CN-680000-AA408.pdf

Agreement No. AA408

STATE OF FLORIDA

AGENCY FOR HEALTH CARE ADMINISTRATION

AGENCY AGREEMENT

AHCA Agreement No. AA408, Page 1 of 9 AHCA Form 2100-0062 (DEC 2018)

In exchange for the mutual promises contained herein, this Agreement is entered into between the State of Florida, AGENCY FOR HEALTH CARE ADMINISTRATION, hereinafter referred to as the “Agency”, whose address is 2727 Mahan Drive, Tallahassee, Florida 32308, and AUDACIOUS INQUIRY LLC (Ai) hereinafter referred to as the “Vendor”, whose address is 5523 Research Park Drive, Suite 370, Baltimore, Maryland 21228, to provide Patient Unified Lookup System for the COVID-19 Pandemic (PULSE COVID).

I. OVERVIEW/PURPOSE

Solution to assist in supporting public health surveillance and provide well-informed care in non-routine settings. The Agency, in collaboration with Florida’s Department of Health (Florida Health) are seeking to improve clinical case augmentation, surveillance capabilities, and demographic data quality for known and suspected cases of COVID-19.

II. LEGAL AUTHORITY

This Agreement is governed by the following legal authority:

A. State of Florida, Office of the Governor, Executive Order Number 20-52

(Emergency Management – COVID-19 Public Health Emergency); and

B. Section 252.38, Florida Statutes – Emergency management powers of political subdivisions.

III. DEFINITIONS

Administrator(s): Agency designee(s) that have authorized and credentialed access to PULSE COVID and is responsible for submitting lists of Verified Users to the Vendor for credentialing. The Administrator(s) will also be responsible for sharing spreadsheets for Bulk Queries to the Vendor.

“Bulk” Query Service: by submitting a spreadsheet, PULSE COVID can gather relevant documents for tens to hundreds of individuals and return them securely to public health authorities and clinical providers.

Clinical Case Augmentation: when patients present to alternative care sites, emergency responders are able to retrieve historical clinical data on those patients to support the current assessment and treatment of those patients.

Clinical Providers: private or public physicians and nurses that have authorized and credentialed access to PULSE COVID.

Clinical Search Portal: end users that have authorized and credentialed access to PULSE COVID can log into a webpage, search for patient records, and receive a list of patient’s clinical documents or be provided an organized list of patient records for “bulk” queries via an Administrator.

HIPAA Regulations: the Standards for Privacy of Individually Identifiable Health Information and the Security Standards for the Protection of Electronic Protected Health

DocuSign Envelope ID: 24F08671-9BD7-420D-8D31-13314A641F58

AHCA Agreement No. AA408, Page 2 of 9

Information (45 CFR Parts 160, 162 and 164) promulgated by the U.S. Department of Health and Human Services under the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the Health Information Technology for Economic and Clinical Health Act (the HITECH Act) of the American Recovery and Reinvestment Act of 2009, as in effect on the date of this Agreement and as may be amended, modified, or renumbered.

National Health Information Exchange Networks: the eHealth Exchange is the largest query-based health information network in the United States (U.S.). It is the principal network that connects all federal agencies and non-federal organizations as well as vendor led networks such as Commonwell, and Carequality.

Non-routine Care Settings: Type 1 alternative care sites, as defined by the State Emergency Response Team (SERT) Alternative Care Site Standard Operating Procedures, which serve to free up hospital space when a surge response level 3 or greater is activated.

Novel Coronavirus Disease 2019 (COVID-19): a severe acute respiratory illness that can spread among humans through respiratory transmission and presents with symptoms similar to those of influenza.

Public Health Emergency Responders: individuals designated by Florida Health to respond to emergencies. They can be sourced from the following list: hospital personnel, county health department personnel, Emergency Medical Services (EMS) personnel, private physicians and nurses, Medical Reserve Corps (MRC), community healthcare workers, specialized local and regional response teams, United States Public Health Service (USPHS) Commissioned Corps, National Disaster Medical System, United States Department of Veterans Affairs, and United States Department of Defense.

PULSE COVID: a web service that allows appropriately verified healthcare providers and public health personnel to find and view electronic patient health and medication histories from across national health information exchange networks. Authorized users can view clinical care documents that include medications, allergies, diagnoses, lab results, and other relevant information. This information can be used to augment clinical care, identify patient comorbidities, and fill in gaps related to patient health or demographic data. A more robust description of the PULSE COVID

Surveillance: involves the collection and analysis of population level health data;

investigation of acute outbreaks; and education and consultation to county, local, and private health agencies on infectious diseases.

Verified User: a Public Health emergency responder, Clinical Provider, or other public health representative, including Agency or Florida Health personnel, authorized by the Agency or Florida Health for the use of the PULSE COVID system to support emergency response efforts related to the COVID-19 State of Emergency.

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK

AHCA Agreement No. AA408, Page 3 of 9

IV. TERM

A. Term

This Agreement shall begin upon execution by all Parties and end on July 31, 2020, inclusive.

B. Renewal

In accordance with Section 287.057(13), Florida Statutes, this Agreement may be renewed for a period that may not exceed three (3) years or the term of the original Agreement, whichever period is longer. Renewal of the Agreement shall be in writing and subject to the same terms and conditions set forth in the initial Agreement. A renewal Agreement may not include any compensation for costs associated with the renewal. Renewals are optional and subject to the availability of funds.

C. Amendment

This Agreement may be amended upon written Agreement signed by both Parties.

D. Termination at will

This Agreement may be terminated by either Party upon no less than ten

(10) calendar day’s written notice, without cause, unless an alternative time is mutually agreed upon by both Parties. Said notice shall be delivered by certified mail, return receipt requested, or in person with proof of delivery.

V. MONETARY VALUE

There are no costs associated with this Agreement.

There will be no subscription, implementation, or integration fees charges to the Agency for the Vendor’s costs to enable and provide the PULSE COVID system and services during the terms of this agreement, for integration methods designated by the Vendor from time to time.

VI. CONTACT INFORMATION

A. The Agency’s Agreement Manager’s contact information is as follows:

Jaime Bustos Agency for Health Care Administration 2727 Mahan Drive, MS #16 Tallahassee, FL 32308

(850) 412-3740 Jaime.Bustos@ahca.myflorida.com mailto:Jaime.Bustos@ahca.myflorida.com

AHCA Agreement No. AA408, Page 4 of 9

B. The Audacious Inquiry Agreement Manager’s contact information is as follows:

Scott Afzal Audacious Inquiry, LLC 5523 Research Park Drive, Suite 370 Baltimore, MD 21228

(301) 560-6999 safzal@ainq.com

C. All matters pertaining to this Agreement shall be directed to the Agreement

Managers for appropriate action or disposition. A change in Agreement Manager by any Party shall be reduced to writing through an amendment to this Agreement by the Agency.

VII. SCOPE

A. Services Provided by the Agency

The Agency shall provide the following to facilitate the Vendor in meeting the requirements of this Agreement:

1. Monitoring and evaluation of the Vendor’s compliance with the requirements of this Agreement. The Agency reserves the right to request additional information in support of monitoring the Vendor’s performance to ensure compliance with the requirements of this Agreement.

2. Review of all deliverables submitted by the Vendor. The Agency reserves the right to approve, deny, or require revisions to any submitted deliverables.

3. Provide interpretation requested by the Vendor of any Agreement requirement. When an interpretation of this Agreement is sought, the Vendor shall submit a written request to the Agency’s Agreement Manager.

B. Services Provided by Vendor

The Vendor shall be responsible for the management, oversight, and support of services for the Florida PULSE COVID system. The PULSE COVID system shall be maintained and operate in a manner consistent with Attachment I, Agency Approved Additions to the Standard Agreement.

1. The Vendor shall make available the PULSE COVID system to the Agency or its designee(s). PULSE COVID availability shall include the following:

a. A query service that allows Verified Users (e.g., public health authorities and clinical providers) to find and view electronic patient health and medication histories from across national health information exchange networks;

mailto:safzal@ainq.com

AHCA Agreement No. AA408, Page 5 of 9

b. The ability for Verified Users to search for individual patient data using the clinical search portal, or for Administrator(s) to perform a “bulk” query to retrieve a list of individuals;

c. The ability for Verified Users to gain access and the ability to view clinical care documents which may include medications, allergies, diagnosis, lab results, and other relevant information to augment clinical care, identify patient comorbidities, and fill in gaps tied to patient health or demographic characteristics;

d. Training for Administrator(s) and Verified Users;

e. Customer service and technical support for issues regarding the access and use of PULSE COVID during normal operating hours.

Activities associated with customer service and technical support include but are not limited to:

1) Account creation and maintenance;

2) Troubleshooting access and login issues; and

3) Providing answers to questions related to access and use of PULSE COVID.

f. In the event the PULSE COVID system needs to be shut down for maintenance or updates, the Vendor shall notify the Agency at least forty-eight (48) hours prior to the system shut down; and

g. Should the access and/or proper use of the PULSE COVID system be jeopardized from unplanned or scheduled activities, the Vendor shall make reasonable effort to return the PULSE COVID system to a usable and secure state within forty-eight (48) hours.

AHCA Agreement No. AA408, Page 6 of 9

C. Deliverables

TABLE 1 – DELIVERABLE SCHEDULE

No. Deliverable Supporting Documentation Due Date

1.

Functional access and use of the PULSE COVID system to allow for:

Document searching and retrieval for patients in support of COVID-19 responses; and

The uploading of securely emailed patient demographics for processing when using the bulk query feature.

Documentation supporting the implementation of the PULSE COVID system shall include:

Weekly Activity Update;

Training Documentation;

Weekly Issues and Solutions Log, if applicable; and

System Use Recommendations to maximize benefits.

Initiation within seven

(7) business days of Agreement execution.

D. Incorporation of Documents

This Agreement incorporates the attached Attachment I, Agency Approved Additions to the Standard Agreement, and any other attachments, exhibits, and relevant statewide guidance, except to the extent that the Agreement explicitly provides to the contrary. In the event of conflict in language among any of the documents referenced, the specific provisions and requirements of this Agreement shall prevail over inconsistent provisions in other general materials not specific to this Agreement and identified attachments. This Agreement, including items incorporated herein, contains the entire understanding of the parties regarding the subject matter of this Agreement and supersedes all prior and contemporaneous negotiations and agreements, whether written or oral, between the parties with respect to its subject matter.

VIII. THE VENDOR HEREBY AGREES:

A. Vendor Monitoring

The Agency shall create a Vendor monitoring checklist and shall complete applicable checklist items upon review of documents, monthly status reports, and other supporting documents as may be reasonably required by the Agency to ensure satisfactory Vendor performance.

B. Limited Waiver of HIPAA Sanctions and Penalties

1. Upon declaration of a State of Emergency, and issuance of an applicable Department of Health & Human Services (HHS) Limited Waiver of HIPAA Sanctions, data use within the PULSE COVID system is retained for emergency response purposes.

AHCA Agreement No. AA408, Page 7 of 9

2. March 2020: COVID-19 & HIPAA Bulletin Limited Waiver of HIPAA

Sanctions and Penalties During a National Health Emergency is hereby incorporated by reference (https://www.hhs.gov/sites/default/files/hipaa-and-covid-19-limited-hipaa-waiver-bulletin-508.pdf).

C. Confidentiality of Information

1. To not use or disclose any confidential information, including social security numbers that may be supplied under this Agreement pursuant to law, and also including the identity or identifying information concerning a Medicaid recipient or services under this Agreement for any purpose not in conformity with State and Federal laws, except upon written consent of the recipient, or his/her guardian.

2. That all personally identifiable information, including Medicaid information, obtained by the Vendor shall be treated as privileged and confidential information and shall be used only as authorized for purposes directly related to the administration of this Agreement. The Vendor must have a process that specifies that patient-specific information remains confidential, is used solely for the purposes of data analysis or the Vendor’s responsibilities under this Agreement, and is exchanged only for the purpose of conducting a review or other duties outlined in this Agreement.

3. All patient-specific information received by the Vendor can be shared only with those agencies that have legal authority to receive such information and cannot be otherwise transmitted for any purpose other than those for which the Vendor is retained by the Agency. The Vendor must have in place written confidentiality policies and procedures to ensure confidentiality and to comply with all Federal and State laws (including the HIPAA and HITECH Acts) governing confidentiality, including electronic treatment records, facsimile mail, and electronic mail).

4. All subcontracts must explicitly state expectations about the confidentiality of information, and the subcontractor is held to the same confidentiality requirements as the Vendor. If provider-specific data are released to the public, the Vendor shall have policies and procedures for exercising due care in compiling and releasing such data that address statutory protections of quality assurance and confidentiality while assuring that open records requirements of Chapter 119, F.S., are met.

5. The Vendor and its subcontractors shall comply with the requirements of

Section 501.171, F.S. and shall, in addition to the reporting requirements therein, report to the Agency any breach of personal information.

6. Any releases of information to the media, the public, or other entities require prior approval from the Agency.

DocuSign Envelope ID: 24F08671-9BD7-420D-8D31-13314A641F58 https://www.hhs.gov/sites/default/files/hipaa-and-covid-19-limited-hipaa-waiver-bulletin-508.pdf https://www.hhs.gov/sites/default/files/hipaa-and-covid-19-limited-hipaa-waiver-bulletin-508.pdf

AHCA Agreement No. AA408, Page 8 of 9

7. Ensure all services will be performed within the borders of the United

States and its territories and protectorates.

8. State-owned Data shall be processed, accessed and stored in data centers that are located only in the forty-eight (48) contiguous U.S.

D. Public Records Requests

1. To comply with Section 119.0701, F.S., if applicable, and all other applicable parts of the Florida Public Records Act.

2. To keep and maintain public records that ordinarily and necessarily would be required in order to perform services under this Agreement.

3. To provide the public with access to public records on the same terms and conditions that the Agency would provide the records and at a cost that does not exceed the cost provided in Section 119.07, F.S., or as otherwise provided by law.

4. That upon request from the appropriate Agency custodian of public records, provide the Agency with a copy of the requested records or allow the records to be inspected or copied within a reasonable time at a cost that does not exceed the cost in Section 119.07, F.S., or as otherwise provided by law.

5. To ensure that public records that are exempt or confidential and exempt from public records disclosure requirements are not disclosed except as authorized by law for the duration of this Agreement term and following completion of this Agreement if the Party does not transfer the records to the Agency.

6. To not collect an individual’s social security number unless the Vendor has stated in writing the purpose for its collection. The Vendor collecting an individual’s social security number shall provide a copy of the written statement to the Agency and otherwise comply with applicable portions of Section 119.071(5), F.S.

7. To meet all requirements for retaining public records and transfer, at no cost, to the Agency all public records in possession of the Vendor upon termination of this Agreement and destroy any duplicate public records that are exempt or confidential and exempt from public records disclosure requirements. All records stored electronically must be provided to the Agency in a format that is compatible with the information technology systems of the Agency.

8. If the Vendor does not comply with a public records request, the Agency shall enforce Agreement provisions in accordance with this Agreement.

AHCA Agreement No. AA408, Page 9 of 9

9. IF THE VENDOR HAS QUESTIONS REGARDING THE

APPLICATION OF CHAPTER 119, FLORIDA STATUTES, TO THE

PARTY’S DUTY TO PROVIDE PUBLIC RECORDS RELATING TO

THIS AGREEMENT, CONTACT THE AGENCY CUSTODIAN OF

PUBLIC RECORDS FOR THIS AGREEMENT. THE AGENCY

CUSTODIAN OF PUBLIC RECORDS FOR THIS AGREEMENT IS

THE AGREEMENT MANAGER.

IN WITNESS THEREOF, the Parties hereto have caused this twenty-three (23) page Agreement, which includes any referenced attachments, to be executed by their undersigned officials as duly authorized. This Agreement is not valid until signed and dated by all Parties.

AUDACIOUS INQUIRY LLC. STATE OF FLORIDA, AGENCY FOR

HEALTH CARE ADMINISTRATION

SIGNED

BY:

SIGNED BY:

NAME: NAME:

TITLE: TITLE:

DATE: DATE:

List of Attachments included as part of this Agreement:

Specify Type Letter/

Description Number

Attachment I Agency Approved Additions to the Standard Agreement (10 Pages) Attachment II Business Associate Agreement (4 Pages)

President

April 20, 2020

Scott Afzal

April 21, 2020

James C. Miller

Chief Strategic Officer

ATTACHMENT I

AGENCY APPROVED ADDITIONS TO THE STANDARD AGREEMENT

AHCA Agreement No. AA408, Attachment I, Page 1 of 9

These PULSE COVID Subscription Terms (“Subscription Terms”) and scope of work operate as Attachment I, Agency Approved Additions to the Standard Agreement, and govern the PULSE COVID Services provided by Audacious Inquiry, LLC (“Ai”) under the Subscription Order (“Order”) agreed between Ai and the Florida Agency for Health Care Administration (“Subscriber”) into which these Subscription Terms are incorporated.

I. DEFINITIONS

Data - all health data transmitted or received by Subscriber, a User, or a Data Source through the PULSE COVID Services

Data Source - a health care facility or other data source that provides Data to the PULSE COVID Services. A Data Source may or may not also be a Subscriber

DURSA - Restatement II of the Data Use and Reciprocal Support Agreement, currently available at https://ehealthexchange.org/wp- content/uploads/2019/11/DURSA- Restatement-II-of-the-DURSA-revised-August-13-2019- EXECUTABLE.pdf

Law - any applicable federal or state statute, law, ordinance, regulation, rule, code, order, constitution, treaty, or legal requirement

Malicious Code - any software, hardware or other technologies, devices, or means, which is objectively designed to: (i) permit unauthorized access to, or to destroy, disrupt, disable, distort, or otherwise harm or impede in any manner, and (ii) any computer, software, firmware, hardware, system or network, and includes any virus, Trojan horse, worm, backdoor, or other malware

Order - an order for PULSE COVID Services that has been accepted by Ai

Person - an individual, corporation, partnership, joint venture, limited liability company, governmental authority, unincorporated organization, trust, association, or other entity

PULSE COVID Services - the software-as-a-service solution and platform described in the Order

Services Term - the term of Subscriber’s subscription to the PULSE COVID Services as set forth in the Order

Subscriber - the Subscriber identified in the Order

Users - all eligible Persons authorized by Subscriber pursuant to these Subscription Terms and the applicable Order(s) to send, receive, or exchange Data through the PULSE COVID Services. Users may include clinical providers with valid national provider identifier, public health authorities that are authorized by law to collect or receive PHI for the purpose of preventing or controlling disease, injury or disability, persons or entities acting under a grant of authority from or under contract with such public health agency or authority, and agencies and public officials who need PHI to deal effectively with a threat or emergency and protect the health of the public (e.g., a food-borne outbreak)

DocuSign Envelope ID: 24F08671-9BD7-420D-8D31-13314A641F58 https://ehealthexchange.org/wp-%20content/uploads/2019/11/DURSA-Restatement-II-of-the-DURSA-revised-August-13-2019-%20EXECUTABLE.pdf https://ehealthexchange.org/wp-%20content/uploads/2019/11/DURSA-Restatement-II-of-the-DURSA-revised-August-13-2019-%20EXECUTABLE.pdf

AHCA Agreement No. AA408, Attachment I, Page 2 of 10

II. SCOPE

This version of PULSE is a solution that leverages existing Ai products and Ai PULSE backend infrastructure to provide basic, ad hoc queries over the national health information exchange networks. The solution is hosted in Amazon Web Services (AWS) to enable quick and easy deployment to multiple states.

A. Bulk Query Service

1. The Vendor shall provide a Bulk Query Service Process Document will be provided to the Agency which will include process details on how the bulk query service may be deployed if this feature is utilized.

a. An example of what would be included in a process document:

• Panels: Approximately one hundred to one thousand (~100-

1,000) patients per day, includes Name, Date of Birth, Gender, Address, City, State, and Zip Code.

• Verified User Bulk Query: each patient on the panel will be sent by the organization to Ai as an individual query using a Hypertext Transfer Protocol Secure (HTTPS) Power On Self Test (POST) with a JavaScript Object Notation (JSON) payload (see transaction examples below). Ai will perform acknowledgment with a Transaction Identifier.

• Ai Queries: Ai will construct queries for each patient on the eHealth Exchange (eHX) national networks and will retrieve the latest Consolidated Clinical Document Architecture (CCDA) document(s) from each eHX organization that successfully matches with the patient demographics.

• Ai Response: Ai will POST the CCDA back to the organization, who will further process and return the CCDA’s to the Verified User. Ai will return the inbound Query transaction ID with the CCDA POST (but no other metadata).

2. Requirements and Assumptions

a. All queries will be made for the assumed purpose of

“TREATMENT”, “PUBLIC HEALTH”, or other permitted purposes.

b. The service will provide auditing metrics: number of Patient Requests, number of Patient Matches, and number of CCDAs returned.

c. The scope of the queries on the national network will default to the health care organizations within the state of Florida. Surrounding states’ connected health care organizations are available at the request of the Agency.

AHCA Agreement No. AA408, Attachment I, Page 3 of 10

B. Clinical Search Portal

1. Scope and Limitations

a. End users must be populated into PULSE COVID by Ai, given an approved list of Verified Users (e.g. clinical providers, public health professionals, etc.) by each state; there will be no single sign on (SSO) or manual user entry option available.

b. There is a maximum of five hundred (500) users.

c. No custom sources which are not currently on the national networks can be added for query.

d. The scope of the queries will be a fixed, regional set (and not customizable based on the patient’s address, current location, etc.).

e. Administrative tools and usage analytics will be limited to meet only basic HIPAA requirements by manual extraction.

f. There will be no search history or cached results (it is assumed users can re-run queries if needed).

g. In PULSE COVID, there is only one (1) active event (COVID-19 outbreak).

2. Requirements and Assumptions

a. All queries will be made for the purpose of “TREATMENT”, “PUBLIC HEALTH,” or other permitted purposes.

b. The service will provide auditing metrics: number of Patient

Requests, number of Patient Matches, and number of CCDAs returned.

c. The scope of the queries on the national network will default to connected health care organizations within the state of Florida.

Surrounding states’ nodes are available at the request of the Agency.

C. Onboarding

1. Bulk Query

For bulk query users of PULSE COVID: Expected onboarding time of seven

(7) days pending secure file delivery.

2. Individual Verified User

For individual users of PULSE COVID: Expected onboarding time of four

(4) days after the Agency Administrator(s) provides user verification.

AHCA Agreement No. AA408, Attachment I, Page 4 of 10

D. Supplemental Terms and Conditions

1. Orders

The terms and conditions of these Subscription Terms shall govern any orders for PULSE COVID Services issued by Subscriber pursuant to these Subscription Terms and accepted by Ai (“Orders”). No different or additional terms contained in any Subscriber purchase orders or similar ordering documents shall apply.

2. Subscription Rights

Ai grants Subscriber a non-exclusive, non-transferable right to access and use the PULSE COVID Services through the designated online site(s) during the Services Term, subject to the terms and conditions of these Subscription Terms and to any usage metrics and other limitations set forth in the applicable Order, and to authorize its Users to do so, subject to Section II of this Attachment.

3. Terms of Use

As a condition of the grant of authority to Subscriber to grant rights to Users as set forth in Section II of this Attachment subscriber agrees that all Users granted access to the PULSE COVID Services shall be required as part of their user registration process, to accept the individual Terms of Use before accessing the PULSE COVID system.

4. Nationwide Network Flow-downs

Subscriber and its Users shall comply with terms and conditions of national networks in order to initiate queries through Ai to those networks. With respect to queries to be made through the eHealth Exchange, Subscriber and Users will comply with the terms and conditions of the then-current DURSA. The DURSA in effect as of the Effective Date may be found at https://ehealthexchange.org/wp-content/uploads/2019/11/DURSA- Restatement-II-of-the-DURSA-revised-August-13-2019- EXECUTABLE.pdf.

5. Policies and Procedures

Ai, in consultation with relevant agencies, will establish policies and procedures (“Policies”) for the PULSE COVID Services. The Policies will contain eligibility standards, technical specifications, other operational elements of the PULSE COVID Services as provided to subscribers generally, and terms reflecting the policies, procedures, standards, and requirements of relevant networks and Data Sources. Subscriber and its Users will comply with the Policies and Procedures to the extent that they do not conflict with applicable law.

https://ehealthexchange.org/wp-content/uploads/2019/11/DURSA-Restatement-II-of-the-DURSA-revised-August-13-2019-EXECUTABLE.pdf https://ehealthexchange.org/wp-content/uploads/2019/11/DURSA-Restatement-II-of-the-DURSA-revised-August-13-2019-EXECUTABLE.pdf https://ehealthexchange.org/wp-content/uploads/2019/11/DURSA-Restatement-II-of-the-DURSA-revised-August-13-2019-EXECUTABLE.pdf

AHCA Agreement No. AA408, Attachment I, Page 5 of 10

6. Data Ownership and Use

As between Ai and Subscriber (and Subscriber’s Users) all Data is owned by Subscriber, Users, and Data Sources as applicable, and Ai has no right of ownership therein. Subject to the terms and conditions of these Subscription Terms, including the Business Associate Agreement attached as Attachment 8 to the DURSA, Subscriber and its Users grant Ai a limited, royalty-free, fully-paid up, non-exclusive, non-transferable, non-sublicensable license during the Term to use, process, and disclose Data received from Subscriber or Users in order to provide PULSE COVID Services in accordance with these Subscription Terms.

III. FEES

PULSE COVID implementation and subscription fees will be waived during the Service Term.

IV. INDEPENDENT CONTRACTOR

Ai will be an independent contractor of Subscriber. As such, neither Ai nor any employee of Ai is an officer or an employee of Subscriber. Neither Party has, nor shall it have, any capacity or authority to act on behalf of or to bind the other Party in any way whatsoever.

V. REPRESENTATIONS, WARRANTIES, AND COVENANTS

A. Limited Warranties

Ai represents, warrants, and covenants to Subscriber that:

1. Ai has, and throughout the Term and any additional periods during which

Ai does or is required to perform the Services will have, the right, power, and authority, including all permits and licenses required, to provide the PULSE COVID Services and grant and perform all rights and licenses granted or required to be granted by it under these Subscription Terms;

2. Ai will make commercially reasonable efforts to assure that the PULSE

COVID Services are and will remain free of Malicious Code; provided that this warranty does not extend to any Malicious Code transmitted to Ai by Subscriber, a User, or a Data Source.

3. All PULSE COVID Services shall be performed in accordance with applicable state and federal Law, including without limitation, laws and regulations regarding the security and privacy of patient health information, including the federal Health Insurance Portability and Accountability Act of

1996 (“HIPAA”).

4. Neither Ai nor (to its knowledge) any of its employees or other personnel assigned to perform material Services under these Subscription Terms have been convicted of a criminal offense related to health care or have listed as debarred, excluded or otherwise ineligible for participation in

AHCA Agreement No. AA408, Attachment I, Page 6 of 10 federal health care programs. Ai shall promptly notify Subscriber if it becomes aware of the same.

B. No Other Warranties

Except for the express warranties set forth herein, the PULSE COVID Services are provided “as is”. Ai and its third-party partners, licensors, and providers hereby disclaim all express or implied warranties including but not limited to any implied warranties of merchantability, fitness for a particular purpose, title, non-infringement and quality. Ai and its third-party partners, licensors, and providers make no representations or warranties regarding the reliability, availability, timeliness, suitability, accuracy or completeness of the services or the results subscriber or users may obtain by using the services.

Without limiting the generality of the foregoing, Ai and its partners, licensors, and service providers do not represent or warrant that the operation or use of the PULSE COVID Services will be timely, uninterrupted or error-free. In particular, (i) Ai does not warrant against possible errors or mismatches when matching patient identities between disparate data sources, although Ai will use its best efforts to minimize “false positive” errors or mismatches that could result in inadvertent disclosures of phi, and (ii) Ai does not warrant against possible errors caused by self-pay patient encounters with users or the receipt and routing of sensitive health data subject to special protections, although Ai will use its best efforts to minimize such errors.

Subscriber acknowledges that neither Ai nor its partners, licensors, or service providers controls the transfer of data over communications facilities, including the internet, and that the PULSE COVID Services may be subject to limitations, delays, and other problems inherent in the use of such communications facilities.

Ai is not responsible for any delays, delivery failures, or other damage resulting from such problems.

VI. LIMITATIONS OF LIABILITY

A. No Indirect Damages

Neither party shall be liable under any contract, negligence, strict liability or other theory: (i) for error or interruption of use, inaccuracy or cost of procurement of substitute goods, service or technology or loss of business, data, profits or revenue; (ii) for any indirect, exemplary, punitive, incidental, special or consequential damages; (iii) for any matter beyond its reasonable control, however caused on any theory of liability and for any claims arising out of or related to this agreement or its subject matter, even if such party has been advised of the possibility of such loss or damage.

B. Maximum Liability

The cumulative maximum liability of Ai to Subscriber and its Users collectively for any and all claims, actions, proceedings, damages, and liabilities arising in connection with the Services, regardless of the number of occurrences or claims, shall be limited to the fees actually paid to Ai under the applicable Order.

AHCA Agreement No. AA408, Attachment I, Page 7 of 10

VII. INTELLECTUAL PROPERTY

A. Retained Ownership of IP Rights

Ai or its partners, licensors, or providers respectively shall (i) retain sole and exclusive rights in the PULSE COVID Services and in applications delivered or made available through the PULSE COVID Services, and in any modifications, improvements, and derivative works thereof, and (ii) Subscriber or Data Sources respectively shall retain sole and exclusive rights in the Data managed or transmitted using the PULSE COVID Services.

VIII. CONFIDENTIAL INFORMATION

A. Definition

Subscriber and Ai each acknowledge that the other Party is the owner of valuable trade secrets, know-how, and other proprietary and confidential information, including, without limitation, software, business plans and strategies. All such information described in this paragraph, as well as the terms and conditions of these Subscription Terms, shall hereinafter be referred to collectively as "Confidential Information." Confidential Information does not include information that: (i) is in the possession of the recipient free of any obligation of confidentiality at the time of its disclosure; (ii) is or becomes publicly known other than by a breach of this provision; (iii) is received without restriction from a non-Party free to disclose it; or (iv) is developed independently by the receiving Party without reference to or reliance on the Confidential Information.

B. Non-Disclosure

Each Party as a recipient of Confidential Information (“Recipient”) shall use the other’s (“Discloser’s”) Confidential Information only for purposes of performance or receipt of performance under the Agreement, and shall protect it from unauthorized disclosure using the same degree of care it uses for its own Confidential Information (but no less than a reasonable degree of care.) Neither Party as a Recipient may disclose the Discloser’s Confidential Information to any third party (other than its attorneys, contractors, investors, lenders, or insurers bound by confidentiality obligations no less stringent than those set forth herein) without the Discloser’s prior written consent, except as required by law or regulation provided that in the event of a compelled legal disclosure, the Recipient notifies the Discloser to enable the Discloser to take protective measures with respect to the disclosure of its Confidential Information. Such consent shall not be unreasonably withheld with respect to requested disclosure to a Recipient’s investors, lenders, contractors, or Subcontractors, provided that such persons are bound by confidentiality obligations no less stringent than those set forth herein.

Notwithstanding the foregoing, Subscriber may disclose such information to Users and Data Sources information necessary to effectuate these Subscription Terms, including but not limited to information necessary to on-board Users and Data Sources into the PULSE COVID Services.

AHCA Agreement No. AA408, Attachment I, Page 8 of 10

C. Protected Health Information

The Parties acknowledge that federal regulations relating to the confidentiality of individually identifiable health information require covered entities and their business associates to comply with the requirements of HIPAA and any other applicable state and federal confidentiality laws. Accordingly, in addition to any other confidentiality obligations hereunder, the Parties agree to comply with the terms of the Attachment II, Business Associate Agreement.

IX. TERMINATION

A. Termination/Non-Renewal for Convenience

Subscriber may terminate or non-renew the Order and its subscription to the PULSE-COVID Services at any time for its convenience, for any reason or no reason, upon ten (10) business days’ notice. Ai may terminate or non-renew the Order and Subscriber’s subscription to the PULSE COVID Services for its convenience, for any reason or no reason, effective on or after July 31, 2020. Ai may also suspend or terminate the Order and Subscriber’s subscription to the PULSE COVID Services immediately for cause, for any material breach of the Order or these Subscription Terms.

B. Effect of Termination

In the event of termination for any reason, all licenses, subscriptions, and rights of access granted hereunder or under the Order shall terminate, and Subscriber and its Users shall cease the use of all PULSE COVID Services.

C. Survival

The following provisions of this Agreement and incorporated documents, and any others that by their nature require performance after the expiration or termination of this Agreement and incorporated documents, shall survive expiration or termination: Section IV.D of the Agreement; and Sections II.D.7, VI through VIII, IX.B, IX.C, X.B through X.L of this Attachment.

X. GENERAL

A. Insurance

Ai will maintain general liability insurance with a general aggregate limited of not less than $2 million. Ai will maintain Errors and Omissions Insurance with an event limit of not less than $2 million. Ai will maintain Cyber Liability insurance with an event limit of not less than $2 million per occurrence and $2 million aggregate. Ai will ensure that its employees and agents performing services hereunder are covered by workers’ compensation insurance.

B. Assignment

Neither Party may assign any rights or obligations under these Subscription Terms to any person without the prior written consent of the other Party, except to an

AHCA Agreement No. AA408, Attachment I, Page 9 of 10

Affiliate of such Party or to a successor by merger, acquisition, or sale of substantially all of such Party’s business or assets. “Affiliate” means any company, partnership or other entity which directly or indirectly controls, is controlled by, or is under common control with such Party. For purposes of this definition, “control” means the beneficial ownership of more than fifty percent (50%) of the issued voting shares or the legal power to direct or cause the direction of the general management of the entity. Ai may subcontract the performance of Services, but shall remain responsible for the acts and omissions of its subcontractors as though they were acts or omissions of Ai itself.

C. Binding Effect

These Subscription Terms will be binding on the Parties and their respective heirs, personal representatives, successors, and permitted assigns, and will inure to their benefit.

D. Waiver

No waiver will be binding on a Party unless it is in writing and signed by the Party making the waiver. A Party’s waiver of a breach of a provision of these Subscription Terms will not be a waiver of any other provision or a waiver of a subsequent breach of the same provision.

E. Notices

All notices or other communications required or permitted by these Subscription Terms shall be in writing. Delivery can be made in person, by overnight courier of national repute, or by registered or certified mail, with return receipt requested, to the Parties at their respective addresses as set forth in the Order or to such other address as either Party shall give to the other Party in the manner provided herein for giving notice. Notice delivered personally shall be considered given at the time it is delivered. Notice by overnight courier or mail shall be considered given on the date received.

F. Attachments

Any exhibits, schedules, and other attachments referenced in these Subscription Terms are part of these Subscription Terms.

G. Validity

If any term or provision of these Subscription Terms is deemed invalid or unenforceable, such term or provision shall not invalidate the rest of these Subscription Terms, which shall nonetheless remain in full force and effect as if such invalidated or unenforceable term or provision had not been made a part of these Subscription Terms.

H. Order of Precedence

In the event of a conflict between the Agreement, this Attachment, the Terms of Use, or the Agency’s Business Associate Agreement, the terms of the Agreement

AHCA Agreement No. AA408, Attachment I, Page 10 of 10 shall prevail, then the Agency’s Business Associate Agreement, then the terms of these Subscription Terms, then the Terms of Use, then the terms of the Order.

I. Third-Party Beneficiaries

The Parties do not intend to confer any right or remedy on any third party through these Subscription Terms, including without limitation Users.

J. Governing Law

These Subscription Terms are governed by the laws of the United States and the State of Florida, without giving effect to any conflict-of-law principle that would result in the laws of any other jurisdiction governing these Subscription Terms.

K. Force Majeure

Each Party shall be excused from performance to the extent that such Party is prevented, hindered or delayed from performing any of its obligations as a result of events beyond its reasonable control, and despite its best efforts to plan for and obtain continuity of the SaaS, including acts or omissions of the other Party, strikes, lockouts, acts of war, fire, flood, acts of God or changes in Law (“Force Majeure Events”), provided that such Party promptly informs the other and proceeds diligently to work around the Force Majeure Event and resume performance.

ATTACHMENT II

BUSINESS ASSOCIATE AGREEMENT

AHCA Agreement No. AA408, Attachment II, Page 1 of 4 AHCA Form 2100-0017, Revised (DEC 2019)

The parties to this Attachment agree that the following provisions constitute a business associate agreement for purposes of complying with the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This Attachment is applicable if the Vendor is a business associate within the meaning of the Privacy and Security Regulations, 45 C.F.R. 160 and 164.

The Vendor certifies and agrees as to abide by the following:

1. Definitions. Unless specifically stated in this Attachment, the definition of the terms contained herein shall have the same meaning and effect as defined in 45 C.F.R. 160 and 164.

a. Protected Health Information. For purposes of this Attachment, protected health information shall have the same meaning and effect as defined in 45 C.F.R. 160 and 164, limited to the information created, received, maintained or transmitted by the Vendor from, or on behalf of, the Agency.

b. Security Incident. For purposes of this Attachment, security incident means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system and includes any event resulting in computer systems, networks, or data being viewed, manipulated, damaged, destroyed or made inaccessible by an unauthorized activity.

2. Applicability of HITECH and HIPAA Privacy Rule and Security Rule Provisions. As provided by federal law, Title XIII of the American Recovery and Reinvestment Act of 2009 (ARRA), also known as the Health Information Technology Economic and Clinical Health (HITECH) Act, requires a Business Associate (Vendor) that contracts with the Agency, a HIPAA covered entity, to comply with the provisions of the HIPAA Privacy and Security Rules (45 C.F.R. 160 and 164) and comply with 45 C.F.R. 162 as applicable.

3. Use and Disclosure of Protected Health Information. The Vendor shall comply with the provisions of 45 CFR 164.504(e)(2)(ii). The Vendor shall not use or disclose protected health information other than as permitted by this Contract or by federal and state law.

The sale of protected health information or any components thereof is prohibited except as provided in 45 CFR 164.502(a)(5). The Vendor will use appropriate safeguards to prevent the use or disclosure of protected health information for any purpose not in conformity with this Contract and federal and state law. The Vendor will implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic protected health information the Vendor creates, receives, maintains, or transmits on behalf of the Agency.

4. Use and Disclosure of Information for Management, Administration, and Legal

Responsibilities. The Vendor is permitted to use and disclose protected health information received from the Agency for the proper management and administration of the Vendor or to carry out the legal responsibilities of the Vendor, in accordance with 45 C.F.R. 164.504(e)(4). Such disclosure is only permissible where required by law, or where the Vendor obtains reasonable assurances from the person to whom the protected health information is disclosed that: (1) the protected health information will be held confidentially, (2) the protected health information will be used or further disclosed only

AHCA Agreement No. AA408, Attachment II, Page 2 of 4 as required by law or for the purposes for which it was disclosed to the person, and (3) the person notifies the Vendor of any instance of which it is aware in which the confidentiality of the protected health information has been breached.

5. Disclosure to Third Parties. The Vendor will not divulge, disclose, or communicate protected health information to any third party for any purpose not in conformity with this Contract without prior written approval from the Agency. The Vendor shall ensure that any agent, including a subcontractor, to whom it provides protected health information received from, or created or received by the Vendor on behalf of the Agency, agrees to the same terms, conditions, and restrictions that apply to the Vendor with respect to protected health information. The Vendor’s subcontracts shall fully comply with the requirements of 45 CFR 164.314(a)(2)(iii).

6. Access to Information. The Vendor shall make protected health information available in accordance with federal and state law, including providing a right of access to persons who are the subjects of the protected health information in accordance with 45 C.F.R.

164.524.

7. Amendment and Incorporation of Amendments. The Vendor shall make protected health information available for amendment and to incorporate any amendments to the protected health information in accordance with 45 C.F.R. 164.526.

8. Accounting for Disclosures. The Vendor shall make protected health information available as required to provide an accounting of disclosures in accordance with 45 C.F.R. 164.528. The Vendor shall document all disclosures of protected health information as needed for the Agency to respond to a request for an accounting of disclosures in accordance with 45 C.F.R. 164.528.

9. Privacy Protection. The Vendor shall permit an individual to request a restriction on the use and disclosure of protected health information about the individual to carry out treatment, payment, or health care operations; and disclosures permitted under 164.510(b) in accordance with 45 C.F.R. 164.522. The Vendor shall permit an individual to request to receive communications of protected health information from the Vendor by alternative means or at alternative locations in accordance with 45 C.F.R. 164.522.

10. Access to Books and Records. The Vendor shall make its internal practices, books, and records relating to the use and disclosure of protected health information received from, or created or received by the Vendor on behalf of the Agency, available to the Secretary of the Department of Health and Human Services (“HHS”) or the Secretary’s designee for purposes of determining compliance with the HHS Privacy Regulations.

11. Reporting. The Vendor shall make a good faith effort to identify any use or disclosure of protected health information not provided for in this Contract.

a. To Agency. The Vendor will report to the Agency in the manner and format obtained from the Contract Manager or Agency contact, within ten (10) business days of discovery, any use or disclosure of protected health information not provided for in…