Exhibit G - Contracting Addendum.pdf

EXHIBIT G – CONTRACT ADDENDUM

(Rev 11/3/21) Page 1

CAREOREGON, INC

CONTRACT ADDENDUM

Contract #

This Contract Addendum (“Addendum”) is entered into by CareOregon, Inc. (“CareOregon”) and (“Contractor”).

This Addendum shall be attached to, and incorporated into, the [Describe title of contract being attached along with description if title is not explanatory] (“Vendor Agreement”). As used below, "Contract" means this Addendum and the Vendor Agreement and “Services” refers to the goods and/or services described in the Vendor Agreement. To the extent there is any conflict between the Addendum and the Vendor Agreement, the terms of this Addendum shall control.

A. Term. This Contract may be extended only if ninety (90) days prior to the then expiration date, the

Contractor provides a written quote to CareOregon for a one-year renewal term, and CareOregon accepts a new renewal term by the issuance of a CareOregon purchase order. Except for the renewal term and associated fee, no other terms and conditions of the original Contract may be changed through this process.

B. CareOregon Contract Administrator. The CareOregon Contract Administrator for this Contract is

C. Invoices and Payments. Invoices shall be submitted to: covendorinvoices@careoregon.org.

Payment for completion of CareOregon contracts are normally made within 30 days following the date the entire order is delivered or the date the accurate invoice is received whichever is later.

Contractor may not assess an overdue account charge in excess of eight percent (8%) per annum on outstanding balances. If Contractor fails to present invoices in proper form within sixty (60) calendar days after the end of the month in which the Services were performed, Contractor waives any rights to present such invoice thereafter and to receive payment therefor.

In the event any Order Form is extended for additional terms, the applicable fees shall not increase by more than three percent (3%) over the prior year fees.

D. Insurance. Contractor shall secure at its own expense and keep in effect during the term of the performance under this Contract the insurance required and minimum coverage indicated below which shall be primary and non-contributory. The insurance requirements outlined below do not in any way limit the amount of scope of liability of Contractor under this Contract. Contractor shall provide proof of said insurance and name CareOregon as an additional insured on commercial general liability and business automobile liability policies. Contractor shall provide CareOregon with a waiver of subrogation in favor of CareOregon for commercial general liability and workers’ compensation, if applicable. Proof of insurance and notice of any material change should be submitted to the following email address: CareOregon Procurement Department, 315 SW Fifth Ave., Portland, OR 97204 or procurement@careoregon.org.

Workers Compensation: Contractor shall comply with the statutory workers’ compensation requirements in ORS 656.017, unless exempt under ORS 656.027 or 656.126.

Commercial General Liability: combined single limit, or the equivalent, of not less than $1,000,000 per occurrence, with an annual aggregate limit of $2,000,000 for Bodily Injury and Property Damage.

Professional Liability: combined single limit, or the equivalent, of not less than $1,000,000 per claim, with an annual aggregate limit of $2,000,000 for damages caused by error, omission or negligent acts.

mailto:covendorinvoices@careoregon.org mailto:procurement@careoregon.org

(Rev 11/3/21) Page 2

Cyber Liability: combined single limit, or the equivalent, of not less than $1,000,000 per occurrence for network security (including data breach), privacy, interruption of business, media liability, and errors and omissions.

The policy(s) stated herein shall provide primary insurance for all claims made pursuant to performance of this Contract. Any insurance or self-insurance maintained by CareOregon shall be excess and non-contributory. Contractor shall provide CareOregon with a waiver of subrogation in favor of CareOregon for Contractor’s commercial general liability and workers’ compensation, if applicable.

Contractor understands that the provisions of this Section may necessitate that Contractor purchase "tail insurance" if its coverage lapses or "nose insurance" and/or "tail insurance" if Contractor changes insurance carriers, even after this Contract has terminated. Should Contractor’s insurance coverage change, lapse or be terminated while this Contract is in effect, Contractor shall provide CareOregon with 30-day advance written notice.

E. Governing Law, Jurisdiction, Venue: This Contract, and all rights, obligations, and disputes arising out of it, shall be governed and construed in accordance with the laws of the State of Oregon without regard to principles of conflicts of law.

The parties agree to negotiate to resolve any disputes in good faith and may use mediation services to facilitate a resolution. If the parties are unable to resolve the dispute through negotiation and mediation, then upon written demand by either party, any dispute arising out of or in connection with this Contract, including any question regarding its existence, interpretation, validity or termination, shall be referred to and definitively resolved by mandatory binding arbitration administered by the Judicial Arbitration and Mediation Services, Inc. (“JAMS”). The place of arbitration shall be Oregon. The arbitrator shall comply with the laws of Oregon. The judgment of the arbitrator shall be accompanied by a written statement of the basis for such judgment and may be entered and enforced by any court having proper jurisdiction. The award of the arbitrator shall be final and binding and shall not be subject to de novo judicial review. It is the express intent and understanding of the parties that each shall be entitled to enforce its respective rights under any provision hereof through specific performance, in addition to recovering damages caused by a breach of any provision hereof, and to obtain any and all other equitable remedies as may be awarded by the arbitrator.

Notwithstanding the above, each party shall have the right to seek provisional remedies from a court of competent jurisdiction. The provisions of this Section shall survive the termination of this Contract.

F. Termination. (i) The parties may terminate this Contract by mutual agreement; (ii) CareOregon may terminate this Contract at any time for convenience with written notice to Contractor. Upon receipt of the written notice, Contractor shall stop performance, and CareOregon shall pay Contractor for the Services delivered and accepted prior to the termination date; (iii) if Contractor breaches any Contract provision or is declared insolvent, CareOregon may terminate this Contract for cause with written notice to Contractor, and Contractor shall be liable for all incidental and consequential damages resulting from its breach, including all damages as provided in the UCC.

G. CareOregon Entities. Contractor understands and agrees that the Contract is between CareOregon, Inc., however the goods/services may be used for services to its subsidiary or affiliated entities including: Health Plan of CareOregon, Inc. dba CareOregon Advantage (Medicare), Columbia Pacific CCO, LLC, Jackson County CCO, LLC dba Jackson Care Connect, Housecall Providers Services, LLC, Housecall Providers, PC, and Care Access, LLC, and all of the respective subsidiaries and successors of the foregoing.

H. Compliance. Contractor shall, at all times during the term of this Contract and at Contractor’s own expense, comply with all applicable federal, state, and local laws, rules and regulations, and shall

(Rev 11/3/21) Page 3 maintain in force any licenses and obtain applicable permits and consents required for performance of the Services under this Contract. Contractor shall provide copies of such applicable current valid licenses and/or permits upon request.

I. Indemnification. Contractor shall be responsible for all damage to property, injury to persons, and loss, expense, inconvenience, and delay which may be caused by, or result from, the conduct of work, or from any act, omission, or neglect of Contractor, its subcontractors, or employees. Contractor shall save, defend, indemnify, and hold harmless CareOregon and its directors, officers, employees, and agents from all claims, suits, and actions of any nature resulting from or arising out of the activities or omissions of Contractor or its subcontractors, officers, employees, or agents. Any Contractor Agreement limitation of liability for damages or obligation to indemnify CareOregon shall not be applicable to damages to property, bodily injury, intellectual property infringement, data breach obligations and for all other damages may not be less than three time the amount paid by CareOregon under the Contractor Agreement.

J. Limitations of Liability or Statute of Limitations. Any limitation of liability included in the

Vendor Agreement shall not apply to claims for bodily injury, property damage, intellectual property infringement, or data breach events. In the event any limitation of liability provision limits the maximum the Contractor is responsible for claims other than the claims listed above, such limitation of liability of damages shall not be less than the greater of three (3) times the amount paid by CareOregon in the prior twelve months, or $500,000. Any provision in the Vendor Agreement that limit the applicable statute of limitations is hereby void.

K. Records. Contractor shall, at all times during the term of this Contract and at Contractor’s own expense, comply with all applicable federal, state, and local laws, rules and regulations, and shall maintain in force any licenses and obtain applicable permits and consents required for performance of the Services under this Contract. Contractor shall provide copies of such applicable current valid licenses and/or permits upon request.

L. Subcontractors. Contractor shall ensure that its subcontractors, if any, comply with the requirements of this Addendum.

M. Counterparts. This Addendum may be executed in several counterparts, each of which shall be an original, all of which shall constitute but one and the same instrument.

N. Waiver. The failure of CareOregon to enforce any provision of this Contract shall not constitute a waiver by CareOregon of that or any other provision.

O. Confidentiality. Contractor acknowledges that in the course of performing the Services, Contractor will likely be given access to confidential and proprietary business information of or about CareOregon, including without limitation, contract terms (inclusive of the terms of this Contract), business relationships, potential collaborations, trade secrets, payor lists, Personal Information (as defined in ORS 646A.602(12), information considered confidential and restricted under other Oregon State and Federal laws, databases, strategic and financial information and other business information, the unauthorized disclosure or use of which will be highly injurious to CareOregon and its business and its relationships in amounts not readily ascertainable (“CareOregon Data”). Accordingly, Contractor shall: (i) hold all CareOregon Data in the strictest confidence; (ii) return all CareOregon Data to CareOregon upon completion of Services; and (iii) not disclose CareOregon Data to any third party or make use of it for any purpose other than providing the Services to CareOregon. Contractor further understands that unauthorized use or disclosure of such information may result in civil and criminal liability under State and/or Federal law; and Contractor agrees that damages would be an inadequate remedy in the event of Contractor’s breach of confidentiality. CareOregon shall be entitled to obtain immediate injunctive relief, in addition to all other remedies available in law or in equity, in the event Contractor breaches the provisions of this Paragraph.

(Rev 11/3/21) Page 4

Contractor agrees to comply with all reasonable requests by CareOregon to ensure the confidentiality and nondisclosure of the CareOregon Data, including if requested and without limitation: (a) obtaining nondisclosure agreements, in a form approved by CareOregon, from each of Contractor’s employees, agents, and subcontractors who are performing services, and providing copies of such agreements to CareOregon; and (b) performing criminal background checks on each of Contractor’s employees, agents, and subcontractors who are performing services, and providing a copy of the results to CareOregon.

Notwithstanding any other provision in this Contract, Contractor will be responsible for all damages, fines, and corrective action (including credit monitoring services) arising from disclosure of such CareOregon Data caused by a breach of its data security or the confidentiality provisions hereunder.

The provisions in this Section shall operate in addition to, and not as limitation of, the confidentiality and similar requirements set forth in the rest of the Contract, as it may otherwise be amended.

Contractor’s obligations under this Contract shall survive the expiration or termination of the Contract, as amended, and shall be perpetual.

P. Federal Healthcare Program Eligibility. Contractor represents and warrants that, to the best of its knowledge, its officers, directors, employees, subcontractors, agents, and other representatives are not debarred, suspended, or excluded from participating in any federal health care programs, as defined under 42 U.S.C. 1320a-7b (f), and to its knowledge, there are no pending or threatened governmental investigations that may lead to such exclusion. Contractor agrees to notify CareOregon of the commencement of any such exclusion or investigation within seven (7) business days of first learning of it. Contractor represents that any employee or subcontractor responsible for administering or delivering services hereunder is not excluded from federal healthcare programs and is not included in the Office of Inspector General (“OIG”) List of Excluded Individuals and Entities and System for Award Management (“SAM”) exclusion list. Contractor and its subcontractors will review the OIG and SAM excluded parties lists prior to initial hiring or contracting, and then monthly thereafter to ensure that employees and subcontractors providing services under the Contract are not so debarred, suspended or excluded. Additionally, if an employee or subcontractor is identified to be on such lists, that employee or subcontractor will immediately be removed from any work related directly or indirectly to all Work pursuant to this Contract and Contractor shall take appropriate corrective actions. CareOregon shall have the right to immediately terminate this Contract upon learning of any such exclusion.

Contractor shall, as soon as commercially practicable, register itself with the federal System for Award Management (SAM). Information regarding registration with SAM may be found at https://www.sam.gov.

Q. Federal First Tier, Downstream, Related Entity Eligibility and Compliance Requirements. To the extent that Contractor is deemed a First Tier, Downstream, and Related Entities (“FDR”) as defined by the Centers for Medicare & Medicaid Services (“CMS”), CareOregon may monitor or audit Contractor’s performance under this Contract to ensure compliance will all applicable CMS regulations. Contractor agrees to comply with all applicable Medicare laws, regulations, and CMS instructions per 42 C.F.R §§ 422.504(i)(4)(v) and 423.505(i)(4)(iv). Contractor shall comply with the Medicare Compliance Addendum, hereby incorporated by reference and found at https://www.careoregon.org/about-us/vendor-resources.

R. Equal Opportunity. CareOregon and Contractor shall, to the extent applicable, abide by the requirements of 41 CFR 60-1.4(a), 60-300.5(a) and 60-741.5(a). These regulations prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities and prohibit discrimination against all individuals based on their race, color, religion, sex, sexual orientation, gender identity, or national origin. These regulations require that covered https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.sam.gov%2F&data=05%7C01%7Cmarltong%40careoregon.org%7C870dd7fd149648a072a508dad1aef8e3%7C293bde5839b14236b6a7b836c810f6f9%7C0%7C0%7C638052846688046508%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=NtBcZGVf5GJTY3NzbIr7Es8qcEF0AfZyCgnR7P7SUis%3D&reserved=0 https://www.careoregon.org/about-us/vendor-resources

(Rev 11/3/21) Page 5 prime contractors and subcontractors take affirmative action to employ, advance in employment and treat qualified individuals without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status or disability.

S. Software License. Title to software provided by Contractor under this Contract remains with

Contractor, except with respect to any Services. To the extent software provided by Contractor is licensed rather than purchased by CareOregon, Contractor hereby grants to CareOregon, for the benefit of CareOregon and its affiliated entities, a non-exclusive, worldwide, perpetual and unlimited (unless a limitation on the number of users, computer systems or other similar restrictions on CareOregon’s usage is expressly stated in the Vendor Agreement license to install, display, access, store and use any software and documentation supplied by Contractor to CareOregon the Contract (including any updates or modifications thereof) for CareOregon’s business purposes. This license grant includes, at no additional charge, the right to make and use a reasonable number of copies of the software and documentation for testing, back-up, archival and disaster recovery purposes, all updates, upgrades and new releases made generally available, and use of the documentation for internal training, support and deployment. To the extent any software delivered hereunder incorporates third party materials, including, without limitation, open-source software, Contractor warrants that it has the right to sublicense such third-party materials to CareOregon consistent with the Vendor Agreement and hereby grants a license in such third-party materials to the full extent of the license in the software. CareOregon may permit its consultants and contractors to exercise its rights under this license for the purpose of providing services to CareOregon.

10. PROTECTION OF PATIENT PRIVACY AND SECURITY. The Parties have determined that Contractor requires access to Protected Health Information (as defined in 45 C.F.R. § 160.103) (“PHI”) under the Health Insurance Portability and Accountability Act, as amended (“HIPAA”) to perform the Work herein and prior to Contractor receiving access to any PHI, the Parties shall promptly execute CareOregon’s Business Associate Agreement, which is incorporated by reference as Exhibit A. Notwithstanding the execution of a Business Associate Agreement, Contractor and CareOregon agree to implement and maintain systems that protect PHI, as required by HIPAA.

T. Cloud Service and Online Content. If the Services include Cloud Service(s), including Online

Content, the Terms and Conditions for the Purchase of Cloud Services, attached and hereby incorporated as Exhibit B, shall apply.

U. CareOregon Data Security Requirements. The Work contemplated under this Contract includes

Contractor having access to CareOregon Data systems, hosting CareOregon Data on Contractor’s systems (or subcontracted systems), or both. CareOregon requires that Contractor maintain commercially reasonable and prudent infrastructure and controls to protect CareOregon Data.

Contractor shall be required to comply with the terms of the CareOregon Data Security Requirements in Exhibit C, attached and hereby incorporated by reference. In the event of any conflict between the CareOregon Data Security Requirements and the CareOregon Business Associate Agreement, the CareOregon Business Associate Agreement shall take precedence.

By their signatures below, the parties to this Addendum agree to the terms, conditions, and content expressed herein.

XXXXXX

Authorized Signature Date

Name/Title (Printed)

CareOregon, Inc.

XXXXXXXX Date

ATTACHMENT 2 – CONTRACTING ADDENDUM

(Rev 11/3/21) Page 6

EXHIBIT A

BUSINESS ASSOCIATE AGREEMENT

THE COMPANIES:

CareOregon, Inc.

Health Plan of CareOregon, Inc. dba CareOregon Advantage Columbia Pacific CCO, LLC Jackson County CCO, LLC dba Jackson Care Connect Housecall Providers Services, LLC Housecall Providers, PC

BUSINESS ASSOCIATE:

VENDOR

This Business Associate Agreement (“BAA”) is between the Companies and Business Associate. Business Associate and the Companies have entered into a Contract Addendum (“Agreement”) and this BAA is incorporated by reference in the Agreement. The Parties’ activities pursuant to the Agreement sometimes may involve (i) the disclosure of PHI by the Companies (or another business associate of the Companies) to Business Associate, (ii) the use or disclosure by Business Associate of PHI received from the Companies and (iii) the transmission by Electronic Media or the maintenance in Electronic Media of Individually Identifiable Health Information by Business Associate. Accordingly, the relationship between the Companies and Business Associate is subject to provisions of the HIPAA Rules. The Companies and Business Associate intend to protect the privacy of PHI and the security of electronic PHI held by Business Associate in connection with the Agreement in compliance with this BAA, the HIPAA Rules and other applicable laws.

1. Definitions Capitalized terms used, but not otherwise defined, in this BAA shall have the same meaning as those terms in the HIPAA Rules.

a) “Agent” means an agent as used and defined under the HIPAA Rules and federal common law.

b) “Breach” has the same meaning as in 45.C.F.R. § 164.402.

c) “Designated Record Set” has the same meaning as in 45 C.F.R. 164.501.

d) “Discovery” means the first day on which a Breach is known, or reasonably should have been known, to Business Associate (including any person, other than the individual committing the Breach, who is an employee or officer of Business Associate) or any Agent or Subcontractor of Business Associate.

e) “Effective Date” means the date first written above.

f) “Electronic Media” means the same as in 45 C.F.R. § 160.103.

g) “Electronic Protected Health Information” or “EPHI” means the same as in 45 C.F.R. § 160.103, limited for purposes of this BAA to EPHI received by Business Associate from, or received or created by Business Associate on behalf of, the Companies.

h) “Electronic Transactions Rules” means 45 CFR Part 162.

i) “Fundraising” means raising funds for the Business Associate’s own benefit as governed by 45

CFR § 164.514.

j) “HIPAA Rules” means the Privacy Rules, the Security Rules, and the Electronic Transactions

Rules.

k) “Individual” means a person to which specific PHI applies.

l) “Marketing” means the same as in 45 CFR § 164.501.

m) “PHI” or “Protected Health Information” means the same as in 45 CFR § 160.103, limited for purposes of this BAA to PHI received by Business Associate or its Agent or Subcontractor from, or received or created by Business Associate, its Agent or Subcontractor on behalf of, the

(Rev 11/3/21) Page 7

Companies.

n) “Privacy Rule” means the Standards for Privacy of Individually Identifiable Health Information in

45 CFR Part 160 and Part 164, Subparts A and E.

o) “Required by Law” means the same as in 45 C.F.R. § 164.103.

p) “Secretary” means the Secretary of the United States Department of Health and Human Services or the Secretary’s designee.

q) “Security Incident” means the same as in 45 CFR § 164.304.

r) “Security Rule” means the Security Standards for the Protection of Electronic Protected Health

Information in 45 CFR Part 164, Subpart C.

s) “Subcontractor” means the same as in 45 C.F.R. § 160.103.

t) “Unsecured PHI” means the same as the term “unsecured protected health information” in 45

C.F.R. § 164.402.

2. Obligations and Activities of Business Associate

a) Business Associate agrees to not use or disclose PHI other than as permitted or required by this BAA or as required by Law.

b) Business Associate agrees to use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this BAA.

c) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate or a Subcontractor or Agent of Business Associate in violation of the requirements of this BAA.

d) Business Associate agrees to report to the Companies any use or disclosure of PHI by Business Associate or a Subcontractor or Agent of Business Associate not permitted under this BAA within five business days after Business Associate becomes aware of such disclosure.

e) Business Associate agrees to report to the Companies any Security Incident, Breach of Unsecured PHI or any use or disclosure of PHI that is not authorized by this BAA of which Business Associate becomes aware.

f) Business Associate will ensure that any Subcontractor or Agent of Business Associate using or disclosing PHI has executed a Business Associate Agreement containing substantially the same terms as this BAA, including the same restrictions and conditions that apply through this BAA to Business Associate with respect to such PHI. Business Associate will ensure that any Agent to whom Business Associate provides PHI received from, or created or received by Business Associate on behalf of, the Companies has executed an agreement containing substantially the same restrictions and conditions that apply through this BAA to Business Associate with respect to such PHI. Business Associate will provide, upon written request by the Companies, a list of any such Subcontractors of Business Associate and any Agents of Business Associate using or disclosing PHI.

g) Business Associate will ensure that any permitted disclosure will be only as minimally necessary for the purpose of the disclosure.

h) Business Associate agrees to provide access, at the reasonable request of, and in the time and manner designated by, the Companies to PHI in a Designated Record Set, to the Companies or, as directed by the Companies, to an Individual in order to meet the requirements under 45 CFR §

164.524. If the Companies request an electronic copy of PHI that is maintained electronically in a Designated Record Set in Business Associate’s custody or control or the custody or control of a Subcontractor or Agent of Business Associate, Business Associate will provide such PHI in the electronic format requested by the Companies unless the PHI is not readily produced in such format, in which case Business Associate will provide another reasonable electronic format as agreed to by the Parties and the Individual requesting such PHI.

i) Within 30 days of receiving a request by the Companies, Business Associate will document disclosures of PHI and information related to such disclosures in such form as would be required for the Companies to respond to a request by an Individual for an accounting of disclosures in

(Rev 11/3/21) Page 8 accordance with 45 C.F.R. § 164.528.

j) Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by the Companies pursuant to 45 CFR § 164.526, at the request of the Companies or of the Individual concerned.

k) Business Associate agrees to make internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, the Companies available to the Companies or, at the request of the Companies, to the Secretary or other regulatory official as directed by the Companies, in a time and manner requested by the Companies or such official for the purpose of determining the Companies’ or Business Associate’s compliance with the HIPAA Regulations.

l) Business Associate agrees to implement administrative, physical, and technical safeguards (including written policies and procedures) that reasonably and appropriately protect the confidentiality, integrity, and availability of EPHI that it receives from, or creates or receives on behalf of, the Companies as required by the Security Rule. Business Associate will ensure that any Agent or Subcontractor to whom Business Associate provides EPHI agrees to implement reasonable and appropriate administrative, physical and technical safeguards to reasonably and appropriately protect the confidentiality, integrity and availability of such EPHI. Business Associate agrees to comply with Sections 164.306, 164.308, 164.310, 164.312, and 164.316 of Title 45, Code of Federal Regulations with respect to all EPHI.

m) In conducting any electronic transaction that is subject to the Electronic Transactions Rule on behalf of the Companies, Business Associate agrees to comply with all requirements of the Electronic Transactions Rule that would apply to the Companies if the Companies were conducting the transaction itself. Business Associate agrees to ensure that any Agent or Subcontractor of Business Associate that conducts standard transactions with PHI of the Companies will comply with all of the requirements of the Electronic Transactions Rule that would apply to the Companies if the Companies were conducting the transaction itself.

n) Business Associate shall not disclose PHI to any member of its workforce unless Business Associate has advised such person of Business Associate’s privacy and security obligations under this BAA, including the consequences for violation of such obligations. Business Associate shall take appropriate disciplinary action against any member of its workforce who uses or discloses PHI in violation of this BAA or applicable law.

o) Business Associate shall notify the Companies of any Breach without unreasonable delay, and in no case later than five business days after Discovery of the Breach. Business Associate will require its Subcontractors and Agents to notify the Companies of a Discovery of a Breach at the same time its Subcontractors and Agents notify the Business Associate, and the following shall apply:

1. Notice to the Companies shall include, to the extent possible: (i) the names of the Individual(s) affected by the Breach; (ii) a brief description of what happened, including the date of the Breach and the date of the discovery of the Breach, if known; (iii) a description of the types of Unsecured PHI that were involved in the Breach; (iv) any steps affected Individuals should take to protect themselves from potential harm resulting from the Breach; (v) a description of what Business Associate is doing to investigate the Breach, to mitigate harm to the affected Individual(s), and to protect against further Breaches; (vi) any notice Business Associate has given pursuant to 45 CFR § 164.404 and

(vii) any other information that the Companies reasonably requests.

2. After receipt of notice, from any source, of a Breach involving PHI used, disclosed, maintained, or otherwise possessed by Business Associate or any Subcontractor or Agent of Business Associate, the Companies may: (i) require Business Associate, at Business Associate’s sole expense, to use a mutually agreed upon written notice to notify, on the Companies’ behalf, the affected Individual(s), in accordance with the notification requirements set forth in 45 CFR § 164.404, without unreasonable delay, but in no case later than sixty (60) days after discovery of the Breach; or (ii) elect to itself provide such

(Rev 11/3/21) Page 9 notice. Business Associate shall indemnify, hold harmless, and defend the Companies from and against any and all costs (including mailing, labor, administrative costs, vendor charges, and any other costs determined to be reasonable by the Companies), losses, penalties, fines, and liabilities arising from or associated with the Breach, including without limitation, the costs of the Companies’ actions taken to: (i) notify the affected Individual(s) of and to respond to the Breach; (ii) mitigate harm to the affected Individual(s); (iii) respond to questions or requests for information about the Breach; and

(iv) fines, damages or penalties assessed against the Companies on account of the Breach of Unsecured PHI.

p) Business Associate shall not use or disclose PHI that is genetic information, or sell (or directly or indirectly receive remuneration in exchange for), any PHI in violation of 45 CFR §164.502(a)(5).

q) Business Associate shall not use or disclose PHI for Marketing or Fundraising purposes without prior written consent from the Companies, subject to any conditions of such consent.

3. Permitted Uses and Disclosures by Business Associate

a) Subject to this BAA and applicable law, Business Associate may use or disclose PHI in connection with functions, activities or services for, or on behalf of, the Companies under the Agreement, provided that such use or disclosure would not violate the HIPAA Rules or the Companies’ own policies and procedures concerning compliance with the “minimum necessary” standard under 45 CFR § 164.502(b) if performed by the Companies.

b) Business Associate may use and disclose PHI for the proper management and administration of Business Associate or to carry out the legal obligations of Business Associate, but only if:

1. The disclosure is required by Law; or

2. Business Associate receives reasonable assurances from any party to whom the PHI is disclosed that: (i) the PHI will be held confidentially by that party; (ii) the PHI will be used or further disclosed by that party only as required by Law or for the purpose for which it was disclosed to that party; and (iii) the party agrees to notify Business Associate of any Breaches of which the party becomes aware.

4. Obligations of the Companies

a) The Companies shall provide Business Associate with its notice of privacy practices produced in accordance with 45 CFR § 164.520 and any changes to such notice while this BAA is in effect.

b) The Companies shall provide Business Associate with any changes in or revocation of permission by any Individual for use or disclosure of PHI if such change or revocation affects Business Associate’s permitted or required uses and disclosures of the PHI.

c) The Companies shall notify Business Associate of any restrictions on the use or disclosure of PHI that the Companies have agreed to in accordance with 45 CFR § 164.522 to the extent that such restrictions affect Business Associate’s use or disclosure of PHI.

5. Term and Termination

a) This BAA shall be effective as of the Effective Date and shall terminate when all PHI provided is destroyed or returned to the Companies, or, if it is infeasible to return or destroy PHI, as long as protections are extended to such PHI in accordance with (c)(2).

b) Upon the Companies obtaining knowledge of a material breach or violation of this BAA by Business Associate, the Companies shall take one of the following actions:

1. If the Companies determine that the breach or violation is curable, the Companies shall provide an opportunity for Business Associate to cure the breach or end the violation within a reasonable time period set by the Companies, which shall not exceed 90 days. If the breach or violation is not cured or ended within the time set by the Companies, the Companies may: (i) immediately terminate this BAA and the Agreement; or (ii) suspend performance by the Companies under the Agreement until such breach or violation is cured.

(Rev 11/3/21) Page 10

2. If the Companies determine that the breach or violation is not curable, The Companies may immediately terminate this BAA and the Agreement.

3. If the Companies determine that neither a termination of this BAA and the Agreement nor a cure of a breach or violation is feasible, the Companies may take such other appropriate actions to remedy, correct, or mitigate the Breach or violation as the Companies shall determine.

4. In addition to the foregoing, the Companies may immediately terminate this BAA and the Agreement if the Companies determine that Business Associate has violated a material term of this BAA concerning the Security Rule.

c) Effect of Termination.

1. Except as provided in paragraph (c) (2), upon termination of this BAA for any reason, Business Associate shall return or destroy all PHI in possession of Business Associate, its Agents or Subcontractors. Business Associate, its Agents and Subcontractors shall retain no copies of the PHI.

2. In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall provide to the Companies notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return or destruction of PHI is infeasible, Business Associate shall extend the protections of this BAA to such PHI (including PHI held by Agents or Subcontractors of Business Associate) and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate, its Agents or Subcontractors maintain such PHI.

6. Indemnification Notwithstanding any other agreement between Business Associate and Companies, Business Associate agrees to indemnify and hold harmless the Companies from direct losses and damages suffered as a result of Business Associate’s breach of its obligations under this BAA, including but not limited to direct losses and damages relating to third-party claims. The obligations under this Section 6 regarding indemnification will survive any expiration or termination of this BAA.

7. Miscellaneous

a) A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended, and for which compliance is required.

b) The Parties agree to take such action as is necessary to amend this BAA from time to time for the Companies to comply with the requirements of the HIPAA Rules and the Health Insurance Portability and Accountability Act, Public Law 104-191, as amended.

c) The respective rights and obligations of Business Associate under Section 5 of this BAA shall survive the termination of this BAA.

d) Any ambiguity in this BAA shall be resolved in favor of a meaning that permits the Companies to comply with the HIPAA Rules and other applicable law. The section and paragraph headings of this BAA are for the convenience of the reader only, and are not intended to act as a limitation of the scope or meaning of the sections and paragraphs themselves.

e) Subject to the following, this BAA shall not be assigned or otherwise transferred by a party without the prior written consent of the other party, which consent shall not be unreasonably withheld. However, no such consent shall be required for either party’s assignment or transfer of this BAA in connection with a merger, sale or transfer of all or substantially all of the business or assets of the assigning party.

f) The invalidity of any term or provision of this BAA will not affect the validity of any other provision. Waiver by any party of strict performance of any provision of this BAA will not be a waiver of or prejudice any party’s right to require strict performance of the same provision in the future or of any other provision on the same or any other occasion.

(Rev 11/3/21) Page 11

g) Any notices permitted or required by this BAA will be addressed to the receiving party at the address shown at the top of this BAA or at such other address as either party may provide to the other.

h) This BAA may be executed in multiple counterparts, all of which together will constitute one agreement, even though all parties do not sign the same counterpart.

i) To the extent of any inconsistency between any other agreement between the Parties and this BAA, the provisions of this BAA shall prevail.

j) This BAA supersedes any other Business Associate Agreement in effect among or between the Parties to this BAA.

IN WITNESS WHEREOF, the Parties have caused this Business Associate Agreement to be executed on their behalf by their duly authorized representatives’ signatures as of the dates set forth below.

VENDOR

Authorized Signature Date

Name / Title (Printed)

The Companies

Amy Dowd Date Chief Operations Officer

(Rev 11/3/21) Page 12

EXHIBIT B

TERMS AND CONDITIONS FOR CLOUD SERVICES

1. DEFINITIONS

The following terms shall have the meaning set forth below for purposes of these Terms and Conditions for the Purchase of Cloud Services:

1.1. “Authorized User” means an employee, consultant, provider, contractor, or other agent of a

CareOregon authorized to access and use the Cloud Service on behalf of CareOregon, and, if applicable, a patient or member of CareOregon and their authorized representatives and family members.

1.2. “Cloud Service” means a Contractor hosted software or platform, or Online Content, that is made available for CareOregon's use via the Internet. Cloud Service includes the software application, platform, content, Documentation, hosting, management, support and maintenance services, together with all Updates and workarounds, corrections, modifications, and improvements, provided by Contractor under the Vendor Agreement. Any services, functions, processes and responsibilities, whether or not specifically described in the Vendor Agreement, that are required for or inherent in the proper performance and delivery of the Cloud Service described therein shall be deemed to be part of the Cloud Service. The Cloud Service is the Services within the meaning of the Contract.

1.3. “Contract” means the contract documents entered into between the Contractor and CareOregon that these Terms and Conditions for Clouds Services are incorporated by reference to.

1.4. “Documentation” means all reference and user manuals and guides describing the Cloud Service and other supporting technical information, materials and documentation.

1.5. “Go-Live Date” means the date CareOregon's production usage of the Cloud Service commences.

1.6. “Implementation Services” means professional services provided by Contractor to configure and implement the Cloud Service and as otherwise specified in an applicable Contract.

Implementation Services shall not include software development or customization.

Implementation Services are a Service within the meaning of the Contract.

1.7. “CareOregon” has the meaning set forth in the Contract.

1.8. “CareOregon Data” means all data and information entered into the Cloud Service by

Authorized Users and as set forth in the Contract.

1.9. “Online Content” means content, knowledgebases, databases or other information or data that is made available for CareOregon's use via the Internet.

1.10. “Service Levels” means the levels of performance Contractor is required to provide for the

Cloud Service, as set forth in the Documentation and/or Vendor Agreement.

1.11. “Specifications” means the features, functions, performance requirements, acceptance criteria, interface specifications and other technical or functional specifications applicable to the Cloud Service(s) that are identified or referenced in the Vendor Agreement and the Documentation.

1.12. “Contractor Infrastructure” means the computer hardware, software, communications systems, network and other infrastructure used by Contractor to host and provide the Cloud Service.

1.13. “Updates” shall mean any modifications, error corrections, bug fixes, new releases, updates and upgrades to the Cloud Service (and any related Documentation) that may be provided or otherwise made generally available by Contractor from time to time to customers of the Cloud Service.

2. CLOUD AND IMPLEMENTATION SERVICES

2.1. Provision of Cloud and Implementation Services. Contractor shall provide the Cloud Service and Implementation Services (if applicable) in accordance with the Vendor Agreement and any applicable Service Levels, including, setup, configuration, operation, and management of Contractor Infrastructure required by Contractor to host, operate, maintain, and provide the Cloud Service. Contractor will provide CareOregon and its Authorized Users with access via the public Internet to the Cloud Service, including all identification numbers, keys and passwords

(Rev 11/3/21) Page 13 and Documentation which CareOregon and Authorized Users may require to access and use the Cloud Services, commencing on the Go-Live Date. Contractor hereby grants to CareOregon and the Authorized Users a worldwide, non-exclusive right and license to (i) access, execute, use, perform, and display the Cloud Service for the benefit of CareOregon, (ii) modify, publish, transmit, create derivative works of Online Content for the benefit of CareOregon; and (ii) reproduce, distribute, and display the Documentation to Authorized Users. The rights granted by Contractor hereunder include the right of CareOregon to have such rights exercised by third parties on its behalf. Contractor and its licensors own and shall retain all intellectual property rights in and to the Cloud Service (excluding CareOregon Data) and Documentation and the Contractor Infrastructure.

2.2. Maintenance and Support for Cloud Service. Contractor shall provide maintenance and support regarding the Cloud Service, including as applicable: (i) causing the Cloud Service to operate according to the Specifications and correcting reported errors; (ii) performing preventive maintenance on the Contractor Infrastructure; and (iii) providing periodic Updates to the Cloud Service and Contractor Infrastructure, including at least all Updates made generally available to Contractor’s customers. Notwithstanding the foregoing, (a) no Update shall serve to reduce the features and functionality, or the scope of Cloud Service provided under the Vendor agreement without CareOregon's prior written consent; and (b) any Update that requires a change to CareOregon's systems, processes or manner of access to the Cloud Service shall be subject to CareOregon's prior written approval. To the extent Contractor acquires some or all components of the Cloud Service and associated Contractor Infrastructure from third parties, Contractor shall be responsible for obtaining appropriate Updates and upgrades from such third-party suppliers and applying them in a manner that does not disrupt the provision of the Cloud Service.

2.3. Protection against Malicious Code and Disabling Devices. Contractor will not knowingly introduce any malware, viruses, worms, Trojan horses, spyware, logic bombs, disabling code, other computer instructions, devices, techniques or other malicious code into the Cloud Service that can or were designed to threaten, infect, assault, vandalize, defraud, disrupt, damage, disable, alter, inhibit or shut down the Cloud Service or CareOregon's processing environment, or intended by Contractor to limit the use of the Cloud Service to particular computers, servers or processors/CPUs ("Malicious Code"). Contractor will implement reputable and industry standard virus detection/scanning program(s) to scan all files transmitted to CareOregon and all Contactor Infrastructure used to provide the Cloud Services. Contractor shall continuously update such virus detection/scanning program(s) for the detection, prevention, and recovery to protect against Malicious Code and will also implement appropriate user awareness procedures.

2.4. Restrictions on Use of Cloud Service. Except for use by Authorized Users as permitted herein, CareOregon may not (i) sell, assign, sublicense or otherwise transfer the Cloud Service to third parties outside of CareOregon, (ii) resell the Cloud Service to third parties outside of CareOregon; (iii) use the Cloud Service to provide or perform service bureau processing, or hosting services for any third party outside of CareOregon; or (iv) use the Cloud Service to knowingly transmit malware, spam or other unsolicited emails in violation of Law, or to post or send any unlawful, threatening, harassing, racist, abusive, libelous, pornographic, defamatory, obscene, or other similarly inappropriate content.

2.5. Prohibited Tracking. Without CareOregon's prior written approval, Contractor shall not do any of the following: (i) implant any "cookies" on any computer of CareOregon or its Authorized Users, except as necessary for the Cloud Service to perform for CareOregon in conformity with its Documentation (and not for purposes of monitoring users or usage within or outside of the Cloud Service) or as explicitly authorized in writing by CareOregon, (ii) track the Internet usage or other computer usage of CareOregon and its Authorized Users except as explicitly authorized in writing by CareOregon, (iii) use any data or information of CareOregon or Authorized Users

(Rev 11/3/21) Page 14 to directly or indirectly market products or services to CareOregon or Authorized Users, and (iv) transfer or sell any lists of Authorized Users to any third party.

2.6. Implementation Services. If Implementation Services are required in the Vendor Agreement, Contractor shall provide such Implementation Services on the terms and schedule set forth therein. The performance of any software development or customization services is outside the scope of the Vendor Agreement.

2.7. Acceptance Testing. If Acceptance Testing is provided in the Vendor Agreement, CareOregon shall have at least thirty (30) days from the Delivery Date of the Cloud Service to perform initial acceptance testing of the Cloud Service ("Acceptance Period"). At the end of the Acceptance Period, CareOregon either inform Contractor that Cloud Service is accepted or identify in reasonable detail why the Cloud Service failed to meet the applicable Specifications.