Participation Agreement.
(h)
Suspension of Access. Health Current may suspend access to the HIE for Participant or
an Authorized User if necessary to ensure the stability or security of the HIE. Health Current shall advise
Participant or Authorized User of such suspension prior to or, if immediate action is required and
prevents prior notice, promptly after, such action is taken, and shall cooperate with Participant or
Authorized User to resolve the issues leading to such suspension. Participant may direct Health Current
to suspend access for a Participant Authorized User, and Health Current will suspend such access
promptly.
9.3
Effect of Termination.
(a)
Termination Process; Access to the HIE and Data. Upon the effective date of
termination of this Participation Agreement, Health Current will cease providing access to the HIE for
the Data Recipient and its Authorized Users, and Data Recipient and its Authorized Users will stop using
the HIE.
(b)
Rights and Duties. Any termination will not alter the rights or duties of the
Parties with respect to a Data Exchange conducted before termination. Upon termination of this
Participation Agreement, Section 6 (Proprietary Information), Section 9 (Term and Termination), Section
10 (Limited Warranties and Disclaimers), Section 11 (Limitation of Liability; Indemnification); Section
15.7 (Notices), Section 15.10 (No Relationship between Participants; No Third Party Rights); Section
15.13 (Dispute Resolution), and any other obligations that by their nature extend beyond termination,
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 11 of 27
cancellation or expiration of this Participation Agreement, will survive such termination, cancellation or
expiration and remain in effect.
(c)
Return of Proprietary Information. Promptly following termination, each Party
will destroy all tangible copies of Proprietary Information belonging to the other and certify the
permanent and irreversible destruction of such Proprietary Information if agreed to by the Party who
originated the Proprietary Information. Within 30 days of termination, Participant will de-install and
return to Health Current all software provided by Health Current (or its subcontractors or third party
vendors) to Participant under this Participation Agreement.
10.0
LIMITED WARRANTIES AND DISCLAIMERS
10.1
Health Current warrants that:
(a)
The HIE and all components of the Data Services will be free from material
defects in materials and workmanship and will operate in accordance with the specifications provided
by Health Current. If the HIE or any component of the Data Services fails such warranty, Health Current
(or its subcontractors or third party vendors) will repair the defect or provide a reasonable work-around.
(i)
Health Current Data Services will be performed in a competent and professional
manner in accordance with industry standards and practices and professional standards generally
applicable to such services; provided, however, that where this Participation Agreement specifies a
particular standard or criteria for performance, this warranty is not intended to and does not diminish
that standard or criteria for performance.
(j)
Each of the Health Current personnel and the Subcontractors and third party
vendors they hire or engage will have the proper skill, training, and background to perform his or her
assigned tasks.
(k)
Health Current will accurately display Data as provided by Data Supplier. If
Health Current fails to accurately display such Data, Health Current will repair the defect or provide a
reasonable work-around.
10.2
HEALTH CURRENT MAKES NO REPRESENTATION OR WARRANTY THAT THE DATA
PROVIDED BY PARTICIPANTS WILL BE TIMELY, CORRECT, OR COMPLETE.
10.3
Other than as provided in this Section 10, HEALTH CURRENT DISCLAIMS ALL OTHER
WARRANTIES REGARDING ANY PRODUCT, SERVICES, OR DATA PROVIDED PURSUANT TO THIS
AGREEMENT INCLUDING WITHOUT LIMITATION ANY WARRANTY OF MERCHANTABILITY OR FITNESS
FOR A PARTICULAR PURPOSE.
11.0
LIMITATION OF LIABILITY; INDEMNIFICATION
11.1
Limitation of Liability. Neither Health Current nor Participant will be liable to the other
for any special, incidental, exemplary, indirect, consequential, or punitive damages (including loss of use
or lost profits) arising out of or in connection with claims relating to Health Current’s or Participant’s
acts or omissions under this Participation Agreement; including but not limited to claims arising from
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 12 of 27
any delay, omission or error in the HIE, provision or receipt of Data, or the handling or storage of Data,
or, whether such liability arises from any claim based upon contract, warranty, tort (including
negligence), product liability or otherwise, and whether or not either Party has been advised of the
possibility of such loss or damage.
11.2
Release of Liability for Health Current. Notwithstanding Section 11.1, Participant
releases Health Current from any claims arising out of any inaccuracy or incompleteness of Data
submitted by a Data Supplier, except in circumstances where Health Current received accurate and
correct data from a Data Supplier, but delivered inaccurate and incorrect Data to a Data Recipient, or
those arising out of Health Current’s gross negligence. Participant also releases Health Current from any
claims relating to clinical, medical or other decisions related to the treatment of a Patient, including
those arising out of the unavailability of Data through the HIE, except for those arising out of Health
Current’s gross negligence. Participant releases Health Current from any liability associated with
Participant’s direction to Health Current to release Data under Section 2.2(c) above.
11.3
Release of Liability for Data Suppliers. Notwithstanding Section 11.1, Health Current
releases Data Supplier from any claims arising out of any inaccuracy or incompleteness of Data
submitted by the Data Supplier, except those arising out of Data Supplier’s gross negligence.
11.4
Indemnification.
(a)
Intellectual Property Infringement. Health Current shall indemnify and hold
harmless Participant and its Authorized Users against any third party claim, action, proceeding, or
demand against Participant or its Authorized Users during the term of this Agreement to the extent the
claim, action, proceeding, or demand alleges the HIE, any software or documentation provided to
Participant or its Authorized Users, or the Data Services (collectively, “Health Current Services”) directly
infringe the third party's United States patent, copyright, or trademark (each, and collectively, an
"Infringement Claim"). Health Current will pay Participant the damages, losses, costs, expenses, or
liabilities incurred (including reasonable legal fees) that are directly attributable to an Infringement
Claim and are either finally awarded by a court of competent jurisdiction against Participant or its
Authorized Users, or agreed to in a written settlement agreement signed by Participant or its Authorized
Users up to Five Million Dollars ($5,000,000).
Health Current will have no liability for any Infringement Claim that arises from: (A) the use of
the Health Current Services outside of the scope of this Agreement; (B) modification of Health Current
Services by Participant or its Authorized Users; (C) use of a superseded or prior version of the Health
Current Services if the infringement would have been avoided by the use of a new version which Health
Current made available to Participant, or (D) use of the Health Current Services in combination with any
other software, hardware or products not supplied by Health Current.
Health Current will have no liability for any Infringement Claim if Participant fails to: (A) notify
Health Current in writing of the Infringement Claim promptly upon the earlier of learning of or receiving
a notice of the Infringement Claim, to the extent that Health Current is prejudiced by this failure; (B)
provide Health Current with reasonable assistance requested by Health Current for the defense or
settlement (as applicable) of the Infringement Claim; (C) provide Health Current with the exclusive right
to control and the authority to settle the Infringement Claim (Participant may participate in the matter
at its own expense); or (D) refrain from making admissions about the Infringement Claim without Health
Current’s prior written consent.
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 13 of 27
The remedies in this section are Participant’s sole and exclusive remedies and Health Current’s
sole liability regarding the subject matter giving rise to any claim, action, proceeding, or demand that
the Health Current Services infringe or misappropriate any third party's intellectual property rights.
(b)
Indemnification for Breach of Agreement and Violation of Law.
(i)
To the extent permitted by Applicable Law, Participant will indemnify
and hold harmless Health Current, its employees and agents from any damages, expenses, including
reasonable attorneys’ fees and settlement costs, as applicable (collectively “Losses”), from such portions
of any demand, suit, action, or proceeding (each a “Claim”) by third parties arising from Participant’s or
its Authorized Users’ breach of this Participation Agreement, including without limitation the
unauthorized or improper use of the HIE, the use or disclosure of Data for any purpose other than a
Permitted Use, or violation of Applicable Law, provided that Health Current notifies Participant in
writing promptly upon discovery of a Claim and gives Participant complete authority and control of, and
full cooperation with, the defense and settlement of such Claim. Health Current will have the right to
retain counsel of its own choosing at its sole cost at any time. In no event may Participant agree to a
settlement or other resolution of such Claim that names Health Current as culpable absent Health
Current’s prior written consent.
(ii)
Health Current will indemnify and hold harmless Participant, its
Authorized Users, and their employees and agents from any damages, expenses, including reasonable
attorneys’ fees and settlement costs, as applicable (collectively “Losses”), from such portions of any
demand, suit, action, or proceeding (each a “Claim”) by third parties arising from Health Current’s
breach of this Participation Agreement, including without limitation, the unauthorized or improper use
of the HIE, use or disclosure of Data for any purpose other than a Permitted Use or as otherwise allowed
under this Participation Agreement, or violation of Applicable Law, provided that Participant notifies
Health Current in writing promptly upon discovery of any such Claim and gives Health Current complete
authority and control of, and full cooperation with, the defense and settlement of such Claim.
Participant will have the right to retain counsel of its own choosing at its sole cost at any time. In no
event may Health Current agree to a settlement or other resolution of such Claim that names Participant
or its Authorized Users as culpable absent Participant's prior written consent.
11.5
Not a Medical Service. The HIE does not make clinical, medical or other decisions. The
HIE is not a substitute for professional medical judgment applied by Participant or its Authorized Users.
11.6
Unavailability of the HIE. Participant understands and agrees that, during suspension or
interruption of the availability of the HIE, Participant and its Authorized Users may not be able to obtain
or access Services from the HIE and Participant shall conduct its operations without such access to the
HIE.
12.0
INSURANCE
12.1
Health Current Insurance. Health Current will maintain in effect policies of commercial
general liability insurance covering direct and indirect damages arising from the intentional or
unintentional Breach or disclosure of Data or Proprietary Information by Health Current and its
employees or contractors, with limits not less than five million Dollars ($5,000,000) per occurrence, and
not less than five million Dollars ($5,000,000) in the aggregate, each of which shall (1) be issued by an
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 14 of 27
insurance company with policy holder ratings no lower than “A” and financial ratings not lower than
“XII” in the latest edition of Best’s Insurance Guide in effect as of the Effective Date; and (2) require no
less than 30 days written notice to Participant prior to cancellation or expiration. Health Current shall
furnish certificates of insurance to Participant upon request. Health Current will require its
subcontractors, if any, to comply with this Section 12.1, or shall ensure that Health Current insurance
covers the work performed by its subcontractors.
12.2
Health Current Cyber, Network Security, and Privacy Liability. Cyber, Network Security
and Privacy Liability Insurance with a limit of not less than $5,000,000 per occurrence. The policy shall
include, but not be limited to; coverage for all directors, officers, agents and employees of insert, losses
with respect to network risks (such as data breaches, unauthorized access or use, and ID theft of data),
invasion of privacy (regardless of the type of media involved in the loss of private information), crisis
management, identity theft response costs, breach notification costs, credit remediation, and credit
monitoring, defense, and claims expenses, regulatory defense costs plus fines and penalties, cyber
extortion, electronic data restoration expenses (data asset protection), network business interruption,
computer fraud coverage, funds transfer loss, third-party fidelity, theft, no requirement for arrest and
conviction, and loss outside the premises of the named insured.
12.3
Data Recipient Insurance. Data Recipient will maintain in effect policies of liability
insurance with limits of not less than one million Dollars ($1,000,000) per occurrence and three million
Dollars ($3,000,000) in the aggregate. Such coverage may be in the form of a self-insurance program.
13.0
EHEALTH EXCHANGE AND THE DATA USE RECIPROCAL SUPPORT AGREEMENT (“DURSA”).
To support Participant’s communications with entities that are not Health Current participants,
Health Current participates in the eHealth Exchange network, which facilitates health information
exchange across the country. As a condition of participation in the eHealth Exchange network, Health
Current has signed the DURSA, and is required to obtain Participant’s agreement to comply with certain
provisions in the DURSA for Participant’s communications using the eHealth Exchange network.
Participant agrees to comply with the following provisions when conducting Data Exchanges with the
eHealth Exchange network:
13.1
Compliance with Law. Participant will comply with all Applicable Law.
13.2
Cooperation. Participant shall reasonably cooperate with Health Current on issues
related to the DURSA, including, but not limited to:
(a)
periodic audits and/or monitoring by Health Current to ensure Participant’s
compliance with this Section 13; and
(b)
information gathering and documentation related to Participant’s use of the HIE
to conduct Data Exchanges with the eHealth Exchange (including for the purpose of investigating any
Breach involving Participant or Participant’s Data).
13.3
Use of eHealth Exchange. When Participant requests a Data Exchange through eHealth
Exchange, such request must be: (i) done by a Participant employee with authority to make the request,
(ii) supported by appropriate legal authority to request the Data Exchange, (iii) submitted to the
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 15 of 27
intended recipient, (iv) for a Permitted Use under this Participation Agreement, as determined from
time to time, and (v) for one of the following purposes as permitted by the DURSA (but only if it is also a
Permitted Use under this Participation Agreement):
(a)
Treatment of the Individual who is the subject of the Data;
(b)
Payment activities of a Health Care Provider for the Individual who is the subject
of the Data;
(c)
Health Care Operations of either:
(i)
the Participant, if the Participant is sending Data to another person or
entity;
(ii)
the recipient of the Data, including the Participant, if: (a) the recipient of
the Data is a Health Care Provider who has an established Treatment relationship with the individual
who is the subject of the Data or such recipient is conducting Data Exchanges on behalf of such Health
Care Provider; and (b) the purpose of the Data Exchange is for those Health Care Operations listed in
paragraphs (1) or (2) of the definition of Health Care Operations in 45 C.F.R. § 164.501 or health care
fraud and abuse detection or compliance of such Health Care Provider;
(d)
Public health activities and reporting as permitted by Applicable Law, including
the HIPAA Regulations at 45 C.F.R. § 164.512(b) or 164.514(e);
(e)
Any purpose to demonstrate meaningful use of certified electronic health
record by the Participant; and
(f)
Uses and disclosures pursuant to an Authorization provided by the individual
who is the subject of the Data Exchange or such individual’s personal representative as described in 45
C.F.R. § 164.502(g) of the HIPAA Regulations. If Participant is requesting data from the eHealth
Exchange for a purpose for which an Authorization is required, Participant shall submit a copy of such
Authorization upon request.
13.4
Use of Data Received. With regard to Data that Participant receives through the
eHealth Exchange, Participant will comply with the terms and conditions of the DURSA, at
http://healthewayinc.org/images/Content/Documents/Application-
Package/restatement_i_of_the_dursa_9.30.14_final.pdf.
13.5
Protection of Passwords and Other Security Measures. Participant and its Authorized
Users shall refrain from disclosing to any other person any passwords or other security measures issued
to the Participant or its Authorized Users, and shall comply with all Policies related to the security of the
HIE.
13.6
Use of Data Received. Participants who receive Data via the eHealth Exchange may
retain, use and re-disclose such Data in accordance with Applicable Law and the Participant’s record
retention policies and procedures.
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 16 of 27
13.7
Reporting Breaches. If Participant discovers a Breach of Data associated with any Data
Exchange via the eHealth Exchange, Participant will report such Breach to Health Current as soon as
reasonably practicable after determining that a Breach occurred, and as required by Section 14.
13.8
Termination of DURSA. If Health Current’s DURSA is terminated for any reason,
Participant will no longer have any right to conduct Data Exchanges through the eHealth Exchange
utilizing Health Current connections.
14.0
BREACH REPORTING
This Section governs the Parties’ obligations under the Breach Notification Rule.
14.1
Participant Reporting to Health Current. If Participant discovers a suspected or
confirmed Breach of Unsecured PHI associated with any Data Exchange via the HIE, Participant will
report such suspected or confirmed Breach to Health Current as soon as reasonably practicable, but not
more than 5 business days after Participant’s discovery of the suspected or confirmed Breach. For
purposes of this Section 14.1, a suspected or confirmed Breach will be treated as discovered by
Participant in accordance with 45 C.F.R. § 164.404.
14.2
Health Current Reporting to Participant. Health Current will report a suspected or
confirmed Breach of a Data Supplier’s Unsecured PHI to the Data Supplier as soon as reasonably
practical, but not more than 5 business days after Health Current’s discovery of the suspected or
confirmed Breach. If a Data Recipient or its Authorized Users caused the suspected or confirmed Breach
of Unsecured PHI, Health Current will also report such suspected or confirmed Breach to the Data
Recipient within 5 business days of Health Current’s discovery of the suspected or confirmed Breach.
For purposes of this Section 14, a suspected or confirmed Breach will be treated as discovered by Health
Current in accordance with 45 C.F.R. § 164.410. Health Current will include information in the report
required by 45 C.F.R. § 164.410.
14.3
Health Current Reporting to Individuals, Media and HHS; Reimbursement to Health
Current for Participant Breach. If there is a Breach of Unsecured PHI for which more than one
Participant has a reporting obligation under 45 C.F.R. § 164.400 et seq., Health Current may assume the
obligation to report on behalf of such Participants to avoid duplicative reporting. However, a Participant
must approve the content of the notifications conducted on its behalf and may conduct its own
reporting if desired. If Health Current undertakes the obligation to conduct reporting on behalf of a
Participant, Health Current will comply with the requirements set forth in 45 C.F.R. § 164.400 et seq.
Where a Participant or its Authorized Users caused the Breach, such Participant will reimburse Health
Current for: (i) the costs of notification, and (ii) the costs of credit monitoring for one (1) year for
affected Individuals if the PHI subject of the Breach contains: (a) the Individual’s first initial or first
name, last name, and social security number; (b) the Individual’s first initial or first name, last name, and
driver’s license or state identification card number; (c) the Individual’s first initial or first name, last
name, account number, credit or debit card number, in combination with any required security code,
access code, or password that would permit access to an Individual's financial account; and/or (d) other
PHI that could lead to identity theft (collectively, “Identity Theft Information”).
14.4
Reimbursement to Participant for Health Current Breach. In the event a Participant is
Required by Law to notify Individual(s) of a Breach that is caused by Health Current or its employees or
Subcontractors: (i) Health Current will reimburse the Participant for reasonable notification costs,
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 17 of 27
unless Health Current agreed to assume the obligation to notify under Section 14.3; and (ii) Health
Current will pay the costs of credit monitoring for one (1) year for affected Individuals if the PHI subject
of the Breach contains Identity Theft Information.
15.0
GENERAL PROVISIONS
15.1
No Exclusion. Health Current represents and warrants to Participant, and Participant
represents and warrants to Health Current, that neither Party (nor their respective employees or agents
providing services under this Participation Agreement) have been placed on the sanctions list issued by
the office of the Inspector General of the Department of Health and Human Services pursuant to the
provisions of 42 U.S.C. 1320a(7), nor have been excluded from government contracts by the General
Services Administration or have been convicted of a felony or any crime relating to health care. Health
Current and Participant will provide one another immediate written notice of any such placement on
the sanctions list, exclusion or conviction. Either Party may terminate this Participation Agreement
immediately upon notice if the other Party (or its respective employees or agents providing services
under this Participation Agreement) becomes sanctioned, excluded or convicted as contemplated by this
provision. Health Current will not engage or contract with any individual or entity that has been placed
on the sanctions list issued by the office of the Inspector General of the Department of Health and
Human Services pursuant to the provisions of 42 U.S.C. 1320a(7) or excluded from any Federal health
care program.
15.2
Severability. Any provision of this Participation Agreement that is determined to be
invalid or unenforceable will be ineffective to the extent of such determination without invalidating the
remaining provisions of this Participation Agreement or affecting the validity or enforceability of such
remaining provisions, unless this Participation Agreement fails of its essential purpose, or one Party is as
a result treated inequitably, in which case the Parties will negotiate in good faith revisions to the terms
of this Participation Agreement to permit the accomplishment of the purposes of this Participation
Agreement, and to treat each Party equitably.
15.3
Entire Agreement. This Participation Agreement constitutes the complete agreement of
the Parties relating to the matters specified in this Participation Agreement and supersedes all earlier
representations or agreements with respect to the subject matter of this Participation Agreement,
whether oral or written with respect to such matters, including any other Participation Agreement
previously executed between Participant and Health Current. This Participation Agreement may be
amended at any time by mutual agreement of the Parties without additional consideration, provided
that, before any amendment shall become effective, it shall be reduced to writing and signed by each of
the Parties. No oral modification or waiver of any of the provisions of this Participation Agreement is
binding on either Party.
15.4
Assignment. Neither Health Current nor Participant may assign its rights or obligations
under this Participation Agreement without the advance written consent of the other Party, except for
assignment to a parent, subsidiary or affiliate wholly owned by the Party, or upon a change of control or
ownership of the Party.
15.5
Governing Laws. This Participation Agreement is governed by and interpreted in
accordance with Arizona laws, without regard to its conflict of law provisions. The Parties agree that
jurisdiction over any action arising out of or relating to this Participation Agreement shall be brought or
filed in the State of Arizona.
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 18 of 27
15.6
Force Majeure. No Party is liable for any failure to perform its obligations under this
Participation Agreement, where such failure results from any act of God or other cause beyond such
Party’s reasonable control. Notwithstanding the foregoing, Health Current shall establish, test, and
implement as appropriate disaster recovery and continuity of operations plans, or shall have its
contractors do so, and this provision shall not be deemed or interpreted to forgive, or prevent recovery
of damages as a result of, failure of Health Current to do so.
15.7
Notices. All notices, requests, demands, and other communications required or
permitted under this Participation Agreement must be in writing. A notice, request, demand, or other
communication will be deemed to have been duly given, made and received: (a) when personally
delivered; (b) on the day specified for delivery when deposited with a courier service such as Federal
Express for delivery to the intended addressee; or (c) three business days following the day when
deposited in the United States mail, registered or certified mail, postage prepaid, return receipt
requested, addressed as set forth below in the signature blocks. Nothing in this Section will prevent the
Parties from communicating via electronic mail, telephone, facsimile, or other forms of communication
for the routine administration of the HIE.
15.8
No Agency. Health Current provides Data Services to Participant, but does not act as
Participant’s agent. Participant will not be deemed an agent of another Health Current participant as a
result of its participation in this Participation Agreement.
15.9
Use of Trademarks and Trade Names. Nothing in this Participation Agreement shall be
deemed to give either Party any right to use the other Party’s trademarks or trade names without the
other Party’s prior written consent. Notwithstanding the foregoing, Health Current may list Participant
as a participant in the HIE, and may otherwise disclose to third parties the fact that Participant is a
participant and Participant may disclose its participation in the HIE. In the case of Participant’s logos or
trademarks or other uses of Participant’s names, any use by Health Current must be expressly approved
in writing by Participant.
15.10 No Relationship between Participants; No Third Party Rights. Nothing in this
Participation Agreement confers any rights or remedies under this Participation Agreement on any
persons other than Health Current and Participant and the Authorized Users, and nothing in this
Participation Agreement is intended to create a contractual relationship or otherwise affect the rights
and obligations among the Health Current participants. Nothing in this Participation Agreement will give
any third party, any right of subrogation or action against any Party to this Participation Agreement, and
no Health Current participant shall gain any subrogation right against another Health Current participant
solely as a result of this Participation Agreement.
15.11 Antitrust Compliance. Participant agrees not to use the information available through
the HIE or to which it has access under this Participation Agreement to evaluate or set its own prices for
services, or otherwise in violation of state or federal antitrust laws and regulations. Participant also
agrees not to discuss prices with other Health Current participants or to make any effort collectively to
establish prices with other participants in violation of law.
15.12 Terms Applicable Only to Agreements with Participant That Is a State or County
Government Agency, or Tribal Governments.
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 19 of 27
(a)
Non-Discrimination: Health Current agrees to comply with all provisions and
requirements of Arizona Executive Order 2009-09 including flow down of all provisions and
requirements to any subcontractors. Executive Order 2009-09 supersedes Executive order 99-4 and
amends Executive order 75-5 and may be viewed and downloaded at the Governor of the State of
Arizona’s website http://www.azgovernor.gov/dms/upload/EO_2009_09.pdf which is hereby
incorporated into this Participation Agreement as if set forth in full herein. During the performance of
this Participation Agreement, Health Current shall not discriminate against any employee, client or any
other individual in any way because of that person’s age, race, creed, color, religion, sex, disability or
national origin.
(b)
Cancellation for Conflict of Interest: This Participation Agreement is subject to
cancellation for conflict of interest pursuant to ARS § 38-511, the pertinent provisions of which are
incorporated into this Participation Agreement by reference.
(c)
Non–Appropriation: Notwithstanding any other provision in this Participation
Agreement, this Participation Agreement may be terminated if for any reason, there are not sufficient
appropriated and available monies for the purpose of maintaining the county or other public entity
obligations under this Participation Agreement. In the event of such termination, Participant shall have
no further obligation to Health Current, other than to pay for services rendered prior to termination.
(d)
Legal Arizona Workers Act Compliance:
(i)
Health Current hereby warrants that it will at all times during the term
of this Participation Agreement comply with all federal immigration laws applicable to Health Current’s
employment of its employees, and with the requirements of A.R.S. § 23-214 (A) (together the “State and
Federal Immigration Laws”). Health Current shall further ensure that each subcontractor who performs
any work for Health Current under this Participation Agreement complies with the State and Federal
Immigration Laws. Participant shall have the right at any time to inspect the books and records of
Health Current and any subcontractor in order to verify compliance with the State and Federal
Immigration Laws. Any breach of Health Current’s or any subcontractor’s warranty of compliance with
the State and Federal Immigration Laws, or of any other provision of this Section 15.12(d), shall be
deemed to be a material breach of this Participation Agreement subjecting Health Current to penalties
up to and including suspension or termination of this Participation Agreement. If the breach is by a
subcontractor, and the subcontract is suspended or terminated as a result, Health Current shall be
required to take such steps as may be necessary to either self-perform the services that would have
been provided under the subcontract or retain a replacement subcontractor, as soon as possible so as
not to delay project completion.
(ii)
Health Current shall advise each of its subcontractors of Participant’s
rights, and the subcontractor’s obligations, under this Section 15.12(d) by including a provision in each
subcontract substantially in the following form: “Subcontractor hereby warrants that it will at all times
during the term of this contract comply with all federal immigration laws applicable to subcontractor’s
employees, and with the requirements of A.R.S. § 23-214 (A). Subcontractor further agrees that a
participant that is a state or county government agency may inspect the subcontractor’s books and
records to ensure that subcontractor is in compliance with these requirements. Any breach of this
paragraph by subcontractor will be deemed to be a material breach of this contract subjecting
subcontractor to penalties up to and including suspension or termination of this contract.”
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 20 of 27
(iii)
Any additional costs attributable directly or indirectly to remedial action
under this Section 15.12(d) shall be the responsibility of Health Current. In the event that remedial
action under this Section 15.12(d) results in delay to one or more tasks on the critical path of
Participant’s approved construction or critical milestones schedule, such period of delay shall be
deemed excusable delay for which Health Current shall be entitled to an extension of time, but not
costs.
15.13 Dispute Resolution. The Parties agree that if there is a dispute between the Parties
arising as a result of this Participation Agreement (“Dispute”), each Party will designate an individual
with settlement authority to meet and confer in good faith in an attempt to resolve any Dispute. If the
Dispute is not resolved within 45 days after the Parties first meet and confer and the Parties wish to
pursue the Dispute, the Parties may agree to refer the Dispute to informal and nonbinding mediation
before a mutually acceptable independent mediator before taking formal legal action. The Parties will
split equally the costs of such mediation; provided, however, that each Party will pay its own fees and
costs incurred in connection with preparation for and participation in the mediation. Information
shared during dispute resolution attempts cannot be introduced as evidence in subsequent related
proceedings.
15.14 Waiver. No waiver of or failure by either Party to enforce any of the provisions, terms,
conditions, or obligations herein shall be construed as a waiver of any subsequent breach of such
provision, term, condition, or obligation, or of any other provision, term, condition, or obligation
hereunder, whether the same or different in nature. No extension of time for performance of any
obligations or acts shall be deemed an extension of the time for performance of any other obligations or
acts.
15.15 Counterparts. This Participation Agreement may be executed in one or more
counterparts, each of which shall be deemed to be an original, but all of which together shall constitute
one and the same instrument. Facsimile signatures and signatures transmitted by email after having
been scanned shall be accepted as originals for the purposes of this Participation Agreement.
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 21 of 27
IN WITNESS WHEREOF, the parties have executed this Agreement as of the respective dates written
below.
For Health Current,
MARICOPA COUNTY
A Contexture Organization
BOARD OF SUPERVISORS
Authorized Individual:
By: __________________________
By: ___________________________
Name: ________________________
Name: ________________________
Title: _________________________
Title: Chairman, Board of Supervisors
Date: _________________________
Date: __________________________
ATTEST:
By: ____________________________
Name: _________________________
Title: Clerk of the Board
Date: __________________________
APPROVED AS TO FORM:
By: ____________________________
Name: _________________________
Title: Deputy County Attorney
Date: __________________________
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
VP, Grants and Contracts Administration
Kelly Procopio
7/16/2024
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
7/18/2024
Davina Bressler
©2022 Contexture. All rights reserved.
Page 22 of 27
EXHIBIT A
BUSINESS ASSOCIATE AGREEMENT
Health Current and Participant agree to the terms and conditions of this Business Associate
Agreement in order to comply with the handling of Protected Health Information (“PHI”) under the
Health Insurance Portability and Accountability Act (“HIPAA”) Standards for Privacy of Individually
Identifiable Health Information, 45 C.F.R. Part 160 and Part 164, Subpart E (“Privacy Rule”) and the
HIPAA Security Standards, 45 C.F.R. Part 160 and Part 164, Subpart C (“Security Rule”), and the HIPAA
Breach Notification Rule, 45 C.F.R. Part 164, Subpart D (“Breach Notification Rule”), all as amended
from time to time. In addition, Health Current and Participant agree to these terms to satisfy the
requirements of 42 C.F.R. Part 2 (“the Part 2 Regulations”) for Health Current to act as a Qualified
Service Organization on behalf of Participant, in the event Participant is a substance abuse treatment
program under the Part 2 Regulations. The Participants in the Health Information Exchange (“HIE”) do
not become Business Associates of each other by virtue of this Business Associate Agreement.
Unless otherwise provided, all capitalized terms in this Business Associate Agreement will have
the same meaning as provided in the Participation Agreement, or under the Privacy Rule, Security Rule
and Breach Notification Rule if not otherwise defined in the Participation Agreement. For purposes of
this Business Associate Agreement, PHI includes only Individually Identifiable Health Information
provided to the HIE by Participant as a Data Supplier, or that is otherwise created or received by Health
Current on behalf of Participant.
1.
USES AND DISCLOSURES OF PHI
1.1
Obligations under HIPAA as a Business Associate: Health Current will use or disclose PHI
only for those purposes necessary to perform services under the Participation Agreement, as otherwise
expressly permitted in the Participation Agreement, or as Required by Law, and will not further use or
disclose PHI. Health Current agrees that anytime it provides PHI to a Subcontractor to perform Data
Services or that creates, receives, maintains or transmits PHI on behalf of Health Current, Health Current
first will ensure that each such Subcontractor agrees to substantially the same terms, conditions, and
restrictions on the Use and Disclosure of PHI as contained in this Business Associate Agreement. To the
extent Health Current is to carry out Data Supplier’s obligations under the Privacy Rule, Health Current
will comply with the Privacy Rule requirements applicable to Data Supplier in the performance of those
obligations.
1.2
Obligations under the Part 2 Regulations as a Qualified Service Organization: To the
extent the PHI received by Health Current is protected by the Part 2 Regulations (called “Part 2 Covered
Information”), Health Current acknowledges that in receiving, storing, processing or otherwise dealing
with Part 2 Covered Information, Health Current is fully bound by the Part 2 Regulations. If necessary,
Health Current will resist in judicial proceedings any efforts to obtain access to Part 2 Covered
Information except as permitted by the Part 2 Regulations.
2.
HEALTH CURRENT USE OR DISCLOSURE OF PHI FOR HEALTH CURRENT’S OWN PURPOSES
Health Current may use or disclose PHI for Health Current’s management and administration or
to carry out its legal responsibilities, including but not limited to audit, legal defense and liability, record
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 23 of 27
keeping, and similar obligations. Health Current may disclose PHI to a third party for such purposes if:
(1) the Disclosure is Required by Law; or (2) Health Current secures written assurance from the receiving
party that the receiving party will: (i) hold the PHI confidentially; (ii) use or disclose the PHI only as
Required by Law or for the purposes for which it was disclosed to the recipient; and (iii) notify Health
Current of any breaches in the confidentiality of the PHI. Health Current also may aggregate the PHI
with other Individually Identifiable Health Information in its possession consistent with 45 C.F.R. §
164.504(e)(2)(i)(B) or otherwise de-identify PHI according to the requirements of 45 C.F.R. §164.514(b);
Health Current may use such aggregated or de-identified PHI for Permitted Uses and as otherwise
permitted by the Participation Agreement.
3.
SAFEGUARDS
Health Current will implement and maintain appropriate safeguards to help prevent any Use or
Disclosure of PHI for purposes other than those permitted by this Business Associate Agreement. Health
Current also will implement administrative, physical and technical safeguards to protect the
confidentiality, integrity, and availability of any electronic PHI that Health Current creates, receives,
maintains, and transmits on behalf of Participant. Health Current will comply with the applicable
requirements of the Security Rule.
4.
UNAUTHORIZED USES OR DISCLOSURES AND BREACHES
4.1
Reporting a Use or Disclosure Not Permitted by This Agreement. Health Current will
report in writing to Data Supplier any Use or Disclosure of PHI for purposes other than those permitted
by this Business Associate Agreement within 5 business days of Health Current’s learning of such Use or
Disclosure.
4.2
Reporting Security Incidents. Health Current will report to a Data Supplier any Security
Incident of which Health Current becomes aware within 5 business days of Health Current’s learning of
such event. Security Incident shall have the same meaning given to such term in 45 C.F.R. § 164.304, but
shall not include (i) unsuccessful attempts to penetrate computer networks or servers maintained by
Health Current or its Subcontractors, and (ii) immaterial incidents that occur on a routine basis, such as
general pings and other broadcast attacks on a firewall, port scans, unsuccessful log-on attempts,
denials of service attacks, so long as such incident does not result in unauthorized access, Use or
Disclosure of PHI (“Unsuccessful Security Incidents). Health Current shall report Unsuccessful Security
Incidents to Participant upon request, but no more than once per month.
4.3
Reporting Breaches of Unsecured PHI. If Health Current discovers a Breach of
Unsecured PHI that Health Current accesses, maintains, retains, modifies, records, stores, destroys, or
otherwise holds, Uses or Discloses, Health Current will report such Breach as required by the Breach
Notification Rule and as provided in Section 14 of the Participation Agreement.
5.
INDIVIDUAL ACCESS TO PHI
Health Current will make available PHI in accordance with 45 C.F.R. § 164.524 and A.R.S. § 36-
3802(2).
6.
AMENDMENT OF PHI
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 24 of 27
Health Current will make available PHI for amendment and incorporate any amendments to PHI
in accordance with 45 C.F.R. § 164.526 and A.R.S. § 36-3802(3).
7.
ACCOUNTING OF DISCLOSURES OF PHI
Health Current will make available the information required to provide an accounting of
disclosures in accordance with 45 C.F.R. § 164.528 and will provide to Data Supplier or directly to an
individual, a list of the persons who have accessed the individual's PHI through the HIE in accordance
with A.R.S. § 36-3802.
8.
ACCESS TO BOOKS AND RECORDS
Health Current will make its internal practices, books and records on the Use and Disclosure of
PHI available to the Data Supplier and to the Secretary of the Department of Health and Human Services
to the extent required for determining Participant’s compliance with the Privacy Rule. Notwithstanding
this provision, no attorney-client, accountant-client or other legal privilege will be deemed waived by
Health Current or Participant as a result of this Section 8.
9.
TERMINATION
Participant may terminate the Participation Agreement upon written notice to Health Current if
Health Current breaches a material term of this Business Associate Agreement and Health Current fails
to cure the breach within 30 days of the date of notice of the breach. Further, Participant shall have all
termination rights as required and set forth at 45 C.F.R. §§ 164.504(e)(1) and 164.314(a)(1).
10.
RETURN OR DESTRUCTION OF PHI
Upon termination of the Participation Agreement, if feasible, Health Current will return or
destroy all PHI received from, or created or received by Health Current on behalf of, the Participant that
Health Current still maintains in any form and retain no copies of such information. Notwithstanding the
foregoing, Participant understands that PHI provided to the HIE may be integrated into the medical
record of Data Recipients that access the HIE, and into records maintained by Health Current, and it may
not be feasible for Health Current to return or destroy PHI that has been thus integrated upon
termination of the Participation Agreement. If Health Current does not return or destroy PHI upon
termination, Health Current will continue to follow the provisions of this Business Associate Agreement
and will limit its Use or Disclosure of PHI to those purposes that make the return or destruction of PHI
infeasible.
11.
RESTRICTION AGREEMENTS AND CONFIDENTIAL COMMUNICATIONS
Health Current will comply with any agreement that Data Supplier makes that either (i) restricts
the Use or Disclosure of Data Supplier’s PHI, or (ii) requires confidential or alternate methods of
communication about Data Supplier’s PHI, provided that Data Supplier notifies Health Current in writing
of the restriction or confidential or alternate communication obligations that Health Current must
follow. Data Supplier will promptly notify Health Current in writing of the termination of any such
restriction agreement or confidential or alternate communication requirement and, with respect to
termination of any such restriction agreement, instruct Health Current whether any of Data Supplier’s
PHI will remain subject to the terms of the restriction agreement.
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 25 of 27
EXHIBIT B
CATALOGUE OF DATA SERVICES
The following Services are provided by Health Current and are available to Participant upon execution of
a separate Statement of Work and payment of applicable fees:
Data Exchange – provides the means of electronically exchanging patient information between its
source and its users. The following methods are available to enable this exchange.
HL7 v2.x – provides a national-standards-based methodology via a virtual private network
(VPN) connection for the unidirectional or bidirectional exchange of information between the
data provider or data user and the Health Information Exchange (“HIE”). This methodology
allows processing of both discrete data and transcribed documents via ADT, Lab, Radiology,
Transcription, Immunization, and Scheduling transactions.
HL7 v3.x – provides a national-standards-based query/response methodology via a VPN
connection for the unidirectional or bidirectional exchange of health information documents (C-
CDA/CCD standards) between the data provider or data user and the HIE. This methodology
utilizes PIXv3/PDQv3 and XDS.b standards for patient discovery, document query and retrieval,
and document storage.
eHealth Exchange – provides a national-standards-based query/response methodology via the
national eHealth Exchange Network for the unidirectional or bidirectional exchange of health
information documents (C-CDA/CCD standards) between certified eHealth Exchange members.
This methodology utilizes cross-community IHE profiles for audit trail and node authentication
(ATNA), patient discovery (XCPD), document query and retrieval (XCA), and document sharing
and storage (XDS).
Provider Portal – provides the means for providers and their delegates to view the patient longitudinal
record with the ability to configure the presentation layout to match their preferences and workflows.
Additionally, a specific report/result or a patient summary including C-CDA/CCD’s within the Provider
Portal can be printed or downloaded, or routed to other providers based on predefined options. Patient
consent can be updated using the Portal including attaching a PDF of the consent form or other
administrative forms. The Portal can be used to perform external document queries via eHealth
Exchange, and provides a single-sign-on to Mirth Mail, the Provider Directory, and to Mirth Match
(Master Patient Index) work queues (used to resolve data providers’ patient identity issues).
Payer Portal – provides a more limited view of the patient longitudinal record and limits access based on
insurance member roster submitted by a health plan. Data is displayed in a format that is more
encounter based with drill down capabilities to access additional patient data. The access to the data
within the Payer Portal is limited to a period of time defined by Health Current Polices.
Direct Secure Messaging (Mirth Mail) – Health Insurance Portability and Accountability Act (“HIPAA”)
compliant, encrypted, secure, scalable, and standards based secure email application. It is based upon
the DirectTrust national standards and provides that means of securely sending/receiving routine
information such as referrals, simple clinical messages, and test results. Mirth Mail includes a web-
based email client, web-based user registration, a standards-compliant provider directory, a secure chat
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 26 of 27
feature, and provides the means to send a “you have mail” notification to a user’s unsecure email
account.
ADT Alerts & Results Notifications – provides the means for notifying a caregiver that an event has
happened or a specific result has been received. The available ADT Alerts include ED Registrations,
Inpatient Admissions, Hospital and ED Discharges, and Ambulatory Registrations. The available Results
Notifications include Lab, Radiology, and Transcription results and reports.
Alerts and Notices are driven by Notification Subscriptions which are automated rules that can be basic
or complex, but all will begin with one of the following types of triggers:
•
Patient – the message is for the specific (subscribed to) patient
•
Patient Group – the message is for one of the patients in the patient group (e.g. diabetic
patients for a specific provider)
•
Provider – the specific provider is listed in the message as either the Attending Provider,
Referring Provider, Consulting Provider, Admitting Provider, Ordering Provider, or Copy To
Provider
•
Provider Group – one of the providers in the provider group is listed in the message
•
Data Source – the message is from a specific source
In addition to the Initial trigger, rules can be created to further narrow messages that are delivered.
These advanced rules can utilize the following factors to narrow the alerting:
•
Clinical Item Type (lab, radiology, transcription, ADT)
•
Data Source Global ID
•
Order Status
•
Ordering Provider’s NPI
•
Ordering Provider’s Full Name
•
Patient Class
•
Patient Community ID
•
Result Status
Alerts and Notices can be delivered via Fax, Direct Secure Messaging, or standards based interfaces (e.g.
HL7 v2.x, HL7 v3.x, C-CDA/CCD).
Public Health Reporting Gateway – provides a single connection (an electronic gateway) for hospitals
and physician practices to submit state and federally required public health information from their
certified EHRs. The following gateways will route properly formatted messages from the EHRs to the
appropriate state or federal agency:
Immunization Registry Reporting Gateway
Syndromic Surveillance Reporting Gateway
Reportable Lab Results Gateway
Reportable Diseases Gateway
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687
©2022 Contexture. All rights reserved.
Page 27 of 27
EXHIBIT C
STATEMENT OF WORK
(Separate Attachment)
Docusign Envelope ID: 92DA3638-EBB1-4F17-80E0-FF7BEF8D82D4
Docusign Envelope ID: 5C3B30DC-9B36-4FEC-8CD4-590F27842687