2572-58127_2572-58127_HealthStream MSA v2.pdf

DSHS Contract #2572-58127

HealthStream, Inc.

500 11th Ave N, Nashville, TN 37203 1

Master Services Agreement DES FILING REQUIREMENT The provisions of Chapter 39.26 RCW require the agency to file this sole source contract with the Department of Enterprise Services (DES) for approval. The effective date of this contract is upon DES approval of the contract, the tenth (15th) working day after it is filed with DES, or as agreed between the parties, whichever is later.

This Master Services Agreement (“Agreement”) is entered into and effective as of March 10, 2025 ("Effective Date") by and between HealthStream, Inc., a Tennessee corporation, having its principal place of business at 500 11th Avenue North, Suite 1000, Nashville, Tennessee 37203 ("HealthStream") and Washington State Department of Social & Health Services, having its principal place of business at1115 Washington St SE, Olympia, WA 98501 ("Customer"). Unless otherwise specified herein, this Agreement shall supersede any and all previous master services or similar agreement(s), including any previously executed Financial and Licensing Terms Agreement(s), Software License Agreement(s) or Subscription Agreement(s) between HealthStream (which shall include any HealthStream acquired entity, including but not limited to VerityStream, Inc.) and Customer.

This Master Services Agreement shall apply only to HealthStream Order Form No. ORD-0800820 (the “Order Form”), the said Order Form appended herein as Exhibit D.

For good and valuable consideration, the receipt and sufficiency of which is acknowledged, the parties agree as follows:

1. Definitions.

“Affiliate(s)” of a Person means any other Person that directly or indirectly, through one or more intermediaries, controls, is controlled by, or is under common control with, such Person. The term “control” (including the terms “controlled by” and “under common control with”) means the direct or indirect power to direct or cause the direction of the management and policies of a Person, whether through the ownership of voting securities, by contract or otherwise.

“Person” means an individual, corporation, partnership, joint venture, limited liability entity, governmental authority, unincorporated organization, trust, association, or other entity.

“Professional Services” means fee-based migration, implementation, training, consulting, or other customized services that HealthStream performs as described in an Order Form, or support services related to the Software.

“Service(s)” means all service(s) provided by HealthStream, including but not limited to Professional Services, support services, Software, or the Online Service(s).

“Software” and “Online Services” mean certain subscription-based Service(s), further described in section 2 below, provided by HealthStream to Users or Permitted Users and delivered over the Internet or other similar computer networks, and/or the cloud hosted proprietary computer software products subject to this Agreement and any Order Form executed hereunder.

“Users” or “Permitted Users” (as noted in the applicable Order Form) means Customer's employees, consultants, contractors, clients, agents, or individuals Customer manages or otherwise controls, who are authorized to use the Online Service(s) and have been supplied user identifications and passwords by Customer (or by HealthStream at Customer's request).

2. Provision of Service(s).

2.1 HealthStream shall make the Service(s) available to

Customer pursuant to the terms and conditions set forth in this Agreement and any and all Order Forms executed under this Agreement from time to time.

2.2 Subscription. Use of Software. Subject to the terms and

conditions contained herein, HealthStream will make the Software available to Customer, and Customer hereby accepts from HealthStream, a limited, non-exclusive, non-transferable, non-sublicenseable, non-perpetual, subscription to access HealthStream’s Software set forth in an applicable Order Form, for its own internal use, in accordance with the terms of this Agreement. This subscription includes Customer’s right to all applicable enhancements, updates, modifications, and new releases for the Software. Customer obtains no rights other than the subscription granted pursuant to this Agreement.

Customer acknowledges and agrees that the Software is proprietary and remains the property of HealthStream. Customer agrees not to disclose the confidential aspects of the Software, consistent with the provisions of Section 6 below (Confidentiality), and agrees not to remove any of HealthStream’s product identification or trademark, copyright or proprietary notices from the Software. Only Users shall be permitted to use the Software under this Agreement.

3. Use of Online Service(s).

3.1 Dependent Online Service(s). Certain Online Service(s)

including, without limitation, content services, courseware services, and authoring services (collectively the “Dependent Online Service(s)”), require other Online Service(s) including, without limitation, hStream and any application(s) (e.g., learning, performance, delivery, or other applications) necessary to utilize the Dependent Online Services any learning application or delivery application (collectively the “Required Online Service(s)”), to be licensed or subscribed to by Customer to enable the Customer to use the Dependent Online Services. For example, the ability to assign and access content (a Dependent Online Services) may require our learning application and shall require hStream (both, a Required Online Service). HealthStream may require and Customer shall agree to contract for, license and/or subscribe to, and purchase at least the minimum level of Required Online Services as a pre-requisite to contracting for, licensing and purchasing the Dependent Online Services. All Required Online Services and Dependent Online Services shall be set forth in the applicable Order Form(s).

3.2 HealthStream Responsibilities. HealthStream shall: (a)

provide the Services as described in an Order Form (or as otherwise mutually agreed to by the parties in writing); (b) provide telephone and online standard support to designated representatives of Customer as described in the applicable Order Form; and (b) use commercially reasonable efforts to make the Service(s) generally available 24 hours a day, 7 days a week, except for: (i) planned downtime; or (ii) any unavailability caused by unforeseeable circumstances beyond HealthStream's reasonable control, including without limitation, acts of God, acts of government, flood, fire, earthquakes, civil unrest, acts of terror, strikes or other labor problems (other than those involving HealthStream employees), computer, telecommunications, Internet service provider or hosting facility failures or delays involving hardware, software or power systems not within HealthStream's possession or reasonable control, and network intrusions or denial of service attacks.

3.3 Customer Responsibilities. Customer is responsible for all

(i) acts and omissions of its Users; and (ii) activities that occur under Customer's User accounts. Customer shall: (a) have sole responsibility for the accuracy, quality, integrity, legality, reliability, and appropriateness of all Customer Data and any content added by users to the Service(s) and/or Software; (b) use commercially reasonable efforts to prevent unauthorized access to, or use of, the Service(s), and notify HealthStream promptly of any unauthorized use; and (c) comply with all applicable local, state, federal, and foreign laws in using the Service(s) and, if using the Service(s) outside of the United States, not use the Service(s) in a manner that would violate any federal or state laws of the United States if conducted in the United States. Customer shall utilize all applicable implementation and/or data conversion

500 11th Ave N, Nashville, TN 37203

Services within twelve (12) months after the Effective Date of the applicable Order Form, unless otherwise agreed to in writing by the parties.

3.4 Use Guidelines. Customer shall use the Service(s) solely for its internal business purposes as contemplated by this Agreement and shall not: (a) license, sublicense, sell, resell, rent, lease, transfer, assign, distribute, time share or otherwise commercially exploit or make the Service(s) available to any third party, other than as contemplated by this Agreement; (b) send spam or otherwise duplicative or unsolicited messages in violation of applicable laws; (c) send or store infringing, obscene, threatening, libelous, or otherwise unlawful or tortious material, including material harmful to children or violative of third party privacy rights; (d) send or store material containing software viruses, worms, Trojan horses or other harmful computer code, files, scripts, agents or programs; (e) interfere with or disrupt the integrity or performance of the Service(s) or the data contained in the Service(s); or

(f) attempt to gain unauthorized access to the Service(s) or its related systems or networks.

4. Fees & Payment.

4.1 Fees. Customer shall pay all fees specified in all executed Order Forms. In the case of Service(s) and except as otherwise provided: (a) fees are based on the Service(s) and the number of User subscriptions purchased in the relevant Order Form, not the extent of actual usage; (b) fees are non-refundable except as explicitly set forth in Section 10.3 of this Agreement; (c) the number of User subscriptions purchased cannot be decreased during the relevant subscription term stated on the Order Form; and (d) except as otherwise set forth in an Order Form, User logins and accounts are for named Users (a specific individual) and cannot be shared or used by more than one User.

HealthStream shall have the right at all times to review and audit the number of Users for any Service and to bill Customer for any Users in excess of that number of properly subscribed and/or licensed and paid Users under all Order Forms and subscriptions.

4.2 Updates. HealthStream shall provide Customer with

applicable subsequent updates, upgrades, or enhancements to the Online Services and/or Software at such time as they are made generally available to all subscribing customers (“Updates”). When and as HealthStream releases an Updates, HealthStream shall provide them to Customer at no additional charge. If applicable, HealthStream shall make Updates available to Customer accompanied by such documentation and instructions concerning such Updates as determined by HealthStream. All new Updates are considered integral to the Software for purposes of this Agreement and the terms of this Agreement apply to such Updates.

4.3 Invoicing & Payment; Suspension of Service. Customer shall maintain complete and accurate billing and contact information with HealthStream at all times. Fees for the Service(s) will be invoiced in advance and otherwise in accordance with the terms set forth in the relevant Order Form. Unless otherwise stated in the Order Form, charges are due 30 days from the invoice date and all payments made under this Agreement shall be in United States dollars. Any payment not received from Customer by the due date may accrue (except with respect to charges then under reasonable and good faith dispute), at HealthStream's discretion, late charges at the rate of 1.5% of the outstanding balance per month, or the maximum rate permitted by law, whichever is lower, from the date the payment was due until the date paid. If Customer's account is thirty (30) days or more overdue (except with respect to charges then under reasonable and good faith dispute), in addition to any of its other rights or remedies, HealthStream reserves the right to suspend the Service(s) provided to Customer, without liability to Customer, until the overdue amounts are paid in full. If Customer requests HealthStream to travel to Customer’s location to provide Services under this Agreement or any Order Form, Customer shall reimburse HealthStream for all reasonable expenses related to such travel subject to the Washington State reimbursement rates as set forth in Exhibit E. HealthStream shall invoice Customer for any such reimbursable travel expenses as incurred.

4.4 Taxes. Unless otherwise stated, HealthStream's fees do not include any local, state, federal or foreign taxes, levies or duties of any nature ("Taxes"). Customer is responsible for paying all Taxes, excluding only taxes based on HealthStream's income. If HealthStream has the legal obligation to pay or collect Taxes for which Customer is responsible under this section, the appropriate amount shall be invoiced to and paid by Customer unless Customer provides HealthStream with a valid tax exemption certificate authorized by the appropriate taxing authority.

5. Proprietary Rights.

5.1 Reservation of Rights. Customer acknowledges that in

providing the Service(s), HealthStream utilizes (a) the HealthStream name, the HealthStream logo, the HealthStream domain name, the product and service names associated with the Service(s), and other trademarks and service marks; (b) certain audio and visual information, documents, software and other works of authorship; (c) certain processes including, but not limited to, HealthStream’s databases, questionnaires, market research procedures, tabulation procedures, creative processes, statistical methods, and production methods; and

(d) other technology, software, hardware, products, processes, algorithms, user interfaces, know-how and other trade secrets, techniques, designs, inventions and other tangible or intangible technical material or information (collectively, "HealthStream IP") and that the HealthStream IP is covered by intellectual property rights owned or licensed by HealthStream (collectively, "HealthStream IP Rights").

Other than as expressly set forth in this Agreement, no license or other rights in or to the HealthStream IP or HealthStream IP Rights are granted to Customer, and all licenses and rights are expressly reserved.

5.2 Restrictions. Customer shall not (a) modify, copy or create derivative works based on the Service(s) or HealthStream IP; (b) create Internet "links" to or from the Online Service(s), or "frame" or "mirror" any content forming part of the Online Service(s), other than on Customer's own intranet; or (c) disassemble, reverse engineer, or decompile the Service(s) or HealthStream IP, or access it in order to build a similar or competitive product or service or copy any ideas, features, functions or graphics of the Service(s).

5.3 Customer Data. Customer shall provide HealthStream with

data necessary to provide Users with full access to the Services. As between HealthStream and Customer, all data obtained by HealthStream from Customer and through the provision of the Service(s) (collectively, the “Customer Data”) is owned exclusively by Customer. Customer Data is Confidential Information of Customer.

Customer grants HealthStream an unrestricted, royalty-free, irrevocable license to maintain and distribute aggregated compilations of Customer Data in a de-identified form (without reference to PHI or PII) (“Aggregated Data”) and to use such Aggregated Data for future studies and reports; provided, however, that the Aggregated Data will not (i) incorporate protected health information (PHI) as the same is defined by the U.S. Health Insurance Portability and Accountability Act of 1996 and (ii) reveal any personal information or the identity (PII) of Customer. HealthStream may, subject to Section 11.10 herein, distribute certain Customer Data to licensing and accreditation organizations for the benefit of Users. HealthStream will release the minimum data required to adequately credit Users for educational activities completed.

5.4 Suggestions. HealthStream shall have a royalty-free, worldwide, perpetual license, to use or incorporate into the Service(s) any suggestions, ideas, enhancement requests, feedback, recommendations or other information provided by Customer or its Users relating to the Service(s) (“Suggestions”). Customer or User has no obligation to provide any such feedback. For avoidance of doubt, HealthStream shall not incorporate Customer Data into Suggestions.

5.5 Third-Party Technology. To the extent that HealthStream

incorporates any Third-Party Technology (as defined herein) into the Services, HealthStream grants Customer a limited, non-exclusive, non-transferable, without right to sublicense, subscription or license to use such Third-Party Technology delivered to Customer solely as necessary for and in conjunction with Customer’s use of the Software in accordance with this Agreement. “Third-Party Technology” shall mean any and all technology and information, data designs, ideas, concepts, user-interfaces, templates, documentation, software, hardware, modules, development tools and other tangible or intangible technical material or information that HealthStream possesses or owns prior to the commencement of the license or subscription or which it develops independent of any activities governed by this Agreement, and any derivatives, modifications or enhancements made to any such property.

6. Confidentiality.

6.1 Definition of Confidential Information. As used in this

Agreement, "Confidential Information" means all confidential and proprietary information of a party ("Disclosing Party") disclosed to the other party ("Receiving Party"), whether orally or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure including, without limitation, the terms and conditions of this Agreement (including pricing and other terms reflected in all Order Forms under this Agreement), the Customer Data, the Service(s), the HealthStream IP, business and marketing plans, technology and technical information, product designs, and business processes.

Confidential Information shall not include any information that: (a) is or becomes generally known to the public without breach of any obligation owed to the Disclosing Party; (b) was known to the Receiving Party prior to its disclosure by the Disclosing Party without breach of any obligation owed to the Disclosing Party; (c) was independently developed by the Receiving Party without breach of any obligation owed to the Disclosing Party; or (d) is received from a third party without breach of any obligation owed to the Disclosing Party.

6.2 Confidentiality. The Receiving Party shall not disclose or use any Confidential Information of the Disclosing Party for any purpose outside the scope of this Agreement. Each party agrees to protect the confidentiality of the Confidential Information of the other party in the same manner that it protects the confidentiality of its own proprietary and confidential information of like kind, but in no event shall either party exercise less than reasonable care in protecting the Confidential Information. If the Receiving Party is compelled by law to disclose Confidential Information of the Disclosing Party, it shall provide the Disclosing Party with prior notice of the compelled disclosure (to the extent legally permitted) and reasonable assistance, at Disclosing Party's cost, if the Disclosing Party wishes to contest the disclosure.

Notwithstanding anything to the contrary in this agreement this Agreement is subject to the Public Records Act as defined in defined in Chapter 42.56 RCW.

6.3 Remedies. If the Receiving Party discloses or uses (or

threatens to disclose or use) any Confidential Information of the Disclosing Party in breach of this Section 6, the Disclosing Party shall have the right, in addition to any other remedies available to it, to seek injunctive relief to enjoin the acts, it being specifically acknowledged by the parties that any other available remedies are inadequate.

7. Warranties & Disclaimers.

7.1 Warranties.

(a) General. Each party represents and warrants that it has the legal power to enter into this Agreement. HealthStream represents and warrants that (i) it will provide the Service(s) in a manner consistent with general industry standards reasonably applicable to the provision of the Service; (ii) it owns or otherwise has sufficient rights to the Service(s) and the HealthStream IP to grant the rights and licenses granted in this Agreement; (iii) it will perform the Services in a skillful, professional, workmanlike and competent manner by qualified personnel; (iv) the Service(s) and HealthStream IP do not infringe any intellectual property rights of any third party. During the term of this Agreement, (i) the Service(s) shall perform materially in accordance with any applicable user guides or specifications; and (ii) the functionality of the Online Service(s) will not be materially decreased from that available as of the

Effective Date. Customer agrees that its purchase of the Service(s) is not contingent upon the delivery of any future functionality or features nor is it dependent upon any oral or written public comments made by HealthStream with respect to future functionality or features.

(b) Non-Exclusion. HealthStream represents and warrants that HealthStream, its officers, directors, and employees (i) are not currently excluded, debarred, or otherwise ineligible to participate in the federal healthcare programs as defined in 42 U.S.C. §1320a-7b(f) (the “federal healthcare programs”), (ii) have not been convicted of a criminal offense related to the provision of healthcare items or services and have not been excluded, debarred, or otherwise declared ineligible to participate in the federal healthcare programs, and (iii) are not, to the best of its knowledge, under investigation or otherwise aware of any circumstances which may result in HealthStream being excluded from participation in the federal healthcare programs. This shall be an ongoing representation and warranty and HealthStream shall immediately notify Customer of any change in the status of the representations and warranty set forth in this section.

7.2 Disclaimer. EXCEPT AS EXPRESSLY PROVIDED IN THIS

AGREEMENT, HEALTHSTREAM MAKES NO WARRANTY OF ANY

KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR

OTHERWISE. HEALTHSTREAM SPECIFICALLY DISCLAIMS ALL

IMPLIED WARRANTIES, INCLUDING ANY WARRANTY OF

MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE,

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW.

8. Mutual Indemnification.

8.1 Indemnification by HealthStream. Subject to this

Agreement, HealthStream shall defend, indemnify and hold Customer harmless against any loss or damage (including reasonable attorneys' fees) incurred in connection with claims, demands, suits, or proceedings ("Claims") made or brought against Customer by an unaffiliated third party alleging that the use of the Service(s) as contemplated under this Agreement infringes the intellectual property rights of such third party;

provided, that Customer (a) promptly gives written notice of the Claim to HealthStream; (b) gives HealthStream sole control of the defense and settlement of the Claim (provided that HealthStream may not settle or defend any Claim unless it unconditionally releases Customer of all liability); and (c) provides to HealthStream, at HealthStream's cost, all reasonable assistance.

8.2 Indemnification by Customer. Subject to this Agreement, Customer shall to the extent permitted under WA state law defend, indemnify and hold HealthStream harmless against any loss or damage (including reasonable attorneys' fees) incurred in connection with Claims made or brought against HealthStream by an unaffiliated third party alleging that the Customer Data or Customer's use of the Service(s) (as opposed to the Service itself) infringes the intellectual property rights of, or has otherwise harmed, a third party; provided, that HealthStream (a) promptly gives written notice of the Claim to Customer; (b) gives Customer sole control of the defense and settlement of the Claim (provided that Customer may not settle or defend any Claim unless it unconditionally releases HealthStream of all liability); and (c) provides to Customer, at Customer's cost, all reasonable assistance.

9. Limitation of Liability.

9.1 Limitation of Liability.

9.1.1. EXCEPT FOR LIABILITY ARISING UNDER SECTIONS 4

(PAYMENT OF FEES) OR 5.2 (RESTRICTIONS), IN NO EVENT

SHALL EITHER PARTY'S AGGREGATE LIABILITY ARISING OUT OF

OR RELATED TO THE AGREEMENT, WHETHER IN CONTRACT,

TORT OR UNDER ANY OTHER THEORY OF LIABILITY, EXCEED

THE GREATER OF (i) ONE HUNDRED THOUSAND DOLLARS ($100,000) OR (ii) THE AMOUNTS ACTUALLY PAID BY AND DUE

FROM CUSTOMER UNDER THIS AGREEMENT.

9.1.2. NOTWITHSTANDING THE FOREGOING, FOR LIABILITY

ARISING UNDER A BREACH OF SECTION 5.3 (CUSTOMER DATA),

6 (CONFIDENTIALITY), OR SECTION 8 (INDEMNIFICATION) IN NO

EVENT SHALL EITHER PARTY'S AGGREGATE LIABILITY ARISING

OUT OF OR RELATED TO THE AGREEMENT, WHETHER IN

CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY,

EXCEED THE GREATER TWO MILLION ($2,000,000.00) DOLLARS.

9.2 Exclusion of Consequential and Related Damages. IN NO

EVENT SHALL EITHER PARTY HAVE ANY LIABILITY TO THE

OTHER PARTY FOR ANY LOST PROFITS, LOSS OF USE, COSTS

OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR

FOR ANY INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR

CONSEQUENTIAL DAMAGES HOWEVER CAUSED AND, WHETHER

IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF

LIABILITY, WHETHER OR NOT THE PARTY HAS BEEN ADVISED OF

THE POSSIBILITY OF THE DAMAGE.

9.3 Intentionally Deleted.

9.4 INTENTIONALLY DELETED.

10. Term & Termination.

10.1 Term of Agreement. This Agreement commences on the

Effective Date and, unless earlier terminated pursuant to the terms of this Agreement, continues for five (5) years following the date of Acceptance of the Online Services noted in the Order Form.

10.2 Term of User Subscriptions. User subscriptions for Online Service(s) commence on the start date specified in the relevant Order Form and continue for the subscription term specified in the Order Form.

Notwithstanding the Term set forth in the applicable Order Form, each Online Services subscription term shall be for 12 months, and Customer, subject to availability of funds and/or budget approval may be renewed annually upon expiration of prior subscription term, by issuing a purchase order upon receipt of an invoice for Online Services for each annual subscription term. It is expressly agreed that neither party shall activate this non-appropriation provision for its convenience or to circumvent the requirement of this Agreement, but only as an emergency fiscal measure.

10.3 Termination for Cause. A party may terminate the

Agreement for cause: (a) upon ninety (90) days written notice of a material breach to the other party if the breach remains uncured at the expiration of the cure period (except that Customer’s failure to cure an outstanding payment shall have a thirty (30) day cure period); or (b) if the other party becomes the subject of a petition in bankruptcy or any other proceeding relating to insolvency, receivership, liquidation or assignment for the benefit of creditors. Upon any termination for cause by Customer, HealthStream shall refund Customer any prepaid fees for Service(s) for the remainder of the User subscription term after the date of termination. Termination shall not relieve Customer of the obligation to pay any fees accrued or payable to HealthStream prior to the effective date of termination.

10.4 Surviving Provisions. The following provisions shall survive any termination or expiration of this Agreement: Sections 4, 5, 6, 7, 8, 9, 10 and 11.

11. General Provisions.

11.1 Relationship of the Parties; Publicity. This Agreement

does not create a partnership, franchise, joint venture, agency, fiduciary or employment relationship between the parties. There are no third-party beneficiaries to this Agreement. Neither party may issue press releases relating to this Agreement without the other party's prior written consent.

Either party may include the name and logo of the other party in lists of customers or vendors in accordance with the other party's standard guidelines.

11.2 Notices. All notices required hereunder shall be in writing and shall be deemed to have been duly given upon receipt, and shall be either delivered in person, by registered or certified mail, postage prepaid, return receipt requested, or by overnight delivery service with proof of delivery. Notices to HealthStream shall be addressed to the attention of its Legal Department.

11.3 Waiver and Cumulative Remedies; Severability. No failure or delay by either party in exercising any right under this Agreement shall constitute a waiver of that right. Other than as expressly stated in this Agreement, the remedies provided in the Agreement are in addition to, and not exclusive of, any other remedies of a party at law or in equity. If any provision of this Agreement is held by a court of competent jurisdiction to be contrary to law, the provision shall be modified by the court and interpreted so as best to accomplish the objectives of the original provision to the fullest extent permitted by law, and the remaining provisions of this Agreement shall remain in effect.

11.4 Assignment. Neither party may assign any of its rights or obligations under this Agreement, whether by operation of law or otherwise, without the prior express written consent of the other party.

Notwithstanding the foregoing, either party may assign this Agreement together with all rights and obligations under this Agreement, without consent of the other party, in connection with a merger, equity purchase, acquisition, corporate reorganization, or sale of all or substantially all of its assets. Any attempt by a party to assign its rights or obligations under this Agreement in breach of this section shall be void and of no effect.

Subject to the foregoing, this Agreement shall bind and inure to the benefit of the parties, their respective successors and permitted assigns.

11.5 Attorney’s Fees. Should either party hereto institute any action or proceeding to enforce any provision of this Agreement or for any damages by reason of default under any representation, warranty or covenant set forth in this Agreement, or for a declaration of such party’s rights or obligations under this Agreement or for any other judicial remedy, the party to whose favor final judgment is entered is entitled to receive from the losing party such amount as the court may judge to be reasonable attorneys’ fees for services rendered to the prevailing party.

11.6 Entire Agreement. This Agreement, including all

attachments, exhibits, and addenda to this Agreement and all Order Forms signed under this Agreement, constitutes the entire agreement between the parties, and supersedes all prior and contemporaneous agreements, proposals or representations, written or oral, concerning its subject matter. No modification, amendment, or waiver of any provision of this Agreement shall be effective unless in writing and signed by both parties. In the event of any conflict between the provisions in this Agreement and any attachment, exhibit, or addendum to this Agreement, or Order Form signed under this Agreement, the terms of the attachment, exhibit, addendum or Order Form shall prevail to the extent of any inconsistency. Notwithstanding any language to the contrary therein, no terms or conditions stated in a Customer purchase order or in any other Customer order documentation (excluding Order Forms, shall be incorporated into or form any part of this Agreement, and all such terms or conditions shall be null and void, and any claim made by the Customer regarding the products purchased under an Order Form that may be brought against HealthStream would be subject to the terms in this Agreement.. This Agreement may be executed in counterparts, which taken together shall form one legal instrument.

11.7 Books and Records. If required by applicable law, the

parties agree that until the expiration of four years after the furnishing of services under this Agreement, HealthStream will make available to the Secretary of the United States Department of Health and Human Services (the "Secretary") and the United States Comptroller General (the "Comptroller") and their duly authorized representatives, this Agreement and all books, documents and records necessary to certify the nature and intent of the costs of the goods and services provided under this Agreement. If HealthStream carries out any of its duties under this Agreement through a subcontract with a related organization, HealthStream will cause, if required by applicable law, such subcontract to contain a clause affording the Secretary, the Comptroller and their duly authorized representatives similar access to such subcontract and all books, documents and records of the related organization necessary to certify the nature and intent of the costs of the goods and services provided under such subcontract on behalf of Customer. No attorney-client, accountant-client or other legal provision is be deemed to have been waived by the parties by virtue of this provision.

11.8 FERPA. To the extent HealthStream may have access to

“education records” from Customer (as that term is defined by the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. 1232g, et seq and regulations promulgated thereunder (“Education Records”), HealthStream agrees that is deemed a “school official” under FERPA.

HealthStream agrees to comply with the requirements of FERPA when handling student information and will promptly notify Customer if HealthStream experiences an actual security breach relating to student information. If any person(s) seek to access Education Records, whether in accordance with FERPA or other federal or state laws or regulations, HealthStream will promptly inform Customer of such request in writing if allowed by law or judicial or administrative order.

11.9 Fair Credit Reporting Act (FCRA). If applicable, Customer hereby authorizes HealthStream to act as its authorized representative to independently verify all information regarding a User’s credentials and qualifications from original sources, designated equivalent sources when a primary source designates another organization as its agent or from entities that maintain specific credentials information identical to the information of the primary source and to provide such information to the Customer on the User’s behalf. Customer will have the sole responsibility for making determinations as to whether the User will be granted membership and/or privileges with the Customer. The Customer has the responsibility to review User Credentialing Information and to immediately report to HealthStream any non-compliant verifications. To the extent that FCRA applies, Customer certifies that it has taken or will take timely all appropriate steps to comply with the requirements of the FCRA, which shall include but not be limited to: (i) Confirming it has a Permissible Purpose for which the Consumer Information will be used and that such information will not be used for any other purpose; (ii) Certifying that it is a verified entity that is permitted to do business for the Permissible Purpose for which the Consumer Information is provided; (iii) Confirming that it has (a) obtained written authorization from the individual whose Consumer Information is being requested; (b) provided the individual the required FCRA disclosure in writing; (c) notifying the individual that the Consumer Information requested for employment purposes will be used only for lawful purposes; and (iv) For purposes of this FCRA compliance certification, all capitalized terms shall have the same meaning as in the FCRA.

11.10 Security Program. The parties shall comply with the

Security Program as defined and outlined in the attached Exhibit B (DSHS Data Security Requirements), and Exhibit C (DSHS Business Associate Agreement) in compliance with HIPAA.

IN WITNESS WHEREOF, and intending to be legally bound hereby, each party hereto warrants and represents that this Agreement has been duly authorized by all necessary corporate action and that this Agreement has been duly executed by and constitutes a valid and binding agreement of that party.

By:

{{Sig_es_:signer1:signature}}

Print Name:

{{*Name1_es_:signer1:fullname}}

Title

{{*Ttl1_es_:signer1:title}}

Date

{{Dte_es_:signer1:date}}

Washington State Department of Social & Health Services

By:

{{Sig_es_:signer2:signature}}

Print Name:

{{*Name2_es_:signer2:fullname}}

Title

{{*Ttl2_es_:signer2:title}}

Date

{{Dte_es_:signer2:date}}

500 11th Ave N, Nashville, TN 37203 CONFIDENTIAL 6

EXHIBIT A

Authorized Purchasing Entities

To be listed by the Customer, these are entities authorized to enter into Order Forms and bind Customer under this Agreement.

EXHIBIT B

DSHS Data Security Requirements

1. Definitions. The words and phrases listed below, as used in this Exhibit, shall each have the following definitions:

a. “AES” means the Advanced Encryption Standard, a specification of Federal Information Processing Standards Publications for the encryption of electronic data issued by the National Institute of Standards and Technology (http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf).

b. “Authorized Users(s)” means an individual or individuals with a business need to access DSHS Confidential Information, and who has or have been authorized to do so.

c. “Business Associate Agreement” means an agreement between DSHS and a contractor who is receiving Data covered under the Privacy and Security Rules of the Health Insurance Portability and Accountability Act of 1996. The agreement establishes permitted and required uses and disclosures of protected health information (PHI) in accordance with HIPAA requirements and provides obligations for business associates to safeguard the information.

d. “Category 4 Data” is data that is confidential and requires special handling due to statutes or regulations that require especially strict protection of the data and from which especially serious consequences may arise in the event of any compromise of such data. Data classified as Category 4 includes but is not limited to data protected by: the Health Insurance Portability and Accountability Act (HIPAA), Pub. L. 104-191 as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH), 45 CFR Parts 160 and 164; the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. §1232g; 34 CFR Part 99; Internal Revenue Service Publication 1075 (https://www.irs.gov/pub/irs-pdf/p1075.pdf); Substance Abuse and Mental Health Services Administration regulations on Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2; and/or Criminal Justice Information Services, 28 CFR Part 20.

e. “Cloud” means data storage on servers hosted by an entity other than the Contractor and on a network outside the control of the Contractor. Physical storage of data in the cloud typically spans multiple servers and often multiple locations. Cloud storage can be divided between consumer grade storage for personal files and enterprise grade for companies and governmental entities. Examples of consumer grade storage would include iTunes, Dropbox, Box.com, and many other entities. Enterprise cloud vendors include Microsoft Azure, Amazon Web Services, and Rackspace.

f. “Encrypt” means to encode Confidential Information into a format that can only be read by those possessing a “key”; a password, digital certificate or other mechanism available only to authorized users. Encryption must use a key length of at least 256 bits for symmetric keys, or 2048 bits for asymmetric keys. When a symmetric key is used, the Advanced Encryption Standard (AES) must be used if available.

g. “FedRAMP” means the Federal Risk and Authorization Management Program (see www.fedramp.gov), which is an assessment and authorization process that federal government agencies have been directed to use to ensure security is in place when accessing Cloud computing products and services.

h. “Hardened Password” means a string of at least eight characters containing at least three of the following four character classes:

Uppercase alphabetic, lowercase alphabetic, numeral, and special characters such as an asterisk, ampersand, or exclamation point.

i. “Mobile Device” means a computing device, typically smaller than a notebook, which runs a mobile operating system, such as iOS, Android, or Windows Phone. Mobile Devices include smart phones, most tablets, and other form factors.

j. “Multi-factor Authentication” means controlling access to computers and other IT resources by requiring two or more pieces of evidence that the user is who they claim to be. These pieces of evidence consist of something the user knows, such as a password or PIN; something the user has such as a key card, smart card, or physical token; and something the user is, a biometric identifier such as a fingerprint, facial scan, or retinal scan. “PIN” means a personal identification number, a series of numbers which act as a password for a device. Since PINs are typically only four to six characters, PINs are usually used in conjunction with another factor of authentication, such as a fingerprint.

k. “Portable Device” means any computing device with a small form factor, designed to be transported from place to place. Portable devices are primarily battery powered devices with base computing resources in the form of a processor, memory, storage, and network access. Examples include, but are not limited to, mobile phones, tablets, and laptops. Mobile Device is a subset of Portable Device.

l. “Portable Media” means any machine readable media that may routinely be stored or moved independently of computing devices.

Examples include magnetic tapes, optical discs (CDs or DVDs), flash memory (thumb drive) devices, external hard drives, and internal hard drives that have been removed from a computing device.

m. “Secure Area” means an area to which only authorized representatives of the entity possessing the Confidential Information have access, and access is controlled through use of a key, card key, combination lock, or comparable mechanism. Secure Areas may include buildings, rooms or locked storage containers (such as a filing cabinet or desk drawer) within a room, as long as access to the Confidential Information is not available to unauthorized personnel. In otherwise Secure Areas, such as an office with restricted access, the Data must be secured in such a way as to prevent access by non-authorized staff such as janitorial or facility security staff, when authorized Contractor staff are not present to ensure that non-authorized staff cannot access it.

n. “Trusted Network” means a network operated and maintained by the Contractor, which includes security controls sufficient to protect DSHS Data on that network. Controls would include a firewall between any other networks, access control lists on networking devices such as routers and switches, and other such mechanisms which protect the confidentiality, integrity, and availability of the Data.

o. “Unique User ID” means a string of characters that identifies a specific user and which, in conjunction with a password, passphrase or other mechanism, authenticates a user to an information system.

2. Authority. The security requirements described in this document reflect the applicable requirements of Standard 141.10 (https://ocio.wa.gov/policies) of the Office of the Chief Information Officer for the state of Washington, and of the DSHS Information Security Policy and Standards Manual. Reference material related to these requirements can be found here:

https://www.dshs.wa.gov/ffa/keeping-dshs-client-information-private-and-secure, which is a site developed by the DSHS Information Security Office and hosted by DSHS Central Contracts and Legal Services.

3. Administrative Controls. The Contractor must have the following controls in place:

a. A documented security policy governing the secure use of its computer network and systems, and which defines sanctions that may be applied to Contractor staff for violating that policy.

b. If the Data shared under this agreement is classified as Category 4, the Contractor must be aware of and compliant with the applicable legal or regulatory requirements for that Category 4 Data.

c. If Confidential Information shared under this agreement is classified as Category 4, the Contractor must have a documented risk assessment for the system(s) housing the Category 4 Data.

4. Authorization, Authentication, and Access. In order to ensure that access to the Data is limited to authorized staff, the Contractor must:

a. Have documented policies and procedures governing access to systems with the shared Data.

b. Restrict access through administrative, physical, and technical controls to authorized staff.

c. Ensure that user accounts are unique and that any given user account logon ID and password combination is known only to the one employee to whom that account is assigned. For purposes of non-repudiation, it must always be possible to determine which employee performed a given action on a system housing the Data based solely on the logon ID used to perform the action.

d. Ensure that only authorized users are capable of accessing the Data.

e. Ensure that an employee’s access to the Data is removed immediately:

(1) Upon suspected compromise of the user credentials.

(2) When their employment, or the contract under which the Data is made available to them, is terminated.

(3) When they no longer need access to the Data to fulfill the requirements of the contract.

f. Have a process to periodically review and verify that only authorized users have access to systems containing DSHS Confidential Information.

g. When accessing the Data from within the Contractor’s network (the Data stays within the Contractor’s network at all times), enforce password and logon requirements for users within the Contractor’s network, including:

(1) A minimum length of 8 characters and containing at least three of the following character classes: uppercase letters, lowercase letters, numerals, and special characters such as an asterisk, ampersand, or exclamation point.

(2) That a password does not contain a user’s name, logon ID, or any form of their full name.

https://ocio.wa.gov/policies https://www.dshs.wa.gov/ffa/keeping-dshs-client-information-private-and-secure

(3) That a password does not consist of a single dictionary word. A password may be formed as a passphrase which consists of multiple dictionary words.

(4) That passwords are significantly different from the previous four passwords. Passwords that increment by simply adding a number are not considered significantly different.

h. When accessing Confidential Information from an external location (the Data will traverse the Internet or otherwise travel outside the Contractor’s network), mitigate risk and enforce password and logon requirements for users by employing measures including:

(1) Ensuring mitigations applied to the system don’t allow end-user modification.

(2) Not allowing the use of dial-up connections.

(3) Using industry standard protocols and solutions for remote access. Examples would include RADIUS and Citrix.

(4) Encrypting all remote access traffic from the external workstation to Trusted Network or to a component within the Trusted Network. The traffic must be encrypted at all times while traversing any network, including the Internet, which is not a Trusted Network.

(5) Ensuring that the remote access system prompts for re-authentication or performs automated session termination after no more than 30 minutes of inactivity.

(6) Ensuring use of Multi-factor Authentication to connect from the external end point to the internal end point,

i. Passwords or PIN codes may meet a lesser standard if used in conjunction with another authentication mechanism, such as a biometric (fingerprint, face recognition, iris scan) or token (software, hardware, smart card, etc.) in that case:

(1) The PIN or password must be at least 5 letters or numbers when used in conjunction with at least one other authentication factor

(2) Must not be comprised of all the same letter or number (11111, 22222, aaaaa, would not be acceptable)

(3) Must not contain a “run” of three or more consecutive numbers (12398, 98743 would not be acceptable)

j. If the contract specifically allows for the storage of Confidential Information on a Mobile Device, passcodes used on the device must:

(1) Be a minimum of six alphanumeric characters.

(2) Contain at least three unique character classes (upper case, lower case, letter, number).

(3) Not contain more than a three consecutive character run. Passcodes consisting of 12345, or abcd12 would not be acceptable.

k. Render the device unusable after a maximum of 10 failed logon attempts.

5. Protection of Data. The Contractor agrees to store Data on one or more of the following media and protect the Data as described:

a. Hard disk drives. For Data stored on local workstation hard disks, access to the Data will be restricted to Authorized User(s) by requiring logon to the local workstation using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards.

b. Network server disks. For Data stored on hard disks mounted on network servers and made available through shared folders, access to the Data will be restricted to Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User ID and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on disks mounted to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism.

For DSHS Confidential Information stored on…