Third Party Terms

By submitting electronic case reports directly or indirectly to the Association of Public Health Laboratories, Inc. (“APHL”), you (“you”) and on behalf of the healthcare provider licensing the software submitting reports (collectively “Participant”) are agreeing to the terms and conditions set forth in this Electronic Case Reporting Participation Terms and Conditions (the “T&Cs”). As used in these T&Cs, APHL and Participant are sometimes referred to herein as a “Party” and collectively as the “Parties.”

Background

1. Participant, either on its own behalf or on behalf of one or more healthcare providers utilizing the Participant’s electronic health record (“EHR”) system, desires to electronically Transmit Electronic Initial Case Reports (“eICRs”) (i) to match reportable conditions to Public Health Authorities in jurisdictions in which infectious, communicable, or other diseases or conditions are reportable, and (ii) for the purpose of public health reporting of such case reports to the applicable Public Health Authorities;
2. APHL, through funding from the Centers for Disease Control and Prevention or other funding sources, seeks to assist Participant with electronic case reporting to Public Health Authorities without charge to Participant; and
3. As a condition of Transmitting information to APHL for electronic case reporting, an entity must either (i) agree to these T&Cs, or (ii) enter into the eHealth Exchange Data Use and Reciprocal Support Agreement under which APHL provides the AIMS Platform (as defined below) as a subcontractor to Healtheway, Inc.

Terms and Conditions of Use

1. Definitions. For the purposes of these T&Cs, the following capitalized terms shall have the meaning ascribed to them below. All definitions contained in the Business Associate Addendum are incorporated herein by this reference. In addition, other capitalized terms defined within these T&Cs shall have the meanings assigned to such terms throughout these T&Cs.

   Applicable Law means all applicable statutes and regulations of the State(s) or jurisdiction(s) in which a Party operates, as well as all applicable Federal statutes, regulations, standards and policy requirements.

   AIMS Platform means the APHL Informatics Messaging Services Platform, a secure cloud-based environment which aids in the transport, validation and routing of electronic health and laboratory data that hosts the RCKMS.

   APHL Services means receipt of eICRs from Participant using the RCKMS and the AIMS Platform, and the submission of eICRs to the applicable Public Health Authorities on behalf of Participant if Participant has elected to have APHL make such submissions.

   Business Associate has the meaning set forth at 45 C.F.R. § 160.103 of the HIPAA Regulations.

   Business Associate Addendum means the business associate agreement as defined at 45 C.F.R. § 160.103 of the HIPAA Regulations for the protection of PHI in the form attached here to as Attachment 2.

   Confidential Information means proprietary or confidential materials or information of a Discloser in any medium or format. Confidential Information includes, but is not limited to: (a) the Discloser’s designs, drawings, procedures, trade secrets, processes, specifications, source code, system architecture, security measures, research and development, including, but not limited to, research protocols and findings, passwords and identifiers, new products, and marketing plans; (b) proprietary financial and business information of a Discloser; and (c) information or reports provided by a Discloser to a Receiving Party pursuant to these T&Cs. Notwithstanding any label to the contrary, Confidential Information does not include: (i) eICRs; (ii) any information which is or becomes known publicly through no fault of a Receiving Party; (iii) any information which is learned of by a Receiving Party from a third party entitled to disclose it; (iv) any information which is already known to a Receiving Party before receipt from a Discloser as documented by Receiving Party’s written records; or (v) any information which is independently developed by Receiving Party without reference to, reliance on, or use of, Discloser’s Confidential Information. eICRs are excluded from the definition of Confidential Information because other provisions of these T&Cs and the Business Associate Addendum address the appropriate protections for eICRs.

   CSTE means the Council of State and Territorial Epidemiologists.

   Days shall mean calendar days unless otherwise specified.

   Discloser means a Party that discloses Confidential Information to a Receiving Party.

   Effective Date means the date specified in Section 19.11 of these T&Cs.

   Electronic Initial Case Report or eICR means an electronic case report of an infectious, communicable, or other disease or condition that matches a RCTC. An eICR includes, but is not limited to, Protected Health Information, and individually identifiable information, and is Transmitted to the RCKMS in order to determine Participant’s public health reporting requirements with respect to the eICR.

   EHR means a company or other organization that will support Participant by providing them with an electronic health records system that creates an eICR that matches an infectious, communicable, or other disease or condition to an RCTC.

   Federal Programs means contracts, subcontracts, grants, and non-procurement transactions issued by or developed under the auspices of one or more agencies of the Federal government.

   Health Care Provider has the meaning set forth at 45 C.F.R. § 160.103 of the HIPAA Regulations.

   HIPAA Regulations means the Standards for Privacy of Individually Identifiable Health Information and the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164) promulgated by the U.S. Department of Health and Human Services under the Health Insurance Portability and Accountability Act (HIPAA) of 1996, as in effect on the Effective Date of these T&Cs and as may be amended, modified, or renumbered.

   Notice or Notification means a written communication, unless otherwise specified in this Agreement, sent to the appropriate Party’s representative at the address listed in Attachment 1.

   Permitted Purpose means public health reporting to a Public Health Authority as permitted by 45 C.F.R. § 164.512(b), and such other purposes as may be approved in an amendment to these T&Cs, so long as such purpose is permitted by Applicable Law.

   Protected Health Information or PHI has the meaning set forth at 45 C.F.R. § 160.103 of the HIPAA Regulations.

   Public Health Authority has the meaning set forth at 45 C.F.R. § 164.501 of the HIPAA Regulations.

   Receiving Party means a Party that receives Confidential Information from a Discloser.

   Reportability Response means the determination that an eICR is reportable to a public health authority, as determined by the RCKMS, and communicated by APHL to the Participant.

   Reportable Condition Knowledge Management System or RCKMS means the system developed and maintained on behalf of CSTE, which resides on a portion of the AIMS Platform, and evaluates eICRs by matching Reportable Condition Trigger Codes against the reporting criteria of Public Health Authorities in jurisdictions in which infectious, communicable, or other diseases or conditions are reportable and determines on behalf of Participant whether an instance of infectious, communicable, or other disease or condition is reportable to a Public Health Authority.

   Reportable Condition Trigger Codes or RCTC means the national set of codes to be implemented by participating EHRs in their electronic health record systems, which encompasses infectious, communicable, or other diseases or conditions that are reportable in any state or jurisdiction in the United States.

   Specifications means the specifications adopted by APHL to prescribe the data content, technical, and security requirements to enable the Participant to Transmit eICRs to the RCKMS, and any implementation guidance, migration plans and other technical materials and resources adopted by APHL in accordance with Section 7.2 of these T&Cs.

   System means software, portal, platform, or other electronic medium controlled by Participant or APHL through which Participant and APHL will Transmit eICRs under these T&Cs.

   Technology Resources means software, utilities, automated tools and digital content that may be made available to Participant for use in connection with the transmission of eICRs pursuant to these T&Cs. Initially, the only Technology Resources to be provided to Participant are the RCTCs.

   Transmit (including variants of Transmit) means the automated electronic transmission of eICRs in accordance with the Specifications.

2. Purpose. The purpose of these T&Cs is to provide a legal framework to enable Participant to Transmit eICRs to APHL using the Specifications in order for APHL to Transmit Reportability Responses to Participant and, if the Participant so elects, to Transmit eICRs to Public Health Authorities as authorized or required by Applicable Law on Participant’s behalf. Participant acknowledges that the project may initially encompass a subset of reportable conditions as identified to Participant by APHL.

3. Authority of APHL. Participant hereby grants to APHL the authority to provide oversight, facilitation and support for all participants who Transmit eICRs in accordance with the eICR project by conducting activities including, but not limited to, the following:

   3.1 Suspending or terminating Participant in accordance with Section 15 of these T&Cs (Term, Suspension and Termination); and 3.2 Managing the amendment of these T&Cs in accordance with Section 19.2 of these T&Cs.

4. Use of eICRs.

   4.1 Solely for Permitted Purpose. The Transmission of eICRs shall be solely for the Permitted Purpose as defined in these T&Cs.

   4.2 Reporting Election. When Participant signs these T&Cs it shall indicate in the manner provided on the last page of these T&Cs if it elects to have APHL Transmit reportable eICRs to applicable Public Health Authorities on its behalf, or if it elects to report reportable eICRs itself. In either case, the AIMS Platform will route an associated Reportability Response to Participant. Notwithstanding Participant’s election, APHL may report eICR counts and involved condition counts to the Centers for Disease Control and Prevention (“CDC”) in response to CDC’s request, in connection with a public health emergency, to the extent permitted or Required by Law.

5. Enterprise Security.

   5.1 General. Each Party shall be responsible for maintaining a secure environment that supports the Transmission of eICRs in accordance with the Specifications. The Parties shall use appropriate safeguards to prevent use or disclosure of eICRs other than as permitted by these T&Cs, including appropriate administrative, physical, and technical safeguards that protect the confidentiality, integrity, and availability of eICRs.

   5.2 Malicious Software. Each Party shall ensure that it employs security controls that meet applicable industry or Federal standards so that the information and eICRs being Transmitted and any method of Transmitting such information and eICRs will not introduce any viruses, worms, unauthorized cookies, trojans, malicious software, “malware,” ransomware, or other program, routine, subroutine, or data designed to disrupt the proper operation of a System or any part thereof or any hardware or software used by a Party in connection therewith, or which, upon the occurrence of a certain event, the passage of time, or the taking of or failure to take any action, will cause a System or any part thereof or any hardware, software or data used by a Party in connection therewith, to be improperly accessed, destroyed, damaged, or otherwise made inoperable.

   5.3 Auditing. Each Party represents that, through its agents, employees, and independent contractors, it has the ability to monitor and audit all access to and use of its System related to these T&Cs, for system administration, security, and other appropriate purposes. Each Party shall perform those auditing activities required by Applicable Law.

6. Equipment and Software. Each Party shall be responsible for procuring all equipment and software necessary for it to Transmit eICRs. Each Party shall ensure that all computers and electronic devices owned or leased by the Party to be used to Transmit eICRs are properly configured, including, but not limited to, the base workstation operating system, web browser, and Internet connectivity.

7. Specifications.

   7.1 Specifications. Participant shall comply with the Specifications identified by APHL as applicable to all participants in the eICR project.

   7.2 Adoption of Specifications. Participant hereby grants APHL the right to adopt new Specifications, and to adopt amendments to, or repeal and replacement of, the Specifications at any time.

   7.3 Notice of Specification Changes. APHL shall provide Notice of new, amended, repealed or replaced Specifications at least thirty (30) Days prior to the effective date of such new, amended, repealed or replaced Specifications. Within fifteen (15) Days of receiving Notice of the new, amended, repealed or replaced Specifications, Participant may request that APHL delay implementation of such the new, amended, repealed or replaced Specifications based on good cause. APHL shall respond to a request to delay implementation within seven (7) Days of receiving the request. If, as a result of a change made by APHL in accordance with this Section 7.3, Participant will not be able to comply with the Specifications or does not otherwise desire to continue to Transmit eICRs after such change becomes effective, then Participant shall terminate its participation in these T&Cs accordance with Section 15.2. Notwithstanding the Notice period specified above, APHL may implement a change without prior Notice if it determines in its reasonable discretion that implementing the change is necessary for the ongoing operation of the RCKMS or AIMS Platform. APHL will provide prompt Notice of such a change to Participant (not to exceed seven (7) Days after such a change is implemented), and Participant may in its discretion immediately terminate these T&Cs in response to such a change by giving Notice to APHL.

8. Expectations of Participant.

   8.1 Accurate Participant Information. Except to the extent prohibited by Applicable Law, Participant shall provide APHL with all information reasonably requested by APHL and needed by APHL to discharge its duties under these T&Cs or Applicable Law. Participant shall provide Notice to APHL if any information provided by Participant to APHL materially changes. Participant acknowledges that APHL reserves the right to confirm the completeness and accuracy of any information provided by Participant at any time and Participant shall reasonably cooperate with APHL in such actions, given reasonable prior Notice.

   8.2 Agreements with EHRs. To the extent that Participant uses an EHR in connection with Participant’s Transmissions of eICRs, Participant represents that the EHR has contractual and legal authority to make such Transmissions on its behalf.

   8.3 Accuracy of eICRs. Participant will ensure that at the time of transmission, the eICR it provides is (a) an accurate representation of the data contained in, or available through, its System, and (b) sent from a System that employs security controls that meet industry standards so that the information and eICR being transmitted are intended to be free from malicious software in accordance with Section 5.2.

   8.4 License to Technology Resources. Participant is hereby granted a nonexclusive, nontransferable, revocable and limited license to Technology Resources solely for use in performance of these T&Cs. Participant shall not: (a) sell, sublicense, transfer, or exploit Technology Resources, other than pursuant to these T&Cs; (b) use any Technology Resources for Participant’s own financial benefit or any commercial purpose; or (c) reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code to any Technology Resources. THE TECHNOLOGY RESOURCES ARE PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT ANY WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.

9. Specific Duties of APHL. APHL is responsible for the operation of the AIMS Platform and providing a host environment on the AIMS Platform for RCKMS. When APHL Transmits an eICR to a Public Health Authority for the Permitted Purpose on behalf of Participant that has elected to have APHL make such Transmissions, APHL shall be responsible for Transmitting the eICR in compliance with Applicable Law, these T&Cs and the applicable Specifications. APHL shall use eICRs only in accordance with the terms of these T&Cs.

10. Business Associate Addendum. Simultaneously with agreeing to these T&Cs, Participant is also agreeing to the terms and conditions set forth in the Business Associate Addendum in the form attached hereto as Attachment 2.

11. Representations, Warranties and Covenants of Participants and APHL

    11.1 Mutual Representations, Warranties and Covenants. APHL and Participant hereby represent, warrant or covenant the following:

    a. Authority. The Participant affirms that it has full power and authority to accept, and perform the obligations set forth in, these T&Cs and has taken whatever measures necessary to obtain all required approvals or consents in order for it to execute these T&Cs. You, as the representative accepting these T&Cs on behalf of the Participant, affirms that you have been properly authorized and empowered to accept these T&Cs on behalf of the Participant.

    b. Compliance with this Agreement. Except to the extent prohibited by Applicable Law, APHL and Participant shall comply fully with all provisions of these T&Cs. To the extent that either Party delegates its duties under these T&Cs to a third party (by contract or otherwise), that delegation shall be in writing and require the third party, prior to Transmitting eICRs, or providing other APHL Services on behalf of APHL, to agree to the same restrictions and conditions that apply through these T&Cs to the respective Party. APHL will be responsible for the performance of third parties when performing any APHL Services under these T&Cs, as if APHL had directly performed such APHL Services.

    c. Compliance with Laws. Participant and APHL shall, at all times, fully comply with all Applicable Law relating to these T&Cs and the Transmission of eICRs.

    11.2 APHL Representations, Warranties and Covenants. APHL hereby represents and, warrants or covenants to Participant the following:

    a. Intellectual Property Claims. as of the Effective Date, to the knowledge of APHL, neither the AIMS Platform nor the RCKMS is subject to any pending, threatened or asserted third party claim of intellectual property infringement.

    b. Authority to License. APHL has authority to license Technology Resources to Participant and to use Technology Resources (including RCTCs), the AIMS Platform, and the RCKMS as provided in these T&Cs.

    c. Federal Program Eligibility. APHL is not excluded, debarred, or otherwise ineligible from participating in Federal Programs. APHL shall immediately provide Notice to Participant if it is suspended, proposed for debarment or other exclusion, or otherwise disqualified or declared ineligible from participating in a Federal Program for any reason, or is a party to a legal proceeding that may result in any such action.

12. Confidential Information.

    12.1 Each Receiving Party shall hold all Confidential Information in confidence and agrees that it shall not, during the term or after the termination of these T&Cs, disclose to any person or entity, nor use for its own business or benefit, any information obtained by it in connection with these T&Cs, unless such use or disclosure is permitted by the terms of these T&Cs.

    12.2 Confidential Information may be disclosed as required by operation of law, provided that the Receiving Party immediately notifies the Discloser of the existence, terms and circumstances surrounding such operation of law to allow the Discloser its rights to object to such disclosure. If after Discloser’s objection, the Receiving Party is still required by operation of law to disclose Discloser’s Confidential Information, it shall do so only to the minimum extent necessary to comply with the operation of the law and shall request that the Confidential Information be treated as such.

13. Insurance.

    13.1 On or prior to the first date that APHL delivers the APHL Services to Participant under these T&Cs, APHL shall obtain the following policies of insurance:

    a. Worker’s compensation and employer’s liability insurance in amounts required under the laws of the one or more states in which the APHL Services are to be performed;

    b. Comprehensive commercial general liability and automobile liability insurance with a combined single limit for bodily injury and property damage of at least $1,000,000 per occurrence;

    c. Cyber liability insurance with annual coverage limits of at least $10,000,000; and

    d. Secondary blanket commercial liability or umbrella liability insurance with annual coverage limits of at least $5,000,000.

    13.2 APHL shall maintain such insurance during the term of these T&Cs and following the termination of these T&Cs in accordance with the terms of Section 19.4 (Survival).

    13.3 Upon reasonable request from Participant, APHL shall provide certificates or adequate proof or evidence of such insurance or shall use commercially reasonable efforts to designate Participant as an additional insured on such insurance policies and to deliver a certificate of insurance evidencing that Participant has been added as an additional insured.

    13.4 Participant shall maintain the following policies of insurance while it is a party to these T&Cs:

    a. Comprehensive commercial general liability and automobile liability insurance with a combined single limit for bodily injury and property damage of at least $1,000,000 per occurrence; and

    b. Cyber liability insurance with annual coverage limits reasonably sufficient to cover any cyber liability associated with Participant’s Transmission of eICR to APHL.

14. Disclaimers; Liability.

    14.1 Reliance on a System. Participant acknowledges and agrees that at the time an eICR is Transmitted, the information and such eICR Transmitted are an accurate representation of data contained in, or available through, its System. Nothing in these T&Cs shall be deemed to impose responsibility or liability on Participant related to the clinical accuracy, content or completeness of any eICR provided pursuant to these T&Cs.

    14.2 Patient Care. Participant, if he/she/it is a Health Care Provider, shall be responsible for all decisions and actions taken or not taken involving patient care, utilization management, and quality management for his/her/its respective patients and clients. APHL, by virtue of executing these T&Cs, does not assume any role in the care of any patient and will not be responsible for any decision or action involving patient care.

    14.3 Carrier Lines. Transmission of eICRs is to be provided over various facilities and communications lines, and information shall be transmitted over local exchange and Internet backbone carrier lines and through routers, switches, and other devices (collectively, “carrier lines”) owned, maintained, and serviced by third-party carriers, utilities, and Internet service providers, all of which may be beyond the Parties’ control. Provided a Party uses reasonable security measures no less stringent than those directives, instructions, and specifications contained in these T&Cs and the Specifications, the Parties assume no liability for or relating to the integrity, privacy, security, confidentiality, or use of any information while it is transmitted over those carrier lines, which are beyond the Parties’ control, or any delay, failure, interruption, interception, loss, transmission, or corruption of any eICR or other information attributable to transmission over those carrier lines which are beyond the Parties’ control. Use of the carrier lines is solely at the Parties’ risk and is subject to all Applicable Law.

    14.4 No Warranties. EXCEPT AS STATED IN SECTION 11, APHL SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT ANY WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. EXCEPT AS STATED IN SECTION 11, DATA IS PROVIDED BY PARTICIPANT “AS IS” AND “AS AVAILABLE” WITHOUT ANY WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. THE PARTIES EACH DISCLAIM ANY AND ALL LIABILITY FOR ERRONEOUS TRANSMISSIONS AND LOSS OF SERVICE RESULTING FROM COMMUNICATION FAILURES BY TELECOMMUNICATION SERVICE PROVIDERS OR OTHER THIRD PARTIES.

    14.5 Liability.

    A. Each Party shall be responsible for its acts and omissions and not for the acts or omissions of the other Party.

    B. IN NO EVENT SHALL EITHER PARTY TO THESE T&CS, ANY RELATED ENTITY OF EITHER PARTY, INCLUDING THEIR OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, SUCCESSORS AND ASSIGNS, OR, WITH RESPECT TO APHL, CSTE OR ANY SUPPLIER OF ApHL, BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES (INCLUDING WITHOUT LIMITATION LOST OR IMPUTED PROFITS, LOST SAVINGS, BUSINESS INTERRUPTION, LOSS OF BUSINESS OR GOODWILL, LOST DATA, OR COST OF PROCUREMENT OF SUBSTITUTE SERVICES) ARISING OUT OF THESE T&CS OR PARTICIPANT’S USE OR INABILITY TO USE THE APHL SERVICES, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

    C. APHL’s AGGREGATE LIABILITY UNDER THESE T&CS TO participant (INCLUDING WITHOUT LIMITATION BASED ON THE ACCURACY OR VALIDITY OF DATA) UNDER CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHER LEGAL THEORY, REGARDLESS OF THE CAUSE OF ACTION, WILL NOT EXCEED FIVE HUNDRED DOLLARS ($500).

    D. THE FOREGOING LIMITAIONS ON LIABILITY AND DAMAGES SHALL NOT APPLY TO A PARTY’S GROSS NEGLIGENCE, OR WILLFUL MISCONDUCT.

    14.6 Effect of T&Cs. Except as expressly provided in these T&Cs, nothing in these T&Cs shall be construed to restrict a Party’s right to pursue all remedies available under law for damages or other relief arising from acts or omissions of the other Party related to these T&Cs, or to limit any rights, immunities, or defenses to which a Party may be entitled under Applicable Law.

15. Term, Suspension and Termination.

    15.1 Term. The initial term of these T&Cs shall be for a period of one year commencing on the Effective Date. Upon the expiration of the initial term, these T&Cs shall automatically renew for successive one-year terms unless terminated pursuant to this Section 15.

    15.2 Suspension or Termination by Participant.

    a. Participant may voluntarily suspend its own right to Transmit eICRs, by informing APHL of its voluntary suspension. Once Participant has provided Notice to APHL of its voluntary suspension, Participant shall not Transmit eICRs until the voluntary suspension has ended and Participant has provided Notice to APHL that the suspension has ended. During the period of the voluntary suspension, Participant’s inability to Transmit eICRs and comply with those terms these T&Cs that require Transmission of eICRs shall not be deemed a breach of these T&Cs. Any voluntary suspension shall be for no longer than ten (10) Days or for more than forty (40) Days during any twelve (12) month period, unless a longer period is agreed to by APHL.

    b. Participant may terminate its own right to participate under these T&Cs, with or without cause, by giving APHL at least seven (7) Days’ prior Notice, or as otherwise provided for in these T&Cs.

    15.3 Suspension or Termination by APHL. APHL may suspend or terminate Participant’s right to Transmit eICRs as follows:

    a. When there is a substantial likelihood that Participant’s acts or omissions create an immediate threat or will cause irreparable harm to one or more other participants in the eICR project, integrity or operation of the Specifications, or an individual whose eICR is Transmitted using the Specifications, APHL shall have the power to temporarily suspend Participant’s right to Transmit eICRs for a period of thirty (30) days by delivery of Notice thereof to Participant and, in the event that Participant has not substantially cured or corrected such acts or omissions by the end of the suspension period and there remains a likelihood Participant might create such immediate threat or cause such irreparable harm, APHL shall have the power to immediately terminate Participant’s right to Transmit eICRs without the need for further Notice; or

    b. In the event Participant is in material default of the performance of a duty or obligation imposed upon it by these T&Cs and such default has not been substantially cured within thirty (30) Days following receipt by Participant of Notice thereof from APHL, APHL shall have the power to immediately terminate Participant’s right to Transmit eICRs without the need for further Notice; or

    c. In the event APHL determines to terminate the eICR project, or APHL determines to discontinue operating the AIMS Platform or RCKMS or learns that CSTE will be unable to continue to support or maintain the RCKMS, it may terminate these T&Cs and Participant’s right to transmit eICRs by giving Participant at least thirty (30) Days’ prior Notice.

    15.4 Effect of Termination. Upon any termination of these T&Cs for any reason, Participant shall have no rights to Transmit eICRs to APHL. Certain provisions of these T&Cs survive termination, as more fully described in Section 19.4 (Survival).

16. Cooperation. To the extent not legally prohibited, Participant shall: (a) cooperate fully with APHL with respect to these T&Cs; and (b) provide such information to APHL as it may reasonably request for purposes of performing activities related to these T&Cs.

17. Notices. All Notices to be made under these T&Cs to the Participant shall be given in writing to the contact you listed on the intake form. All Notices to be made under these T&Cs to APHL shall be given to the address listed in Attachment 1 to this Agreement. Any Notice shall be deemed given: (a) upon delivery, if personally delivered; (b) upon the date indicated on the return receipt, when sent by the United States Postal Service Certified Mail, return receipt requested; and (c) if by facsimile telecommunication or other form of electronic transmission, upon receipt when the Notice is directed to a facsimile telecommunication number or electronic mail address listed on Attachment 1 and the sending facsimile machine or electronic mail address receives confirmation of receipt by the receiving facsimile machine or electronic mail address.

18. Exempt Organization Restrictions. As required under Section 501(c)(3) of the Internal Revenue Code of 1986, as amended, no part of a nonprofit tax-exempt Participant’s earnings shall inure to the benefit of, or be distributable to, its members, trustees, officers, or other private persons, except that nonprofit tax-exempt Participant shall be authorized and empowered to pay reasonable compensation for services rendered and to make payments and distributions in furtherance of the purposes of the eICR project.

19. Miscellaneous/General.

    19.1 Governing Law. In the event of any controversy, dispute, or disagreement arising out of or relating to these T&Cs between or between the Parties, the applicable Federal and State conflicts of law provisions that govern the operations of the Parties shall determine governing law.

    19.2 Amendment. These T&Cs may be amended by APHL at any time by posting an updated version to the eCR website.

    19.3 Assignment. Participant shall not assign or transfer these T&Cs, or any part thereof, without the express written consent of APHL. Any assignment that does not comply with the requirements of this Section 19.3 shall be void and have no binding effect.

    19.4 Survival. The rights and obligations of the Parties which by intent or meaning have validity beyond termination of these T&Cs, including, but not limited to, the provisions of Sections 1 (Definitions), the last sentence of Section 8.4 (License to Technology Resources), 12 (Confidential Information), 13 (Insurance), 15.4 (Effect of Termination), 17 (Notices), 19.4 (Survival), 19.5 (No Waiver), 19.7 (Validity of Provisions), 19.8 (Priority), 19.9 (Headings), 19.10 (Relationship of the Parties), 19.11 (Counterparts; Effective Date), and 19.12 (Third Party Beneficiaries) shall survive the termination of these T&Cs for any reason.

    19.5 No Waiver. No failure or delay by any Party in exercising its rights under these T&Cs shall operate as a waiver of such rights, and no waiver of any right shall constitute a waiver of any prior, concurrent, or subsequent right. Nothing in these T&Cs may be construed to constitute a waiver by a Party of any immunities from suit or from liability or other liability protections that may be applicable.

    19.6 Entire Agreement. These T&Cs, together with all Attachments, sets forth the entire and only agreement among the APHL and Participant relative to the subject matter hereof. Any representation, promise, or condition, whether oral or written, not incorporated herein, shall not be binding upon APHL or Participant.

    19.7 Validity of Provisions. In the event that a court of competent jurisdiction shall hold any Section, or any part or portion of any Section of these T&Cs, invalid, void or otherwise unenforceable, each and every remaining Section or part or portion thereof shall remain in full force and effect.

    19.8 Priority. In the event of any conflict or inconsistency between a provision in the body of these T&Cs and any attachment hereto, the terms contained in the body of these T&Cs shall prevail, except that the terms of the Business Associate Addendum shall take precedence on all matters relating to APHL’s business associate functions.

    19.9 Headings. The headings throughout these T&Cs are for reference purposes only, and the words contained therein may in no way be held to explain, modify, amplify, or aid in the interpretation or construction of meaning of the provisions of these T&Cs. All references in this instrument to designated “Sections” and other subdivisions are to the designated Sections and other subdivisions of these T&Cs. The words “herein,” “hereof,” “hereunder,” and other words of similar import refer to these T&Cs as a whole and not to any particular Section or other subdivision.

    19.10 Relationship of the Parties. Participant and APHL are independent contracting entities. Nothing in these T&Cs shall be construed to create a partnership, agency relationship, or joint venture among the Parties. Except as expressly provided for in these T&Cs, neither APHL nor Participant shall have any authority to bind or make commitments on behalf of another Party for any purpose, nor shall any such Party hold itself out as having such authority. No Party shall be held liable for the acts or omissions of another Party.

    19.11 Counterparts; Effective Date. The Effective Date shall be the date that Participant executes these T&Cs. These T&Cs may be executed in any number of counterparts, each of which shall be deemed an original as against the Party whose signature appears thereon, but all of which taken together shall constitute but one and the same instrument.

    19.12 Third-Party Beneficiaries. With the exception of the Parties to these T&Cs, no person has any right to claim a beneficial interest in these T&Cs or any rights occurring by virtue of these T&Cs.

    19.13 Force Majeure. A Party shall not be deemed in violation of any provision of these T&Cs if it is prevented from performing any of its obligations by reason of: (a) severe weather and storms; (b) earthquakes or other disruptive natural occurrences; (c) strikes or other labor unrest; (d) power failures; (e) nuclear, public health or other civil or military emergencies; (f) terrorist attacks; (g) acts of legislative, judicial, executive, or administrative authorities; (h) full or partial closure of the federal or a state government; or (i) any other circumstances that are not within its reasonable control. This Section 19.13 shall not apply to obligations imposed under Applicable Law.

    19.14 Pre-existing Contracts and Residual Authority. Nothing in these T&Cs shall be construed to preempt, nullify or preclude Participant from performing under pre-existing contracts or other arrangements. Participant retains the authority to enter into contracts or arrangements with other entities for public health activities outside of these T&Cs.

    19.15 Use of Name / Trademark. No license to either Party’s trademarks is granted herein. Neither Party shall use the other Party’s name, trademarks or service marks in connection with any marketing materials or otherwise without the prior written consent of the other Party. Such consent shall not be unreasonably withheld.

Attachment 1 – APHL Addresses for Notice

Attachment 2

Business Associate Addendum (this “Addendum”)

BACKGROUND

I. Participant has accepted the Electronic Case Reporting Participation Terms and Conditions (the “T&Cs”) governing their participation in the eICR reporting project;

II. Participant is a Covered Entity or Business Associate under the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act and otherwise, and its implementing regulations at 45 C.F.R. Parts 160 to 164 (collectively, “HIPAA”);

III. APHL will create, receive, maintain, or transmit Protected Health Information on Participant’s behalf, thereby qualifying as their Business Associate or Subcontractor Business Associate under HIPAA; and

IV. Participant seeks to ensure that APHL will appropriately safeguard any Protected Health Information that it creates, receives, maintains, or transmits on behalf of Participant and to comply with 45 C.F.R. §§ 164.314(a) and .504(e) of HIPAA.

ADDENDUM TERMS AND CONDITIONS

1. Definitions. All capitalized terms used but not otherwise defined in this Addendum shall have the same meaning as in HIPAA.

   APHL Services shall have the meaning set forth in the Addendum.

   Electronic Initial Case Report or eICR shall have the meaning set forth in the T&Cs.

   Individual shall have the same meaning as the term “individual” in 45 C.F.R. § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g).

   Privacy Rule shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Part 164 Subpart E.

   Protected Health Information shall have the same meaning as the term “protected health information” in 45 C.F.R. § 160.103 that is received, created, maintained, or transmitted by APHL on behalf of Participant.

   RCKMS shall have the meaning set forth in the T&Cs.

   Security Rule shall mean the Security Standards for the Protection of Electronic Protected Health Information at 45 C.F.R. Part 164 Subpart C.

2. Permitted Uses and Disclosures by APHL

   2.1 RCKMS. Except as otherwise limited in this Addendum, APHL may Use Protected Health Information to evaluate an Electronic Initial Case Report using RCKMS and determine whether it is reportable to one or more Public Health Authorities.

   2.2 Permitted Purpose. Except as otherwise limited in this Addendum, APHL may Disclose Protected Health Information for any Permitted Purpose on Participant’s behalf to the extent authorized or Required by Law if done by the Participant and if permitted by the T&Cs.

   2.3 Permissibility under the Privacy Rule. Except as set forth in Sections 2.4 and 2.5, APHL shall not Use or Disclose Protected Health Information in a manner that would violate the Privacy Rule if done by Participant. This includes, but is not limited to, making reasonable efforts to only Use or Disclose the minimum necessary protected health information to accomplish the purpose of the Use or Disclosure.

   2.4 Use for Proper Management and Administration of APHL. Except as otherwise limited in this Addendum, APHL may Use Protected Health Information for the proper management and administration of APHL or to carry out the legal responsibilities of APHL.

   2.5 Disclosure for Proper Management and Administration of APHL. Except as otherwise limited in this Addendum, APHL may Disclose the Protected Health Information in its possession to a third party for the proper management and administration of APHL or to fulfill any legal responsibilities of APHL, provided that:

   2.5.1 APHL is Required by Law to make the Disclosure and APHL provides Participant, to the extent permitted by law, reasonable prior notice of the Disclosure, but not more than five (5) days from receipt of the request for the Disclosure, and reasonably cooperates with any efforts by Participant to object to the Disclosure through a court of law; or

   2.5.2 APHL has received from the third party reasonable written assurances that: (1) the information will remain confidential and will be Used or further Disclosed only as Required by Law or for the purpose for which it was Disclosed to the party; and (2) the third party will notify APHL of any instances of which it becomes aware in which the confidentiality of the information has been breached.

3. Obligations and Activities of APHL

   3.1 Limit on Uses and Disclosures. APHL shall not Use or Disclose Protected Health Information other than as permitted or required by this Addendum or as Required by Law.

   3.2 Offshore Use Prohibited: APHL will not, and will not permit its Subcontractors, Employees or Agents, to Use or Disclose Protected Health Information outside the United States.

   3.3 Appropriate Safeguards. APHL agrees to use appropriate administrative, physical, and technical safeguards to prevent Use or Disclosure of the Protected Health Information other than as provided for by this Addendum. Applicable Laws define appropriate safeguards, which include measures reasonably calculated to prevent Breaches and Security Incidents, such as, at a minimum, minimum restricted area-access, locked areas, and password-protected computer access.

   3.3.1 Malware: At all times during the term of this Addendum, APHL will use current antivirus and security protection for its internal systems and will install all critical Malware protection program updates (e.g., security patches and antivirus updates) according to current industry and regulatory standards.

   3.3.2 APHL will encrypt all back-up media, laptops, mobile devices, jump/USB, and similar drives, and on other devices that interact with or store Protected Health Information (“Devices”), keeping audit logs of all Devices so that if a Device is lost, APHL can verify that the Device was encrypted;

   3.3.3 APHL will encrypt Protected Health Information transmission between APHL and Participant using VPN, Secure FTP, or another encryption method (note: all encryption technologies and practices must be consistent with or more protective of Protected Health Information than applicable industry standards and the requirements of Applicable Laws).

   3.3.4 APHL will not use or permit any person or entity to use a generic account login or generic root access to APHL’s information systems, (i.e., each administrator of any APHL’s information systems must have his or her own alpha-numeric logins of at least six characters that can be tracked and audited individually).

   3.4 Security Rule. APHL agrees to comply with the applicable requirements of the Security Rule with respect to Electronic Protected Health Information.

   3.5 Reporting. APHL agrees to promptly report to Participant:

   3.5.1 Any Use or Disclosure of Protected Health Information not provided for by this Addendum within five (5) business days; and/or

   3.5.2 Any Security Incident within five (5) business days, provided that this section shall hereby serve as notice, and no additional reporting shall be required, of any unsuccessful attempts at unauthorized Access, Use, Disclosure, modification, or destruction of information or unsuccessful interference with system operations in an information system.

   3.5.3 For any Breach of Unsecured Protected Health Information, APHL agrees to supplement the above report with the information required by 45 C.F.R. § 164.410 without unreasonable delay and in no case later than 30 calendar days after discovery of the Breach.

   3.6 Subcontractors. In accordance with 45 C.F.R. § 164.502(e)(1)(ii), APHL agrees to ensure that any Subcontractors that create, receive, maintain, or transmit Protected Health Information on APHL’s behalf agree in writing to the same restrictions and conditions that apply through this Addendum to APHL with respect to such Protected Health Information, including complying with the applicable requirements of the Security Rule.

   3.7 Access to Records. APHL agrees to make its internal practices, books, and records relating to the Use and Disclosure of Protected Health Information received from, or created or received by APHL on behalf of Participant, available to the Secretary of the Department of Health and Human Services (“Secretary”) for the purposes of the Secretary determining compliance with HIPAA. Nothing in this section shall be construed as a waiver of any legal privilege or of any protections for trade secrets or confidential commercial information.

   3.8 Right of Access. APHL, upon request by Participant, will make Protected Health Information in a Designated Record Set available to Participant as necessary to allow Participant to comply with its obligations to provide access to Individuals of their health information as required by 45 C.F.R. § 164.524.

   3.9 Right of Amendment. APHL, upon request by Participant, will make Protected Health Information in a Designated Record Set available to Participant and will incorporate any amendments to such information as instructed by Participant as necessary to allow Participant to comply with its amendment obligations as required by 45 C.F.R. § 164.526.

   3.10 Right of Accounting of Disclosures. APHL will maintain and, upon request by Participant, provide Participant with the information necessary for Participant to provide an Individual with an accounting of Disclosures as required by 45 C.F.R. § 164.528.

   3.11 Delegation of Privacy Rule Obligations. To the extent that APHL is to carry out one or more of Participant’s obligations under the Privacy Rule, APHL shall comply with the Privacy Rule’s requirements that apply to Participant in the performance of such obligations.

   3.12 Audit/Inspection: Within thirty (30) days after Participant’s written request, Participant has the right to review APHL’s records relating to APHL’s compliance with this Addendum. APHL will make available for review all facilities, systems procedures, and records relating to the use or disclosure of Protected Health Information. The term “records” includes, but is not limited to, all documentation, policies, agreements, logs, procedures, and internal audits relating to this Addendum. Participant will give APHL at least five (5) business days’ notice of a review and will conduct the review at APHL’s place of business during normal business hours. Additionally, from time to time, Participant may request an attestation of APHL’s compliance with this Addendum and Applicable Laws. Participant shall enter into a non-disclosure agreement with APHL upon APHL’s request governing any confidential information obtained through the audit.

   3.13 Ownership of Information: Participant owns and retains ownership of all information including, but not limited to, Protected Health Information that it discloses to under this Addendum. APHL acquires no title or right under this Addendum to any information, including de-identified or aggregated data that is derived from Protected Health Information.

4. Obligations of Participant

   a) Notice of Privacy Practices. Participant warrants that its notice of privacy practices or, in the case that Participant is a Business Associate, its Covered Entities’ notices of privacy practices, identify the Use and Disclosure of Protected Health Information for purposes of public health and as Required by Law.

   b) Restrictions. Participant warrants that it has not agreed to a restriction on Use or Disclosure of Protected Health Information that would materially impact the Use or Disclosure of Protected Health Information as necessary by APHL to perform the APHL Services. In the case that Participant is a Business Associate, Participant warrants that its Covered Entities have not agreed to such a restriction.

   c) Changes in Permission. Participant shall notify APHL of any changes in, or revocation of, the permission by an Individual to Use or Disclose his or her Protected Health Information, to the extent that such changes may affect APHL’s Use or Disclosure of Protected Health Information as necessary by APHL to perform the APHL Services.

   d) Requests in Violation of HIPAA. Participant shall not request or cause APHL to Use or Disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by Participant or, if Participant is a Business Associate, if done by Participant’s Covered Entities.

5. Term and Termination

   a) Term. The term of this Addendum shall commence as of the Effective Date and shall terminate with respect to APHL and Participant when the T&Cs have terminated.

   b) Termination. Upon Participant’s knowledge of a breach of this Addendum by APHL or its agents or subcontractors, Participant may cease transmitting eCRs and, as a consequence, terminate the T&Cs: (i) immediately if Participant determines that there is a continuing risk to the confidentiality, integrity, or availability of Protected Health Information that cannot be immediately cured; or (ii) after Participant has notified APHL of the breach and provided at least 30 calendar days for APHL to cure the breach if APHL has not cured the breach in such period of time.

   c) Effect of Termination. (i) Except as provided in paragraph (ii) of this section, upon termination of this Addendum or the T&Cs for any reason, APHL shall return or destroy all Protected Health Information. APHL shall not retain, nor allow any of its agents or subcontractors to retain, copies of the Protected Health Information. Further, APHL will certify in writing to Participant upon Participant’s request and after 30 days after termination that APHL (including its agents and subcontractors) has returned or destroyed all Protected Health Information. However, if the return or destruction of Protected Health Information is infeasible, APHL shall extend the protections of this Addendum to such Protected Health Information and limit further Uses and Disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for as long as APHL maintains such Protected Health Information. This Section shall survive the termination of this Addendum for any reason.

6. Miscellaneous a) No Third Party Beneficiaries. Nothing in this Addendum shall confer upon any person other than the parties and their respective successors or assigns, any rights, remedies, obligations, or liabilities whatsoever.

   b) Amendment; Waiver. This Addendum may be modified only in writing, executed by both parties. The waiver by any Party of a breach or violation of any provision of this Addendum shall not be construed to be a continuing waiver or a waiver of any subsequent breach of either the same or any other provision of this Addendum.

   c) Effect on Addendum. Except as specifically required to implement the purposes of this Addendum, or to the extent inconsistent with this Addendum, all other terms of the T&Cs shall remain in force and effect.