SIGNED NETWORK PARTICIPATION AGREEMENT_MARICOPA COUNTY (1).PDF

THE NETWORK PARTICIPATION AGREEMENT

This Participation Agreement (“Participation Agreement”) is entered into between Health
Information Network of Arizona (“HINAz”} and Maricopa County (“Participant”), with an effective date
of April 1, 2015 (“Effective Date”). Throughout this Participation Agreement HINAz and Participant may
be referred to individually as a “Party” and collectively as the “Parties.”

RECITALS:

1. HEALTH INFORMATION NETWORK OF ARIZONA (“HINAz”) is a non-profit organization
providing a secure network for electronic health information exchange (“The Network”). The HINAz
mission is to support the appropriate and secure exchange of electronic health information enabling
Arizona’s health care communities to improve health care coordination, quality and safety, and to
reduce costs.

2, Participants in The Network include Data Recipients and Data Suppliers, as defined
below. A participant in The Network may be a Data Recipient, a Data Supplier, or both.

3. This Participation Agreement sets forth the terms and conditions of Participant’s access
to The Network.

AGREEMENT:
1.0 DEFINITIONS

Applicable Law means federal, state and local statutes and regulations that are applicable to the
Participant, or those applicable to HINAz.

Authorized User means an individual authorized by Participant under this Participation
Agreement to use The Network to access or receive Data for a Permitted Use.

Data means any information transmitted to The Network by Data Suppliers, including but not
limited to Protected Health Information (“PHI”).

Data Exchange means electronically providing, receiving, or accessing Data through The
Network.

Data Recipient means the Segal entity that has entered into a Participation Agreement and
whose Authorized Users will access or receive Data using The Network.

Data Supplier means an entity that makes Data available for access through The Network and
has entered into a Participation Agreement.

Data Services means the services provided to HINAz participants, including, but not limited to
the administrative, operational, and information system support services required to operate The
Network.

Patient means an individual who has received or will receive treatment or health care services
from a Health Care Provider. For purposes of individual rights set forth in the HIPAA Business Associate
Agreement at Exhibit A, the term "Patient" or “Individual” shall include, with respect to individuals
under legal disability, the parent(s), guardian or other legally authorized representative of such person,

Permitted Use includes treatment, care coordination, case or care management, transition of
care planning, or other purposes approved by the HINAz Board of Directors. Any such Permitted Use is
subject, however, to a Patient's right under state or federal law to opt-out of permitting access to
his/her Data.

Other Definitions: Unless otherwise defined in this Participation Agreement, all capitalized
terms in this Participation Agreement will have the same meaning as provided under the Health
Insurance Portability and Accountability Act (HIPAA) Standards for Privacy of Individually Identifiable
Health Information, 45 C.F.R. Part 160 and Part 164, Subpart E (the Privacy Rule}, the HIPAA Security
Standards, 45 C.F.R. Part 160 and Part 164, Subpart C (the Security Rule), and the HIPAA Breach
Notification Regulations, 45 C.F.R. Part 160 and Part 164, Subpart D (the Breach Notification Rule), all as
amended from time to time.

2.0 HINAz OBLIGATIONS

2.4 Services Provided by HINAz.

(a) Network Operation and Data Management Services. HINAz will maintain and
operate The Network and provide the Data Services (whether through its own resources or those of its
Subcontractors or third party vendors). HINAz is responsible for the hardware, operating system(s),
applications, and interfaces necessary to exchange clinical and administrative information with
Participant's designated systems over a secure encrypted network connection (“VPN”) provided by the
Participant. Participant is responsible for Participant's hardware, operating system(s), networks,
applications and interfaces to permit its designated systems to connect to The Network by way of the
Participant's VPN.

(b) Use of Subcontractors and Third Party Vendors. HINAz may contract with
Subcontractors and third party vendors to maintain and operate The Network's hardware, applications
or to provide the Data Services. HINAz will require that its Subcontractors and third party vendors
comply with the applicable terms and conditions of this Participation Agreement and applicable laws
and regulations. HINAz will be responsible for the performance of its Subcontractors and third party
vendors when performing any Data Services under this Participation Agreement, as if HINAz had directly
performed such Data Services.

2.2 HINAz Records of Data Exchange; Use and Disclosure of Data.

(a) HINAz Records. HINAz will maintain records relating to the operation of The
Network, including records of the date, time and records that are received, transmitted or accessed by a
Data Recipient or an Authorized User in each Data Exchange as set forth in its Policies as described in
Section 2.3. HINAz will not be responsible for maintaining records of the content of any Data Exchange
or inspecting the content of Data.

The Network Participation Agreement, March 2015 Page 2 of 23

(b) Data Storage and Maintenance, HINAz will store Data (for example, for a
continuity of care record or for storage of certain demographic, imaging, laboratory or pharmaceutical
information). HINAz’s storage of such Data will be governed by this Participation Agreement.

(c) HINAz Use and Disclosure of Data and Information Related to Data Exchanges.

(i} HINAz will not Use or Disclose Data or information relating to Data
Exchanges to third parties except: (i) for a Permitted Use; (ii) as required by law or subpoena in
accordance with A.R.S. § 36-3808; (iii) as directed in writing by the Data Supplier that provided the
Data; or (iv) to an individual in accordance with A.R.S. § 36-3802.

(ii) \f HINAz or any of its Subcontractors or third party vendors receives a
court order or subpoena for Data, or request for Data by a government entity pursuant to law, HINAz, to
the extent permitted by law, will provide notice to the Data Supplier that provided the Data, if known, as
soon as possible, but not more than 5 calendar days from receipt of the request, so that the Data
Supplier has an opportunity to object to the court order, subpoena or governmental request. HINAz
will not be responsible for contesting or objecting to any such court order, subpoena or governmental
request, but will reasonably assist a Data Supplier in its efforts to do so at no cost to HINAz. HINAz will
comply with A.R.S. § 36-3808 in responding to subpoenas.

(iii) HINAz and its Subcontractors and third party vendors may access Data
and information relating to Data Exchanges only to provide Services to HINAz participants, for the
testing, operation and maintenance of The Network, to conduct investigations and actions relating to
compliance with this Participation Agreement, and as permitted by this Participation Agreement. HINAz
and its subcontractors and third party vendors must camply with HINAz Policies and applicable laws.

2.3 Policies.

(a) Establishment of Policies. The Board of Directors of HINAz (the “Board”) (or its
delegates) will establish policies (“Policies”) that will govern HINAz’s and Participant’s activity related to
The Network, and will make these Policies available to HINAz participants or prospective participants
upon request. HINAz will develop and maintain a process for consultation with participants regarding
such Policies, and encourages Participant to provide input into the development of Policies through the
Board of Directors or the working groups and committees to which such efforts are delegated by the
Board. These Policies may govern HINAz’s and Participant’s use of The Network and the use,
submission, transfer, access, privacy, security, accuracy of Data, and the standards for vendor
contracting and quality control, and policies and procedures with regard to Patient consent. Participant
will have no ownership or other property rights in the Policies or other materials or services provided by
HINAz.

(b) Changes to Policies. The HINAz Board may change or amend the Policies from
time to time at its discretion. HINAz will provide Participant at least 30 days’ advance notice of material
changes to Policies before their effective date, unless the HINAz Board determines that an earlier
effective date is required to address a legal requirement, a concern relating to the privacy or security of
Data or an emergency situation. HINAz also may postpone the effective date of a change if the HINAz
determines, in its sole discretion, that additional implementation time is required. If the HINAz Board
amends the definition of Permitted Use as set forth in Section 1.0, Participant may terminate this

The Network Participation Agreement, March 2015 Page 3 of 23

Participation Agreement with 30 days’ advance notice to HINAz, unless such amendment is Required by
Law.

(c) Security. HINAz will implement Policies that are reasonable and appropriate to
protect Data from improper access, tampering or unauthorized disclosure and to secure compliance
with applicable laws and regulations. Such Policies will include administrative procedures, physical
security measures, and technical security services that are reasonably necessary to assure the
confidentiality, integrity, and the availability of the Data. HINAz and Participant will comply with all
security Policies established by HINAz. If Participant's security requirements are more stringent than
HINAz Policies, HINAz will cooperate with Participant to accommodate Participant’s more stringent
security requirements, to the extent feasible. Throughout the term of this Participation Agreement,
HINAz will and will assure that its Subcontractors and third party vendors:

(i) Implement and maintain access controls to The Network, such that Data
will be reasonably secured from intrusion, corruption, loss of integrity or inappropriate access;

ii) Have the capability to report access to Data through The Network at the
patient-level, at a level of detail to be reasonably determined by HINAz;

(ii) Support the provision of unique user identification and passwords to
Authorized Users;

{iv} Manage The Network in accordance with the National Institute for
Standards and Technology’s Security Guidelines, and will employ at least industry standard anti-virus
software;

(v) Encrypt Web-based Data transmissions sent through The Network, as
appropriate using encrypted virtual private network technology or other industry-standard encryption
techniques in compliance with guidance issued by the Secretary of United States Department of Health
and Human Services in 74 Fed. Reg. 19006 (2009);

{vi} Logically separate each of the HINAz participant's Data in test and
production environments;

(vii) Implement, maintain, test and, as appropriate, trigger disaster
avoidance and recovery procedures in accordance with a disaster avoidance and recovery and continuity
of operations plan; :

(vill) Provide Participant the right to inspect and audit compliance with these
requirements, at Participant’s expense; and

{ix) Ensure the security and privacy of the Data pertaining to Patients who
opt out of participation in Data Exchanges via The Network.

(d) Investigations, Corrections, Reports. HINAz will adopt Policies for the
investigation, resolution and reporting of Patient complaints, security breaches or other concerns
relating to compliance with this Participation Agreement, HINAz Policies and applicable laws and
regulations (“Compliance Concerns”). HINAz will provide notice to applicable HINAz participants,

The Network Participation Agreement, March 2015 Page 4 of 23

pursuant to HINAz Policies and as required by law or regulation, of any Compliance Concern related to
Participant’s Authorized Users’ use of The Network, Data provided by Participant, or a Compliance
Concern that may lead to a claim, audit, investigation or cause of action against Participant, and
Participant will cooperate with HINAz in its investigation of any Compliance Concern and corrective
action.

(e) Offshoring. HINAz will ensure that it and its employees, Subcontractors, and
third party vendors will not transmit Data outside the jurisdiction of the United States of America or Its
territories. Any breach of the foregoing shall constitute a material breach of this Participation
Agreement. This section will not prohibit HINAz from releasing de-identified Data for testing to
employees or contractors outside the United States, as long as HINAz requires such employees or
contractors to destroy such de-identified Data upon completion of testing. This section also will not
prohibit Participant from allowing its Authorized Users to access The Network for a Permitted Purpose
while outside the United States.

2.4 Obligations to Comply with Law. HINAz will comply with all federal, state and local laws
applicable to HINAz. HINAz obligations as a HIPAA Business Associate are set forth in Exhibit A.

3.0 DATA RECIPIENT OBLIGATIONS.

The obligations of this Section 3.0 apply to a HINAz participant that is a “Data Recipient.” These
obligations do not apply to a participant that is only a “Data Supplier,” as participants that are only Data
Suppliers will not have access to the Data in The Network.

3.1 Data Exchange. Data Recipient agrees that its participation in any Data Exchange, and
use of The Network by Data Recipient and its Authorized Users, will comply with the terms of this
Participation Agreement, HINAz Policies, and Applicable Law, including but not limited to those
governing the use, privacy, and security of Data received through and stored on The Network.

3.2 Permitted Use. Data Recipient and its Authorized Users will use The Network only for
Permitted Uses.

3.3 Authorized Users. Data Recipient will identify and authenticate its Authorized Users, in
accordance with this Participation Agreement and HINAz’s Policies. Authorized Users will include only
those persons who require access ta The Network to facilitate Data Recipient’s use of the Data fora
Permitted Use. Participant is responsible for its Authorized Users complying with the terms and
conditions of this Participation Agreement, HINAz Policies and applicable laws and regulations. Data
Recipient will assure that each Authorized User has received training on the requirements of this
Participation Agreement and HINAz Policies that are applicable to Authorized Users, before Data
Recipient permits such Authorized User to access The Network.

3.4 System Operations. Data Recipient, at its own expense, will provide and maintain the
hardware, operating system(s), applications and interfaces required of a Participant in Section 2,1 and as
set forth in HINAz Policies.

3.5 Print Capability. The Network will allow Participant to print the information viewed by
Authorized Users (whether through Print Screen or similar functionality). Participant is responsible for

The Network Participation Agreement, March 2015 Page 5 of 23

determining whether information viewed by Authorized Users will be integrated into Participant’s
medical records.

3.6 Obligations to Comply with Law. Data Recipient will comply with Applicable Law,
including all applicable federal, state and local laws related to use of The Network and the Data.

4.0 DATA SUPPLIER OBLIGATIONS,

The obligations of this Section 4.0 apply to a HINAz participant that is a “Data Supplier.” These
obligations do not apply to a participant that is only a “Data Recipient.”

41 Data Exchange and Data Submission. By engaging in Data Exchanges, Data Supplier
agrees that: (a) it will supply Data in compliance with this Participation Agreement, HINAz Policies, and
Applicable Law; and (b) the Data provided or transferred by Data Supplier can be related to and
identified with source records maintained by Data Supplier. Additionally, for each Data Exchange, Data
Supplier agrees that it will provide sufficient Patient identifying information to permit HINAz to match
such Patient Data with other Data of the same Patient already maintained by HINAz on The Network.
Data Supplier will make Data available for The Network in accordance with the scope, format, and
specifications set forth in HINAz Policies.

4.2 Data Status upon Termination of Data Supplier Participation. HINAz will return or
destroy Data that it stores or maintains on behalf of Data Supplier upon termination of Data Supplier's
Participation Agreement at the request of Data Supplier, in a form and manner consistent with industry
standards, unless HINAz is required by law to retain the Data. Notwithstanding the foregoing,
Participant understands that PHI provided to The Network may be integrated into the medical record of
Data Recipients that access The Network, and into records maintained by HINAz, and it may not be
feasible for HINAz to return or destroy PHI that has been thus integrated upon termination of this
Participation Agreement. If HINAz does not return or destroy PHI upon termination, HINAz will continue
to follow the provisions of Exhibit A, the “Business Associate Agreement,” and will limit its Use or
Disclosure of PHi to those purposes that make the return or destruction of PHI infeasible.

4.3 System Operations. Data Supplier will provide and maintain the hardware, operating
system(s), applications and interfaces required of a HINAz participant in Section 2.1 and as set forth in
HINAz Policies.

AA Accuracy. Data Supplier will promptly correct any mistakes or errors discovered in Data
it transmits to The Network (such as Data attributed to an incorrect Individual or an error in laboratory
value) by transmitting the Data to HINAz as a corrected report or value in accordance with HINAz
Policies. All corrections will be clearly marked as a correction. However, Data Supplier does not warrant
the accuracy of the Data provided to The Network.

4.5 Obligations to Comply with Law. Data Supplier will comply with all Applicable Law,
including federal, state and local laws related to providing Data to The Network.

5.0 COMPLIANCE WITH LAWS; CONFIDENTIALITY

Both HINAz and Participant, and their agents and employees, will comply with Applicable Law,
including without limitation, laws on the use and disclosure of Data, the security and privacy of Data,

The Network Participation Agreement, March 2015 Page 6 of 23

Patient consent or authorization for the use and transfer of Data and requirements for Data Exchange,
including the right to opt-out in accordance with A.R.S. § 36-3803, and the provision and distribution of
the HINAz Notice of Health Information Practices in accordance with A.R.S. § 36-3804. Participant will
assure that its Authorized Users comply with all Applicable Law. HINAz’s use of Data will be subject to
this Participation Agreement and the Business Associate Agreement set forth in Exhibit A.

6.0 PROPRIETARY INFORMATION

Pursuant to this Participation Agreement, each Party may have access to information about the
other Party that: (a) relates to past, present or future business activities, practices, protocols, products,
services, information, content, and technical knowledge; and (b) has been identified as confidential
(collectively, “Proprietary Information”) by such Party. For the purposes of this provision, Proprietary
Information will not include PHI.

6.1 Non-disclosure. The Parties will: (a) hold Proprietary information in strict confidence;
{b) not make the Proprietary Information available for any purpose other than as specified in the
Participation Agreement or as required by law or subpoena; and (c) take reasonable steps to ensure that
the Proprietary Information is not disclosed or distributed by employees, agents, subcontractors or third
party vendors (who will have access to the same only on a “need-to-know” basis) to third parties in
violation of this Participation Agreement. If HINAz or Participant receives a request for Proprietary
Information, the Party receiving the request will provide the other Party notice of the request and an
opportunity to seek a protective order limiting the nature and scope of the information to be disclosed,
and the disclosing Party is only permitted to disclose Proprietary Information to the extent required by
law.

6.2 Exclusions. Proprietary information will not include information that: (a) at the time of
disclosure, is known or becomes known or available to general public through no act or omission of the
receiving Party; (b) was in the receiving Party’s lawful possession before it was provided to the receiving
Party by the disclosing Party; (c) is disclosed to the receiving Party by a third party having the right to
make such disclosure; or (d) is independently developed by the receiving Party without reference to the
disclosing Party's Proprietary Information.

6.3 Equitable Remedies. The Parties agree that a breach of this Section 6 will cause the
disclosing Party substantial and continuing damage, the value of which will be difficult or impossible to
ascertain, and other irreparable harm for which the payment of damages alone will be inadequate.
Therefore, in addition to any other remedy that the disclosing Party may have under this Participation
Agreement, at law or in equity, in the event of such a breach or threatened breach by the receiving
Party of the terms of this Section 6, the disclosing Party will be entitled, after notifying the receiving
Party in writing of the breach or threatened breach, to seek both temporary and permanent injunctive
relief without the need to prove damage or post bond.

6.4 Public Records. Notwithstanding the above provisions, in the event Proprietary
Information is requested for public release pursuant to A.R.S. § 39-121 et seq., from a Participant
subject to this statute (“Public Participant”), such Public Participant may release Proprietary Information
ten (10) business days after Public Participant has notified the source of the Proprietary Information
(“Source”), unless the Source secures a protective order, injunctive relief or other appropriate order
from a court of competent jurisdiction enjoining the release of the records. For the purposes of this
paragraph, the day of the request for release shall not be counted in the time calculation. Public

The Network Participation Agreement, March 2015 Page 7 of 23

Participant shall notify Source of any request for such release on the same day of the request for public
release or as soon thereafter as practicable. Public Participant shall not, under any circumstances, be
responsible for securing a protective order or other relief enjoining the release of Proprietary
Information, nor shall Public Participant be in any way financially responsible for any costs associated
with securing such an order.

7.0 SOFTWARE LICENSE

7.1 License Grant: HINAz represents and warrants that it has obtained all necessary licenses
and/or approvals to make available the Data Services and The Network to Participant under the terms
and conditions of this Participation Agreement.

7.2 Third Party Software: Before making software provided by third parties (“Third Party
Software”) available to Participant, HINAz will obtain the right and ability to permit HINAz and the HINAz
participants to use the Third Party Software that is part of the Data Services.

7.3 No Sublicensing: Participant shall not sublicense, export, rent, lease, grant a security
interest in, or otherwise transfer rights to The Network or any component of the Data Services, without
advance written permission from HINAz.

74 No Transfer or Modification. Except as permitted under this Participation Agreement,
Participant will not sell, rent, sublicense or otherwise share its right to use the Data Services or The
Network. Participant will not modify, reverse engineer, decompile, disassemble or otherwise attempt to
learn the source code, structure or ideas upon which such software is based.

8.0 ELECTRONIC SIGNATURES

8.1 Signatures and Signed Documents. Participant, at HINAz’s request, will implement for
each of its Authorized Users a unique electronic identification consisting of symbols or codes that are to
be affixed to or contained in a Data Exchange made by the Authorized User(s) of the Participant
(“Electronic Signatures”). Participant agrees, and will require each of its Authorized Users to agree, that
any Electronic Signature of such Authorized User affixed to or contained in any Data Exchange will be
sufficient to verify that the particular Authorized User originated such Data Exchange. Any properly
transmitted Data Exchange made pursuant to this Participation Agreement shall be considered a
“writing” or “in writing” and any such Data Exchange containing, or to which there is affixed, an
Electronic Signature (“Signed Documents”) shall be deemed for all purposes: (a) to have been “signed;”
and (b) to constitute an original when printed from electronic files or records established and
maintained in the normal course of business. ‘

8.2 Validity of Signed Documents. Participant will not, and will not permit any Authorized
User to, contest the validity or enforceability of Signed Documents under the provisions of any
applicable law relating to whether certain agreements are to be in writing or signed by the Party to be
bound thereby. Signed Documents, if introduced as evidence on paper in any judicial, arbitration,
mediation, or administrative proceedings will be admissible as between the Parties to the same extent
and under the same condition as other business records originated and maintained in paper form.

9.0 TERM AND TERMINATION

The Network Participation Agreement, March 2015 Page 8 of 23

9.1 Term. The term of this Participation Agreement will begin on the Effective Date and wilt
continue until December 31 of that year (the “initial Term”), or until terminated as set forth in Section
9.2. This Participation Agreement will automatically renew for additional one year terms (eacha .
“Renewal Term”) after the Initial Term, unless terminated as set forth in Section 9.2.

9.2 Termination. Either Party may terminate this Participation Agreement under any of the
following circumstances:

(a) Immediate Termination by HINAz. HINAz, at its sole discretion, may
immediately terminate this Participation Agreement prior to March 1, 2015 by providing Participant
written notice of termination.

(b) Termination by Participant without Cause. Participant may terminate this
Participation Agreement by providing HINAz written notice of its intent to terminate this Participation
Agreement no later than November 1 of the Term or the then current Renewal Term. Termination
pursuant to this Section 9.2(b) shall be effective as of December 31 of the Term or the then current
Renewal Term, whichever is applicable.

{c) Termination by HINAz without Cause. HINAz may terminate this Agreement by
providing the Participant written notice of its intent to terminate this Participation Agreement no later
than December 1 of the Term or the then current Renewal Term. Termination pursuant to this Section
9.2(c) shall be effective as of December 31 of the Term or the then current Renewal Term, whichever is
applicable.

{d) Termination for Violation of Law or Regulation. If either HINAz or Participant
determines that its continued participation in this Participation Agreement would cause it to violate any
law or regulation applicable to it, or would place it at material risk of suffering any sanction, penalty, or
liability, then that Party may terminate its participation in this Participation Agreement immediately
upon written notice to the other Party.

{e) Termination for Breach of the Participation Agreement. If HINAz or Participant
determines that the other Party or any of its employees, agents or contractors have breached this
Participation Agreement, then the non-breaching Party may terminate this Participation Agreement with
advance written notice to the breaching Party, provided that such notice identifies the breach and such
breach is not cured within 30 days of receipt of the notice. HINAz may require any participant to
terminate access rights of any Authorized User if such Authorized User: (i) accesses or uses, or attempts
to access or use, Data in violation of this Participation Agreement; or (ii) accesses or uses The Network in
a manner that disrupts, interferes with, or puts at risk the continued efficient operation of The Network.
HINAz may terminate the Participation Agreement if the Participant refuses to terminate the access
rights of an Authorized User as required by this Section.

(f) Termination of Network Funding and Services Agreement. This Participation
Agreement will terminate concurrently with termination of the Network Funding and Services
Agreement between the Parties.

(g) Suspension or Termination of Vendor's Services. HINAz may terminate this
Participation Agreement concurrently with the termination or suspension of any agreement with its
Subcontractors or third party vendors that provide any essential component of the Data Services.

The Network Participation Agreement, March 2015 Page 9 of 23

HINAz will promptly notify Participant following delivery of any notice of such termination or
suspension, and HINAz will require the Subcontractor or third party vendor to cooperate with the
migration of Data and services to an alternative vendor upon request and if feasible.

(h) Suspension of Data. Data Supplier may suspend providing Data to The Network
for reasonable cause upon notice to HINAz, which notice shall describe the reason for such suspension.
Data Supplier will work with HINAz to resolve Data Supplier's reason for Data suspension, with the
intent of resuming the provision of Data as soon as possible. In the event Data Supplier's suspension of
Data continues for forty-five (45) days, HINAz may terminate this Participation Agreement.

{i) Suspension of Access, HINAz may suspend access for Participant or an
Authorized User if necessary to ensure the stability or security of The Network. HINAz shall advise
Participant or Authorized User of such suspension prior to or, if immediate action is required and
prevents prior notice, promptly after, such action is taken, and shall cooperate with Participant or
Authorized User to resolve the issues leading to such suspension.

9.3 Effect of Termination.

(a) Termination Process and Access to Network and Data. Upon the effective date
of termination of this Participation Agreement, HINAz will cease providing access to The Network for the
Data Recipient and its Authorized Users, and Data Recipient and its Authorized Users will stop using The
Network.

(b) Rights and Duties. Any termination will not alter the rights or duties of the
Parties with respect to a Data Exchange conducted before termination. Upon termination of this
Participation Agreement, Sections 6 (Proprietary Information), Section 9 (Term and Termination),
Section 10 (Limited Warranties and Disclaimers), Section 11 (Limitation of Liability; indemnification);
Section 15.7 (Notices), Section 15.10 (No Relationship between Participants; No Third Party Rights};
Section 15.13 (Dispute Resolution), and any other obligations that by their nature extend beyond
termination, cancellation or expiration of this Participation Agreement, will survive such termination,
cancellation or expiration and remain in effect.

(c) Return of Proprietary Information. Promptly following termination, each Party
will return to the other all tangible copies of Proprietary Information belonging to the other or certify
the permanent and irreversible destruction of such Proprietary Information if agreed to by the Party
who originated the Proprietary Information. Within 30 days of termination, Participant will de-instal!
and return to HINAz all software provided by HINAz (or its subcontractors or third party vendors) to
Participant under this Participation Agreement.

10.0 LIMITED WARRANTIES AND DISCLAIMERS
10.2 HINAz warrants that:

{a} The Network and all components of the Data Services will be free from material
defects in materials and workmanship and will operate in accordance with the specifications provided
by HINAz. If The Network or any component of the Data Services fails such warranty, HINAz {or its
subcontractors or third party vendors) will repair the defect or provide a reasonable work-around.

The Network Participation Agreement, March 2015 Page 10 of 23

(b) HINAz Data Services will be performed in a competent and professional manner
in accordance with industry standards and practices and professional standards generally applicable to
such services; provided, however, that where this Participation Agreement specifies a particular
standard or criteria for performance, this warranty is not intended to and does not diminish that
standard or criteria for performance.

(c) Each of the HINAz personnel and the Subcontractors and third party vendors
they hire or engage will have the proper skill, training, and background to perform his or her assigned
tasks.

(d) The Network will accurately display Data as provided by Data Supplier. If The
Network fails to accurately display such Data, HINAz will repair the defect or provide a reasonable work-
around.

10.2. HINAz MAKES NO REPRESENTATION OR WARRANTY THAT THE DATA PROVIDED BY
PARTICIPANTS WILL BE TIMELY, CORRECT, OR COMPLETE.

10.3. Other than as provided in this Section 10, HINAz DISCLAIMS ALL OTHER WARRANTIES
REGARDING ANY PRODUCT, SERVICES, OR DATA PROVIDED PURSUANT TO THIS AGREEMENT
INCLUDING WITHOUT LIMITATION ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A
PARTICULAR PURPOSE.

11.0 LIMITATION OF LIABILITY; INDEMNIFICATION

11.1 Limitation of Liability. Neither HINAz nor Participant will be liable to the other for any
special, incidental, exemplary, indirect, consequential, or punitive damages (including loss of use or lost
profits) arising out of or in connection with claims relating to HINAz’s or Participant's acts or omissions
under this Participation Agreement, including but not limited to claims arising from any delay, omission
or error in The Network, provision or receipt of Data, or the handling or storage of Data, or, whether
such liability arises from any claim based upon contract, warranty, tort (including negligence), product
liability or otherwise, and whether or not either Party has been advised of the possibility of such loss or
damage.

11.2 Release of Liability for RINAz. Notwithstanding Section 11.1, Participant releases HINAz
from any claims arising out of any inaccuracy or incompleteness of Data submitted by a Data Supplier,
except in circumstances where HINAz received accurate and correct data from a Data Supplier, but
delivered inaccurate and incorrect Data to a Data Recipient, or those arising out of HINAz’s gross
negligence. Participant also releases HINAz from any claims relating to clinical, medical or other
decisions related to the treatment of a Patient, including those arising out of the unavailability of Data
through The Network, except for those arising out of HINAz’s gross negligence. Participant releases
HINAz from any liability associated with Participant’s direction to HINAz to release Data under Section
2.2(c}) above.

11.3 Release of Liability for Data Suppliers. . Notwithstanding Section 11.1, HINAz releases
Data Supplier from any claims arising out of any inaccuracy or incompleteness of Data submitted by the
Data Supplier, except those arising out of Data Supplier's gross negligence.

11.4 indemnification.

The Network Participation Agreement, March 2015 Page 11 of 23

{a} Intellectual Property Infringement. HINAz shall indemnify and hold harmless
Participant and its Authorized Users against any third party claim, action, proceeding, or demand against
Participant or its Authorized Users during the term of this Agreement to the extent the claim, action,
proceeding, or demand alleges The Network, any software or documentation provided to Participant or
its Authorized Users, or the Data Services (collectively, “HINAz Services”) directly infringe the third
party's United States patent, copyright, or trademark (each, and collectively, an "Infringement Claim").
HINAz will pay Participant the damages, losses, costs, expenses, or liabilities incurred (including
reasonable legal fees) that are directly attributable to an Infringement Claim and are either finally
awarded by a court of competent jurisdiction against Participant or its Authorized Users, or agreed to in
a written settlement agreement signed by Participant or its Authorized Users up to Five Million Dollars
($5,000,000).

HINAz will have no liability for any Infringement Claim that arises from: (A) the use of the HINAz
Services outside of the scope of this Agreement; (B) modification of HINAz Services by Participant or its
Authorized Users; (C) use of a superseded or prior version of the HINAz Services if the infringement
would have been avoided by the use of a new version which HINAz made available to Participant, or (D)
use of the HINAz Services in combination with any other software, hardware or products not supplied by
HINAz.

HINAz will have no liability for any Infringement Claim if Participant fails to: (A) notify HINAz in
writing of the Infringement Claim promptly upon the earlier of learning of or receiving a notice of the
Infringement Claim, to the extent that HINAz is prejudiced by this failure; (B) provide HINAz with
reasonable assistance requested by HINAz for the defense or settlement (as applicable) of the
Infringement Claim; (C) provide HINAz with the exclusive right to control and the authority to settle the
Infringement Claim (Participant may participate in the matter at its own expense); or (D) refrain from
making admissions about the Infringement Claim without HINAz’s prior written consent.

The remedies in this section are Participant's sole and exclusive remedies and HINAz’s sole
liability regarding the subject matter giving rise to any claim, action, proceeding, or demand that the

HINAz Services infringe or misappropriate any third party's intellectual property rights.

(b) indemnification for Breach of Agreement and Violation of Law.

(i) To the extent permitted by law, Participant witl indemnify and hold
harmless HINAz, its employees and agents from any damages, expenses, including reasonable attorneys’
fees and settlement costs, as applicable (collectively “Losses”}, from such portions of any demand, suit,
action, or proceeding (each a “Claim”) by third parties arising from Participant's or its Authorized Users’
breach of this Participation Agreement, including without limitation the unauthorized or improper use
of The Network, the use or disclosure of Data for any purpose other than a Permitted Use, or violation
of Applicable Law, provided that HINAz notifies Participant in writing promptly upon discovery of a Claim
and gives Participant complete authority and control of, and full cooperation with, the defense and
settlement of such Claim. HINAz will have the right to retain counsel of its own choosing at its sole cost
at any time. In no event may Participant agree to a settlement or other resolution of such Claim that
names HINAz as culpable absent HINAz’s prior written consent.

(ii) HINAz will indemnify and hold harmless Participant, its Authorized
Users, and their employees and agents from any damages, expenses, including reasonable attorneys’

The Network Participation Agreement, March 2015 Page 12 of 23

fees and settlement costs, as applicable (collectively “Losses”), from such portions of any demand, suit,
action, or proceeding (each a “Claim”) by third parties arising from HINAz’s breach of this Participation
Agreement, including without limitation, the unauthorized or improper use of The Network, use or
disclosure of Data for any purpose other than a Permitted Use or as otherwise allowed under this
Participation Agreement, or violation of Applicable Law, provided that Participant notifies HINAz in
writing promptly upon discovery of any such Claim and gives HINAz complete authority and control of,
and full cooperation with, the defense and settlement of such Claim. Participant will have the right to
retain counsel of its own choosing at its sole cost at any time. in no event may HINAz agree to a
settlement or other resolution of such Claim that names Participant or its Authorized Users as culpable
absent Participant's prior written consent.

11.5 Nota Medical Service. The Network does not make clinical, medical or other decisions.
The Network is not a substitute for professional medical judgment applied by Participant or its
Authorized Users.

411.6  Unavailability of The Network. Data Recipients who are Health Care Providers
understand and agree that, during suspension or interruption of the availability of The Network, Health
Care Provider may not be able to obtain or access Patient health information from The Network and
Health Care Provider shall conduct its operations without such access to The Network.

12.0 INSURANCE

12.1 HINAz Insurance. HINAz will maintain in effect policies of commercial general liability
insurance covering direct and indirect damages arising from the intentional or unintentional breach or
disclosure of Data or Proprietary Information by HINAz and its employees or contractors, with limits not
less than five million Dollars ($5,000,000) per occurrence, and not less than five million Dollars
($5,000,000) in the aggregate, each of which shall (1) be issued by an insurance company with policy
holder ratings no lower than “A” and financial ratings not lower than “XII” in the latest edition of Best’s
Insurance Guide in effect as of the Effective Date; and (2) require no less than 30 days written notice to
Participant prior to cancellation or expiration. HINAz shall furnish certificates of insurance to Participant
upon request. HINAz will require its subcontractors, if any, to comply with this Section, or shall ensure
that HINAz insurance covers the work performed by its subcontractors.

12.2. Data Recipient insurance. Data Recipient will maintain in effect policies of liability
insurance with limits of not less than 1 million Dollars (5 1,000,000) per occurrence and 3 million Dollars
($ 3,000,000) in the aggregate. Such coverage may be in the forra of a self-insurance program.

13.0 EHEALTH EXCHANGE AND THE DATA USE RECIPROCAL SUPPORT AGREEMENT (“DURSA”).

To support Participant’s communications with entities that are not HINAz participants, HINAz
participates in the eHealth Exchange network, which facilitates health information exchange across the
country. Asa condition of participation in the eHealth Exchange network, HINAz has signed the DURSA,
and is required to obtain Participant’s agreement to comply with certain provisions in the DURSA for
Participant’s communications using the eHealth Exchange network. Participant agrees to comply with
the following provisions when conducting Data Exchanges with the eHealth Exchange network:

13.1 Compliance with Law. Participant will comply with ail Applicable Law.

The Network Participation Agreement, March 2015 Page 13 of 23

13.2 Cooperation, Participant shall reasonably cooperate with HINAz on issues related to the
DURSA, including, but not limited to:

(a) periodic audits and/or monitoring by HINAz to ensure Participant’s compliance
with this Section; and

(b) information gathering and documentation related to Participant’s use of The
Network to conduct Data Exchanges with the eHealth Exchange (including for the purpose of
investigating any Breach involving Participant or Participant’s Data).

13.3. Use of eHealth Exchange. When Participant requests a Data Exchange through eHealth
Exchange, such request must be: {i) done by a Participant employee with authority to make the request,
(ii} supported by appropriate legal authority to request the Data Exchange, (iil) submitted to the
intended recipient, (iv) for a Permitted Use under this Participation Agreement, as determined from
time to time, and (v) for one of the following purposes as permitted by the DURSA (but only If it is also a
Permitted Use under this Participation Agreement):

(a) Treatment of the Individual who is the subject of the Data;

(b) Payment activities of a Health Care Provider for the Individual who is the subject
of the Data;

(c) Health Care Operations of either:

(i) the Participant, if the Participant is sending Data to another person or
entity;

(ii) the recipient of the Data, including the Participant, if: (a) the recipient of
the Data is a Health Care Provider who has an established Treatment relationship with the individual
who is the subject of the Data or such recipient is conducting Data Exchanges on behalf of such Health
Care Provider; and (b) the purpose of the Data Exchange is for those Health Care Operations listed in
paragraphs (1) or (2) of the definition of Health Care Operations in 45 C.F.R. § 164.501 or health care
fraud and abuse detection or compliance of such Health Care Provider;

{d) Public health activities and reporting as permitted by Applicable Law, including
the HIPAA Regulations at 45 C.F.R. § 164.512(b) or 164.514(e);

{e) Any purpose to demonstrate meaningful use of certified electronic health
record by the Participant; and

(f) Uses and disclosures pursuant to an Authorization provided by the individual
who is the subject of the Data Exchange or such individual’s personal representative as described in 45
C.F.R. § 164.502(g) of the HIPAA Regulations. if Participant is requesting data from the eHealth Exchange
for a purpose for which an Authorization is required, Participant shall submit a copy of such
Authorization upon request.

13.4 Use of Data Received. With regard to Data Participant receives through the eHealth
Exchange, Participant will comply with the terms and conditions of the DURSA, at

The Network Participation Agreement, March 2015 Page 14 of 23

http://healthewayinc.org/images/Content/Documents/Application-
Package/restatement_i_of_the_dursa_9.30.14_final.pdf.

13.5 Protection of Passwords and Other Security Measures. Participant and its Authorized
Users shall refrain from disclosing to any other person any passwords or other security measures issued
to the Participant or its Authorized Users, and shall comply with all Policies related to the security of The
Network.

13.6 Use of Data Received. Participants who receive Data via the eHealth Exchange may
retain, use and re-disclose such Data in accordance with Applicable Law and the Participant’s record
retention policies and procedures.

13.7 Reporting Breaches. If Participant discovers a Breach of Data associated with any Data
Exchange via the eHealth Exchange, Participant will report such Breach to HINAz as soon as reasonably
practicable after determining that a Breach occurred, and as required by Section 14.

13.8 Termination of DURSA. If HINAz’s DURSA is terminated for any reason, Participant will
no longer have any right to conduct Data Exchanges through the eHealth Exchange utilizing The Network
connections.

14.0 BREACH REPORTING
This Section governs the Parties’ obligations under the Breach Notification Rule.

14.1 Participant Reporting to HINAz. If Participant discovers a suspected or confirmed Breach
of Unsecured PHI associated with any Data Exchange via The Network, Participant will report such
suspected or confirmed Breach to HINAz as soon as reasonably practicable, but not more than 5
business days after Participant’s discovery of the suspected or confirmed Breach. For purposes of this
Section 14.1, a suspected or confirmed Breach will be treated as discovered by Participant in accordance
with 45 C.F.R. § 164.404.

14.2 HINAz Reporting to Participant. HINAz will report a suspected or confirmed Breach of a
Data Supplier's Unsecured PHI to the Data Supplier as soon as reasonably practical, but not more than 5
business days after HINAz’s discovery of the suspected or confirmed Breach. Ifa Data Recipient or its
Authorized Users caused the suspected or confirmed Breach of Unsecured PHI, HINAz will also report
such suspected or confirmed Breach to the Data Recipient within 5 business days of HINAz’s discovery of
the suspected or confirmed Breach. For purposes of this Section 14, a suspected or confirmed Breach
will be treated as discovered by HINAz in accordance with 45 C.F.R. § 164.410. HINAz will include
information in the report required by 45 C.F.R. § 164.410.

14.3. HINAz Reporting to Individuals, Media and HHS; Reimbursement to HINAz for
Participant Breach. If there is a Breach of Unsecured PHI for which more than one Participant has a
reporting obligation under 45 C.F.R. § 164.400 et seq., HINAz may assume the obligation to report on
behalf of such Participants so as to avoid duplicative reporting. However, a Participant must approve
the content of the notifications conducted on its behalf and may conduct its own reporting if desired. If
HINAz undertakes the obligation to conduct reporting on behalf of a Participant, HINAz will comply with
the requirements set forth in 45 C.F.R. § 164.400 et seg. Where a Participant or its Authorized Users
caused the Breach, such Participant will reimburse HINAz for: (i) the costs of notification, and (ii) the

The Network Participation Agreement, March 2015 Page 15 of 23

costs of credit monitoring for one (1) year for affected Individuals if the PHI subject of the Breach
contains: (a) the Individual’s first initial or first name, last name, and social security number; (b} the
Individual’s first initial or first name, last name, and driver's license or state identification card number;
(c) the Individual’s first initial or first name, last name, account number, credit or debit card number, in
combination with any required security code, access code, or password that would permit access to an
Individual’s financial account; and/or (d) other PHI that could lead to identity theft (collectively, “Identity
Theft Information”).

14.4 Reimbursement to Participant for HINAz Breach. In the event a Participant is Required
by Law to notify individual(s) of a Breach that is caused by HINAz or its employees or Subcontractors: (i)
HINAz will reimburse the Participant for reasonable notification costs, unless HINAz agreed to assume
the obligation to notify under Section 14.3; and (ii) HINAz will pay the costs of credit monitoring for one
(1) year for affected Individuals if the PHI subject of the Breach contains Identity Theft Information.

15.0 GENERAL PROVISIONS

15.1 No Exclusion. HINAz represents and warrants to Participant, and Participant represents
and warrants to HINAz, that neither Party (nor their respective employees or agents providing services
under this Participation Agreement) have been placed on the sanctions list issued by the office of the
Inspector General of the Department of Health and Human Services pursuant to the provisions of 42
U.S.C, 1320a(7}, nor have been excluded from government contracts by the General Services
Administration or have been convicted of a felony or any crime relating to health care. HINAz and
Participant will provide one another immediate written notice of any such placement on the sanctions
list, exclusion or conviction. Either Party may terminate this Participation Agreement immediately upon
notice if the other Party (or its respective employees or agents providing services under this
Participation Agreement) becomes sanctioned, excluded or convicted as contemplated by this provision.
HINAz will not engage or contract with any individual or entity that has been placed on the sanctions jist .
issued by the office of the Inspector General of the Department of Health and Human Services pursuant
to the provisions of 42 U.S.C. 1320a(7) or excluded from any Federal health care program.

15.2 Severability. Any provision of this Participation Agreement that is determined to be
invalid or unenforceable will be ineffective to the extent of such determination without invalidating the
remaining provisions of this Participation Agreement or affecting the validity or enforceability of such
remaining provisions, unless this Participation Agreement fails of its essential purpose, or one Party is as
a result treated inequitably, in which case the Parties will negotiate in good faith revisions to the terms
of this Participation Agreement to permit the accomplishment of the purposes of this Participation
Agreement, and to treat each Party equitably.

15.3 Entire Agreement. This Participation Agreement constitutes the complete agreement of
the Parties relating to the matters specified in this Participation Agreement and supersedes all earlier
representations or agreements with respect to the subject matter of this Participation Agreement,
whether oral or written with respect to such matters, including any other Participation Agreement
previously executed between Participant and HINAz. This Participation Agreement may be amended at
any time by mutual agreement of the Parties without additional consideration, provided that, before
any amendment shall become effective, it shall be reduced to writing and signed by each of the Parties,
No oral modification or waiver of any of the provisions of this Participation Agreement is binding on
either Party.

The Network Participation Agreement, March 2015 Page 16 of 23

15.4 Assignment. Neither HINAz nor Participant may assign its rights or obligations under
this Participation Agreement without the advance written consent of the other Party, except for
assignment to a parent, subsidiary or affiliate wholly owned by the Party, or upon a change of control or
ownership of the Party.

15.5 Governing Laws. This Participation Agreement is governed by and interpreted in
accordance with Arizona laws, without regard to its conflict of law provisions. The Parties agree that
jurisdiction over any action arising out of or relating to this Participation Agreement shall be brought or
filed in the State of Arizona.

15.6 Force Majeure. No Party is liable for any failure to perform its obligations under this
Participation Agreement, where such failure results from any act of God or other cause beyond such
Party’s reasonable control. Notwithstanding the foregoing, HINAz shall establish, test, and implement as
appropriate disaster recovery and continuity of operations plans, or shall have its contractors do so, and
this provision shall not be deemed or interpreted to forgive, or prevent recovery of damages as.a result
of, failure of HINAz to do so.

15.7. Notices. All notices, requests, demands, and other communications required or
permitted under this Participation Agreement must be in writing. A notice, request, demand, or other
communication will be deemed to have been duly given, made and received: (a) when personally
delivered; (b) on the day specified for delivery when deposited with a courier service such as Federal
Express for delivery to the intended addressee; or (c) three business days following the day when
deposited in the United States mail, registered or certified mail, postage prepaid, return receipt
requested, addressed as set forth below in the signature biocks. Nothing in this Section will prevent
the Parties from communicating via electronic mail, telephone, facsimile, or other forms of
communication for the routine administration of The Network.

15.8 No Agency. HINAz provides Data Services to Participant, but does not act as
Participant’s agent. Participant will not be deemed an agent of another HINAz participant as a result of
its participation in this Participation Agreement.

15.9 Use of Trademarks and Trade Names. Nothing in this Participation Agreement shall be
deemed to give either Party any right to use the other Party’s trademarks or trade names without the
other Party’s prior written consent. Notwithstanding the foregoing, HINAz may list Participant as a
participant in The Network, and may otherwise disclose to third parties the fact that Participant is a
participant and Participant may disclose its participation in The Network. In the case of Participant's
logos or trademarks or other uses of Participant’s names, any use by HINAz must be expressly approved
in writing by Participant.

15.10 No Relationship between Participants; No Third Party Rights. Nothing in this
Participation Agreement confers any rights or remedies under this Participation Agreement on any
persons other than HINAz and Participant and the Authorized Users, and nothing in this Participation
Agreement is intended to create a contractual relationship or otherwise affect the rights and obligations
among the HINAz participants. Nothing in this Participation Agreement will give any third party, any
right of subrogation or action against any Party to this Participation Agreement, and no HINAz
participant shall gain any subrogation right against another HINAz participant solely as a result of this
Participation Agreement.

The Network Participation Agreement, March 2015 Page 17 of 23

15.11 Antitrust Compliance. Participant agrees not to use the information available through
The Network or to which it has access under this Participation Agreement to evaluate or set its own
prices for services, or otherwise in violation of state or federal antitrust laws and regulations.
Participant also agrees not to discuss prices with other HINAz participants or to make any effort
collectively to establish prices with other participants in violation of law.

15.12 Terms Applicable Only to Agreements with Participant That Is a State or County
Government Agency.

{a} Non-Discrimination: HINAz agrees to comply with all provisions and
requirements of Arizona Executive Order 2009-09 including flow down of all provisions and
requirements to any subcontractors. Executive Order 2009-09 supersedes Executive order 99-4 and
amends Executive order 75-5 and may be viewed and downloaded at the Governor of the State of
Arizona’s website http://www.azgovernor.gov/dms/upload/EO_2009_09.pdf which is hereby
incorporated into this Participation Agreement as if set forth in full herein. During the performance of
this Participation Agreement, HINAz shall not discriminate. against any employee, client or any other
individual in any way because of that person’s age, race, creed, color, religion, sex, disability or national
origin.

{b} Cancellation for Conflict of Interest: This Participation Agreement is subject to
cancellation for conflict of interest pursuant to ARS § 38-511, the pertinent provisions of which are
incorporated into this Participation Agreement by reference.

{c) Non-Appropriation: Notwithstanding any other provision in this Participation
Agreement, this Participation Agreement may be terminated if for any reason, there are not sufficient
appropriated and available monies for the purpose of maintaining the county or other public entity
obligations under this Participation Agreement. In the event of such termination, Participant shall have
no further obligation to HINAz, other than to pay for services rendered prior to termination.

{d) Legal Arizona Workers Act Compliance:

{i) HINAz hereby warrants that it will at all times during the term of this
Participation Agreement comply with all federal immigration laws applicable to HINAz’s employment of
its employees, and with the requirements of A.R.S. § 23-214 (A) (together the “State and Federal
Immigration Laws”). HINAz shall further ensure that each subcontractor who performs any work for
HINAz under this Participation Agreement complies with the State and Federal Immigration Laws.
Participant shall have the right at any time to inspect the books and records of HINAz and any
subcontractor in order to verify compliance with the State and Federal Immigration Laws. Any breach of
HINAz’s or any subcontractor’s warranty of compliance with the State and Federal Immigration Laws, or
of any other provision of this Section, shall be deemed to be a material breach of this Participation
Agreement subjecting HINAz to penalties up to and including suspension or termination of this
Participation Agreement. If the breach is by a subcontractor, and the subcontract is suspended or
terminated as a result, HINAz shall be required to take such steps as may be necessary to either self-
perform the services that would have been provided under the subcontract or retain a replacement
subcontractor, as soon as possible so as not to delay project completion.

(ii) HINAz shall advise each of its subcontractors of Participant’s rights, and
the subcontractor’s obligations, under this Section by including a provision in each subcontract

The Network Participation Agreement, March 2015 Page 18 of 23

substantially in the following form: “Subcontractor hereby warrants that it will at all times during the
term of this contract comply with all federal immigration laws applicable to subcontractor’s employees,
and with the requirements of A.R.S. § 23-214 (A). Subcontractor further agrees that [Participant] may
inspect the subcontractor’s books and records to ensure that subcontractor is in compliance with these
requirements. Any breach of this paragraph by subcontractor will be deemed to be a material breach of
this contract subjecting subcontractor to penalties up to and including suspension or termination of this
contract.”

(iii) Any additional costs attributable directly or indirectly to remedial action
under this Section shall be the responsibility of HINAz. In the event that remedial action under this
Section results in delay to one or more tasks on the critical path of Participant’s approved construction
or critical milestones schedule, such period of delay shall be deemed excusable delay for which HINAz
shall be entitled to an extension of time, but not costs.

(e} Scrutinized Business Operations: Pursuant to A.R.S. §§ 35-391.06 and 393.06,
HINAz hereby certifies that it does not have scrutinized business operations in Iran or Sudan. The
submission of a false certification by HINAz may result in action up to and including termination of this
Participation Agreement.

15.13 Dispute Resolution: The Parties agree that if there is a dispute between the Parties
arising as a result of this Participation Agreement (“Dispute”}, each Party will designate an individual
with settlement authority to meet and confer in good faith in an attempt to resolve any Dispute. ifthe
Dispute is not resolved within 45 days after the Parties first meet and confer and the Parties wish to
pursue the Dispute, the Parties may agree to refer the Dispute to informal and nonbinding mediation
before a mutually acceptable independent mediator before taking formal legal action. The Parties will
split equally the costs of such mediation; provided, however, that each Party will pay its own fees and
costs incurred in connection with preparation for and participation in the mediation. Information shared
during dispute resolution attempts cannot be introduced as evidence in subsequent related
proceedings.

15.14 Waiver. No waiver of or failure by either Party to enforce any of the provisions, terms,
conditions, or obligations herein shall be construed as a waiver of any subsequent breach of such
provision, term, condition, or obligation, or of any other provision, term, condition, or obligation
hereunder, whether the same or different in nature. No extension of time for performance of any
obligations or acts shall be deemed an extension of the time for performance of any other obligations or
acts.

15.15 Counterparts. This Participation Agreement may be executed in one or more
counterparts, each of which shall be deemed to be an original, but all of which together shall constitute
one and the same instrument. Facsimile signatures and signatures transmitted by email after having
been scanned shall be accepted as originals for the purposes of this Participation Agreement.

[Signatures on following page]

The Network Participation Agreement, March 2015 Page 19 of 23

PARTICIPANT HEALTH INFORMATION NETWORK OF
ARIZONA

Printed Name: | veslen Les (Ravsimeer Printed Name: SS bi OV UM = Awd ath
a) Ge

Signature: sinatra wc Burn Praott
rite___ CPO Title: Di veoty a Fuance tfAtmin Alec
Date: ‘4b hs Date: U-teb-iS

Information for notices under this Participation Agreement:

Printed Name:\O€Y Molma Cre crm Printed Name: ‘Melissa-A-Ketrys- YJ ror. Pouwrestott

Title pau isor Prete Tt Title: _ Sbhiet Executive Officer ;
. Drecte of Fines ed Ad minateatha
Address: 390 Ww, Lincoln Street Address: 3877 N. 7" Street, Suite 130

Phoenix, AZ 85022

Phoeni AZ &5003
Molnas 9 p3 @ Mail. Maricopa .ApVv

Kndvea. Stupka, CPP
Procuvement Officer
320 W. Lincoln street

Phoen¥ KE $5002
astupka @ mail Maricopa gov

The Network Participation Agreement, March 2015 Page 20 of 23