RFP 2022-07 Response to Clarifying Questions 7-14-22.pdf

315 SW Fifth Ave, Portland, OR 97204 | 800-224-4840 | TTY 711 | careoregon.org

George Marlton Procurement Director

Procurement Department 503-416-4706 Procurement@careoregon.org

REQUEST FOR PROPOSALS #2022-07

CONTRACT LIFECYLE MANAGEMENT SOLUTION

RESPONSE TO CLARIFYING QUESTIONS

July 13, 2022

Note that these are questions submitted by interested firms to the above referenced solicitation.

The below answers are for clarification purposes only and in no way alter or amend the RFP as published.

1. Will CareOregon consider a limit of liability for data breach?

Answer: CareOregon is willing to negotiate a reasonable limit of liability. We have outlined the required minimum insurance coverage so it should be taken into account as to what we believe is reasonable. Our primary concern is that we need reasonable responsibility for damages and insurance to cover breaches given the sensitive data that we will have in the system. Requirements of completely waiving or having unreasonably low limits will not be considered.

2. How many active contracts does CareOregon have?

Answer: Approximately 4,550 (~2400 business contracts, ~1900 provider contracts, ~250 VBP contracts).

3. How many contracts will be migrated to the new system?

Answer: See answer to #2 above.

4. How many users need access to the new system?

Answer: See Section 3.1 of the RFP for details.

5. Will an IT resource be assigned to help coordinate the date and document migration?

Answer: Unknown at this time.

6. Is there a preferred order for the interfaces and roll-out plan?

Answer: The project plan is to implement all teams at the same time but will consider a staggered roll-out plan based on the selected vendor experience and best practices recommendation. The preferred order for interfaces has not been determined at this time.

7. Regarding the Health Services Functionality, is CareOregon willing to consider an alternative process for provider credentialing?

http://careoregon.org/ mailto:Procurement@careoregon.org

Answer: CareOregon is willing to consider an alternative process for provider credentialing, however we will need to have our Credentialing team involved. Our primary priority is contract management and can review changes to credentialing at a later phase.

8. If yes, is CareOregon interested an Advanced CVO solution that combines software and services with NCQA certification?

Answer: Unable to answer at this time.

9. Is the plan to fully replace Symplr for Provider Credentialing? If yes, when does the contract term with Symplr end?

10. Describe CareOregon’s current credentialing process?

Answer: Credentialing reviews and primary source verifies initial credentialing applications for providers joining the CareOregon network as participating providers.

Providers determined to meet the minimum credentialing requirements outlined in our policies and procedures and decision-making guidelines are approved for 36 months.

Recredentialing is processed every 36 months thereafter in order to remain a participating provider. Providers are notified 3 months prior to the renewal month that recredentialing is due.

11. How many total providers are managed in the network (include facilities and people)?

Answer: approximately 5900 providers

12. Is there a single appointment decision for CareOregon, or does the solution need to accommodate multiple appointment decisions by plan or network (if so, how many distinct appointments are required and please include an estimate of crossover providers)?

Answer: Unsure what this question is asking.

13. Describe any details CareOregon’s current approach to Provider Data Management tasks and Direction publication?

a. Is there a current solution in place for these tasks?

14. Does the process include management of CCO rosters, or the need to directly manage and reconcile data from other delegated entities (how is this process currently managed)?

Answer: No

15. Would you be open to pricing for the Contract Management system to be hosted by vendor (SaaS/cloud) or deployed on your organization’s service (on-premise)?

Answer: See Section 3.2.1 of the RFP that CareOregon is only considering SaaS solutions.

16. How many total users?

a. How many internal users will require administrative level access?

b. How many internal users will require the ability to add, edit and delete?

c. How many internal users will require request only access?

d. How many internal users will require read-only access?

Answer: See Section 3.1 of the RFP for details.

17. How many internal users do you project will require to the system at any given time?

Answer: Not sure we understand the question but up to 20-30 or more people could simultaneously be in system at any given time of different access rights.

18. Does your organization require data import services? If so, please expand on the data migration / importing requirements for the Contract Management Software? (Such as record info, employee lists, vendor lists, etc.)

Answer: Yes, see Section 3.2.1 of the RFP for details (highlight Implementation Requirements).

a. How many total electronic files (PDF, MS Word, etc.) in current/legacy system into the CLM?

Answer: See response to Question 2 for number of contracts. We will also have associated documents (license verification, SAM/OIG confirmation, COI, etc.)

b. How many total electronic files in current/legacy system (rows in the exported spreadsheet)

Answer: See response to Question 2.

c. Where are the legacy (historic) electronic contract files currently stored? (shared folders, Sharepoint, document management system, paper, etc.)

Answer: See the Project Specific Background information in Section 3.1.

Contracts are currently stored in ConvergePoint, Sharepoint, and shared network drives. Format of files are in Word of the draft contract and a PDF of the fully signed contract. All files are in electronic format.

19. What documents/contract types would you like to author within the system (number of templates)?

Answer: CareOregon has 13 distinct contract types and around 65 contract templates in total under the contract types. We also have 3 procurement templates (RFQ, RFP, ITB).

20. Do you require professional services to configure templates? If so, how many would be required for the awarded vendor to configure?

Answer: Yes. All of them.

21. Do you require professional services to configure workflow processes? If so, how many would be required for the awarded vendor to configure?

Answer: Yes. Unknown number of workflows as number and complexity will be dependent on the selected solution functionality.

22. Can you please provide additional details about your organization’s workflow/approval processes? Can you please provide number of steps and examples?

Answer: Based on the contract type, there are many different workflows that require department management review/approval, internal stakeholder review, budget manager reviews, executive review, and other ad hoc reviews based on the project. We have very different workflows if it is a business contract, health services contract, or other type.

Currently CareOregon has organized contracts into 13 distinct contract types which each may have multiple different contract templates and workflows. The teams are undergoing a future state workflow workshop in anticipation of the new software solution.

23. What are the languages used by CareOregon in authoring contracts?

Answer: English only.

24. How many contract temples does CareOregon have?

Answer: See answer to Question 20 above.

25. Are you considering rolling out/implementing the new system by business units or by region?

Answer: Our ideal goal is to implement all at once, however, are open to recommendations based on best practices for a different implementation approach given the complexities of the project.

26. Does CareOregon want to migrate contracts to the new system. If yes, what is the expected volume of legacy contracts which will be migrated into the new system?

Answer: See response to Question 19.

27. Do legacy contracts and associated document currently reside in a single repository or are they spread over disparate file systems? Please provide names.

Answer: See response to Question 19.

28. Does CareOregon have structured metadata for all contracts (active, legacy)?

Answer: No. For contracts in ConvergePoint, most of the data is not reliable. We are undertaking a project to do a review of legacy contracts to be migrated into the new system. We will develop core data fields that we need populated but also understand that the new system may need key data fields for the system to accept legacy contracts/data.

We will work with the selected firm to refine as needed.

29. Is it expected to capture additional metadata fields or attributes from the legacy/active contracts?

Answer: Unsure. When migrating, we want to make sure data fields accurately match the contract terms. Also we are unsure what the selected solution will require for mandatory fields. See response to Question 29.

30. What is the complexity of your metadata (20 fields 100 fields)?

Answer: Data fields range from 20 to 65 fields depending on the contacting group and contract type.

31. Does CareOregon have inhouse resources to ingest the QA/QC the in-scope contracts post migration into the system?

Answer: No.

32. Please share the Data Security Requirements and Terms and Conditions for Cloud Services

Answer: The documents may be found at: https://www.careoregon.org/contact-us/vendor-resources. Also attached to this response.

33. Please provide the number of CareOregon contract types - unique agreement types (e.g.

NDA, MSA, SOW, Lease agr, etc.)

Answer: See response to Question 20.

34. Please provide the number of Associations - other documents tied to contracts (e.g.

Insurance cert, Exhibits, Products, etc.)

Answer: Unknown at this time.

35. Can CareOregon Provide Number of Clauses - this can be estimated

Answer: Unknown. Research for an answer would be very time consuming and outside our available resources at this stage in the project. We have around 35 contract templates with some clauses being the same and then completely different clauses.

https://www.careoregon.org/contact-us/vendor-resources https://www.careoregon.org/contact-us/vendor-resources

36. How Many Templates does CareOregon manage - tied to the contract types above (e.g.

variations of SOW based on geo or LOB)

Answer: See response to Question 20.

37. Are all these legacy contracts in a structured form with metadata available? If yes, where are these stored today

Answer: No. See response to Question 29.

38. Is there a need for additional metadata extraction from contract documents before migrating this legacy data?

Answer: Possible depending on the capabilities of the selected solution and the resource demands to extract the additional information.

39. Does CareOregon currently have a procurement system?

Answer: No procurement software solution.

40. What encompasses “Procurement Functionality” for CareOregon? Is it just requisitioning or is there a desire to tie contracts into a larger procurement process?

Answer: Please carefully review Procurement/Solicitation Requirements in Section 3.2.1 of the RFP. The procurement function is a separate but connected process that occurs to select a solution/vendor and then moves into the contracting process. The ideal solution would have procurement functionality that workflows directly into the contracting workflow process.

41. How many sourcing manager/buyers does CareOregon have?

Answer: At CareOregon, departments are the business owners that identify that they need goods/services and then they either self-service the procurement process (direct or obtain 3 quotes) for lower dollar projects or seek services from the Procurement department to conduct more formal procurements (RFQ, RFP, ITB, etc.). All contracts are processed through one of the departments outlined in the RFP. Departments also request purchase orders through AvidXchange that Procurement finalizes. See response to Question 4 for more information about potential count.

42. How many supplier mangers does CareOregon have?

Answer: See response to Question 42. Unknown.

End of Clarifying Questions

CareOregon Data Security Requirements (rev 11/3/21) Page 1

EXHIBIT X

CAREOREGON DATA SECURITY REQUIREMENTS

1. CareOregon Data. CareOregon Data is defined as all confidential and proprietary business information including but not limited to contract terms, business relationships, potential collaborations, trade secrets, payor lists, Personal Information (as defined in ORS 646A.602(12)), Protected Health Information (as defined in 45 C.F.R. § 160.103), information considered confidential and restricted under other Oregon State and Federal laws, databases, strategic and financial information and other business information, the unauthorized disclosure or use of which will be highly injurious to CareOregon and its business and its relationships in amounts not readily ascertainable

2. Security Program. Contractor agrees to at all times maintain a well-documented security program that conforms to generally recognized industry standards, employ the use of at least one recognized security framework for its operations, and abide by all applicable laws or regulations. The security program must at a minimum include:

a. Oversight and management of technologies used to protect CareOregon data,

b. Proactive identification and addressing of vulnerabilities,

c. Periodic testing of security controls, and

d. Detection of and response to security events.

3. Backup and Retrieval. Contractor shall be responsible for the commercially reasonable and prudent infrastructure and maintenance of the infrastructure to provide the herein described Work. This includes, but is not limited to database backups, application backups, OS patches and upgrades, database patches and upgrades, power supply, network security, etc.

4. Third-Party Audits. Contractor agrees that a SSAE 18 audit certification (SSAE 18, issued by the

American Institute of Certified Public Accountants) will be conducted annually, and Contractor agrees to provide CareOregon with the current SSAE 18 SOC2 Type II audit certification upon CareOregon’s request.

5. CareOregon Audits. At any time during the term of the Contract CareOregon may independently, at its own expense, perform an audit or review of the security of Contractor’s systems used to store, transmit, or process CareOregon Data. Contractor agrees to respond to all reasonable requests for documentation in the execution of that audit, such as security program documentation, system security plans (SSP), architectural or technical diagrams, security policies and procedures, internal risk assessments, and other third-party security audits and/or assessments. CareOregon may issue findings or corrective actions to the Contractor as an outcome of the audit. Contractor agrees to review, respond, and remediate the findings in good faith. Any audit requests by CareOregon must be completed in a timely manner not exceeding 30 days from data of request.

6. Data Security. Contractor agrees to preserve the confidentiality, integrity, and accessibility of CareOregon

Data with administrative, technical, and physical measures that conform to generally recognized industry standards and best practices. Maintenance of a secure processing environment includes but is not limited to the timely application of patches, fixes, and updates to operating systems and applications as provided by software vendor or open-source software support.

7. Data Storage. Contractor agrees that any and all CareOregon Data will be stored, processed, and maintained solely on designated target servers in accordance with “Data Location” below. CareOregon Data must be encrypted while at rest, and in accordance with “Data Encryption Standard” below. Unless agreed to in writing, at no time will CareOregon Data be processed on or transferred to any portable or laptop computing device or any portable storage medium, unless that device or storage medium is in use as

(rev 11/3/21) Page 2 part of the Contractor’s designated backup and recovery processes and is encrypted in accordance with “Data Encryption Standard” below.

8. Data Location. Unless otherwise stated in the Scope of Work and approved in advance by CareOregon, the

Contractor will limit the storage and transmission of CareOregon Data to data centers and network paths physically located in the continental United States. This includes the Contractor’s own data center assets and any third party or subcontracted “cloud” services used by the Contractor to provide services to CareOregon.

9. Data Encryption Standard. Contractor agrees to encrypt all CareOregon Data regardless of location using commercially supported encryption solutions. Contractor agrees that all designated backup and recovery processes maintains data in encrypted form, including on recovery media. The Contractor shall ensure physical storage encryption modules are consistent with FIPS 140-2 “Security Requirements for Cryptographic Modules”. Encryption algorithms will meet or exceed the standards defined in NIST SP 800- 57 Part 3 “Recommended Key Sizes and Algorithms” and at a minimum will be deployed with no less than a 256-bit key length for symmetric encryption and a 2048-bit key length for asymmetric encryption.

10. Data Transmission. Contractor agrees that any and all electronic transmission of CareOregon data unless initiated by CareOregon, shall be transmitted in an encrypted state using encryption per Data Encryption Standard above, and take place solely in accordance with “Data Re-Use” below.

11. Data Re-Use. Contractor agrees that any and all data exchanged shall be used expressly and solely for the purposes enumerated in this Contract. Data shall not be distributed, repurposed, or shared across other applications, environment, or business units of Contractor. Contractor further agrees that no CareOregon Data of any kind shall be transmitted, exchanged, or otherwise passed to other contractors or interested parties except on a case-by-case basis as specifically agreed to in writhing by CareOregon.

12. Non-disclosure and Separation of Duties. The Contractor shall enforce separation of job duties, require commercially reasonable non-disclosure agreements, and limit staff knowledge of CareOregon Data to that which is absolutely necessary to perform job duties.

13. Data Breach. Contractor shall provide notice, either orally or in writing, to CareOregon any known, actual, or suspected compromise of the security, confidentiality, or integrity of CareOregon Data (“Data Breach”).

Such notice shall be made as promptly as possible under the circumstances and without unreasonable delay of any Data Breach, but in no event more than two (2) business days after Contractor reasonably believes there has been a Data Breach. Contractor shall use commercially reasonable efforts to contain such Data Breach and provide CareOregon with a detailed report that includes: (i) the nature of the unauthorized use or disclosure, (ii) the CareOregon Data used or disclosed, (iii) who made the unauthorized use or received the unauthorized disclosure, (iv) what Contractor has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure, and (v) what corrective action Contractor has taken or shall take to prevent future similar unauthorized use or disclosure. Contractor shall provide CareOregon with all reasonably available information regarding such Data Breach and provide supplemental information as it is discovered.

Contractor may need to communicate with outside parties regarding a Data Breach, which may include contacting law enforcement, fielding media inquiries and seeking external expertise as mutually agreed upon, defined by law or contained in the Contract. Discussing Data Breaches with CareOregon should be handled on an urgent as needed basis, as part of Contractor’s communication and mitigation processes as mutually agreed upon, defined by law, or contained in the Contract.

The Contractor shall (1) cooperate with CareOregon as reasonably requested by CareOregon to investigate and resolve the Data Breach, (2) promptly implement necessary remedial measures, if necessary, and (3)

(rev 11/3/21) Page 3 document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the Work, if necessary.

Unless otherwise stipulated, if a Data Breach is a direct result of Contractor’s breach of its contractual obligation to encrypt personal data or otherwise prevent its release as reasonably determined by CareOregon, the Contractor shall bear the costs associated with (1) the investigation and resolution of the Data Breach; (2) notifications to individuals, regulators or others required by federal and state laws or as otherwise agreed to; (3) a credit monitoring service required by state (or federal) law or as otherwise agreed to; (4) a website or a toll-free number and call center for affected individuals required by federal and state laws - all not to exceed the average per record per person cost calculated for data breaches in the United States in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the Data Breach; and (5) complete all corrective actions as reasonably determined by Contractor based on root cause.

14. Damages. Notwithstanding any other provision in this Contract (including any limitation of liability clauses), Contractor shall indemnify, hold harmless, and defend CareOregon from and against any and all costs (including without limitation, mailing, labor, administrative costs, vendor charges), fines, liabilities, and corrective action (including without limitation, notification costs, forensics, credit monitoring services, call center services, identity theft protection services, and crisis management/public relations services) arising out of the Data Breach.

15. Rights to Data. Contractor and CareOregon agree that as between them, all rights, including all intellectual property rights, in and to CareOregon Data shall remain the exclusive property of CareOregon, and Contractor has a limited, non-exclusive license to access and use CareOregon Data as provided to Contractor solely for performing its obligations under the Contract. Nothing herein shall be construed to confer any license or rights.

16. End of Agreement Data Handling. Contractor agrees that upon termination of the Contract it shall erase, destroy, and render unrecoverable all CareOregon Data and certify in writing that these actions have been completed within thirty (30) days of the termination of the Contract or within seven (7) days of the request of the CareOregon Contract Administrator, whichever comes first. At a minimum a “Clear” media sanitation is to be performed according to the standards enumerated by the National Institute of Standards, Guidelines for Media Sanitation, SP800-88, Appendix A (csrc.nist.gov).

17. Subcontractors. Contractor shall require all subcontractors that have access to CareOregon Data comply with these CareOregon Data Security Requirements. Upon request by CareOregon, Contractor shall disclose to CareOregon all subcontractors or service providers that have access to CareOregon Data.

18. Legally Required Disclosures. If Contractor is required to disclose CareOregon Data pursuant to the order of a court or administrative body of competent jurisdiction or a government agency, Contractor shall: (i) if practicable and permitted by law, notify CareOregon prior to such disclosure, and as soon as possible after such order; (ii) cooperate with CareOregon (at CareOregon’s costs and expense) in the event that CareOregon elects to legally contest, request confidential treatment, or otherwise attempt to avoid or limit such disclosure; and (iii) limit such disclosure to the extent legally permissible.

19. Contractor shall provide to CareOregon relevant contact information for a Contractor’s employee who

CareOregon may contact any time should any security related questions, or concerns arise.

http://www.csrc.nist.gov/

(Rev 11/3/21) Page 1

Exhibit X Terms and Conditions for Cloud Services

1. DEFINITIONS

The following terms shall have the meaning set forth below for purposes of these Terms and Conditions for the Purchase of Cloud Services:

1.1. “Authorized User” means an employee, consultant, provider, contractor, or other agent of a

CareOregon authorized to access and use the Cloud Service on behalf of CareOregon, and, if applicable, a patient or member of CareOregon and their authorized representatives and family members.

1.2. “Cloud Service” means a Contractor hosted software or platform, or Online Content, that is made available for CareOregon's use via the Internet. Cloud Service includes the software application, platform, content, Documentation, hosting, management, support and maintenance services, together with all Updates and workarounds, corrections, modifications, and improvements, provided by Contractor under the Vendor Agreement. Any services, functions, processes and responsibilities, whether or not specifically described in the Vendor Agreement, that are required for or inherent in the proper performance and delivery of the Cloud Service described therein shall be deemed to be part of the Cloud Service. The Cloud Service is the Services within the meaning of the Contract.

1.3. “Contract” means the contract documents entered into between the Contractor and CareOregon that these Terms and Conditions for Clouds Services are incorporated by reference to.

1.4. “Documentation” means all reference and user manuals and guides describing the Cloud Service and other supporting technical information, materials and documentation.

1.5. “Go-Live Date” means the date CareOregon's production usage of the Cloud Service commences.

1.6. “Implementation Services” means professional services provided by Contractor to configure and implement the Cloud Service and as otherwise specified in an applicable Contract.

Implementation Services shall not include software development or customization.

Implementation Services are a Service within the meaning of the Contract.

1.7. “CareOregon” has the meaning set forth in the Contract.

1.8. “CareOregon Data” means all data and information entered into the Cloud Service by

Authorized Users and as set forth in the Contract.

1.9. “Online Content” means content, knowledgebases, databases or other information or data that is made available for CareOregon's use via the Internet.

1.10. “Service Levels” means the levels of performance Contractor is required to provide for the

Cloud Service, as set forth in the Documentation and/or Vendor Agreement.

1.11. “Specifications” means the features, functions, performance requirements, acceptance criteria, interface specifications and other technical or functional specifications applicable to the Cloud Service(s) that are identified or referenced in the Vendor Agreement and the Documentation.

1.12. “Contractor Infrastructure” means the computer hardware, software, communications systems, network and other infrastructure used by Contractor to host and provide the Cloud Service.

1.13. “Updates” shall mean any modifications, error corrections, bug fixes, new releases, updates and upgrades to the Cloud Service (and any related Documentation) that may be provided or otherwise made generally available by Contractor from time to time to customers of the Cloud Service.

2. CLOUD AND IMPLEMENTATION SERVICES

2.1. Provision of Cloud and Implementation Services. Contractor shall provide the Cloud Service and Implementation Services (if applicable) in accordance with the Vendor Agreement and any applicable Service Levels, including, setup, configuration, operation, and management of Contractor Infrastructure required by Contractor to host, operate, maintain, and provide the Cloud Service. Contractor will provide CareOregon and its Authorized Users with access via the public Internet to the Cloud Service, including all identification numbers, keys and passwords

(Rev 11/3/21) Page 2 and Documentation which CareOregon and Authorized Users may require to access and use the Cloud Services, commencing on the Go-Live Date. Contractor hereby grants to CareOregon and the Authorized Users a worldwide, non-exclusive right and license to (i) access, execute, use, perform, and display the Cloud Service for the benefit of CareOregon, (ii) modify, publish, transmit, create derivative works of Online Content for the benefit of CareOregon; and (ii) reproduce, distribute, and display the Documentation to Authorized Users. The rights granted by Contractor hereunder include the right of CareOregon to have such rights exercised by third parties on its behalf. Contractor and its licensors own and shall retain all intellectual property rights in and to the Cloud Service (excluding CareOregon Data) and Documentation and the Contractor Infrastructure.

2.2. Maintenance and Support for Cloud Service. Contractor shall provide maintenance and support regarding the Cloud Service, including as applicable: (i) causing the Cloud Service to operate according to the Specifications and correcting reported errors; (ii) performing preventive maintenance on the Contractor Infrastructure; and (iii) providing periodic Updates to the Cloud Service and Contractor Infrastructure, including at least all Updates made generally available to Contractor’s customers. Notwithstanding the foregoing, (a) no Update shall serve to reduce the features and functionality, or the scope of Cloud Service provided under the Vendor agreement without CareOregon's prior written consent; and (b) any Update that requires a change to CareOregon's systems, processes or manner of access to the Cloud Service shall be subject to CareOregon's prior written approval. To the extent Contractor acquires some or all components of the Cloud Service and associated Contractor Infrastructure from third parties, Contractor shall be responsible for obtaining appropriate Updates and upgrades from such third-party suppliers and applying them in a manner that does not disrupt the provision of the Cloud Service.

2.3. Protection against Malicious Code and Disabling Devices. Contractor will not knowingly introduce any malware, viruses, worms, Trojan horses, spyware, logic bombs, disabling code, other computer instructions, devices, techniques or other malicious code into the Cloud Service that can or were designed to threaten, infect, assault, vandalize, defraud, disrupt, damage, disable, alter, inhibit or shut down the Cloud Service or CareOregon's processing environment, or intended by Contractor to limit the use of the Cloud Service to particular computers, servers or processors/CPUs ("Malicious Code"). Contractor will implement reputable and industry standard virus detection/scanning program(s) to scan all files transmitted to CareOregon and all Contactor Infrastructure used to provide the Cloud Services. Contractor shall continuously update such virus detection/scanning program(s) for the detection, prevention, and recovery to protect against Malicious Code and will also implement appropriate user awareness procedures.

2.4. Restrictions on Use of Cloud Service. Except for use by Authorized Users as permitted herein, CareOregon may not (i) sell, assign, sublicense or otherwise transfer the Cloud Service to third parties outside of CareOregon, (ii) resell the Cloud Service to third parties outside of CareOregon; (iii) use the Cloud Service to provide or perform service bureau processing, or hosting services for any third party outside of CareOregon; or (iv) use the Cloud Service to knowingly transmit malware, spam or other unsolicited emails in violation of Law, or to post or send any unlawful, threatening, harassing, racist, abusive, libelous, pornographic, defamatory, obscene, or other similarly inappropriate content.

2.5. Prohibited Tracking. Without CareOregon's prior written approval, Contractor shall not do any of the following: (i) implant any "cookies" on any computer of CareOregon or its Authorized Users, except as necessary for the Cloud Service to perform for CareOregon in conformity with its Documentation (and not for purposes of monitoring users or usage within or outside of the Cloud Service) or as explicitly authorized in writing by CareOregon, (ii) track the Internet usage or other computer usage of CareOregon and its Authorized Users except as explicitly authorized in writing by CareOregon, (iii) use any data or information of CareOregon or Authorized Users

(Rev 11/3/21) Page 3 to directly or indirectly market products or services to CareOregon or Authorized Users, and (iv) transfer or sell any lists of Authorized Users to any third party.

2.6. Implementation Services. If Implementation Services are required in the Vendor Agreement, Contractor shall provide such Implementation Services on the terms and schedule set forth therein. The performance of any software development or customization services is outside the scope of the Vendor Agreement.

2.7. Acceptance Testing. If Acceptance Testing is provided in the Vendor Agreement, CareOregon shall have at least thirty (30) days from the Delivery Date of the Cloud Service to perform initial acceptance testing of the Cloud Service ("Acceptance Period"). At the end of the Acceptance Period, CareOregon either inform Contractor that Cloud Service is accepted or identify in reasonable detail why the Cloud Service failed to meet the applicable Specifications. Contractor shall have ten (10) business days to address CareOregon’s concerns. If, at the end of such ten

(10) business day period, CareOregon determines the Cloud Service continues to fail to meet its Specifications, CareOregon may, at its option, either (i) terminate the Vendor Agreement and receive a refund of any fees paid, or (ii) extend the time for Contractor to address CareOregon’s concerns. CareOregon's acceptance of the Cloud Service will not limit the obligations of Contractor under the warranty or Service Level provisions of the Vendor Contract.

2.8. Additional Invoicing Requirements. In addition to the invoicing and payment requirements in the Contract, unless otherwise set forth in the Vendor Contract, Contractor will not invoice CareOregon and CareOregon shall not be obligated to pay any fees: (a) for the Cloud Service until the Go-Live Date has occurred; and (b) for Implementation Services until Contractor has completed the Implementation Services and they have been accepted by CareOregon.

3. CareOregon DATA

3.1. Risk of Data Loss. In the event any CareOregon Data is damaged, lost or destroyed due to any act or omission of Contractor, Contractor shall be responsible for the prompt regeneration or replacement of such information. Contractor shall prioritize this effort so that the loss will not have an adverse effect upon CareOregon's business or Contractor’s provision of the Cloud Service. CareOregon agrees to cooperate with Contractor to provide any available information, files or raw data needed for the regeneration of the lost information. If Contractor fails to correct or regenerate the lost or destroyed information within the period of time reasonably set by CareOregon, then CareOregon may obtain data reconstruction services from a third party, and Contractor shall cooperate with such third party as requested by CareOregon.

3.2. Disposition of CareOregon Data upon Expiration or Termination. Upon expiration or termination of the Vendor Agreement (or as part of Transition Assistance, if applicable), Contractor will either provide CareOregon Data in Contractor’s or its subcontractors' possession to CareOregon in the format(s) reasonably requested by CareOregon or CareOregon's designee and destroy any residual copies in its/their possession or destroy the CareOregon Data without providing a copy to CareOregon, as directed by CareOregon. Contractor shall not be obligated to destroy CareOregon Data maintained in archival form if destruction is infeasible, and any such CareOregon Data retained shall only be used for archival purposes and will remain subject to the confidentiality terms of the Contract, and the requirements in the CareOregon Data Security Requirements and/or any applicable business associate agreement.

4. TRANSITION ASSISTANCE

Contractor shall provide the transition assistance ("Transition Assistance") described in this Section and shall cooperate in an orderly and efficient transition to CareOregon or to a successor vendor of CareOregon commencing upon CareOregon request and continuing for a period up to thirty (30) days after the end of the Term (the "Transition Period"). Except as otherwise mutually agreed by the parties, during the Transition Period, Contractor will continue to provide the same level and quality of the Cloud

(Rev 11/3/21) Page 4

Service required under the Vendor Agreement as in effect during the period ninety (90) days prior to the start of the Transition Period and CareOregon will pay the same fees therefor during the Transition Period. The parties acknowledge and agree that the overriding principle of the transition shall be maintenance of the continuity of the Cloud Service and CareOregon’s satisfaction; and Contractor agrees to provide all services reasonably required by CareOregon to achieve this principle and a seamless transition. Contractor shall provide Transition Assistance to CareOregon or its designee regardless of the reason for the expiration or termination of the Vendor Agreement. Termination of the Vendor Agreement shall not act as a waiver of any breach of the Vendor Agreement and shall not act as a release of either party from any liability for breach of such party's obligations under the Vendor Agreement.