Health Information Services Provider (HISP) Services Agreement,

Provider Directory Data Sharing Agreement,

and Business Associates Agreement

Effective August 25, 2020

 

THIS HEALTH INFORMATION SERVICE PROVIDER (HISP) SERVICES AGREEMENT (the “Agreement”) is made and entered into the effective date by and between iShare Medical, LLC (“iShare Medical”), a Missouri limited liability company, and Covered Entity (“Subscriber”).

WHEREAS, iShare is a health information services provider (“HISP); and

 WHEREAS, iShare Medical is a DirectTrust Accredited Trust Anchor HISP and DirectTrust Network Service Provider; and

WHEREAS, iShare Medical is Accredited HISP Privacy and Security by the Electronic Healthcare Network Accreditation Commission (“EHNAC”); and

WHEREAS, iShare Medical provides HISP services and other related services described more fully herein, including the facilitation of Direct Messages (as defined below) and attachments thereto which may contain protected health information, to individuals and organizations; and

WHEREAS, Subscriber desires to engage iShare Medical to provide HISP services and other related services to Subscriber and iShare Medical desires to provide such services in accordance with the terms and conditions specified herein.

WHEREAS, Subscriber will appoint a Trusted Agent (“Trusted Agent”) who will be responsible for providing collection of information and confirmation of authorized users in the Subscribers organization.

NOW THEREFORE, in consideration of the recitals above and the terms and conditions more particularly set forth below, the parties do hereby agree as follows:

ARTICLE I

ENGAGEMENT

 

1.1             Engagement.  Subscriber hereby engages iShare Medical on an independent contractor basis, and iShare Medical accepts such engagement, to provide HISP and other related services (the “Services”) as described in Section 1.2 hereof, in accordance with the terms and conditions of this Agreement.

1.2          Services.  iShare Medical will provide the following Services to Subscriber:

1.2.1       iShare Medical shall provide identity verification services for individuals and organizations through itself or its EHNAC-accredited Registration Authority (“RA”) and verify the identity of the individual or organization to the level of verification assurance necessary to facilitate secure information exchange;

1.2.2       iShare Medical shall provide digital certificate issuance, management and revocation services through itself or its EHNAC-accredited Certificate Authority (“CA”).  The Direct Certificate is issued in accordance with DirectTrust’s direct protocol and will be issued to and identify the Subscriber or another individual or organization;

1.2.3       iShare Medical shall assign domains and unique iShareID Direct Addresses (“Direct Addresses”) for accounts to Subscribers and other individuals and organizations in adherence with the Direct Project, which is a nationwide project to specify a simple, secure, scalable, standards-based way for participants to send authenticated, encrypted health information directly to known, trusted recipients over the Internet;

1.2.4       iShare Medical shall use the Direct Addresses to send and receive secure Direct Messages and attachments thereto from Subscriber that may contain patient medical records and other protected health information.  “Direct Messages” are secure messages sent between trusted Direct Certificate holders or other trusted parties;

1.2.5       iShare Medical shall store and maintain digital certificates and associated private keys to protect the confidentiality of protected health information;

1.2.6       iShare Medical shall provide software tools to establish a direct account for Subscriber to allow authorized individuals and organizations access to its Direct Messages and attachments thereto; and

1.2.7       iShare Medical shall provide data hosting for Subscriber for Direct messages and attachments.

ARTICLE II

OBLIGATIONS OF SUBSCRIBER

 

2.1       HIPAA Compliance.  Prior to disclosing or transmitting any protected health information to iShare Medical pursuant to this Agreement, if applicable, Subscriber shall ensure that it has obtained a valid authorization from an individual or an individual’s representative or is otherwise permitted to use or disclose an individual’s protected health information under the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder at 45 CFR Parts 160 and 164 (collectively “HIPAA”) in accordance with this Agreement.  Subscriber acknowledges that, due to the provision of certain services hereunder, iShare Medical is Subscriber’s business associate, as that phrase is defined under HIPAA.  Thus, Subscriber and iShare Medical have entered into a Business Associate Agreement, attached hereto as Exhibit C.  

2.2       Payment.  Subscriber shall timely pay iShare Medical for its Services in accordance with Section 4.1 hereof.

ARTICLE III
TERM AND TERMINATION

3.1       Term.  The initial Agreement term shall be for one year (the “Initial Term”) commencing on the Effective Date, defined below, subject to earlier termination of this Agreement pursuant to Section 3.2 hereof.  The “Effective Date” means the date in which the Subscriber agrees to this Agreement, unless the parties agree otherwise in writing.  This Agreement shall automatically renew for successive one (1) year renewal terms (each a “Renewal Term”) unless either party gives written notice at least thirty (30) days prior to the expiration of the Initial Term or the then current Renewal Term of an intention not to renew.  The Initial Term and any Renewal Term(s) are referred to collectively as the “Term.”

3.2       Termination.  Either party may terminate this Agreement for cause in the event of a material breach by the other party.  In such case, the terminating party must give written notice to the other party specifying in reasonable detail the claimed breach.  The other party shall have thirty (30) days following receipt of such notice in which to cure the breach.  If the claimed breach is not so cured within such period, the non-breaching party shall have the right, but not the obligation, to immediately terminate this Agreement. 

ARTICLE IV
COMPENSATION

 

4.1       Compensation for Services.  In exchange for the Services described herein, Subscriber shall pay iShare Medical the fees set forth in Exhibit A at the time of purchase hereto (the “Fees”).  iShare Medical shall automatically charge the Subscriber monthly for the Fees and any overages that apply.  Subscriber shall automatic pay the amount due via reoccurring credit card.  Subscriber’s failure to pay the full amount of any invoice within such thirty (30) day period will be considered a material breach hereof and iShare Medical may, at its option and in addition to all other remedies available to iShare Medical hereunder, including termination of this Agreement, deactivate Subscriber’s accounts until such time as payment is made in full or a payment arrangement has been mutually agreed upon by both parties.    

 

ARTICLE V
INDEPENDENT CONTRACTOR

 

5.1       Independent Contractor Status.  The relationship of the parties hereunder is solely that of independent contractors.  Nothing herein is intended to, nor shall it be construed to, make either party the employee, agent or servant of the other for any purpose whatsoever. 

ARTICLE XI

INDEMNIFICATION/LIMITATION OF LIABILITY

 

6.1       Indemnification.  Subscriber will indemnify and defend iShare Medical and its officers, directors, managers, members, employees and representatives against all claims and damages, including expenses and reasonable attorneys' fees ("Claim") to the extent arising out of its use or disclosure of protected health information hereunder. 

6.2       Limitation of Liability.  In no event will iShare Medical be liable for any special, indirect, incidental or consequential damages in connection with or related to the Services.  Liability of iShare Medical for claims related to this Agreement, whether in contract, tort or otherwise, will not exceed the fees paid by the Subscriber for the Services to which the claims relate.

 

ARTICLE VII

NOTICE

 

7.1       Notices.  All notices required or permitted to be given under the terms of this Agreement shall be in writing, and shall be effective upon delivery if delivered to the addressee in person, effective three (3) business days after mailing if mailed by certified mail, postage prepaid, return receipt requested, or effective the next business day if delivered by overnight courier with charges prepaid, as follows:

If to iShare Medical:   iShare Medical, LLC

3150 Mercier, Suite 608A

Kansas City, Missouri 64111

Attn: Linda Van Horn, MBA

                       

If to Subscriber:          Subscribers Trusted Agent

ARTICLE VIII

CONFIDENTIAL INFORMATION/INTELLECTUAL PROPERTY

 

8.1       Confidential Information.  All business, proprietary, financial, legal, and personal information disclosed by iShare Medical, either intentionally or unintentionally, to Subscriber in connection with this Agreement shall be held in strict confidence and shall not be disclosed by Subscriber without the prior written consent of iShare Medical.  For purposes of this Agreement, confidential information shall not include protected health information, as defined for purposes of HIPAA.  Subscriber shall not use any information gained as a result of this Agreement to the competitive disadvantage or in any other way detrimental to iShare Medical.  Subscriber shall not, during or after the Term, disclose such confidential and proprietary information of iShare Medical, or trade secrets of iShare Medical, to any other firm, person, corporation, association or other entity for any reason or purpose whatsoever, or use such information for Subscriber’s own benefit, without the prior written consent of iShare Medical, unless otherwise required to disclose such by law, in which case Subscriber shall immediately notify iShare Medical thereof.  This Section shall survive the expiration or termination of this Agreement for any reason.

8.2       Names, Logos, Marks.  Neither party shall use the name, logos, or marks of the other party without such party’s prior written consent, except that Subscriber may use iShare Medical’s name, logos, or marks to indicate that it may share information hereunder and iShare Medical may use Subscriber’s name, logos, or marks to identify it as a user of iShare Medical’s services.  This Section shall survive the expiration or termination of this Agreement for any reason.

8.3       Intellectual Property.  Each party shall retain all right, title and interest in all of its own Intellectual Property and all elements and derivative works thereof, whether or not developed in conjunction with the other party, and whether or not protected or protectable.  Notwithstanding the foregoing, the parties agree that iShare Medical shall own any new Intellectual Property that it develops pursuant to this Agreement, whether such development is at the request of Subscriber or otherwise.  For purposes hereof, “Intellectual Property” means (a) copyrights, (b) issued patents and patentable inventions, processes, methodologies, and procedures, (c) trade secrets and know-how, (d) trademarks or service marks, (e) moral rights, and (f) applications for registration or protection of any of the foregoing.  This Section shall survive the expiration or termination of this Agreement for any reason.

ARTICLE IX

MISCELLANEOUS

9.1       Recitals.  The recitals are true and correct and are incorporated herein in their entirety.

9.2       Dispute Resolution.  The parties agree to make all reasonable efforts to resolve any and all disputes between them in connection with this Agreement in an amicable manner.

9.3       Assignments.  Neither party may assign its rights or duties hereunder without the prior written consent of the other party; provided, however, that iShare Medical, at its discretion, may use one or more vendors or contractors to fulfill its obligations hereunder.

9.4       Publicity.  In accordance with Section 8.2 above, iShare Medical may use Subscriber’s name in press releases, product brochures, financial reports, and other marketing materials indicating that Subscriber is a customer of iShare Medical.

9.5       Force Majeure.  Failure of iShare Medical to perform its obligations under this Agreement will not subject iShare Medical to any liability to Subscriber if such failure is caused by acts of God, legal restrictions, transportation conditions, materials shortages, supplier delays, riot, sabotage, communication losses or interruptions, embargo, strikes or any other cause beyond the reasonable control of iShare Medical.  Such an occurrence or interruption shall not constitute a breach of this Agreement or vest in Subscriber any right of damage, cancellation or rescission.  iShare Medical will resume the performance of its obligations as soon as practicable after the force majeure event has ceased.   

9.6       Entire Agreement.  This Agreement supersedes all previous contracts or agreements between the parties with respect to the same subject matter and constitutes the entire Agreement between the parties hereto.

9.7       Governing Law.  This Agreement shall be construed and governed by the laws of the State of Missouri.  Any action or claim arising from, under or pursuant to this Agreement shall be brought in the courts, state or federal, within Kansas City, Missouri, and the parties expressly waive the right to bring any legal action or claims in any other courts.  The parties to this Agreement hereby consent to venue in any state or federal court within Kansas City, Missouri for all purposes in connection with any action or proceeding commenced between the parties hereto in connection with or arising from this Agreement.

9.8       Severability.  In the event that any provision hereof is found invalid or unenforceable, the remainder of this Agreement shall remain valid and enforceable according to its terms.

9.9       Amendments.  This Agreement may be amended only by an instrument in writing signed by the parties hereto.

9.10     Changes in Law or Interpretation of Law.  The parties recognize that this Agreement at all times is subject to applicable federal, state and local laws.  The parties further recognize that this Agreement shall be subject to amendments in and changing interpretations of such laws and regulations and to possible new legislation as well.  Should any provision of law (including existing law) invalidate, or otherwise be inconsistent with, the terms of this Agreement or cause one or both of the parties to be in violation of a material law, the parties shall exercise their bests efforts to negotiate an amendment to this Agreement so as to comply with such law, while maintaining the terms and intent of this Agreement to the greatest extent possible consistent with the requirements of law.  If a party reasonably requests an amendment to this Agreement pursuant to this Section and such amendment is not negotiated within thirty (30) days, or sooner if required by law, following notice of one party to the other that the Agreement or any portion thereof is invalid or inconsistent with applicable law, the party requesting the amendment may terminate this Agreement. 

9.11     Counterparts.  This Agreement may be executed simultaneously in two or more counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument.

 

iShare Medical

Provider Directory Data Sharing Agreement

Last Revised August 25, 2020

 

THIS PROVIDER DIRECTORY DATA SHARING AGREEMENT (the “Agreement”) is made and entered into by and between iShare Medical, LLC (“iShare Medical”), a Missouri limited liability company, and the person or entity who is identified pursuant to Section 2.1 hereof and agrees to the terms set forth herein by electronic signature (referred to herein as “Subscriber”.

WHEREAS, iShare is a health information services provider (“HISP); and

 WHEREAS, iShare Medical is a DirectTrust Accredited Trust Anchor HISP and DirectTrust Network Service Provider; and

WHEREAS, iShare Medical is Accredited HISP Privacy and Security by the Electronic Healthcare Network Accreditation Commission (“EHNAC”); and

WHEREAS, as a DirectTrust Trust Anchor, iShare Medical has access to data from multiple sources from which iShare Medical has created its own Direct Address directory (the “iShare Medical Directory”); and

WHEREAS, iShare Medical has developed software that allows its customers and subscribers to query the iShare Medical Directory and obtain Direct Addresses of providers and other persons; and

WHEREAS, Subscriber desires to enter into this Agreement to be authorized to query the iShare Medical Directory and iShare Medical desires to provide such authorization and access to the iShare Medical Directory through iShare Medical’s software in accordance with the terms and conditions specified herein.

NOW THEREFORE, in consideration of the recitals above and the terms and conditions more particularly set forth below, the parties do hereby agree as follows:

ARTICLE X

SERVICES

 

10.1     Querying Service.  Subject to Article XI below, iShare Medical shall provide to Subscriber software to allow Subscriber to query the iShare Medical Directory (“Query”) and shall set up an account that Subscriber may use to Query the iShare Medical Directory (the “Account”).  Subscriber may Query using the iShare Medical Directory application via the Internet using an Internet enabled device via their iShare Medical Messaging account. Upon making a Query, Subscriber will receive a search result based upon the information provided by Subscriber.

10.2     Use of Information Received from iShare Medical Directory.  Subscriber shall only use the information received from the iShare Medical Directory in order to (i) send direct messages to other providers, patients, third party insurers, business associates (as defined for purposes of the HIPAA Privacy Rule), or other third parties, as authorized by law; (ii) send direct text or direct instant messages to other providers, patients, third party insurers, business associates (as defined for purposes of the HIPAA Privacy Rule), or other third parties, as authorized by law; or (iii) perform health information exchange functions, as authorized by law.  Subscriber shall not use information received from iShare Medical Directory for any other reason without iShare Medical’s prior written consent, which consent may be withheld at iShare Medical’s sole discretion.

10.3 Restrictions on Distributing and Using Information.  Subscriber shall not shall not distribute to third parties, sell or re-sell any iShare Medical Directory information, including any Direct Addresses, nor shall Subscriber use such information for advertising, soliciting business, sending spam messages, distributing mass communications or influencing or attempting to influence for commercial purposes any diagnostic or treatment-related decisions.  iShare Medical Directory can only be used in conjunction with iShare Medical HISP services.  iShare Medical Directory cannot be purchased or used as a standalone product.  Further, iShare Medical Directory cannot be used for Direct Messaging from any other HISP, product, or service other than the iShare Medical product suite. 

Access to iShare Medical Directory or to any information returned from iShare Medical Directory is limited to employees, agents, or servants of the Subscriber’s organization.

If information from iShare Medical Directory is saved by Subscriber, Subscriber is responsible to ensure the saved information is periodically updated and checked for validity and accuracy while it is in use, such as for sending Direct Messages.  All Directory data obtained from iShare Medical Directory is only authorized to be used in accordance with this policy.

The restrictions in this Section 10.3 are not intended to be an exclusive list of prohibited actions with regard to the use or disclosure of information received by Subscriber and Subscriber shall at all times abide by the permissible use provisions set forth in Section 10.2 hereof.

10.4     Deactivation of Subscriber Account.  If Subscriber violates the restrictions related to the use of information received by Subscriber through iShare Medical Directory set forth in Section 10.2 or 10.3 or if Subscriber otherwise breaches this Agreement or violates applicable law or regulations, iShare Medical may immediately deactivate Subscriber’s Account and terminate this Agreement in accordance with section 12.2.

ARTICLE XI
OBLIGATIONS OF SUBSCRIBER

11.1     iShare Medical Messaging Subscriber.  iShare Medical Directory is offered exclusively as a service to iShare Medical Messaging Health Information Services Provider (HISP) subscribers.  As such, subscribers are required to have an iShare ID Direct Address. 

11.2     Providing Information.  As a condition of having access to the iShare Medical Directory, Subscriber shall provide the following information to iShare Medical: (i) the legal name of the Subscriber; (ii) the full name (i.e., first name, last name and any suffix) of each individual that will have access to the Account on Subscriber’s behalf; (iii) mailing address; (iv) telephone number; and (v) credit card information.

11.3     Payment.  Subscriber shall pay iShare Medical for the services provided hereunder in accordance with Section 4.1 hereof.  In order to make such payments and as a condition of having access to the iShare Medical Directory, Subscriber shall provide credit card information to iShare Medical in a form and format designated by iShare Medical. iShare Medical shall automatically charge the credit card information provided by Subscriber to set up an automated payment mechanism for Subscriber to make payments under Section 4.1 to iShare Medical.

ARTICLE XII
TERM AND TERMINATION

12.1     Term.  The Agreement term shall be for one (1) year (the “Initial Term”) commencing on the Effective Date subject to earlier termination of this Agreement pursuant to Section 10.4 and Section 3.2 hereof.  Following the Initial Term, this Agreement shall automatically renew for successive one (1) year renewal terms (each a “Renewal Term”) unless either party gives written notice to the other party at least ninety (90) days prior to the expiration of the Initial Term or the then current Renewal Term of such party’s intention not to renew.  The Initial Term and any Renewal Term(s) are referred to collectively as the “Term.”  The duration of each of the Initial Term, the Renewal Term, and the Term is subject to earlier termination of this Agreement pursuant to Section 3.2, Section 10.4, and Section 12.2 hereof.

12.2     Termination. 

12.2.1  Either party may terminate this Agreement for cause in the event of a material breach by the other party.  In such case, the terminating party must give written notice to the other party specifying in reasonable detail the claimed breach.  The other party shall have thirty (30) days following receipt of such notice in which to cure the breach.  If the claimed breach is not so cured within such period, the non-breaching party shall have the right, but not the obligation, to immediately terminate this Agreement. 

12.2.2  Notwithstanding the provisions of Section 12.2.1 or any other provision hereof, iShare Medical may terminate this Agreement immediately if any other third party that owns or licenses databases from which iShare Medical obtains necessary information for the iShare Medical Directory no longer allows iShare Medical access to the necessary information to allow iShare Medical to provide the services hereunder.

12.2.3 Notwithstanding the provisions of Sections 12.2.1 and 12.2.2, iShare Medical may terminate this Agreement as provided in Section 3.2, Section 10.4, and Section 12.2 hereof.

12.2.4 Upon termination of this Agreement, all Directory information obtained by Subscriber using iShare Medical Directory must be destroyed or removed from all media under Subscriber’s control, including hard-copy and electronic media.

ARTICLE XIII
COMPENSATION

13.1     Compensation for Services.  In exchange for the services described herein, Subscriber shall pay iShare Medical the fees set forth on Exhibits A and B hereto (the “Fees”).  Excluding Subscribers who have entered into an agreement to be invoiced and pay in accordance with that invoicing agreement, iShare Medical shall automatically charge Subscriber’s credit card each month during the Term for the amount of Fees owed by Subscriber for transactions that exceed the base allowed per account for the previous month plus the monthly base Fee charge for the applicable month in which the charge is made.  If there is any issue with the use of Subscriber’s credit card such that the charge by iShare Medical is denied or declined, Subscriber will be considered in material breach hereof and iShare Medical may, at its option and in addition to all other remedies available to iShare Medical hereunder and under the law, including termination of this Agreement, deactivate Subscriber’s Account until such time as payment is made in full or a payment arrangement has been mutually agreed upon by both parties. 

Subscriber’s failure to pay the full amount of any invoice within such thirty (30) day period will be considered a material breach hereof and iShare Medical may, at its option and in addition to all other remedies available to iShare Medical hereunder, including termination of this Agreement, deactivate Subscriber’s accounts until such time as payment is made in full or a payment arrangement has been mutually agreed upon by both parties. 

ARTICLE XIV
INDEPENDENT CONTRACTOR

14.1     Independent Contractor Status.  The relationship of the parties hereunder is solely that of independent contractors.  Nothing herein is intended to, nor shall it be construed to, make either party the employee, agent or servant of the other for any purpose whatsoever. 

ARTICLE XV
INDEMNIFICATION/LIMITATION OF LIABILITY

 

15.1     Indemnification.  Subscriber shall defend iShare Medical and its officers, directors, managers, members, employees and representatives against all claims and damages and indemnify iShare Medical and its officers, directors, managers, members, employees and representatives for all claims, damages and costs, including expenses and reasonable attorneys’ fees, to the extent arising out of its use or disclosure of information received through iShare Medical Directory hereunder. 

15.2     Limitation of Liability.  iShare Medical is not responsible for or liable for (i) any inaccuracies of data or other information that are provided by third parties to iShare Medical for inclusion in the iShare Medical Directory or (ii) any errors (e.g., typographical mistakes) by the Subscriber.  Further, in no event will iShare Medical be liable for any special, indirect, incidental or consequential damages in connection with or related to the services provided hereunder.  Liability of iShare Medical for claims related to this Agreement, whether in contract, tort or otherwise, will not exceed the Fees paid by the Subscriber for the services to which the claims relate.

ARTICLE XVI

NOTICE

 

16.1     Notices.  All notices required or permitted to be given under the terms of this Agreement shall be in writing, and shall be effective upon delivery if delivered to the addressee in person, effective three (3) business days after mailing if mailed by certified mail, postage prepaid, return receipt requested, or effective the next business day if delivered by overnight courier with charges prepaid, as follows:

If to iShare Medical:   iShare Medical, LLC

3150 Mercier, Suite 608A

Kansas City, Missouri 64111

Attn: Linda Van Horn, MBA

                       

If to Subscriber:          Individual and address identified by Subscriber as specified in Section 2.1

ARTICLE XVII

CONFIDENTIAL INFORMATION/INTELLECTUAL PROPERTY

 

17.1     Confidential Information.  All business, proprietary, financial, legal, and personal information disclosed by iShare Medical, either intentionally or unintentionally, to Subscriber in connection with this Agreement shall be held in strict confidence and shall not be disclosed by Subscriber without the prior written consent of iShare Medical.  Subscriber shall not use any information gained as a result of this Agreement to the competitive disadvantage or in any other way detrimental to iShare Medical.  Subscriber shall not, during or after the Term, disclose such confidential and proprietary information of iShare Medical, or trade secrets of iShare Medical, to any other firm, person, corporation, association or other entity for any reason or purpose whatsoever, or use such information for Subscriber’s own benefit, without the prior written consent of iShare Medical, unless otherwise required to disclose such by law, in which case Subscriber shall immediately notify iShare Medical thereof.  This Section shall survive the expiration or termination of this Agreement for any reason.

17.2     Names, Logos, Marks.  Neither party shall use the name, logos, or marks of the other party without such party’s prior written consent, except that iShare Medical may use Subscriber’s name, logos, or marks to identify it as a user of iShare Medical’s services.  This Section shall survive the expiration or termination of this Agreement for any reason.

17.3     Intellectual Property.  Each party shall retain all right, title and interest in all of its own Intellectual Property and all elements and derivative works thereof, whether or not developed in conjunction with the other party, and whether or not protected or protectable.  Notwithstanding the foregoing, the parties agree that iShare Medical shall own any new Intellectual Property that it develops pursuant to this Agreement, whether such development is at the request of Subscriber or otherwise.  For purposes hereof, “Intellectual Property” means (a) copyrights, (b) issued patents and patentable inventions, processes, methodologies, and procedures, (c) trade secrets and know-how, (d) trademarks or service marks, (e) moral rights, and (f) applications for registration or protection of any of the foregoing.  This Section shall survive the expiration or termination of this Agreement for any reason.

ARTICLE XVIII
MISCELLANEOUS

18.1     Recitals.  The recitals are true and correct and are incorporated herein in their entirety.

18.2     Dispute Resolution.  The parties agree to make all reasonable efforts to resolve any and all disputes between them in connection with this Agreement in an amicable manner.

18.3     Assignments.  Neither party may assign its rights or duties hereunder without the prior written consent of the other party; provided, however, that iShare Medical, at its discretion, may use one or more vendors or contractors to fulfill its obligations hereunder.

18.4     Publicity.  In accordance with Section 18.2 above, iShare Medical may use Subscriber’s name in press releases, product brochures, financial reports, and other marketing materials indicating that Subscriber is a customer of iShare Medical.

18.5     Force Majeure.  Failure of iShare Medical to perform its obligations under this Agreement will not subject iShare Medical to any liability to Subscriber if such failure is caused by acts of God, legal restrictions, transportation conditions, materials shortages, supplier delays, riot, sabotage, communication losses or interruptions, embargo, strikes or any other cause beyond the reasonable control of iShare Medical.  Such an occurrence or interruption shall not constitute a breach of this Agreement or vest in Subscriber any right of damage, cancellation or rescission.  iShare Medical will resume the performance of its obligations as soon as practicable after the force majeure event has ceased.  

18.6     Entire Agreement.  This Agreement supersedes all previous contracts, proposals, or agreements between the parties with respect to the same subject matter and constitutes the entire Agreement between the parties hereto.

18.7     Governing Law.  This Agreement shall be construed and governed by the laws of the State of Missouri.  Any action or claim arising from, under or pursuant to this Agreement shall be brought in the courts, state or federal, within Kansas City, Missouri, and the parties expressly waive the right to bring any legal action or claims in any other courts.  The parties to this Agreement hereby consent to venue in any state or federal court within Kansas City, Missouri for all purposes in connection with any action or proceeding commenced between the parties hereto in connection with or arising from this Agreement.

18.8     Severability.  In the event that any provision hereof is found invalid or unenforceable, the remainder of this Agreement shall remain valid and enforceable according to its terms.

18.9     Amendments.  This Agreement may be amended only by an instrument in writing signed by the parties hereto.

18.10   Changes in Law or Interpretation of Law.  The parties recognize that this Agreement at all times is subject to applicable federal, state and local laws.  The parties further recognize that this Agreement shall be subject to amendments in and changing interpretations of such laws and regulations and to possible new legislation as well.  Should any provision of law (including existing law) invalidate, or otherwise be inconsistent with, the terms of this Agreement or cause one or both of the parties to be in violation of a material law, the parties shall exercise their bests efforts to negotiate an amendment to this Agreement so as to comply with such law, while maintaining the terms and intent of this Agreement to the greatest extent possible consistent with the requirements of law.  If a party reasonably requests an amendment to this Agreement pursuant to this Section and such amendment is not negotiated within thirty (30) days, or sooner if required by law, following notice of one party to the other that the Agreement or any portion thereof is invalid or inconsistent with applicable law, the party requesting the amendment may terminate this Agreement. 

 

 

EXHIBIT A

 

Fees for iShare Medical Messaging for Providers

 

This exhibit outlines pricing for iShare Medical Messaging for Providers.  iShare Medical fees are as follows:

 

I. iShare Medical Messaging for Providers

 

1.      iShareID Direct Domain Certificates for 1 to 5 Direct Addresses is $125 per year per subscribing healthcare organization. iShareID Direct Certificates for the purposes of Direct Messaging cannot be used by multiple organizations. This product includes the following:

a.      ID Proofing of Subscriber Organization and Trusted Agent.

b.      Administrative account for Trusted Agent to create and manage Direct Addresses for the Organization.

c.      iShareID Direct Domain includes two key pairs.  One key pair is used for encryption/decryption of messages and the second key paid is used for digital signatures. Each key pair is bound to a separate Certificate.

d.      HIPAA compliant secure storage and protection of private keys.

2.      iShare Medical Messaging is sold in increments of 5 users at a cost of $19.95 per user per month. Each user will have a separate user login to iShare Medical Messaging for Provider application which allows the user to view Direct Messages in plain English.  Login accounts use two-factor authentication.  Factor one is a username and password and factor two is a single use token texted to the users cell phone or desk top computer. 

3.      For each 5 users there is an aggregated number of Transactions included of 1,000.  Transactions in excess of 1,000 are $0.22 (twenty-two cents) per Transaction.  Transactions include Direct Messages sent or received.  Administrative messages such as Message Disposition Notifications (MDNs) and internal messages from the postmaster are not counted against the 1,000 Transactions. The maximum size for any Direct Message is 10 MB, including the message header, the message body, and attachments.  The Direct Message size limit is for pricing purposes.  Larger Direct Message sizes can be accommodated under a different pricing structure.  

4.      Additional Storage over 1 GB is $5 per GB per month.

 

 

 

EXHIBIT B

iShare Medical Directory Fees

This exhibit outlines pricing for iShare Medical Directory.  iShare Medical Directory is available as a web application or as a RESTful API.  In either case, iShare Medical Directory cannot be purchased as a stand-alone product.  In the case of the web application, iShare Medical Directory is included as a part of iShare Medical Messaging.  In the case of API access to iShare Medical Directory, iShare Medical RESTful API for Directory Services is a separate product that is only available to customers who have also purchased iShare Medical RESTful API for iShare Medical Messaging.

 

iShare Medical Directory

 

1.      Subscribers must have and iShareID Direct Address in order to access the iShare Medical RESTful API for Directory Services or iShare Medical Directory online provider directory.

2.      iShare Medical Directory is a component of iShare Medical Messaging and included in the price for iShare Medical Messaging.

3.      iShare Medical RESTful API for Directory Services is priced separately and available upon request.

 

 

 

EXHIBIT C

Business Associate Agreement

 

This BUSINESS ASSOCIATE AGREEMENT (the “Agreement”) is entered into on effective date by and between the Subscriber, and iShare Medical, LLC, a Missouri limited liability company with its principal place of business at 3150 Mercier, Suite 608A, Kansas City, Missouri 64111 (sometimes hereinafter referred to as "iShare").

WHEREAS, the Subscriber is a “covered entity” under the regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”); and

WHEREAS, the parties have entered into that certain Agreement for HISP Services (“Service Agreement”) that will require Subscriber to disclose to iShare information that is confidential and must be afforded special treatment and protection in accordance with HIPAA and the regulations promulgated thereunder at 45 CFR Parts 160 and 164.

NOW, THEREFORE, the parties agree as follows:

1.    Definitions.  Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the Privacy Rule, Security Rule, or Data Breach Notification Rule.  For the purposes of this Agreement, the following words shall have the following meanings:

a.                 Breach.  “Breach” shall have the same meaning as the term “breach” in 45 CFR 164.402, limited to a Breach involving Protected Health Information as defined herein.

b.                Business Associate. “Business Associate” shall mean iShare.

c.                 Covered Electronic Transactions.  “Covered Electronic Transactions” shall have the same meaning as the term “Transaction” in 45 CFR 160.103.

d.                Covered Entity. “Covered Entity” shall mean Subscriber.

e.                 Data Breach Notification Rule. “Data Breach Notification Rule” shall mean the standards for Breach Notification of Unsecured Protected Health Information at 45 CFR part 160 and part 164, subparts A and D, as amended.

f.                 Individual. “Individual” shall have the same meaning as the term “individual” in 45 CFR 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

g.                Privacy Rule. “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E, as amended.

h.                Protected Health Information. “Protected Health Information” shall have the same meaning as the term “protected health information” in 45 CFR 160.103, limited to the information created, received, maintained or transmitted by Business Associate from or on behalf of Covered Entity.

i.                  Required By Law. “Required By Law” shall have the same meaning as the term “required by law” in 45 CFR 164.103.

j.                  Secretary. “Secretary” shall mean the Secretary of the Department of Health and Human Services (“DHHS”) or his or her designee.

k.                Security Incident. “Security Incident” shall have the same meaning as the term “security incident” in 45 CFR 164.304.

l.                  Security Rule.  “Security Rule” shall mean the Security Standards for the Protection of Electronic Protected Health Information, 45 CFR Part 160 & Part 164, subparts A & C, as amended.

m.              Standards for Electronic Transactions Rule.  “Standards for Electronic Transactions Rule” means the final regulations issued by DHHS concerning standard transactions and code sets, 45 CFR Part 160 & Part 162, as amended.

2.   Obligations and Activities of Business Associate.

a.                 Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by the Agreement or as Required By Law.

b.                Business Associate agrees to use appropriate safeguards, and to comply with the Security Rule with respect to electronic Protected Health Information, to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement, including the implementation of administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic Protected Health Information that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity as required by the Security Rule.  Covered Entity expressly agrees that Business Associate may de-identify PHI that is received from, or created on behalf of, the Covered Entity.

c.                 Business Associate agrees to report to Covered Entity any (i) Security Incident of which it becomes aware, (ii) use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware, or (iii) any Breach of which it becomes aware, within twenty (20) business days of Business Associate’s discovery of any such Security Incident, unauthorized use or disclosure, or Breach.  The parties agree, however, that Unsuccessful Security Incidents (USI) are foreseeable and expected, are not reportable under this paragraph, and that this paragraph provides notice of such USI.  For purposes of this Agreement, USI includes, but is not limited to, pings on a firewall, unsuccessful attempts to log onto a system with an invalid password or user name, unsuccessful attempts to load malware, denial-of-service attacks that do not result in a server being taken off-line, and other events that do not result in actual impermissible disclosure of Protected Health Information or a substantial risk thereof. 

d.                In accordance with 45 CFR 164.502(e)(1)(ii) and 45 CFR 164.308(b)(2), Business Associate agrees to ensure that any agents or Subcontractors that create, receive, maintain or transmit Protected Health Information on behalf of the Business Associate execute a written contract agreeing to abide by the same restrictions, conditions and requirements that apply through this Agreement to Business Associate with respect to such information, including without limitation an agreement to implement reasonable and appropriate safeguards to protect non-electronic and electronic Protected Health Information.

e.                 Within ten (10) business days of receipt of a written request from Covered Entity, Business Associate agrees to provide access in the manner designated by the Covered Entity to Protected Health Information in a Designated Record Set, to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR 164.524.

f.                 Unless otherwise Required By Law or by an accrediting organization, Business Associate agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526 at the request of Covered Entity or an Individual, and in the time and manner designated by the Covered Entity.

g.                Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available to the Secretary, in a time and manner designated by the Secretary, for purposes of the Secretary determining Covered Entity’s compliance with the Privacy Rule. 

h.                Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

i.                  Within ten (10) business days of receipt of a written request from Covered Entity, Business Associate agrees to provide to Covered Entity or an Individual, in the manner designated by the Covered Entity, information collected in accordance with Section 2(h) of this Agreement, so as to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

j.                  If Business Associate transmits or receives any Covered Electronic Transaction on behalf of the Covered Entity, it shall comply with all applicable provisions of the Standards for Electronic Transactions Rule to the extent Required By Law, and shall ensure that any agents that assist Business Associate in conducting Covered Electronic Transactions on behalf of the Covered Entity agree in writing to comply with the Standards for Electronic Transactions Rule to the extent Required By Law. 

k.                To the extent Business Associate is to carry out Covered Entity’s obligations under the Privacy Rule, Business Associate agrees to comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of the obligation.

l.                  Business Associate agrees to reasonably safeguard protected health information to limit incidental uses or disclosures made pursuant to an otherwise permitted or required use or disclosure.

m.              Business Associate agrees to comply with all applicable federal and state laws and regulations, including the HITECH Act’s privacy and security requirements.

3.   Permitted Uses and Disclosures by Business Associate. 

a.                 Except as otherwise limited in this Agreement, Business Associate may use or disclose Protected Health Information to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the Service Agreement, provided that such use or disclosure would not violate the Privacy Rule if done by Covered Entity or the minimum necessary policies and procedures of the Covered Entity (except for the specific uses and disclosures set forth below). 

b.                Except as otherwise limited in this Agreement, Business Associate may use Protected Health Information for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. 

c.                 Except as otherwise limited in this Agreement, Business Associate may disclose Protected Health Information for the proper management and administration of the Business Associate, provided that disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

d.                Except as otherwise limited in this Agreement, Business Associate may use Protected Health Information to provide Data Aggregation services to Covered Entity as permitted by 42 CFR 164.504(e)(2)(i)(B).

e.                 Business Associate may use Protected Health Information to report violations of law to appropriate federal and state authorities, consistent with 45 CFR 164.502(j)(1).

f.                 Except as otherwise limited in this Agreement, Business Associate may disclose Protected Health Information to a business associate who is an agent or Subcontractor and may allow the agent or Subcontractor to create, receive, maintain or transmit Protected Health Information on its behalf, if the Business Associate enters into a written contract with the agent or Subcontractor in which the agent or Subcontractor agrees to abide by the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information, including without limitation an agreement to implement reasonable and appropriate safeguards to protect non-electronic and electronic Protected Health Information.  

g.                Business Associate may use or disclose Protected Health Information as Required By Law.

4.  Obligations of Covered Entity. 

a.                 Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices under 45 CFR 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of Protected Health Information.

b.                Covered Entity shall notify Business Associate of any changes in, or revocation of, authorizations by an Individual to use or disclose Protected Health Information, to the extent that such changes may affect Business Associate's use or disclosure of Protected Health Information.

c.                 Covered Entity shall notify Business Associate of any restriction to the use or disclosure of Protected Health Information that Covered Entity has agreed to in accordance with 45 CFR 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of Protected Health Information.

5.  Permissible Requests by Covered Entity.  Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by Covered Entity, except that Covered Entity may request Business Associate to undertake the activities mentioned in Sections 3(b)-(f) above.

6.       Term and Termination.

a.                 Term. The Term of this Agreement shall be effective as of today and shall terminate when all of the Protected Health Information provided by Covered Entity to Business Associate, or created, received, maintained or transmitted by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy Protected Health Information, protections are extended to such information, in accordance with the termination provisions in this Section. 

b.                Termination for Cause. Upon Covered Entity’s knowledge of a pattern of activity or practice of the Business Associate that constitutes a material breach or violation of this Agreement by Business Associate, Covered Entity shall either:

1.                Provide an opportunity for Business Associate to cure the breach or end the violation and terminate this Agreement and the Service Agreement if Business Associate does not cure the breach or end the violation within the time specified by Covered Entity, if termination is feasible; or

2.                Immediately terminate this Agreement and the Service Agreement if cure is not possible, if feasible.

c.                 Effect of Termination.

1.                Except as provided in paragraph (2) of this subsection, upon termination of this Agreement, for any reason, Business Associate shall return or destroy all Protected Health Information received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the Protected Health Information.

2.                In the event that Business Associate determines that returning or destroying the Protected Health Information is infeasible, Business Associate shall provide a written certification to Covered Entity of the conditions that make return or destruction infeasible. Upon certifying that return or destruction of Protected Health Information is infeasible, Business Associate shall extend the protections of this Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such Protected Health Information.

7. HITECH Act Amendments.  To comply with certain provisions contained in the American Recovery and Reinvestment Act of 2009, the parties agree to comply with the following:

a.                 Business Associate shall comply with the applicable standards, implementation specifications, and requirements of the Security Rule with respect to electronic Protected Health Information of Covered Entity.  Specifically, Business Associate shall comply with all applicable sections of 45 C.F.R. §§ 164.306, 164.308, 164.310, 164.312, 164.314 and 164.316.  The additional requirements of Subtitle D of Division A of the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”) contained in Public Law 111-005 that relate to security and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by this reference hereby are incorporated into this Agreement, and Business Associate shall comply with those requirements and any implementing regulations.

b.                Business Associate may use and disclose Protected Health Information that it obtains or creates only if such use or disclosure, respectively, is in compliance with each applicable requirement of 45 C.F.R. 164.504(e).  The additional requirements of Subtitle D of Division A of the HITECH Act and its implementing regulations that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to Business Associate and shall be and by this reference hereby are incorporated into this Agreement, and Business Associate shall comply with those requirements.

8.  Miscellaneous.

a.                Regulatory References. A reference in this Agreement to a section in the Privacy Rule or the Security Rule means the section as in effect or as amended.

b.                Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Covered Entity and Business Associate to comply with the requirements of the Privacy Rule, the Security Rule, the Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191, and the HITECH Act and its implementing regulations.  Regardless of the execution of a formal amendment of this Agreement, the Agreement shall be deemed amended to permit the Covered Entity and Business Associate to comply with HIPAA, the HITECH Act and its implementing regulations, the Privacy Rule, and the Security Rule, as the same may be hereafter amended or interpreted.

c.                 Survival. The rights and obligations of Business Associate under Section 6(c) shall survive the termination of this Agreement.  Sections 8(a) and 8(c)-(h) of this Agreement shall survive the termination of this Agreement.

d.                Interpretation. This Agreement supersedes any prior business associate agreement between the parties.  Any ambiguity in this Agreement shall be resolved to permit the parties to comply with the requirements of HIPAA and all regulations promulgated pursuant to HIPAA, including without limitation the Privacy Rule and the Security Rule, and with the HITECH Act and its implementing regulations.  In the event of any conflict between this Agreement and any other agreement between the parties, this Agreement shall control. 

e.                 Notices.  Notices permitted or required to be given under this Agreement shall be in writing and shall either be hand delivered, sent by certified mail, return receipt requested, or delivered by overnight courier to the address of the parties as set forth herein below, or to other such person or to other such address as the parties hereto may specify by written notice to the other:

Covered Entity:	Subscriber Trusted Agent as specified in section 2.1
Business Associate:	iShare Medical, LLC 3150 Mercier, Suite 608A Kansas City, Missouri 64111 Attn:  Linda Van Horn

 

f.                 No Third Party Beneficiaries.  The parties specifically intend that nothing in this Agreement, either express or implied, is intended to confer any rights or remedies under or by reason of this Agreement upon any person or entity other than the parties hereto and their respective successors and assigns.  In particular, the parties intend that this Agreement governs and applies only to their relationship and all other persons or entities shall have no rights, claims, entitlements, or benefits under or as a result of this Agreement.

g.                Independent Contractor Status.  It is expressly acknowledged and agreed by the parties that Business Associate is an independent contractor and nothing in this Agreement is intended or will be construed to create an employer/employee, partner or joint venturer relationship between the parties.  Business Associate shall control the manner, means, and methods by which services are performed by it, subject to compliance with this Agreement and the Service Agreement.

h.                Governing Law; Where Action to Be Brought; Venue.  This Agreement shall be governed by, and construed in accordance with, the laws of the State of Missouri without regard to conflicts of law principles.  Any action or claim arising from, under or pursuant to this Agreement shall be brought in the courts, state or federal, within Kansas City, Missouri, and the parties expressly waive the right to bring any legal action or claims in any other courts.  The parties hereto hereby consent to venue in any state or federal court within Kansas City, Missouri for all purposes in connection with any action or proceeding commenced between the parties hereto in connection with or arising from this Agreement.

 

IN WITNESS WHEREOF, the parties hereto have executed this Agreement as of the day and year first written above. 

IN WITNESS WHEREOF, Business Associate and Covered Entity have caused this Agreement to be signed and delivered by their duly authorized representatives, as of the date first set forth above.

 

61289280.10