Master Subscription Services Agreement

The entity defined on the Order Form or Statement of Work, as applicable, (“Client”) desires to purchase products and services from Surgical Safety Technologies Inc. (“SST”), as defined in the Order Form and Statement of Work submitted by Client to SST. If SST accepts such Order Form and Statement of Work, the Parties will have entered into a binding contract on terms and conditions set forth in this Master Subscription Services Agreement, including all Exhibits hereto (“Agreement”), which shall govern the Parties’ rights and obligations with regard to the applicable transaction.   SST and Client are sometimes referred to individually a “Party” and collectively “Parties”.  

IN CONSIDERATION of the mutual covenants and agreements set out below, and for other good and valuable consideration, the receipt and sufficiency of which the Parties acknowledge, the Parties agrees as follows: 

General Terms and Conditions

1.     Definitions.

1.1.1.     “Analytics Software” means SST’s proprietary software solution and related processes for analysis of Client Data and De-Identified Data, including processing Client Data, providing analysis and generating Insights.

1.1.2.     “Anonymized Data” means De-Identified Data that has been anonymized by removing markers identifying the source of the data.

1.1.3.     “Client Data” means any data, information or materials generated by Client that are uploaded, accessed, captured, or collected by the SST System, including, without limitation, patient data, healthcare practitioner or other provider data, event data, video data, voice data, machine-operation data, imaging data, health or surgery device or system data, simulation data, metadata, and sensor data, and all intellectual property rights therein, and includes, without limitation, any of the foregoing that is Personal Data.

1.1.4.     “Client Practices” means the internal business practices, workflows, techniques, methods or processes of Client.

1.1.5.     “Client Provided Systems” means the information systems resources (e.g. network switches, servers, etc.), mechanisms of connectivity, or other infrastructure  owned, controlled, or operated by Client, that Client is required to supply in order to implement, access, and use the SST System, as set forth in the Documentation. 

1.1.6.     “Client User” means those individuals who are authorized, subject to the terms and conditions of this Agreement, to access and use the SST System.

1.1.7.     “De-Identified Data” means Client Data that has been de-identified  in accordance with 45 CFR 164.514(b).

1.1.8.     “Documentation” means the administrative guide, specifications, and / or other policies and documents provided by SST to Client to facilitate use of the SST System, Third-Party Software, and / or Equipment, as applicable, as the same may be updated or amended by SST from time to time.

1.1.9.     “Equipment” means the hardware described in an Order Form.

1.1.10.    “Initial Subscription Term” means the period of time beginning on the Order Form Effective Date (as defined in the applicable Order Form) and continuing for the duration of the term specified in the applicable Order Form.

1.1.11.    “Insights” means insights, learnings, extracted features, and analytics, and libraries or reports based on these, generated by the SST System, or otherwise by or for SST by processing Client Data, De-Identified Data or Anonymized Data, including by application of analytics, aggregation, data enrichment, data discovery, artificial intelligence or machine learning to Client Data, De-Identified Data or Anonymized Data. Insights include, but are not limited to, key (clinical) performance indicators, health outcome metrics, and procedure reports. Insights exist in a de-identified state, where the information does not identify an individual and there is no reasonable basis to believe that the information can be used to identify an individual.

1.1.12.    “Named Facility” means each healthcare facility listed on the applicable Order Form that is wholly owned or controlled by Client. For purpose of this definition, “control” means (i) the power by contract to operate or manage the day-to-day operations of a health care facility, or (ii) the power to elect a majority of the directors of a corporation or similar officers of an entity.

1.1.13.    “Order Form” means an order for the SST System, Third Party Software, and/or Equipment signed by SST and Client.

1.1.14.    “Personal Data” means any information relating to an identified or identifiable natural person that, if improperly used or disclosed, would trigger an obligation under applicable Privacy Laws.

1.1.15.    “Privacy Laws” means applicable laws relating to the access, use and disclosure of Personal Data.

1.1.16.    “Data Privacy Agreement(s)” means a Business Associate Agreement, Privacy Agreement, Data Protection Agreement, or other agreement required by law to be entered into by and between Client and SST governing the use and processing of Personal Data, as applicable.

1.1.17.    “Professional Services” means any implementation, project management, training, and/or consulting services, directly related to the SST System, provided by SST pursuant to a Statement of Work, as specified in such Statement of Work.

1.1.18.    “Room” means a clinical environment at a Named Facility where Client is licensed to access and use the SST System (e.g. operating room, trauma bay, or simulation center), as set forth in the applicable Order Form.

1.1.19.    “Services” means the SST System, Professional Services, and Support Services.

1.1.20.   “SST System” means SST’s proprietary software-as-a-service platform, inclusive of the Analytics Software and Insights.   

1.1.21.   “Statement of Work” or “SOW” means the document, signed by SST and Client, setting forth the Professional Services purchased by Client. 

1.1.22.   “Subscription Term” means, collectively, the Initial Subscription Term and any Renewal Terms, as applicable.

1.1.23.   “Third Party Software” means any third-party proprietary software specified in an Order Form.  

1.1.24.   “Work Product” means materials, deliverables, work product, or the like, produced in connection with any Professional Services provided hereunder. Work Product does not include Client Data or Client Practices. 

2.     Scope of Agreement.

Client agrees to purchase from SST, and SST agrees, subject to the terms and conditions of this Agreement, to supply to Client the Services, Equipment, and/or Third Party Software, if any, as specified in each Order Form and Statement of Work, as applicable. Except as otherwise set forth herein, this Agreement does not grant any rights to Client affiliates. Each Order Form is subject to, and made part of, this Agreement.

3.     Grant of Rights.

3.1   License Grant.  Subject to the terms and conditions of the Agreement, including, without limitation, Section 3.2 below, SST hereby grants Client, during the Subscription Term set forth in the applicable Order Form, a limited, revocable, non-exclusive, non-assignable and non-transferrable right of access and license to use the SST System for the Permitted Use. The “Permitted Use” means access to and use of the applicable SST System by Client Users in the number of Rooms at the Named Facilities listed in the applicable Order Form (i) in a manner commensurate with the intended use of the SST System (as set forth in the Agreement and the Documentation), and (ii) solely in connection with Client’s internal business purposes.

3.2   Proprietary Rights; Restrictions. SST retains all ownership right, title, and interest in and to the Services and any Work Product provided hereunder, including, but not limited to all patent, copyright, trade secret, trademark and other intellectual property rights associated therewith, and any derivative works thereof. Without limiting the generality of the foregoing, Client represents and warrants that Client will not itself, directly or indirectly, and will not permit Client Users, other employees or contractors, or any third party to (i) access the SST System or Documentation other than as permitted by this Agreement, (ii) sublicense, share, assign, transfer, copy, sell, distribute, market or otherwise dispose of the SST System or Documentation, (iii) modify, port, reverse engineer, decompile, disassemble, translate, copy, record or otherwise reproduce or create derivative works of the SST System or Documentation, (iv) remove any proprietary notices, labels, or marks from the SST System or Documentation, (v) release to any third-party the results of any benchmark testing of the SST System, (vi) provide access to the SST System or Documentation to any competitor of SST, or (vii) access the SST System or Documentation in order to (a) build a competitive product or service, (b) build a product using similar ideas, features, functions or graphics of the SST System, or (c) copy any ideas, features, functions or graphics of the SST System. In no event shall anything in this Agreement or in SST’s provision of any Services convey any license under any patent, copyright, trademark, trade name, trade secret, or other intellectual property right not explicitly licensed. All rights not expressly granted to Client under this Agreement are reserved by SST. Client will not introduce any unauthorized computer program, functionality, routine, data, resources or capabilities to the SST System, or any portion thereof, and, without limiting the generality of the foregoing, Client will specifically not permit and shall prevent the entry of any computer virus program, Trojan horse program, worm program or other unauthorized computer program into the SST System, or any part thereof or into the data, databases, computer programs, computer resources or computer systems or any other technology or resource provided by SST. SST reserves the right to suspend Client and any Client User’s access to the SST System if SST believes such access may pose a reasonable threat to the security, availability, or integrity of the SST System.  

3.3   Third Party Software. Third Party Software supplied by SST is subject to the terms and conditions of this Agreement and the applicable third-party terms, including as may be set forth in an end user license agreement (“Third Party Terms”). In the event of any conflict between the terms in this Agreement and the Third-Party Terms, as they pertain to any such Third Party Software, the Third Party Terms shall govern.

3.4   Client Users. Client is responsible for, and shall ensure, each Client User’s compliance with the terms of this Agreement. Any violation of this Agreement by any Client User is a violation of this Agreement by Client. Client shall ensure that (i) only Client Users who need access to the SST System to exercise Client’s rights or perform its obligations under this Agreement access the SST System, and (ii) Client Users do not share logon credentials or attempt to access the SST System without providing valid logon credentials specific to such individual. Without limiting the foregoing, once a Client User is no longer engaged by Client or is no longer assigned to activities of the Client that require use of the SST System, Client shall immediately revoke such access to the SST System. Client shall maintain reasonable and appropriate technical, physical, and administrative safeguards with respect to Client’s access to the SST System, including, without limitation, maintaining the confidentiality and security of all logon credentials.  Client shall be responsible for all access to the SST System provided by Client, directly or indirectly, and Client will promptly notify SST of any actual or suspected unauthorized access or use of the SST System provided hereunder. Client will take whatever steps are reasonably required to halt and otherwise remedy any such breach of security and will be solely responsible for any resulting loss of or unauthorized access to any Personal Data or such other information improperly disclosed or misused, and will prevent, as necessary, further disclosures or misuses. 

3.5   Updates. During the Subscription Term, SST shall provide to Client all Updates.  “Updates” means software that is an upgrade, bug fix, patch or other release for the SST System, which SST makes generally available free of incremental charge to clients purchasing a subscription for the applicable SST System. Updates shall be deemed part of the SST System.

3.6   Support Services. During the Subscription Term, SST will provide support for the SST System, Third-Party Software, and Equipment in accordance with SST’s then-current support policy:   https://www.surgicalsafety.com/support-policy (“Support Services”), which may be updated from time-to-time in SST’s sole discretion (“Support Policy”).

3.7   Client Provided Systems. Client is responsible for providing and maintaining applicable Client Provided Systems. Client Provided Systems must meet or exceed the specifications set out in the Documentation. Client acknowledges that the functionality of the SST System is dependent upon proper and functioning Client Provided Systems, and SST shall have no responsibility or liability as it relates to any Client Provided Systems or for any failure or deficiency of the SST System as a result of the Client Provided Systems.

4.     Professional Services.

4.1   Statements of Work. From time to time, SST may provide Professional Services to Client, which shall be set forth in a Statement of Work. Each Statement of Work is subject to, and made part of, this Agreement.

4.2   On Location. If SST and Client agree that SST will perform Professional Services at a Named Facility, Client shall provide or arrange for the necessary equipment, information, and facilities required by SST to perform such Professional Services, as reasonably specified by SST.

4.3   Work Product. Subject to Client’s payment in full of applicable Professional Services fees, SST grants to Client a non-exclusive, non-transferable, non-sublicensable, revokable, limited license for Client to use the Work Product during the Term in connection with its use of the SST System as permitted hereunder. 

5.     Payment.

5.1   Fees. SST will invoice Client for, and Client shall pay to SST, all fees and other charges specified in each Order Form and/or Statement of Work.  All invoices are due and payable within thirty (30) days of the date of the invoice, in the manner and at the location set forth in the applicable invoice. Client agrees to pay interest on all past due amounts at the lower of one point five percent (1.5%) per month or the highest rate allowed by applicable law. Client will be responsible for paying any applicable duties, sales, use, transaction, excise or similar taxes and any federal, state or local fees or charges, imposed on, in respect of or otherwise associated with any Services. In addition, if payments are not received when due as described above, SST reserves the right to suspend the Services and may remove any Equipment from the Named Facilities at any time, unless and until such undisputed payment(s) are received in full, and Client agrees to hold SST harmless for such. Client must notify SST within thirty (30) days of the date of invoice if it disputes any amount contained in an invoice and shall work with SST in good faith to resolve any such disputes.  Client shall reimburse SST for all reasonable costs incurred (including reasonable attorneys’ fees) in collection past due amounts from Client.

5.2   Expenses.  Client shall be responsible for any additional out of pocket costs and expenses incurred by SST in connection with the performance of the Services under this Agreement. Such costs and expenses shall be invoiced to Client without markup and shall be payable in accordance with the terms of Section 5.1.  Any such additional costs and expenses will be supported by receipts and documentations upon Client’s reasonable request.

5.3  Purchase Orders. Client agrees to pay SST’s invoices without a purchase order reference. Without limiting the foregoing, if and only to the extent that Client provides SST with a purchase order contemporaneous with execution of an Order Form or Statement of Work, SST will use commercially reasonable efforts to include such purchase order reference in the applicable invoice. Client acknowledges and agrees that, notwithstanding anything to the contrary, Client’s failure to provide such information or SST’s failure to include a purchase order reference in any invoice, in accordance with the preceding sentence, shall not relieve Client of its obligation to pay an invoice in accordance with the terms of Section 5.1 above. Client shall appoint an individual designated by Client to serve as Client's contact with respect to all invoice and payment related matters, including purchase orders. Client shall identify this individual and provide their contact information to SST, in writing, on or before the Effective Date. Neither SST, nor this Agreement, shall be subject to provisions of any pre-printed terms on or attached to purchase orders (including, without limitation, hyperlinks to additional terms included in purchase orders) generated by Client, or any Client policies, regulations, rules, etc., including those set forth in any Client-sponsored registration system, regardless if the same requires affirmative acknowledgment from an SST representative.

5.4  Commitment. The terms and conditions of this Agreement including, without limitation, pricing terms contained in the applicable Order Form and Statement of Work, contemplate implementation of the SST System (including operationalization of applicable interfaces and installation of applicable Equipment at the Named Locations) within ninety (90) days of the applicable Order Form Effective Date (as defined in such Order Form). If the SST System is not implemented within such period, the ninety (90) day anniversary of the Order Form Effective Date shall be deemed the Go-Live Date, as that term is defined in the applicable Order Form and/or Statement of Work.

6. Compliance with Law.

6.1 Applicable Laws; Data Privacy Agreements. Each Party will comply with all applicable laws and regulations that apply to its respective activities under this Agreement, including all applicable laws (including Privacy Laws), statutes, ordinance, codes, rules, ethical standards and other pronouncements that have the effect of law of any applicable government authority (“Applicable Laws”).  The Parties agree to enter into any Data Privacy Agreement(s) as required to comply with applicable Privacy Laws.  Client agrees not to provide SST with any Personal Data unless and until the appropriate Data Privacy Agreement(s) has or have been mutually executed by the Parties. Any such Data Privacy Agreement(s) are subject to, and made part of, this Agreement. Without limiting the foregoing, the parties agree to the Business Associate Addendum (“BAA”) attached hereto as Exhibit A and made part of this Agreement. 

6.2   CCPA Compliance.  SST and Client shall each comply with all applicable provisions of the California Consumer Privacy Act (“CCPA”).  Each party shall, upon the other’s reasonable written request, cooperate in good faith to enter into additional and modified terms to address any amendments to the CCPA or otherwise ensure the parties’ compliance.  For the purposes of this Section 6.2 , the terms “Personal Information”, “Consumer”, “Processing”, “Service Provider”, “Business Purpose”, “Commercial Purpose”, “Sell” and “Third Party” shall have the meaning given to those terms in the CCPA.  To the extent that SST receives from Client any Personal Information of any Consumer for Processing on behalf of Client pursuant to this Agreement: (a) SST shall be a Service Provider to Client under the CCPA; (b) SST shall not retain, use or disclose the Personal Information for any purpose other than for the specific purpose of performing services under this Agreement or as otherwise permitted by the CCPA, including for any Business Purpose; (c) SST shall not retain, use or disclose the Personal Information for a Commercial Purpose other than providing the services under this Agreement, and (d) SST shall not Sell the Personal Information.  If SST authorizes any subcontractor, service provider or third party to use, store or process Personal Information of Company, SST shall enter into contractual provisions so that such subcontractor, service provider or third party is a Service Provider and not a Third Party under CCPA.

7. Data.

7.1 Data Ownership. As between SST and Client, Client shall retain all right, title and interest in and to the Client Data and De-Identified Data; provided, however, that Client’s retention of ownership in the Client Data and De-Identified Data shall not constitute any ownership interest in the Services or Work Product. As a part of the Services, SST may  convert Client Data to De-Identified Data.  Client hereby grants to SST a worldwide, perpetual, irrevocable, royalty-free license to use the Client Data and De-Identified Data (i) to perform the Services, (ii) to develop, train, tune, enhance, and improve its software and services, and (iii) to develop, generate, or otherwise create Insights. As between Client and SST, SST will be the owner of and retain all right, title, and interest in Anonymized Data and Insights, and further shall own all intellectual property rights in all enhancements and improvements to the Services that result from use of the Client Data,  De-Identified Data, Anonymized Data and/or Insights or are otherwise developed in the course of SST’s performance of the Services. Notwithstanding the foregoing, other than for the sole use by Client, SST will not publish any Insights that identify Client, unless SST has obtained express written consent from Client.

7.2  Consents. Client is solely responsible for obtaining all necessary consents under Applicable Laws and regulations in order to allow Client to collect and provide Client Data and De-identified Data to SST hereunder, and for SST’s use of the Client Data and De-Identified Data in accordance with this Section 7.

8. Feedback.

Client or Client Users may, from time to time, but are not obligated to, provide input, comments, suggestions, feedback or learnings regarding the Services (“Feedback”), which may include suggestions for, or feedback concerning, improvements, modifications, corrections, enhancements, derivatives or extensions, functionality, user interface, as well as branding, business or marketing ideas related to SST and/or its Services. SST acknowledges and agrees that the Feedback is provided by Client as-is, without warranties of any kind. “Feedback” does not, and shall not, include Client Practices, Client Confidential Information, or Client Data.   Client acknowledges that Feedback shall be considered SST Confidential Information and shall be protected from disclosure in accordance with the terms of this Agreement. Client hereby grants to SST a non-exclusive, perpetual, irrevocable, worldwide, royalty-free license, with the rights to sublicense through multiple tiers, to use, publish, and disclose such Feedback in any manner SST chooses and to display, perform, copy, make, have made, use, sell, and otherwise dispose of SST's products or services embodying Feedback in any manner and via any media SST chooses, without reference to the source. SST shall be entitled to use Feedback for any purpose without restriction or remuneration of any kind with respect to Client or Client Users, including but not limited to the commercialization and development of improvements and enhancements to the Services based on the Feedback, and SST will own all such improvements and any intellectual property rights therein. Client acknowledges that Feedback is only intended as possible strategies, developments, and functionalities of the Services and is not intended to be binding upon SST to any particular course of business, product strategy, and/or development. Client covenants and agrees to sign such further documents as may be reasonably required to confirm such license to SST in accordance with this Section 8. 

9.     Equipment

9.1  Equipment.  SST will provide to Client all Equipment for Client’s use during the Subscription Term, as set out in the applicable Order Form. The Equipment is subject to the terms and conditions of this Agreement and applicable manufacturer terms.

9.2  Title. SST shall retain all right, title, and interest in and to the Equipment. Client agrees to take no action that would adversely affect SST’s right, title, or interest in the Equipment. The Equipment is and shall remain personal property of SST regardless of its use or manner of attachment to realty. At all times, Client shall use the Equipment in a careful and proper manner, in accordance with its Documentation. Client shall implement controls to ensure protection and security of the Equipment and to prevent theft or damage to the Equipment.  Client shall not undertake any repairs or modifications to the Equipment unless so directed by SST.  Client shall not (a) use, operate, maintain or store any Equipment improperly, carelessly, unsafely or in violation of any applicable law or regulation or for any purpose other than as set forth in this Agreement and the Documentation ; (b) abandon any Equipment; (c) sublease, transfer, or assign any Equipment without the prior written consent of SST; or (d) create or allow to exist any lien, claim, security interest or encumbrance on any of its rights hereunder.  Client shall not alter any Equipment or affix any accessory or equipment to it if doing so will impair its originally intended function or use or reduce its value. Client shall not make any non-reversible addition to any Equipment without the prior written consent of SST. Any alteration or addition to any Equipment shall be the responsibility of and at the sole risk of Client. Client shall promptly notify SST of any defective or malfunctioning Equipment. Notwithstanding anything to the contrary, SST shall not be liable for any damage to property or personal injury (including death) to the extent caused by Equipment installed at a Named Facility.

9.3  Maintenance. All maintenance, support, and replacement, if necessary, of the Equipment shall be provided remotely by SST. Client shall provide SST with access to the Equipment with reasonable prior notice. Client shall be solely responsible for any labor related to Equipment replacement. If the Equipment is required to be upgraded or replaced, as determined by SST in its sole, reasonable discretion  Client shall (i) within one hundred twenty (120) days of receipt of notice from SST, authorize SST to perform such Equipment upgrade or replacement, and Client will provide all assistance reasonably required by SST to complete such upgrade or replacement, and (ii)return all defective Equipment or parts within thirty (30) days of receipt of the replacement or upgraded Equipment or parts, or undertake such other action as reasonably directed by SST.  Should Client fail to return the defective Equipment or part(s) or undertake such other action as directed by SST within the prescribed timeline, Client will be responsible for the replacement cost of the defective Equipment or part(s), including but not limited to all shipping, taxes, and duties.  The foregoing remedies are Client’s exclusive remedies and SST’s sole liability for warranty claims with respect to Equipment. Notwithstanding anything to the contrary, Client shall be responsible for the cost of any maintenance, repair, and/or replacement of Equipment that is required due to Client’s or any Client User’s negligence, recklessness, or willful misconduct.

9.4  Non-abatement.  Client shall not be entitled to abatement or reduction of rent or setoff against an fees paid hereunder, this Agreement shall not terminate because of, nor shall the obligations of Client be affected by: (i) any defect in, damage to, destruction of, or loss of possession or use of any  Equipment; (ii) the attachment of any lien, security interest or other claim to any Equipment; or (iii)  any interference with Client’s use of the Equipment, except as specifically provided herein.

9.5   Delivery. SST will cause the Equipment to be delivered to the applicable Named Facility, or such other site designated in writing by Client. Equipment will be shipped DAP Incoterms® 2020. SST is responsible for all shipping and transport of the Equipment and shall bear all risk of loss to the Equipment until such time the Equipment has been delivered to the applicable Named Facility (or other site designated in writing by Client), at which time Client assumes risk of loss and damage in accordance with DAP Incoterms® 2020. Client shall undertake all actions necessary to clear customs in a timely manner, as applicable.

9.6   Inspection Period. Upon delivery of the Equipment as set forth in Section 9.5 above, Client will have five (5) business days (each an “Inspection Period”) to inspect the Equipment to assess whether it materially complies with the Documentation. At or prior to the expiry of an Inspection Period, Client will notify SST in writing of Equipment that Client believes does not materially conform with the Documentation. SST will have ten (10) business days after the expiry of an Inspection Period to confirm and correct any such material deficiencies. If Client does not provide written notice of any material deficiencies during an Inspection Period, Client will be deemed to have accepted the Equipment. 

9.7   Return of Equipment. Upon termination or expiration of this Agreement, or if SST otherwise rightfully demands possession of any Equipment, Client, at its expense, shall promptly deliver possession of the Equipment to SST, properly protected and in good working condition (reasonable wear and tear excepted), in the manner and to the destination requested by SST. If the Equipment is not returned within thirty (30) days of SST’s request or if Client returns the Equipment in disrepair, Client shall pay to SST on demand, the then costs to SST for the purchase of new replacement Equipment, without markup.  At SST’s option, SST may waive the requirement for return of the Equipment in writing, and in such event, SST shall have been deemed to transfer and assign ownership of the Equipment to Client, provided that Client must certify to SST in writing that it has reset the Equipment to factory settings and has erased and/or removed any Analytics Software, Insights, Documentation, trademarks, logos, or other confidential information of SST therefrom, as applicable.

10.  Confidentiality Obligations.

10.1   Confidential Information. “Confidential Information” as used in this Agreement means any information which is disclosed by either Party (including such Party’s employees or agents), directly or directly, in whatever form or medium,  during the term of this Agreement, and marked or otherwise identified as confidential or proprietary at the time of disclosure, or is of a nature that a reasonable person would, considering the circumstances and nature of disclosure, consider it to be confidential. Confidential Information may include (but is not limited to) information of the disclosing Party including, without limitation, designs, know-how, methods, processes, trade secrets, configurations, business information and plans, financial information, software, and technology. For the avoidance of doubt, all Services, Documentation, and pricing are Confidential Information of SST.

10.2    Obligations of Confidentiality. The receiving Party will not use the disclosing Party’s Confidential Information for purposes other than as provided in this Agreement. Each Party must protect the Confidential Information provided by the other Party, to prevent the unauthorized use, dissemination, disclosure, or publication of the Confidential Information, by using the same degree of care as it uses to protect its own confidential information of a like nature but exercising no less than a reasonable degree of care in any event.  Confidential Information disclosed hereunder may be disclosed to and used, in accordance with the terms of this Agreement, by the receiving Party’s employees, partners, agents, auditors, contractors, and subcontractors who (i) have a need to know such information, and (ii) are bound by the terms of an agreement protecting against unauthorized use or disclosure of Confidential Information that is at least as protective as this Agreement. The terms of this Agreement shall be considered Confidential Information; provided, however, that SST may provide a copy of this Agreement in connection with any financing transaction or due diligence inquiry. 

10.3   Exceptions. Each Party’s obligations set forth in this Section 10 shall not apply with respect to any portion of the Confidential Information of the other Party that: (i) was in that Party’s possession before receipt from the other Party as evidenced by written records; (ii) becomes a matter of public knowledge through no fault of the receiving Party; (iii) is rightfully obtained by either Party from a third party who, to the knowledge of the receiving Party, is legally free to pass on such information without the duty of confidentiality; (iv) is independently developed by either of the Parties; or (v) is Personal Data, the protection of which is governed by Exhibit A.

10.4   Judicial Order. If the receiving Party is required to disclose any Confidential Information by the requirements of law or regulations at the request of a regulatory authority, or by virtue of a summons or an order or decree of a court or tribunal, the receiving Party must, to the extent legally permitted, make commercially reasonable efforts to provide prompt written notice of such requirement to the disclosing Party prior to disclosure.   If the disclosing Party is unable to obtain a protective order or arrangement preserving the confidentiality of the Confidential Information, the receiving Party subject to the disclosure requirement must limit the disclosure to only that portion of the Confidential Information which is legally required to be disclosed. 

10.5   Return of Confidential Information.  Upon termination or expiration of the Agreement, or otherwise at the disclosing Party’s written request, and at the disclosing Party’s option, the disclosing Party’s Confidential Information shall be either promptly returned to the disclosing Party or destroyed. The receiving Party may retain one (1) copy of disclosing Party’s Confidential Information in its confidential files, solely for the purpose of monitoring its continuing obligations of confidentiality under this Agreement. Notwithstanding the foregoing, electronic copies of Confidential Information stored in computer system backups maintained in accordance with the receiving Party’s systematic backup, disaster recovery, or business continuity procedures need not be returned or destroyed, provided that the receiving Party shall continue to be bound by the obligations set forth in this Agreement with respect to any of disclosing Party’s Confidential Information retained in accordance with this Section 10.

11.  Representation and Warranties

11.1 Mutual Representation and Warranties

11.1.1 Each Party represents and warrants to the other Party that it is an entity, duly organized, validly existing and in good standing under the laws of its jurisdiction of organization.

11.1.2    Each Party represents and warrants to the other Party that it has all necessary rights, power, and authority to enter into this Agreement and to perform all of its obligations under this Agreement.

11.1.3    Each Party represents and warrants to the other Party that this Agreement has been duly and validly authorized, executed and delivered by it and constitutes a valid and binding obligation, enforceable in accordance with its terms (except as such enforceability may be limited by any applicable bankruptcy, insolvency, winding up, or other laws affecting creditors’ rights generally and by limitations on the availability of equitable remedies such as specific performance and injunction which are not in the discretion of the court from which they are sought).

11.1.4    Each Party represents and warrants to the other Party that to its knowledge, as of the Effective Date, there are no actions, suits or proceedings, existing or pending or threatened against or affecting it, before any court, arbitrator or governmental or administrative body or agency that affect the validity or enforceability of this Agreement or that would have an effect on its ability to perform its obligations hereunder.

11.2   SST Warranties

11.2.1   SST System Warranty. SST warrants that the SST System shall be made available in substantial conformity with its Documentation. Client’s sole remedy and SST’s sole liability for a breach of this warranty shall be for SST, in SST's sole discretion, to either (i) repair or replace any reported nonconformity in the SST System or, (ii) return the pro-rata fees paid for, and terminate Client’s access to, such nonconforming SST System.

11.2.2   Professional Services Warranty. SST warrants that the Professional Services provided by SST pursuant to this Agreement shall be performed in a professional manner by trained and skilled personnel. Client must notify SST of any breach of such warranty within thirty (30) days following performance of the non-conforming Professional Services giving rise to the breach of warranty claim. Client’s sole and exclusive remedy and SST’s entire liability for any breach of the warranty set forth in this Section 11.2.2 will be for SST, in SST's sole discretion, to either (i) re-perform such non-conforming Professional Services so as to comply with such warranty, or (ii) return the pro-rata fees paid for such nonconforming Professional Services.

11.2.3   Limitation of Warranties. The warranties set forth in this Section 11.2  shall not apply, and SST shall have no warranty obligation or liability with respect to, (a) any SST System that (i) are damaged through no fault of SST, (ii) are modified by anyone other than SST or SST’s designee, (iii) are used for any purpose other than its intended purpose (as specified in the Documentation), (iv) are used with equipment not specified as compatible in the Documentation, (v) are used with software not specified as compatible in the Documentation, (vi) Client fails to properly install or maintain, (b) any computer malfunction not attributable to the Services (c) any incorrect use of the Services, or (d) any willful misconduct or negligent action or omission of Client.

11.2.4 DISCLAIMER. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE WARRANTIES CONTAINED IN THIS SECTION 11 ARE THE ONLY WARRANTIES AND THERE ARE NO OTHER WARRANTIES OR CONDITIONS, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABLE QUALITY, FITNESS FOR A PARTICULAR PURPOSE,  NON-INFRINGEMENT AND TITLE, AND/OR THOSE ARISING BY STATUTE OR OTHERWISE IN LAW OR FROM A COURSE OF DEALING OR USAGE OF TRADE, ALL OF WHICH ARE EXPRESSLY DISCLAIMED. FOR THE AVOIDANCE OF DOUBT, SST DOES NOT WARRANT, IN ANY WAY WHATSOEVER, THAT ANY USE OF THE SERVICES WILL RESULT IN ANY BENEFIT, ADVANTAGE OR IMPROVEMENT TO CLIENT, NAMED FACILITIES, OR ANY CLIENT USERS, OR THAT THE SERVICES WILL BE PERFORMED WITHOUT ERROR OR INTERRUPTION. CLIENT UNDERSTANDS THAT SST IS NOT THE MANUFACTURER OF ANY THIRD PARTY SOFTWARE OR EQUIPMENT, AND SST MAKES NO REPRESENTATION OR WARRANTY WITH RESPECT TO ANY THIRD-PARTY SOFTWARE OR EQUIPMENT. UNDER NO CIRCUMSTANCES SHALL SST'S THIRD-PARTY SUPPLIERS OF ANY COMPONENT OF THE SERVICES OR EQUIPMENT BE RESPONSIBLE OR LIABLE TO CLIENT OR ITS AFFILIATES FOR ANY DAMAGES, DIRECT OR OTHERWISE, ARISING UNDER THIS AGREEMENT OR OTHERWISE ARISING FROM THE TRANSACTIONS CONTEMPLATED HEREIN. SUCH THIRD-PARTY SUPPLIERS ARE THIRD PARTY BENEFICIARIES OF THE FOREGOING SENTENCE. 

12. Indemnification

12.1 SST Indemnification.  SST will indemnify and hold harmless Client and its officers, directors, employees, agents, successors, heirs and assigns (“Client Indemnitees”) from any losses, liabilities, damages, and expenses (including reasonable legal fees) (“Losses”) arising out of any third-party claims, suits, demand, and causes of action (“Claims”) brought during the Term based on:

• any gross negligence or wilful misconduct of SST in the performance of its obligations hereunder;

• any damage to property or personal injury (including death) to the extent caused by the gross negligence of SST while performing Professional Services at a Named Facility; or

• the infringement of any United States or Canadian patent, copy right or trademark, or misappropriation of a trade secret of such third party, by the SST System.

12.2  Infringement Remedy.  In the event of infringement as described in Section 12.1 c. above, or if SST reasonably believes that such infringement is likely, SST may, at its option: (i) procure for Client the right to continue using the infringing SST System; (ii) modify the SST System to make its use non-infringing; (iii) replace the SST System with a product having materially equivalent functionality; or (iv) if, in SST’s reasonable opinion, neither (i) (ii) or (iii) above are commercially reasonable, terminate Client’s right to use such SST System and refund any prepaid and unused fees paid by Client for the infringing SST System. SST will have no obligation or liability under this Section 12 for any claim or action resulting from any of the following: (a) any claim or action that would have arisen due to Client’s business activities without use of the particular technology employed by the SST System, or (b) any claim or action resulting from any of the following: (i) modifications to the SST System by Client or a party other than SST, (ii) the combination of the SST System with other products, processes, or materials not provided by SST if the SST System itself would not infringe, (iii) specifications or requirements supplied by Client that were used for the configuration of the SST System, or (iv) where Client continues allegedly infringing activities after being provided with modifications that would have avoided the alleged infringement. This Section 12 states the sole obligation and exclusive liability of SST (express, implied, statutory or otherwise), and the sole remedy of Client, for any third-party claims or actions of infringement of any intellectual property or other proprietary right.

12.3  Client Indemnification. Client will indemnify and hold harmless SST and its trustees, directors, officers, employees, agents, third party service providers, successors, heirs, and assigns from any Losses arising out of or relating to any Claims for:

• any gross negligence or wilful misconduct of Client and/or any Client Indemnitee;

• failure of Client and/or any Client Indemnitee to comply with applicable Privacy Laws; or

• damage to property or personal injury (including death) to the extent caused by (i) any acts or omissions of Client and/or Client Indemnitees, or (ii) Equipment installed at a Named Facility.

12.4  Indemnification Process. The indemnifying Party shall bear the expense of defending the Claims and shall pay any Losses attributed to a Claim.   The indemnified Party will provide all reasonably requested cooperation and assistance to the indemnifying Party (at the indemnifying Party’s expense) and provide the indemnifying Party with full authority to defend, settle or otherwise dispose of a Claim in accordance with this Section 12; provided that the indemnified Party may elect to participate in such a defense at its sole option and expense.   The obligations of the indemnifying Party are conditioned on the indemnified Party’s prompt written notification of a Claim that is subject to the indemnification obligations under this Section 12.  Notwithstanding the foregoing, the indemnifying Party may not enter into any settlement that (i) requires the indemnified Party to admit fault, (ii) that imposes any obligation on the indemnified party, or (iii) that does not contain a release of the indemnified Party, without the prior written consent of the indemnified Party, which consent shall not be unreasonably withheld or delayed.

13.  Limitations of Liability

13.1 SST’s liability to the Client for any expense, damage, loss, injury, or liability of any kind, regardless of the form of action or theory of liability (including for breach of contract, tort, negligence, by statute or otherwise) arising out of or related to this Agreement (including, without limitation, any Data Privacy Agreement/s) will be limited to the actual direct damages suffered by such Party and such liability will not exceed the fees paid by Client in the twelve-month period immediately preceding the first claim for which SST is liable, for any and all claims arising in any connection with this Agreement.

13.2 IN NO EVENT WILL SST BE LIABLE TO CLIENT FOR ANY LOSS OF PROFITS OR REVENUES, LOSS OF ANTICIPATED SAVINGS, LOSS OF CUSTOMERS, OR LOSS OF USE OF ANY SOFTWARE OR DATA, NOR FOR ANY SPECIAL, INDIRECT, INCIDENTAL OR CONSEQUENTIAL DAMAGES SUFFERED BY CLIENT, HOWSOEVER CAUSED AND REGARDLESS OF THE FORM OR CAUSE OF ACTION, EVEN IF SUCH DAMAGES ARE FORESEEABLE OR SST HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 

13.3 CLIENT ACKNOWLEDGES THAT SOFTWARE AND SERVICES ARE NOT ERROR FREE. FURTHERMORE, DATA ANALYSIS IS A PROCESS THAT IS INHERENTLY INACCURATE AND ERRORS OCCUR IN THE CONTENT, OUTPUT AND RESULTS OF SUCH PROCESSES THAT SST IS NOT RESPONSIBLE FOR. CLIENT AGREES THAT IT IS THE SOLE RESPONSIBILITY OF CLIENT AND EACH CLIENT USER TO IDENTIFY AND CORRECT ANY SUCH ERRORS AND INACCURACIES BEFORE USING AND/OR RELYING ON THE CONTENT, RESULTS OR OUTPUT OF ANY SOFTWARE AND/OR SERVICES PROVIDED UNDER THIS AGREEMENT. CLIENT UNDERSTANDS THAT SST IS NOT RESPONSIBLE FOR THE ACCURACY OF ANY CLIENT DATA, CLIENT’S CONFIDENTIAL INFORMATION, OR OTHER INFORMATION PROVIDED BY CLIENT. CLIENT FURTHER UNDERSTANDS THAT CLIENT SHALL NOT HOLD SST LIABLE OR PURSUE ANY CLAIMS AGAINST SST ARISING AS A RESULT OF ANY ERROR, MISREPRESENTATION, OR INACCURACY IN THE CLIENT DATA OR CLIENT’S CONFIDENTIAL INFORMATION FURNISHED TO SST OR UPLOADED INTO THE SST SYSTEM BY CLIENT HEREUNDER. SST SHALL HAVE NO LIABILITY FOR ANY LOSS, DAMAGE TO, OR CORRUPTION OF ANY CLIENT DATA. CLIENT AGREES THAT SST IS NOT PROVIDING MEDICAL PRACTICE ADVICE, AND THAT CLIENT AND EACH CLIENT USER WILL CONSULT WITH AND RELY EXCLUSIVELY ON ITS OWN PHYSICIANS OR OTHER MEDICAL DIRECTION FOR REVIEW, NECESSARY REVISIONS AND APPROVAL OF ANY AND ALL SUCH MEDICAL-PRACTICE-RELATED CONTENT, RESULTS OR OUTPUT. CLIENT UNDERSTANDS AND ACKNOWLEDGES THAT THE SST SYSTEM USES ARTIFICIAL INTELLIGENCE, WHICH MAY NOT BE ERROR FREE AND MAY NOT BE ACCURATE, RELIABLE, OR NON-INFRINGING. SST ASSUMES NO RESPONSIBILITY FOR ANY OF THE FOREGOING.

14.  Term and Termination

14.1. Term. This Agreement will commence on the Effective Date and, unless terminated earlier in accordance with the terms hereof, shall remain in effect until the last to expire of any Subscription Term.  Each Order Form shall be effective for the Initial Subscription Term set forth in such Order Form and thereafter shall subsequently automatically renew at SST’s then-current rates for the same term length as the Initial Subscription Term (each a “Renewal Term”), unless either Party gives one hundred and eighty (180) days’ advance notice prior to the expiration of the Order Form’s Initial Subscription Term or applicable Renewal Term of a decision to terminate or not renew the Order Form.    

14.2 Termination for Cause. Either Party may terminate this Agreement, and/or any Order Form or Statement of Work, upon written notice if the other Party commits a material breach of this Agreement or such Order Form or Statement of Work and fails to cure such breach within thirty (30) days of receipt of written notice describing such breach. Notwithstanding the foregoing, SST may terminate this Agreement, and/or any Order or Statement of Work, immediately upon written notice to Client if Client (a) infringes SST’s intellectual property rights, (b) commits, or permits any third party to commit, any breach of confidentiality obligations, or (c) Client has a receiver appointed to handle its assets or affairs, admits that it is insolvent, or is otherwise unable to pay its debts as they mature, or ceases to do business in the ordinary course.

14.3 Effects of Termination. In the event of termination of this Agreement: (i) Client will promptly pay all amounts owing and payable to SST up to and including the effective date of termination, and (ii) all licenses and rights granted by SST to Client under this Agreement will terminate.

14.4 Survival.  The provisions of Sections 1, 3.2, 3.4, 5, 7, 8, 9, 10, 11, 12, 13, 14.3, 14.4, and 15 and such other terms and conditions that, by their nature and context, survive expiration or termination of this Agreement, will survive termination or expiration of this Agreement.

15.   General Provisions; Miscellaneous.

15.1. Independent Contractors.  SST and Client acknowledge and agree that SST is an independent contractor and is not an employee, agent or partner of Client.  Neither Client or SST will have the authority to enter into any contract on behalf of the other or make any representation or incur any obligation in the name of or on behalf of the other.

15.2  Entire Agreement.   This Agreement, including all Exhibits, Order Forms, and Statements of Work hereto, constitutes the entire agreement between the Parties pertaining to all matters herein and terminates and supersedes all prior agreements, understandings, letter of intent, negotiations and discussions between the Parties, whether oral or written.  This Agreement may only be amended by written agreement executed by the authorized representative of the Parties.

15.3   Order of Precedence. In the event of a conflict between the terms or provisions of this Agreement, the order of precedence shall be as follows: (i) any Data Privacy Agreement entered into by the Parties which incorporates this Agreement by reference, solely with respect to the privacy and security of Personal Data, (ii) this Agreement, and (iii) each Order Form or Statement of Work, unless Order Form or Statement of Work states that a specific provision of this Agreement will be superseded by a specific provision therein.   

15.4  No Third-Party Beneficiaries. Except as expressly stated otherwise in this Agreement, nothing in this Agreement is intended to create any rights in, or confer any benefits upon, any person or entity other than the Parties to this Agreement.

15.5  Dispute Resolution.  If a dispute arises out of, or in connection with this Agreement, the Parties agree to use good faith efforts to pursue a resolution through negotiation before resorting to litigation.  All information exchanged during any such negotiation, shall be regarded as “without prejudice” communications for the purpose of settlement negotiations and shall be treated as confidential by the Parties and their representatives, unless otherwise required by law. However, evidence that is independently admissible or discoverable shall not be rendered inadmissible or non-discoverable by virtue of its use during such negotiations. All disputes hereunder shall be brought within a period of one (1) year from the later of (i) the date the dispute arose, or (ii) the date the applicable Party learned of, or, by exercising a reasonable degree of care, should have learned of, the circumstances from which the dispute arose.

15.6  Publicity.  SST may use in its advertising, publicity, websites, press releases, marketing materials, or otherwise the name, logo and trademarks of Client, and Client hereby expressly grants SST a fully paid up, non-exclusive, irrevocable license to use any such materials of Client to do so, or to perform any of SST’s obligations under this Agreement. Without limiting the foregoing, SST may refer to the existence of this Agreement or the relationship of the Parties in connection with a press release. SST will not use any trademarks of Client for any other purpose.  The Client shall not use the name, business, name, trademarks or logos of SST in any advertising, publicity or marketing other materials intended for public release, whether in hard copy or electronic format, without the express written permission of SST.

15.7  Subcontracting. SST reserves the right to subcontract the performance of its obligations under this Agreement to third-party subcontractors. Without limiting the foregoing, Client acknowledges and agrees that SST’s rights and obligations hereunder may be exercised, performed, or otherwise carried out by an SST affiliate.

15.8  Assignment.  Neither Party may assign this Agreement without the prior written consent of the other Party. Notwithstanding the foregoing, either Party may assign this Agreement to a successor of all or substantially all of such Party’s business or assets to which this Agreement relates, whether by merger, consolidation, sale of assets or otherwise, upon written notice to the other Party.  Any purported assignment in contravention of the foregoing will be null and void.  The rights and obligations of the Parties under this Agreement will be binding upon and inure to the benefit of the successors and permitted assigns of the Parties.

15.9  Injunctive Relief. Each Party acknowledges that any use or disclosure of Confidential Information in breach of this Agreement or any violation of SST’s intellectual property rights may cause irreparable damage to the non-breaching Party, for which remedies other than injunctive relief may be inadequate, and the breaching Party agrees that it shall not object to the non-breaching Party seeking injunctive or other equitable relief to restrain the alleged breach or violation. The Parties further agree that in the event such equitable relief is granted in the United States, they will not object to courts in other jurisdictions granting provisional remedies enforcing such United States judgments.

15.10   Counterparts.  This Agreement may be executed in any number of counterparts, each of which shall be deemed an original.   Facsimile or electronic copies hereof shall be deemed to be originals.

15.11   Governing Law.  This Agreement shall be construed and enforced in accordance with the laws of the State of New York, without regard to conflict of law rules.  All disputes arising from this Agreement will be subject to the exclusive jurisdiction of the state or federal courts of competent jurisdiction located in New York, New York. EACH OF THE PARTIES HERETO HEREBY IRREVOCABLY WAIVES ANY AND ALL RIGHT TO TRIAL BY JURY IN ANY LEGAL PROCEEDING ARISING OUT OF OR RELATED TO THIS AGREEMENT OR THE TRANSACTIONS CONTEMPLATED HEREBY. This Agreement was prepared in the English language, which language shall govern the interpretation of, and any dispute regarding, the terms of this Agreement. All information to be provided by the Parties to each other shall be in English, and Client shall be responsible for all necessary translation. Unless stated otherwise, all currency references herein are to United States Dollars. 

15.12 Notices.   Any notices or communication required or permitted to be given under this Agreement shall be served personally, sent by mail, sent by overnight delivery or courier, or sent by email to the following address:

If to SST:          Surgical Safety Technologies Inc.
Attn: Dr. Teodor Grantcharov; Sr. Director Contracts + Compliance
One World Trade Center, Suite 80J
New York, NY 10007
Email: contracts@surgicalsafety.com 

 If to Client:     Address indicated on the applicable Order Form or Statement of Work

15.13   Force Majeure. Except for payment obligations, neither Party will be liable for any failure or delay in performing an obligation under this Agreement that is due to any of the following causes, to the extent beyond its reasonable control: acts of God , accident, riots, terrorist act, epidemic, pandemic, quarantine, civil commotion, breakdown of communication facilities, breakdown of web host, breakdown of internet service provider, natural catastrophes, governmental acts or omissions, changes in laws or regulations, national strikes, fire, explosion, generalized lack of availability of raw materials or energy. 

15.14   Severability.   The invalidity or unenforceability of one or more provisions of this Agreement shall not affect the validity or enforceability of any of the other provisions hereof and this Agreement shall be construed in all respects as if such invalid or unenforceable provisions are omitted.

Exhibit A

BUSINESS ASSOCIATE ADDENDUM

RECITALS

As a “business associate” of a “covered entity” as each is defined under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended by the  Health Information Technology for Economic and Clinical Health Act, Public Law 111-005, and the regulations promulgated thereunder by the U.S. Department of Health and Human Services, (collectively, “HIPAA Regulations”), SST (or “BA”) is required to comply with the HIPAA Regulations provisions regarding the confidentiality and privacy of Protected Health Information provided by Client (or “CE”) to BA or created or received by BA on CE’s behalf  (“PHI”) .

Pursuant to the terms of the Master Subscription Services Agreement to which this BAA is attached (“Underlying Agreement”), BA shall provide certain services to CE.  To facilitate BA’s provision of such services, CE may disclose certain information to BA, some of which may constitute PHI. CE and BA intend to protect privacy and provide for the security of PHI disclosed to BA pursuant to the Underlying Agreement in compliance with the HIPAA Regulations. This BAA serves to establish the responsibilities of CE and BA regarding PHI, and to bring the Underlying Agreement into compliance with the HIPAA Regulations. This BAA is subject to, and made part of, the Underlying Agreement.

NOW, THEREFORE, in consideration of the mutual promises below and the exchange of information pursuant to this BAA, CE and BA agree as follows:

AGREEMENT

 1. Definitions.

Capitalized terms used, but not otherwise defined, in this BAA shall have the same meaning as those terms in the HIPAA Regulations.

2. Obligations of Business Associate. 

2.1 Permitted Access, Use or Disclosure.  Except as otherwise provided in this BAA, BA may use or disclose PHI as reasonably necessary to provide the functions, activities, or services described in the Underlying Agreement to CE, and to undertake other activities of BA permitted or required of BA by this BAA or as required by law.

2.2. Except as otherwise limited by this BAA or the HIPAA Regulations, CE authorizes BA to use the PHI in its possession for the proper management and administration of BA’s business and to carry out its legal responsibilities. BA may disclose PHI for its proper management and administration and to carry out its legal responsibilities, provided that (i) the disclosures are required by law; or (ii) BA obtains prior to making any disclosure to a third party (a) reasonable written assurances from such third party that the PHI will be held confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to such third party and (b) an agreement from such third party to notify BA promptly of any breaches of the confidentiality of the PHI, to the extent it has knowledge of the breach.

2.3. Upon request, BA will make available to CE any of CE’s PHI that BA or any of its agents or subcontractors have in their possession. BA may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR §164.502(j)(1).

2.4. BA may de-identify PHI obtained by BA under this BAA in accordance with 45 C.F.R. §164.514(b) and may use and disclose such de-identified data for the purposes set forth in the Underlying Agreement. De-identified information does not constitute PHI and is not subject to the terms of this BAA.

2.5. BA may use PHI to provide Data Aggregation services to Covered Entity as permitted by 45 C.F.R. §164.504(e)(2)(i)(B).

2.6 Prohibited Uses and Disclosures under HITECH.  BA shall only use and disclose PHI as permitted or required under the Underlying Agreement, this BAA or as required by law but shall not otherwise use or disclose any PHI.  BA shall not, and shall ensure that its employees, other agents, and contractors do not, use or disclose PHI received from CE in any manner that would constitute a violation of the HIPAA Regulations.  BA shall not violate the HIPAA Regulations prohibition on the sale of PHI. To the extent BA is required to carry out any of CE’s obligations under Subpart E of 45 C.F.R. Part 164, BA shall comply with the requirements of Subpart E that apply to CE in the performance of such obligation(s).

2.7 Appropriate Safeguards.  BA shall implement appropriate safeguards to comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Underlying Agreement or this BAA. 

2.8 Reporting of Improper Access, Use, or Disclosure. 

(a) Generally.  BA shall promptly notify CE of any unauthorized access, use, or disclosure of PHI of which BA becomes aware, including a Breach of Unsecured PHI as required by 45 C.F.R. § 164.410, and any successful Security Incident of which it becomes aware. Notification of a Breach will be made without unreasonable delay, but in no event more than three (3) business days after BA’s discovery of a Breach. Taking into account the level of risk reasonably likely to be presented by the unauthorized access, use or disclosure of PHI, successful Security Incident, or Breach, the timing of other reporting will be made consistent with BA’s and CE’s legal obligations. The Parties acknowledge and agree that this Section constitutes notice by BA that attempted but unsuccessful security incidents such as pings and other broadcast attacks on BA’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above regularly occur and that no further notice will be made by BA, unless such incidents result in unauthorized access, use, or disclosure of PHI. Notifications under this Section, if any will be delivered to contacts identified by CE in Section 8 below by any means BA selects, including through e-mail. BA’s obligation to report under this Section is not and will not be construed as an acknowledgement by BA of any fault or liability with respect to any use, disclosure, Security Incident or Breach.

(b) Mitigation.  BA shall take reasonable steps designed to mitigate, to the extent practicable, any deleterious effects known to BA of any unauthorized or unlawful access, use or disclosure of PHI not authorized by the Underlying Agreement or this BAA.

2.9 Access to PHI.  To the extent BA maintains a Designated Record Set on behalf of the CE, BA shall make Protected Health Information maintained by BA or its agents or subcontractors in Designated Record Sets available to CE for inspection and copying within ten (10) business days of a request by CE to enable CE to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 C.F.R. § 164.524. Unless otherwise expressly set forth in the Underlying Agreement, CE acknowledges that BA does not maintain any Designated Record Set on behalf of CE.

2.10 Business Associate’s Subcontractors and Agents.  BA shall ensure that any agents or subcontractors to whom it provides PHI and who create, maintain or transmit PHI on behalf of the BA agree in writing to substantially similar restrictions and conditions that apply to BA with respect to such PHI. 

2.11 Accounting Rights.  Within ten (10) business days of notice by CE of a request for an accounting of disclosures of Protected Information, BA shall make available to CE the information required to provide an accounting of disclosures to enable CE to fulfill its obligations under the HIPAA Regulations, including, but not limited to, 45 C.F.R. § 164.528. BA shall notify CE within five (5) business days of receipt of any request by an individual or other requesting Party for an accounting of disclosures. 

2.12 Minimum Necessary.  To the extent required by the HIPAA Regulations and feasible in the performance of services under the Underlying Agreement, BA (and its agents or subcontractors) shall request, use, and disclose only the minimum amount of PHI necessary to accomplish the purpose of the request, use, or disclosure. 

2.13 Amendment of PHI. 

(a) Upon request and instruction from CE, BA will amend PHI contained in a Designated Record set maintained on behalf of CE in accordance with 45 CFR §164.526. Any request by CE to amend such information will be completed by BA within fifteen (15) business days of CE’s request. In the event that any Individual requests that BA amend such Individual’s PHI, BA within ten (10) business days will forward this request to CE. Any amendment of, or decision not to amend the PHI as requested by an Individual and compliance with the requirements applicable to an Individual’s right to request an amendment of PHI, will be the sole responsibility of CE. Unless otherwise expressly set forth in the Underlying Agreement, BA does not maintain any Designated Record Set on behalf of CE.

2.14 Breach Pattern or Practice.  Pursuant to 42 U.S.C. § 17934(b), if BA knows of a pattern of activity or practice of a subcontractor that constitutes a material breach or violation of subcontractor’s obligations under its agreement, this BAA, or other arrangement, BA must take reasonable steps to cure the breach or end the violation.  If the steps are unsuccessful, BA must terminate the agreement to which the breach and/or violation relates if feasible.

3. Responsibilities of Covered Entity.

3.1 CE shall provide BA with the notice of privacy practices that CE produces in accordance with 45 C.F.R. §164.520, as well as any changes to such notice. 

3.2 CE shall provide BA, in writing, with any changes in, or revocation of, permission by Individual to the use or disclosure of PHI, if such changes affect the BA’s permitted or required uses or disclosures. Upon receipt by BA of such notice of changes, BA shall cease the use and disclosure of any such Individual’s PHI except to the extent it has relied on such use or disclosure, or where an exception under the HIPAA Regulations expressly applies.

3.3 CE shall notify BA of any restriction to the use or disclosure of PHI that CE has agreed to in accordance with 45 C.F.R. §164.522.

3.4 CE shall not request or require BA to use and/or disclose PHI in a manner not permitted by the HIPAA Regulations.

3.5 CE is responsible for implementing appropriate privacy and security safeguards in the systems, applications, and software that CE controls, manages, and configures to protect its PHI in compliance with the HIPAA Regulations. 

4.   Termination.

4.1   Termination.

(a) Material Breach.  Upon any material breach of this BAA, the non-breaching Party, shall provide the breaching Party with written notice of such alleged breach and shall afford the breaching Party an opportunity to cure the alleged breach within thirty (30) business days of such notice.  If such breach is not cured within such time, the non-breaching Party may immediately terminate this BAA and the Underlying Agreement.

(b) Effect of Termination.  Upon expiration or termination of the Underlying Agreement for any reason, BA shall, if feasible, destroy all PHI relating to the Underlying Agreement that BA or its agents or subcontractors still maintain in any form and shall retain no copies of such PHI.  If destruction is not feasible, BA shall continue to extend the protections of this BAA to such information, and limit further use of such PHI to those purposes that make the destruction of such PHI infeasible. 

5.   Amendment to Comply with Law. 

Because state and federal laws relating to data security and privacy are rapidly evolving, amendment of the Underlying Agreement or this BAA may be required to provide for procedures to ensure compliance with such developments.  BA and CE shall take such action as is necessary to implement the standards and requirements of the HIPAA Regulations.  Upon the request of either Party, the other Party shall promptly enter into negotiations concerning the terms of an amendment to this BAA embodying written assurances consistent with the standards and requirements of the HIPAA Regulations.  This BAA may not be modified or amended except in a writing duly signed by authorized representatives of the Parties.

6.   Availability of Books and Records.

BA will make available its internal practices, books, and records relating to the use and disclosure of PHI, upon request, to the Secretary of HHS for purposes of determining CE’s compliance with HIPAA Regulations subject to attorney-client and other applicable legal privileges.

7.   No Third-Party Beneficiaries. 

Nothing express or implied in the Underlying Agreement or this BAA is intended to confer, nor shall anything herein confer upon any person other than CE, BA and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.

8.   Entire Agreement of the Parties. 

This BAA supersedes any and all prior and contemporaneous business associate agreements or addenda between the Parties and constitutes the final and entire agreement between the Parties hereto with respect to the subject matter hereof.  Each Party to this BAA acknowledges that no representations, inducements, promises, or agreements, oral or otherwise, with respect to the subject matter hereof, have been made by either Party, or by anyone acting on behalf of either Party, which are not embodied herein.  No other agreement, statement, or promise, with respect to the subject matter hereof, not contained in this BAA shall be valid or binding.

9.   Interpretation. 

This BAA and the Underlying Agreement shall be interpreted as broadly as necessary to allow the Parties to implement and comply with the HIPAA Regulations.  Any ambiguity in this BAA shall be resolved in favor of a meaning that complies and is consistent with the HIPAA Regulations. 

10.   Regulatory References. 

A reference in this BAA to a section of regulations means the section as in effect or as amended, and for which compliance is required.