10-Business Asscociate Agreement.docx

BUSINESS ASSOCIATE AGREEMENT

THIS BUSINESS ASSOCIATE AGREEMENT (“Agreement”) is effective as of __ (the “Effective Date”), by and between ROSWELL PARK CANCER INSTITUTE CORPORATION d/b/a ROSWELL PARK COMPREHENSIVE CANCER CENTER, a New York public benefit corporation with its principal place of business located at Elm and Carlton Streets, Buffalo, New York 14263 (“Covered Entity”), and __, a __ with its principal place of business located at __ (“Business Associate”). Covered Entity and Business Associate may be referred to herein individually as a “Party” and collectively as the “Parties”.

W I T N E S S E T H:

WHEREAS, Covered Entity and Business Associate are the parties to one or more Service Agreements wherein Covered Entity qualifies as a “covered entity” and Business Associate qualifies as Covered Entity’s “business associate” under 45 C.F.R. § 160.103; and

WHEREAS, the PHI accessed, received, created, maintained, or transmitted by Business Associate for or on behalf of Covered Entity under such Service Agreements is subject to protection under HIPAA, the HITECH Act, and the regulations promulgated thereunder, including the HIPAA Final Rule; and

WHEREAS, the Parties wish to enter into this Agreement to memorialize their obligations with respect to such PHI pursuant to the applicable requirements of HIPAA and to satisfy certain standards and requirements of the Privacy and Security Rules and the HITECH Act.

NOW, THEREFORE, in consideration of the premises, and for other good and valuable consideration, the receipt of which is hereby acknowledged, Covered Entity and Business Associate agree as follows:

1. DEFINITIONS. Capitalized terms used but not otherwise defined in this Agreement shall have the same meanings ascribed to those terms under the HIPAA Regulations and the HIPAA Final Rule.

1.1. “HIPAA Final Rule” means the HIPAA Omnibus Final Rule, which amended the Privacy and Security Rules and implemented several provisions of the HITECH Act, extending certain HIPAA obligations to business associates and their Subcontractors.

1.2. “HIPAA Regulations” means the following regulations, as may be amended from time to time, promulgated under the Administrative Simplification requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”): (i) the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Parts 160 and 164 (Subparts A and E) (the “Privacy Rule”); (ii) the Administrative Requirements applicable to Transactions at 45 C.F.R. Parts 160 and 162 (Subparts A and I) (the “Electronic Transactions Rule”); (iii) the Security Standards for the Protection of Electronic Protected Health Information at 45 C.F.R. Parts 160 and 164 (Subparts A and C) (the “Security Rule”); and (iv) the Standards for Notification in the Case of Breach of Unsecured Protected Health Information at 45 C.F.R. Parts 160 and 164 (Subparts A and D) (the “Breach Notification Rule”).

1.3. “HHS Guidance” means HHS’s “Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals for Purposes of the Breach Notification Requirements Under Section 13402 of the HITECH Act”.

1.4. “HITECH Act” means the Health Information Technology for Economic and Clinical Health Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (Pub. L. 111-5).

1.5. “Protected Health Information” or “PHI” means as defined under 45 C.F.R. § 160.103, as applied to the information accessed, received, maintained, or created by or made accessible to Business Associate by or on behalf of Covered Entity under a Service Agreement.

1.6. "Service Agreement” means the written agreement or arrangement between the Parties pursuant to which Business Associate accesses, receives, creates, maintains, or transmits PHI for or on behalf of Covered Entity.

1.7. “Unsuccessful Security Incidents” include, but are limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service, and any combination of the above, so long as no such incident results in unauthorized acquisition, access, Use, Disclosure, modification, or destruction of PHI, including ePHI.

2. USE AND DISCLOSURE BY BUSINESS ASSOCIATE.

2.1. General. Except as otherwise provided for in this Agreement, Business Associate may access, maintain, Use, and Disclose PHI only as reasonably necessary to fulfill Business Associate’s obligations to Covered Entity under a Service Agreement.

2.2. Minimum Necessary. Business Associate shall limit permitted access, maintenance, Use, and Disclosure of PHI to the minimum extent necessary to fulfill Business Associate’s obligations under a Service Agreement and accomplish the intended purpose of such access, maintenance, Use, or Disclosure in accordance with the minimum necessary standard set forth at 45 C.F.R. § 164.502(b) and 45 C.F.R. § 164.514(d).

2.3. Use for Proper Management and Administration. Except as otherwise limited in this Agreement, Business Associate may, consistent with 45 C.F.R. § 164.504(e)(4)(i), Use PHI as necessary for the proper management and administration of Business Associate or to carry out its legal responsibilities.

2.4. Disclosure for Proper Management and Administration. Except as otherwise limited in this Agreement, Business Associate may, consistent with 45 C.F.R. § 164.504(e)(4)(ii), Disclose PHI as necessary for the proper management and administration of Business Associate provided that: (i) the Disclosure is Required by Law; or (ii) if the Disclosure is not Required By Law, prior to such Disclosure, Business Associate obtains reasonable written assurances from the person or entity to whom the PHI is Disclosed that: (a) the PHI will be held in confidence and Used or further Disclosed only as Required By Law for the purpose for which it was Disclosed; and (b) the person or entity will notify Business Associate of any instances in which the confidentiality of the PHI has been Breached. Such notification shall be made within three (3) business days of discovery.

2.4.1. Disclosures Required by Law. In the event Business Associate receives a subpoena, court/administrative order, or other discovery request or mandate for release of PHI, Business Associate shall notify Covered Entity as soon as reasonably practicable, but in any event within five (5) business days of receipt. Covered Entity shall have an opportunity to oppose such Disclosure and/or seek confidential treatment for the PHI to be Disclosed, which Business Associate shall fully cooperate with. If Covered Entity objects to such disclosure, Business Associate shall refrain from disclosing the PHI until Covered Entity has exhausted all alternatives for relief.

2.5. Subcontractors. Prior to any Disclosure of PHI to, or maintenance, access, or Use of PHI by, any Subcontractor as permitted under the applicable Service Agreement, Business Associate shall enter into a business associate agreement with the Subcontractor that is no less restrictive than this Agreement and that applies to Subcontractor the same restrictions, requirements, and conditions that apply to Business Associate hereunder. Use of a Subcontractor shall not relieve Business Associate of any liability or obligation under this Agreement.

2.6. De-Identification, and Limited Data Sets. Unless expressly authorized under a Service Agreement, Business Associate may not: (i) de-identify PHI; (ii) Use, sell, publish, access/allow access to, or otherwise Disclose de-identified PHI for Business Associate’s own purposes; or (iii) create a Limited Data Set from PHI. If Business Associate is expressly authorized under a Service Agreement to: (a) de-identify PHI, such de-identification shall comply with 45 C.F.R. § 164.514(b); or (b) create a Limited Data Set from PHI, such creation shall comply with 45 C.F.R. § 164.514(e).

2.7. Data Aggregation. Business Associate may use PHI to provide Data Aggregation services only as expressly permitted under a Service Agreement, and in such cases, in accordance with 45 C.F.R. § 164.501 and 504(e)(2)(i)(B).

2.8. Marketing and Fundraising Activities. Business Associate may Use and Disclose PHI for marketing and fundraising purposes only as expressly permitted under a Service Agreement, and in such cases, in accordance with 45 C.F.R. § 508(a)(3). Business Associate will not Use or Disclose PHI for fundraising purposes or its own marketing, business, or product development purposes.

3. PRIVACY RULE OBLIGATIONS OF BUSINESS ASSOCIATE.

3.1. Access. If Business Associate maintains PHI in a Designated Record Set, Business Associate shall make the PHI specified by Covered Entity available to the Individual(s) identified by Covered Entity as being entitled to access in accordance with 45 C.F.R. § 164.524 within five (5) business days of receipt of the request. If Business Associate receives an Individual’s request to access his or her PHI, Business Associate shall forward such request to Covered Entity within three (3) business days of receipt of the request.

3.2. Amendment. In the event Business Associate maintains PHI in a Designated Record Set, upon request by an Individual, Covered Entity shall determine whether any Individual is entitled to amendment of its PHI pursuant to 45 C.F.R. § 164.526. If Covered Entity determines that an Individual is entitled to such an amendment, Covered Entity will notify Business Associate and Business Associate shall amend the PHI in the same manner as would be required for Covered Entity within five (5) business days of receipt of the request. If Business Associate receives an Individual’s request to amend his or her PHI, Business Associate shall forward such request to Covered Entity within three (3) business days of receipt of the request.

3.3. Accounting. Business Associate shall document and account for all Disclosures of PHI and information related to such Disclosures. Within five (5) business days of receipt of the request, Business Associate shall provide to Covered Entity an accounting of all Disclosures of PHI in order for Covered Entity to comply with 45 C.F.R. § 164.528, including, as applicable, the date of the Disclosure, the name and, if known, the address of the recipient of the PHI, a brief description of the PHI Disclosed, and the purpose of the Disclosure. If an Individual contacts Business Associate directly for such an accounting, Business Associate shall forward the request to Covered Entity within three (3) business days of receipt of the request and will direct the Individual to contact Covered Entity.

3.4. Restrictions on Disclosures. Upon request by an Individual, Covered Entity shall determine whether an Individual is entitled to a restriction on Disclosure of PHI pursuant to 45 C.F.R. § 164.522. If Covered Entity determines that an Individual is entitled to such a restriction, Covered Entity will notify Business Associate and Business Associate will restrict its Disclosures of the Individual’s PHI in the same manner as would be required for Covered Entity. If Business Associate receives an Individual’s request for a restriction, Business Associate shall forward such request to Covered Entity within three (3) business days of receipt of the request.

3.5. Assistance with Privacy Rule Compliance. If a Service Agreement requires Business Associate to perform any activity on behalf of Covered Entity in order to assist Covered Entity in complying with the Privacy Rule, Business Associate agrees to comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of such activity.

3.6. Access to Books and Records. Business Associate shall make its internal practices, books, and records relating to the Use and Disclosure of PHI available to Covered Entity and the Secretary of HHS or his or her designee for purposes of determining compliance with the HIPAA Regulations.

4. SECURITY RULE OBLIGATIONS OF BUSINESS ASSOCIATE.

4.1. Safeguards. Business Associate shall employ appropriate safeguards to prevent access, Use, or Disclosure of PHI other than as provided for by this Agreement. Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI that it Uses, Discloses, creates, receives, maintains, or transmits on behalf of Covered Entity, as required by the Security Rule. Without limiting the generality of the foregoing, Business Associate shall also comply with the security standards set forth in 45 C.F.R. §§§§ 164.308, 164.310, 164.312, and 164.316, as applicable.

4.2. Security and Encryption. Business Associate agrees to secure and render all PHI maintained or otherwise held by Business Associate in any format or medium unusable, unreadable, or indecipherable, consistent with the Security Rule and other applicable laws and industry guidance, including HHS Guidance. Business Associate shall not transmit any unencrypted PHI, including over any network, system, or the public internet. The requirements in this Section, without limitation, apply to PHI: (i) residing on computers, servers, portable, and non-portable devices; (ii) residing on hosted services and cloud storage, if such storage methods are permitted; (iii) communicated through email or other means of electronic communication; and (iv) that is maintained on any Business Associate archival or backup storage medium. For avoidance of doubt, Business Associate acknowledges and agrees that in no event shall PHI be stored on any Business Associate portable hardware, including laptops, tablets, mobile devices, or flash drives unless such PHI is secured and encrypted consistent with this Section.

4.3. Security Documentation and Survey. Upon request, Business Associate shall: (i) make available to Covered Entity a written description of Business Associate’s security program, or an executive summary thereof, including its most recent ePHI risk analysis and its policies, procedures, security incidents, and responses and evidence of training; and (ii) complete a security survey and/or attestation document designed to assist Covered Entity in understanding and documenting Business Associate’s security procedures and compliance with the requirements of this Agreement. Business Associate’s failure to respond to the foregoing requests within a reasonable timeframe specified by Covered Entity shall constitute a material breach of this Agreement.

4.4. Access. Business Associate shall restrict access to PHI to the minimum workforce members necessary to fulfill Business Associate’s contractual obligations to Covered Entity under this Agreement and each Service Agreement. Business Associate shall maintain an audit trail of access to ePHI. Business Associate shall institute and maintain appropriate physical and technical controls over its infrastructure to ensure only those authorized to access PHI are able to, which includes requiring the use of unique user IDs and strong passwords, multi-factor authentication and re-authentication, and automatic locking of systems and devices after short periods of inactivity. Business Associate shall, and shall require any Subcontractors to, provide training to its employees and any other workforce members who have access to PHI.

4.5. Storage. Business Associate shall not store any PHI except where there is a business necessity pursuant to the applicable Service Agreement, and then only to the extent encrypted in accordance with Section 4.2 and otherwise compliant with this Agreement.

4.6. No Remuneration. Business Associate shall not solicit or receive remuneration, either directly or indirectly, in exchange for PHI that has been de-identified.

4.7. Activities Outside the United States. Business Associate shall ensure that all hosting of PHI occurs within the United States and represents and warrants that neither it nor any permitted Subcontractors will Use, Disclose, transfer, access, store/maintain, or otherwise handle PHI in any form via any medium outside of the boundaries and jurisdiction of the United States except as expressly authorized in the applicable Service Agreement.

5. INCIDENT REPORTING OBLIGATIONS OF BUSINESS ASSOCIATE.

5.1. Reporting Obligation. Business Associate shall report to Covered Entity, in writing, any access, acquisition, Use, or Disclosure of PHI not permitted under this Agreement, including without limitation any Security Incident or Breach (each, an “Incident”). Such reporting shall be without unreasonable delay and in no event more than three (3) business days after discovery. Notwithstanding the foregoing, the Parties acknowledge and agree that this Section constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of Unsuccessful Security Incidents for which no additional notice to Covered Entity shall be required; provided, however, if Business Associate is reasonably aware that the Unsuccessful Security Incidents are specific, targeted attacks on Covered Entity’s PHI, Business Associate will promptly notify Covered Entity.

5.2. Report Contents. Each report will contain all available information known to Business Associate, including: (i) a brief description of the Incident, including the date of, and the date of discovery thereof, and a description of the type(s) of PHI involved; (ii) identities of each Individual whose PHI has been, or is reasonably believed by Business Associate to have been, impacted by the Incident; (iii) any steps Individuals should take to mitigate harm resulting from the Incident; (iv) a description of what Business Associate is doing to investigate, mitigate, and to protect against any further unauthorized access, acquisition, Use, or Disclosure of PHI resulting from the Incident; (v) contact procedures for Covered Entity to contact Business Associate to ask questions or learn additional information; and (vi) such other information as Covered Entity may reasonably request. Notwithstanding any language herein to the contrary, Covered Entity may disclose such reports in connection with Covered Entity’s investigation, remediation, or mitigation efforts, or in connection with complying with applicable law.

5.3. Report Supplementation. Business Associate shall promptly supplement its reporting to Covered Entity as information originally reported changes or if Business Associate learns of any additional information pertaining to the above. Business Associate shall cooperate with Covered Entity’s reasonable requests for updates and additional information during Business Associate’s or Covered Entity’s investigation into potential access, acquisition, Use, or Disclosure of PHI not permitted by this Agreement.

5.4. Cooperation with Violations. Business Associate will cooperate with Covered Entity’s investigation and/or risk assessment with respect to any report made pursuant to this Section 5. In doing so, Business Associate will abide by Covered Entity’s decision with respect to whether such Incident constitutes a Breach and will follow Covered Entity’s instructions with respect to any event reported to Covered Entity by Business Associate. Business Associate shall maintain complete records regarding any event requiring reporting for the period required by 45 C.F.R. 164.530(j) or such longer period as may be required by New York state law and shall make such records available to Covered Entity within five (5) business days of request upon request.

5.5. Cost Recovery. In addition to Business Associate’s indemnification obligations under this Agreement and/or the applicable Service Agreement, Business Associate shall reimburse Covered Entity for reasonable costs and expenses incurred by Covered Entity to the extent resulting from an Incident caused by Business Associate or its Subcontractors, including: (i) costs of providing notifications required by applicable law; (ii) costs of remediation required under applicable law (such as credit monitoring and call center support); (iii) costs of forensic investigation; (iv) government fines or penalties; and (v) attorneys’ fees.

6. STANDARD TRANSACTIONS. To the extent that Business Associate conducts Electronic Transactions, in whole or part, on behalf of the Covered Entity for which HHS has established standards, Business Associate will comply, and will require any Subcontractor it involves with the conduct of Electronic Transactions to comply, with each applicable requirement of the Electronic Transactions Rule. Business Associate shall also comply with the National Provider Identifier requirements, if and to the extent applicable.

7. TERM AND TERMINATION.

7.1. Term. Unless earlier terminated as provided for herein, the term of this Agreement begins on the Effective Date and shall continue in effect until all PHI in Business Associate’s possession and control, including, for the avoidance of doubt, PHI that is hosted, maintained, or otherwise held by Business Associate by or on behalf of Covered Entity, is destroyed or returned to Covered Entity.

7.2. Covered Entity’s Right to Terminate. Upon Covered Entity’s knowledge of a breach by Business Associate (including any Subcontractor) of the terms of this Agreement, Covered Entity shall provide an opportunity for Business Associate to cure the breach so long as Covered Entity reasonably deems the breach to be curable. If Covered Entity reasonably determines that the breach is not curable, or Business Associate fails to cure the breach within the timeframe specified by Covered Entity to the reasonable satisfaction of Covered Entity, Covered Entity may immediately terminate: (i) this Agreement; (ii) the Service Agreement, or those provisions of the Service Agreement that involve the Use or Disclosure of PHI; and (iii) such other provisions, if any, of the Service Agreement as Covered Entity designates in its sole discretion.

7.3. Procedure Upon Termination. Upon expiration or termination of this Agreement and at Covered Entity’s election and direction, Business Associate shall: (i) permanently delete, wipe, or degauss for physical destruction or disposal all PHI possessed, controlled, or otherwise maintained by Business Associate or its Subcontractors, in accordance with HHS Guidance and in a manner meeting forensic industry standards no less stringent than the NIST Special Publication 800‐88 Guidelines for Media Sanitization; (ii) return all such PHI or migrate such PHI to a platform-agnostic format that maintains the security, integrity, and availability of the PHI; or (iii) a combination of the foregoing. In the event that the Parties agree that return and/or destruction of all or a portion of the PHI in Business Associate’s or its Subcontractors’ possession or control is/are infeasible or retention is required by applicable law, Business Associate (or its Subcontractors) may retain such PHI for so long as the return or destruction remains(s) infeasible or the retention is required by law, provided that Business Associate (and its Subcontractors, as applicable) extends the protections of this Agreement to the PHI for so long as the PHI is retained, and limits further use and disclosure of the PHI to those purposes that make the return and/or destruction infeasible or required by law.

8. INDEMNIFICATION. Business Associate shall indemnify, defend, and hold harmless Covered Entity, its affiliates, and their respective employees, officers, and directors (collectively, “Indemnitees”), from and against any and all third party actions, suits, claims, demands, and prosecutions (collectively, “Claims”) brought or instituted, and all damages, liabilities, losses, settlements, judgments, costs, and expenses (including, but not limited to, reasonable attorneys’ fees and costs) incurred by, imposed upon, or asserted against the Indemnitees, to the extent arising out of an Incident caused by the acts or omissions of Business Associate or a Subcontractor. Business Associate shall defend any Claim at Business Associate’s expense using qualified counsel reasonably acceptable to Covered Entity. Business Associate shall not enter into any settlement without the written consent of Covered Entity.

9. NO LIMITATION OF LIABILITY. NOTWITHSTANDING ANY OTHER PROVISION OF THIS AGREEMENT OR ANY SERVICE AGREEMENT, ANY PURPORTED LIMITATION ON BUSINESS ASSOCIATE’S LIABILITY AS TO TYPE OR AMOUNT OF DAMAGES SHALL NOT APPLY TO ANY LIABILITY ARISING OUT OF THIS AGREEMENT.

10. GENERAL PROVISIONS.

10.1. No Third-Party Beneficiaries. This Agreement is for the sole benefit of the Parties. There are no third‑party beneficiaries to the Agreement.

10.2. Amendment. This Agreement may be modified, or any rights under it waived, only by a written document signed by the authorized representatives of both Parties. In addition, if any relevant portion of applicable law is amended in a manner that changes the obligations of Business Associate or Covered Entity that are embodied in the terms of this Agreement, then the Parties agree to negotiate in good faith appropriate amendments to this Agreement to give effect to such revised obligations.

10.3. No Assignment. Business Associate’s duties under this Agreement may not be assigned to or assumed by any other person or entity, in whole or in part, without the prior written consent of Covered Entity. Subject to the foregoing, this Agreement shall be binding upon, and shall inure to the benefit of, the Parties hereto and their respective successors and permitted assigns.

10.4. No Ownership. PHI governed by this Agreement shall be and remain the sole property of Covered Entity and Business Associate shall not have or obtain any rights therein except as stated herein.

10.5. Survival. Except as otherwise expressly provided in this Agreement, all covenants, agreements, representations, and warranties, express and implied, shall survive the expiration or termination of this Agreement, for any reason or no reason, and shall remain in effect and binding upon each Party until such Party has fulfilled all of its obligations hereunder.

10.6. Remedies. Business Associate acknowledges that the remedies at law for its violation of the terms of this Agreement may be inadequate and that monetary damages resulting from such violation may not be readily measured. Accordingly, in the event of a violation by Business Associate of the terms of the Agreement, Covered Entity shall be entitled to immediate injunctive relief. Notwithstanding the foregoing, nothing herein shall prohibit Covered Entity from pursuing any other remedies that may be available to it for such violation.

10.7. Independent Contractors. Nothing in this Agreement shall be construed to create: (i) a partnership, joint venture or other joint business relationship between the Parties; or (ii) an agency relationship for purposes of the HIPAA Final Rule.

10.8. Notices. All notices under this Agreement shall be in writing and delivered to the address(es) listed below via: (i) personal delivery; (ii) certified mail, return receipt requested and postage prepaid; or (iii) overnight mail. Either Party may change its address for notice by giving an appropriate notice to the other Party in conformity with this Section. Notices shall be addressed as follows:

If to Covered Entity:

Roswell Park Comprehensive Cancer Center Elm and Carlton Streets Buffalo, New York 14263 Attention: Privacy Officer

With a copy to:

Roswell Park Comprehensive Cancer Center Elm and Carlton Streets Buffalo, New York 14263 Attention: General Counsel

If to Business Associate:

10.9. Execution. This Agreement may be executed in counterparts, each of which shall be deemed an original and all of which shall constitute one and the same instrument. An executed Agreement delivered by electronic mail shall be treated as if an original, and an electronic signature shall create a valid and binding obligation of the Party executing (or on whose behalf such signature is executed) and shall be deemed an original signature for all purposes under this Agreement.

10.10. Severability; Waiver. If for any reason a court of competent jurisdiction finds any portion of this Agreement to be unenforceable, then such portion shall be enforced to the maximum extent permissible so as to effect the intent of the Parties, and the remainder of this Agreement shall continue in full force and effect. The failure of either Party to enforce any of the provisions of this Agreement shall not be construed to be a waiver of the right of such Party thereafter to enforce such provisions.

10.11. Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the state of New York, exclusive of its choice of law provisions.

10.12. Cooperation in Investigations. The Parties acknowledge that certain breaches or violations of this Agreement may result in litigation or investigations pursued by federal or state governmental authorities of the United States resulting in civil liability or criminal penalties. Each Party will cooperate in good faith in all respects with the other Party in connection with any request by a federal or state governmental authority for additional information and documents or any governmental investigation, complaint, action, or other inquiry.

10.13. Entire Agreement. This Agreement, together with each Service Agreement and any amendments hereto or thereto, respectively, represents the entire agreement between the Parties with respect to the subject matter of this Agreement, superseding all prior communications, discussions, understandings, proposals, and agreements between the Parties with respect to the subject matter hereof, whether oral or written. In the event of a conflict between the terms of this Agreement and any Service Agreement, the terms of this Agreement shall prevail.

IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed by their duly authorized representatives as of the Effective Date.

ROSWELL PARK CANCER INSTITUTE CORPORATION d/b/a ROSWELL PARK COMPREHENSIVE CANCER CENTER

Signature

Signature

Printed Name

Printed Name

Title

Title

Agreement No. ___