Exhibit 10.32

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

MASTER SERVICES AGREEMENT

 

This Master Services Agreement (“Agreement”) is made as of December 19, 2016 (the “Effective Date”), between:

 

United HealthCare Services, Inc., a Minnesota corporation with offices at 9900 Bren Road East, Minnetonka, MN 55343 (“Customer”), on behalf of itself and its Affiliates; and

 

Innovation Specialists, LLC d/b/a 2nd.MD, a Texas limited liability company with principal offices at 1300 Post Oak Boulevard, Suite 725, Houston, Texas 77056 (“Vendor”).

 

Any Affiliate of Customer may execute a SOW hereunder and in such case, all obligations of, and references to, Customer in this Agreement shall instead refer to such Affiliate. For purposes of this Agreement, “Affiliate” means any entity directly or indirectly controlled by, controlling, or under common control with Customer.

 

Section 1. Services

 

Section 1.1 Description of Services. Vendor shall provide to Customer the services (“Services”) as specified in statements of work to this Agreement that are signed by the parties from time to time in a form substantially similar as attached hereto as Exhibit A (“SOWs” or “Statements of Work”). SOWs and any and all other documents referenced as a part of this Agreement are hereby incorporated by reference into this Agreement. SOWs shall constitute the only authorization for Vendor to take any action that will result in expense to or otherwise on behalf of Customer. Customer does not guarantee Vendor any particular amount of work under this Agreement. The Services shall be performed at the locations identified in the SOW, or if not identified, from such location specified by Customer. Vendor shall not use subcontractors without Customer’s prior written consent. Vendor shall provide the Services in accordance with the service levels set forth on in the applicable Order or SOW (“Service Levels”). In the event that a Service Level has not been met, Vendor shall: (i) perform a root-cause analysis to identify the cause of such failure; (ii) promptly correct such failure within the timeframe set forth in the applicable SOW; and (iii) provide Customer with a written report detailing the cause of, and procedure for correcting, such failure within [***] after such Service Level failure has occurred. [***].

 

Section 1.2 Additional Exhibit Terms. Vendor agrees to comply with the requirements outlined in the following Exhibits attached to this Agreement, which are fully incorporated herein by reference.

 

Exhibit A – Form of Statement of Work

Exhibit B – Certificate of Compliance for Contractors and Suppliers

Exhibit C – Price List

Exhibit D – HIPAA and GLBA (Business Associate Agreement)

Exhibit E – Standard Contractual Clauses

Exhibit F – Security

Exhibit G – Background Investigations

Exhibit H – Medicare Advantage Regulatory Requirements Appendix

Exhibit I – Master Community & State Appendix

Exhibit J – Exchange Regulatory Appendix

 

Section 1.3 Personnel.

 

(A) General Requirements. The parties are independent contractors and nothing in this Agreement or otherwise shall be deemed or construed to create any other relationship, including one of employment, joint venture or agency. Vendor shall be solely responsible for any taxes of any type, including central, state or local tax, employment, withholding or reporting tax, social security taxes, workers’ compensation taxes or costs, unemployment compensation taxes or costs, or any other taxes or charges, provident fund, gratuity, bonus, workmen’s compensation, employee state insurance, other employment law deductions, or private insurance, related to Vendor’s or Vendor’s personnel’s receipt of compensation and performance of Services under this Agreement. Vendor has withheld properly all federal, state and local employment taxes from the wages of its employees and otherwise has conducted and will conduct itself not as an individual or individuals but as a legal entity separate from the persons actually performing the Services pursuant to this Agreement. In addition, Vendor agrees to inform all of its employees performing the Services that they are employees solely of Vendor, and are not eligible to any of Customer’s employee benefit plans, incentive, compensation or other employee programs or policies. Vendor will be solely responsible for compliance with immigration and visa laws and requirements, including compliance with the Immigration and Reform Control Act of 1986 (IRCA) with respect to Vendor employees and contractors. Vendor represents and warrants that all Vendor personnel (1) will hold appropriate and valid visas or other work authorizations for the jurisdiction in which such individuals will be working, each of which will be valid for a period at least equal to the anticipated duration of each such individual’s assignment to the Customer account, and (2) will not be provided by Vendor with any technology or information in violation of any export laws of the U.S. or any other relevant country. Vendor will provide, at no cost to Customer, adequate levels of training and education for Vendor personnel, so that they are properly educated, trained and fully qualified with respect to the Services they are to perform.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

(B) Attrition; Removal. Vendor will use commercially reasonable efforts to keep the attrition rate to a reasonably low level. Notwithstanding the transfer, attrition or other turnover of Vendor personnel, Vendor remains obligated to perform the Services without degradation (including in accordance with applicable Service Levels) and in accordance with the terms of this Agreement. If Customer determines in good faith that the continued assignment of any Vendor personnel to Customer’s account is not in Customer’s best interests, then Customer may give Vendor written notice to that effect. After receipt of such notice, Vendor will promptly remove the person in question from Customer’s account and from any Customer facilities and will replace that person with another person of suitable ability and qualifications. Vendor retains the sole right to hire and fire Vendor personnel, and will be solely responsible for oversight of Vendor personnel and any decision to fire any Vendor personnel.

 

(C) Key Personnel. Each Statement of Work will set forth: (1) the names of all Vendor personnel performing Services under such Statement of Work, (2) the location of each such person, (3) whether a person is designated as “key” (“Key Vendor Personnel”), and (4) with respect to Key Vendor Personnel, the period of time such personnel will be assigned to performing the Services. Vendor will not assign any Key Vendor Personnel to the account of any Customer competitor while such individual is assigned to Customer’s account and for a period of six months following the date that such individual is removed from, or ceases to provide any services in connection with, Customer’s account.

 

(D) Background Checks and Compliance. Vendor will comply with the applicable requirements of Exhibit G (Background Investigations) before assigning an individual to perform Services. Further, Vendor will cause all Vendor personnel to (1) comply with Customer requests, rules and regulations, and policies regarding safety and health and personal and professional conduct while on site at Customer facilities, (2) comply with applicable requirements of the Vendor Code of Conduct (as defined in Section 5.12), and (3) otherwise conduct themselves in a professional and businesslike manner.

 

Section 1.4 Subcontracting and Offshoring.

 

(A) Subcontracting. Vendor may not subcontract any of its obligations under this Agreement without Customer’s prior written approval, which will not be unreasonably withheld (subject to Section 1.4(B)). Vendor will remain responsible for obligations, services and functions performed by subcontractors to the same extent as if such obligations, services and functions were performed by Vendor employees, and for purposes of this Agreement such work will be deemed work performed by Vendor. Vendor will be Customer’s sole point of contact regarding the Services, including with respect to payment. Vendor will not disclose Customer Confidential Information to a subcontractor unless and until such subcontractor has agreed in writing to protect the confidentiality of such Confidential Information in a manner substantially equivalent to that required of Vendor under this Agreement.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

(B) Offshoring. Before providing any component of the Services from a location outside of the United States, Vendor must obtain Customer’s written approval, which may be withheld by Customer in its sole discretion. Before entering into a subcontract for work to be performed outside of the United States, Vendor must provide to Customer a description of the scope and material terms (other than financial) of the proposed subcontract. Customer will have the right to approve or disapprove of any such subcontracts and subcontractors in its sole discretion.

 

Section 2. Pricing and Payment Terms

 

Section 2.1 Fees. All charges for the Services are set forth in the applicable Statement of Work. Customer will not be required to pay Vendor any amounts for the Services other than (A) the charges in the applicable Statement of Work, and (B) reimbursable expenses, subject to Section 2.3. The parties agree and acknowledge that, except as set forth in the applicable Statement of Work, the charges will be inclusive of, and not subject to adjustment to account for, any inflation or cost of living increases or fluctuation in any currency exchange rates. [***]. Vendor is solely responsible for managing its resources so as to provide the Services in compliance with applicable Service Levels and the other terms of this Agreement and each applicable Statement of Work.

 

Section 2.2 Expenses; Taxes. All pass-through or out-of-pocket expenses for which Customer is responsible must be expressly identified in the applicable Statement of Work. If a Statement of Work provides that Customer will reimburse Vendor for travel expenses, Vendor will obtain Customer’s prior written approval for travel and all travel will be consistent with Customer’s Travel and Expense Policy, which is available for Vendor to review at http://www.unitedhealthgroup.com/suppliers/default.aspx?. Customer will not be responsible for the payment or reimbursement of expenses not expressly identified as a Customer responsibility in the applicable Statement of Work. With respect to services or materials paid for on a pass-through expenses basis, Customer reserves the right to obtain such services or materials directly from a third party or designate the third party source for such services or materials. Vendor will use commercially reasonable efforts to minimize the amount of pass-through and out-of- pocket expenses. Customer will be responsible for the payment of any sales or use taxes levied on Services provided under this Agreement. Each party will be responsible for any personal property taxes on property it owns or leases, for franchise and privilege taxes on its business, and for taxes based on its net income or gross receipts.

 

Section 2.3 Invoicing and Payment. Vendor will invoice Customer on a monthly basis in arrears, unless otherwise set forth in the applicable Statement of Work. Vendor’s rates under any Statement of Work may not exceed those set forth on Exhibit C (Price List). As directed by Customer, Vendor will establish an electronic vendor account through the third party internet-based platform specified by Customer, through which Vendor will submit invoices to and receive purchase orders from Customer (the “eProcurement System”). In addition, Vendor will be responsible for any fees or charges imposed on Vendor associated with the eProcurement System, and will not pass such fees or charges through to Customer. If Customer has established an eProcurement System applicable to this Agreement, Customer will not be required to pay any invoice unless Vendor has submitted such invoice through the eProcurement System. Undisputed invoices will be due and payable by Customer within [***] after invoice receipt, or, in the case of invoices submitted outside of the eProcurement System, within [***] after invoice receipt. Customer’s payment of any invoice will not be construed as acceptance of the underlying Services. Vendor will provide invoices with sufficient detail to enable Customer to identify the SOW to which the fees pertain and, for Services provided on a time and materials basis, the invoice will contain the name of the individual performing the Services as well as the number of hours spent performing the Services.

 

Section 2.4 Disputed Fees; Set-Off. Customer may withhold payment of particular charges that Customer disputes in good faith, pending the resolution of such dispute, provided that Customer provides Vendor with written notice of the amounts being withheld and the reason for withholding such amounts. With respect to any amount to be paid by Customer under this Agreement, Customer may deduct from such amount any amount that Vendor is obligated to pay or credit to Customer.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Section 3. Confidentiality

 

Section 3.1 Confidentiality Obligations. During the term of this Agreement, from time to time, either party may disclose (the “Disclosing Party”) or make available to the other party (the “Receiving Party”), whether orally, electronically or in physical form, confidential or proprietary information concerning the Disclosing Party and/or its business, products or services in connection with this Agreement (together, “Confidential Information”). Confidential Information of Customer includes, without limitation, business plans, health plan relationships, acquisition plans, systems architecture, information systems, technology, data, computer programs and codes, processes, methods, operational procedures, finances, budgets, policies and procedures, customer, employee, provider, member, patient and beneficiary information, claims information, vendor information (including agreements, software and products), product plans, projections, analyses, plans or results, the existence of any business dealings or agreements between Customer and Vendor, and any other information which is normally and reasonably considered confidential. Each party agrees that during the term of this Agreement and thereafter: (a) it will use Confidential Information belonging to the Disclosing Party solely for the purpose(s) of this Agreement; and (b) it will not disclose Confidential Information belonging to the Disclosing Party to any third party (other than the Receiving Party’s employees, contractors and/or professional advisors on a need-to-know basis who are bound by obligations of nondisclosure and limited use at least as stringent as those contained herein) without first obtaining the Disclosing Party’s written consent. Upon request by the Disclosing Party, the Receiving Party will return all copies of any Confidential Information to the Disclosing Party. Vendor hereby agrees that every individual person who performs under this Agreement shall execute the appropriate documents to undertake obligations of confidentiality consistent with the terms set forth herein. Vendor hereby agrees to provide evidence and/or copies of such duly executed documents to Customer upon request.

 

Section 3.2 Confidentiality Exclusions. For purposes hereof, Confidential Information will not include any information that the Receiving Party can establish by convincing written evidence: (a) was independently developed by the Receiving Party without use of or reference to any Confidential Information belonging to the Disclosing Party; (b) was acquired by the Receiving Party from a third party having the legal right to furnish same to the Receiving Party without disclosure restrictions; or (c) was at the time in question (whether at disclosure or thereafter) generally known by or available to the public (through no fault of the Receiving Party).

 

Section 3.3 Required Disclosures. These confidentiality obligations will not restrict any disclosure required by order of a court or any government agency, provided that the Receiving Party gives prompt notice to the Disclosing Party of any such order and reasonably cooperates with the Disclosing Party at the Disclosing Party’s request and expense to resist such order or to obtain a protective order.

 

Section 3.4 Customer Data. [***].

 

Section 3.5 Injunctive Relief. The parties acknowledge and agree that the disclosure of Confidential Information may result in irreparable harm for which there is no adequate remedy at law. The parties therefore agree that the Disclosing Party may be entitled to seek an injunction in the event the Receiving Party violates or threatens to violate the provisions of this Section 3, and that no bond will be required. This remedy will be in addition to any other remedy available at law or equity.

 

Section 3.6 HIPAA and GLBA. Vendor understands and acknowledges that Exhibit D (HIPAA and GLBA) attached hereto will apply in the event Vendor provides Services to Customer pursuant to which Vendor has access to, receives from, creates, or receives on behalf of Customer Protected Health Information, or Vendor has access to, creates, receives, maintains or transmits on behalf of Customer Electronic Protected Health Information (as those terms are defined under the privacy or security regulations issued pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and Subtitle D of the Health Information Technology for Economic and Clinical Health Act provisions of the American Recovery and Reinvestment Act of 2009 (“ARRA”)), and/or nonpublic personal information, as defined under the Gramm-Leach-Bliley Act and implementing regulations (“GLBA”), during the performance of its obligations under this Agreement.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Section 3.7 EU Data Protection.      If the Services involve the creation, processing, retention, deletion, use or disclosure of personal data (as that term is defined under the EU Data Protection Directive), including of Customer employees and other individuals (“Personal Data”), then Vendor will comply, and will require that its personnel and subcontractors comply, with all applicable requirements of the EU Data Protection Directive, including, without limitation, ensuring that transfers of Personal Data to third countries are made only in accordance with the following: (a) the transfer is to a jurisdiction deemed by the European Commission to have an adequate level of protection; (b) the transfer is subject to contractual provisions approved by the European Commission such as, by way of example only, the Standard Contractual Clauses attached as Exhibit E, which the parties hereby adopt and incorporate into this Agreement by this reference; or (c) pursuant to a framework deemed adequate and approved by the European Commission. For purposes of this Agreement, the “EU Data Protection Directive” means Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and any legislation implementing or revising such directive in applicable EU member states.

 

Section 3.8 Customer IT Systems Security. Vendor acknowledges and agrees that its access to Customer’s information technology systems will be subject to the provisions of Exhibit F (Security).

 

Section 4. Work Product and Customer Property

 

Section 4.1 [***].

 

Section 4.2 Customer Property. [***].

 

Section 4.3 Residual Knowledge. Nothing contained in this Agreement will restrict a party from the use of any general ideas, concepts, know-how, methodologies, processes, technologies, algorithms or techniques retained in the unaided mental impressions of such party’s personnel relating to the Services which either party, individually or jointly, develops or discloses under this Agreement, provided that in doing so such party does not breach its obligations under Section 3 or infringe the intellectual property rights of the other party or third parties who have licensed or provided materials to the other party.

 

Section 5. Representations and Warranties; Compliance with Laws

 

Section 5.1 General Warranties. Vendor represents and warrants to Customer that: (a) it is duly incorporated and validly existing under applicable laws and in good standing in applicable business locations as required; (b) it has all necessary right, title, license and authority to enter into and perform its obligations under this Agreement; (c) Vendor has appropriate agreements with its employees and Customer-approved subcontractors to allow it to provide the Services in accordance with the terms of this Agreement; and (d) the person signing this Agreement (including each attachment) on behalf of Vendor has full authority to bind Vendor to the terms and conditions hereof.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Section 5.2 Performance Warranties. Vendor represents and warrants to Customer that: (a) the Services performed and the work created under this Agreement will conform with all applicable laws, industry standards and Customer’s instructions and specifications; (b) Vendor will provide the Services in a workmanlike, professional, and ethical manner; (c) the Services performed and the Work Product created under this Agreement will not infringe the copyrights, patents, trade secrets or other intellectual property or other rights of any third party; (d) performing the Services will not conflict with any other agreements to which Vendor is a party; and (e) Vendor will not use any of its own proprietary materials in the Work Product without Customer’s prior written permission and an appropriate perpetual license to Customer.

 

Section 5.3 Viruses; Disabling Codes. Vendor warrants that any and all computer code and/or software created or modified for, or otherwise supplied to Customer: (A) contains only what is stated in the documentation provided; (B) is free of any open source code, spyware, and any master access key (ID, password, trap door, trojan horse, back door, etc.) to the system, and (C) immediately prior to its delivery to Customer, has been checked for and deemed free of any and all computer viruses and/or other destructive code using a regularly updated, industry-standard software package designed for such purpose (for example, the most current version of Symantec Norton Antivirus) and has been inspected by Vendor’s authorized personnel. In the event any computer code and/or software created or modified for, or otherwise supplied to Customer contains destructive code, then, in addition to any other remedies available to Customer, at Customer’s request, Vendor will, at no cost to Customer:

 

(1) restore to the fullest extent possible any and all data lost by Customer as a result of the destructive code, and

(2) provide and install a new copy of the computer code and/or software without the presence of destructive code.

 

Section 5.4 Pass-Through of Third Party Warranties. If third party software or hardware is acquired hereunder, Vendor agrees to pass through to Customer all warranties from such third party software vendors, in addition to the warranties provided in this Agreement.

 

Section 5.5 Additional Warranties; Disclaimer. Other warranties pertaining to the services or deliverables may be set forth in an applicable Statement of Work. OTHER THAN AS PROVIDED IN THIS AGREEMENT OR ANY STATEMENT OF WORK, THERE ARE NO EXPRESS WARRANTIES AND THERE ARE NO IMPLIED WARRANTIES, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

 

Section 5.6 Compliance with Laws. Vendor shall comply with all applicable federal, state, county, and local laws, orders, rules, ordinances, regulations, and codes, including without limitation Vendor’s obligations as an employer regarding the health, safety and payment of its employees. Vendor’s compliance shall also include identifying and procuring the required permits, certificates, approvals, and inspections in Vendor’s performance under this Agreement. In addition, Vendor certifies and represents its compliance with the federal laws set forth in Exhibit B, to the extent applicable. Vendor will promptly notify Customer of any change of status with regard to these certifications and representations. These certifications and representations are material statements of fact upon which Customer has relied with respect to this Agreement.

 

Section 5.7 Payment Card Industry. To the extent that Vendor, in the course of providing Services, stores, processes, transmits or otherwise obtains cardholder data, or performs any activities regulated by the Payment Card Industry (“PCI”) Security Standards Council, Vendor shall comply with the most current version of the PCI Data Security Standard, the PIN Transaction Security Standard, the Payment Application Data Security Standard, the Point-to-Point Encryption Solution Requirements and Testing Procedures, any other applicable program or requirement that is published and/or otherwise mandated by applicable card networks or the PCI Security Standards Council.

 

Section 5.8 Medicare Advantage. Vendor will comply with the terms of the Medicare Advantage Regulatory Requirements Appendix attached hereto as Exhibit H when performing administrative services or providing products under this Agreement that relate to Medicare Advantage Benefit Plans, as defined in Exhibit H (Medicare Advantage Regulatory Requirements Appendix).

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Section 5.9 Other Government Requirements. Vendor will comply with all applicable federal and state legal and regulatory requirements, including but not limited to those set forth in Exhibit I (Master Community & State Appendix) when performing services or providing products under this Agreement that relate to Medicaid and other state government regulated programs, and Exhibit J (Exchange Regulatory Appendix) when performing services or providing products under this Agreement that relate to public Exchanges (as defined in Exhibit J).

 

Section 5.10 Conflict of Interest.

 

(A) Vendor hereby represents and warrants to Customer that:

 

(1) There is no conflict of interest between Vendor’s other contracts, business relationships, revenue-sharing arrangements or other business activities, if any, and the Services to be provided to Customer pursuant to this Agreement, and Vendor will ensure that no such conflict arises during the term of this Agreement (which includes, but is in no way limited to, use of another’s confidential and proprietary information). Accordingly, Vendor agrees that it may not perform duties for any third party, if Vendor believes its duties to such third party may result in a conflict of interest relative to Vendor’s work for Customer, unless Vendor first notifies Customer in writing of the possible conflict of interest and obtains written consent from an authorized representative of Customer.

 

(2) Vendor will not use for the benefit of Customer any confidential information acquired from any third party and subject to a duty of confidentiality to such third party.

 

(3) Unless previously disclosed in writing to an authorized representative of Customer, (a) Vendor has not, for at least [***] before the Effective Date, acted as or been paid for services as a consultant, employee or in any other capacity, to any governmental entity with respect to procurement by such governmental entity of health insurance coverage or an administrative services agreement, or (b) participated in any capacity on behalf of a governmental entity in a decision-making capacity in connection with the procurement of health insurance coverage, administrative services agreement or any related services.

 

(B) Vendor agrees that during the term of this Agreement Vendor will not act as or be paid for services as a consultant for any governmental entity with respect to procurement of such governmental entity’s health insurance coverage or administrative services agreement. It is understood by the parties that Customer does not have the exclusive right to Vendor’s services.

 

Section 5.11 Utilization of MWVBE Suppliers. As used in this Agreement, “MWVBE Supplier” means a supplier who maintains a valid certification as a minority, women, or veteran (veteran, disabled veteran, service-disabled) business enterprise from any of the following organizations: (A) the National Minority Supplier Development Council (NMSDC), (B) the Women’s Business Enterprise National Council (WBENC), (C) the US Department of Veteran Affairs, or (D) any other third party certification organization approved in advance by Customer. Vendor agrees to provide MWVBE Suppliers with the maximum practicable opportunity to participate in any subcontracts or orders it may award in connection with this Agreement. Vendor will report on a quarterly basis, or as otherwise requested by Customer, the level of MWVBE Supplier participation in this Agreement.

 

Section 5.12 Additional Compliance Requirements. Vendor agrees to comply with the Anticorruption Policy and Vendor Code of Conduct, which may be found at http://www.unitedhealthgroup.com/suppliers/default.aspx?.

 

Section 6. Insurance

 

Section 6.1 Required Coverage. During the term of this Agreement, Vendor will obtain and maintain, at its sole cost and expense, the insurance in the types and minimum amounts outlined below or as required by applicable law, whichever is greater, and any such additional insurance necessary to insure against claims that may arise from or in connection with its obligations under this Agreement, whether such obligations are performed by or on behalf of the Vendor:

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Coverage Type	Minimum Limits of Liability
Commercial General Liability	·  [***] ·  [***] ·  [***] ·  [***]
Worker’s Compensation	In accordance with the laws of the country, state, or province, or territory exercising jurisdiction over employees
Employer’s Liability (including “Stop Gap” Liability where applicable)	·  [***] ·  [***] ·  [***]
Umbrella	·  [***] ·  [***]
Professional Liability / Errors & Omissions Liability	·  [***] ·  [***]
Cyber Liability	·  [***] ·  [***]

 

Section 6.2 Insurance Ratings. Subject to the Vendor’s right to self-insure coverage as set forth below, insurance shall be issued by insurance companies authorized to conduct business within the jurisdiction in which Services are provided, with a minimum A.M. Best rating of A- VII in the current edition of Best’s Key Rating Guide.

 

Section 6.3 Additional Insurance Requirements. In the event that any insurance required by this Agreement is written on a claims-made basis, such insurance will have a policy retroactive date that coincides with or predates the Effective Date. Vendor will continue coverage, through either policy renewals or the purchase of an extended reporting period for not less than [***], beginning at the time obligations under this Agreement have been completed. Commercial general liability will include Customer and its Affiliates as additional insured(s) with respect to liability arising out of the Services. Professional liability / errors and omissions liability will provide coverage for liability for loss or damage due to an act, error, omission, or negligence arising from the Services. Cyber liability insurance will provide coverage for liability for damages claimed by third parties arising from data destruction, extortion, theft, hacking, and denial of service attacks impacting Vendor’s operations. Vendor may arrange any required insurance under separate policies for the full minimum limits of liability required, or by a combination of underlying policies and an umbrella or excess liability policy. Any umbrella or excess liability insurance policy will be adequate to satisfy the insurance requirements of this Agreement. Vendor may, with Customer’s prior approval (which shall not be unreasonably withheld), elect to self-insure, in whole or in part, in the amounts and types of insurance required herein. Vendor will (i) maintain a separate reserve or trust for its self- insurance, (ii) provide to Customer a copy of the most recent evaluation of its self-insurance funds prepared by an independent actuary, (iii) warrant that its self-insurance fund will comply with applicable laws and regulations, and (iv) fund its self-insurance funds in accordance with the recommendations of the independent actuary and assure that funds are available at all times to pay claims in the amounts required by this Section 6. The funding of deductibles and self-insured retentions, if any, maintained by Vendor are the sole responsibility of Vendor, including any deductibles or self-insured retentions applicable to claims involving Customer.

 

Section 6.4 Waiver of Subrogation. Except where prohibited by law, Vendor agrees to waive all rights of subrogation, including any rights of its insurers, against Customer and its Affiliates, under the commercial general liability, automobile liability, workers’ compensation, and employer’s liability coverage, with respect to losses, damages, claims, suits, or demands, however caused.

 

Section 6.5 Certificates of Insurance. On or before the Effective Date, and upon Customer’s request thereafter, Vendor will provide certificate(s) of insurance providing evidence that Vendor has complied with the insurance requirements set forth in this Agreement. Vendor will give [***] prior written notice to Customer in the event of any cancellation of the insurance required hereunder.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Section 6.6 Notices. In the case of loss or damage or other event involving Customer or its Affiliates that requires notice or other action under the terms of any insurance coverage specified in this Section 6, Vendor will be solely responsible to take such action. Vendor will provide Customer with contemporaneous notice and with such other information as Customer may request regarding the event.

 

Section 6.7 Subcontractors. Except to the extent (i) otherwise stated in this Agreement, or (ii) agreed by Customer in writing, Vendor shall require, in writing, that each subcontractor adhere to the same insurance requirements as outlined in this Agreement. Vendor may (1) insure any subcontractors under its own policies, or (2) modify the applicable subcontractor’s insurance requirements, with the agreement that any deficiencies in such policies shall be borne by Vendor.

 

Section 6.8 Limits of Liability. All insurance required of Vendor to provide coverage to Customer and its Affiliates as additional insureds [***]. Such additional insured coverage will apply to [***]. The availability or unavailability of insurance coverage shall not limit, modify or otherwise impact Vendor’s other obligations and liabilities under this Agreement. Vendor’s obligation to maintain the insurance stipulated in this Section 6 shall be in addition to, and not in lieu of, Vendor’s other obligations hereunder, and Vendor’s liability to Customer shall not be limited to the amount of coverage required hereunder. Vendor’s insurance will apply separately to each insured against whom a claim is made or lawsuit is brought, except with respect to the insurer’s limits of liability.

 

Section 7. Indemnification

 

To the maximum extent allowed by law, Vendor will defend, indemnify and hold harmless Customer and its directors, officers, employees, and agents (collectively, the “Indemnitees”), from and against any and all claims, losses, damages, suits, fees, judgments, costs and expenses (collectively referred to as “Claims”), including attorneys’ fees incurred in responding to such Claims, that the Indemnitees may suffer or incur arising out of or in connection with: (a) Vendor’s breach of warranty or damages due to Vendor’s negligence or willful misconduct; (b) any allegation that the Indemnitees’ use of any goods or services (including without limitation any computer code and Work Product) created for or provided to Customer in connection with this Agreement constitutes an infringement, contributory infringement or violation of any patent, copyright, trade secret, trademark, or other third party intellectual property right or a misappropriation of a trade secret or other personal rights of a third party; (c) any breach by Vendor of its: (i) confidentiality obligations; (ii) obligations to comply with laws; (iii) obligations under Exhibit D or Exhibit F (if applicable); or (iv) obligation to pay any compensation, fees, salary, bonuses, mandatory or fringe employee benefits, social security, taxes or other withholdings which are alleged to be owed in respect of any personnel or contractors of Vendor; (d) any personal injury (including death) or damage to property resulting from Vendor, Vendor personnel or its agents’ acts or omissions; and (e) Vendor’s introduction of any unauthorized material, including without limitation, a “computer virus” or other contaminant into Customer’s environment. The Indemnitees will give prompt notice of any Claim to Vendor, and Vendor will defend the Indemnitees at the Indemnitees’ request. Vendor may settle, at its sole expense, any Claim for which Vendor is responsible under this Section 7 provided that such settlement shall not limit, unduly interfere, or otherwise adversely affect the rights granted herein, Vendor’s obligations under this Agreement, or impose any additional liability or obligation on Customer or does not contain an unconditional and full release of the Indemnitees’ in respect of such Claim. Customer reserves the right to participate in the defense and/or settlement of any Claim. [***].

 

Section 8. Liability

 

Section 8.1 Waiver of Damages. SUBJECT TO SECTION 8.2, IN NO EVENT, WHETHER IN CONTRACT OR IN TORT (INCLUDING BREACH OF WARRANTY, NEGLIGENCE AND STRICT LIABILITY IN TORT), WILL A PARTY BE LIABLE FOR INDIRECT OR CONSEQUENTIAL, EXEMPLARY, PUNITIVE OR SPECIAL DAMAGES, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES IN ADVANCE.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Section 8.2 Exceptions; Cumulative Remedies. The limitations set forth in Section 8.1 will not apply with respect to: [***]. The remedies specified in this Agreement are cumulative and in addition to any remedies available at law or in equity.

 

Section 9. Organizational Resiliency and Force Majeure

 

Section 9.1 Resiliency Planning. Vendor will, at its sole expense, establish and maintain an organizational resilience program designed to protect physical, intangible, environmental and human assets critical to Vendor’s provision of the Services. Vendor’s organizational resilience program will identify and address significant hazards or threats that may impact the Services or Vendor’s critical assets. Vendor’s organizational resilience program will include, to the extent applicable, (i) risk assessments and controls, (ii) written business continuity plans for the Services and supporting facilities, (iii) written disaster recovery plans for critical technology and systems infrastructure, and (iv) corporate crisis management response protocols, as necessary to enable continued performance under this Agreement if any event (including a corporate crisis, technological accident, or human- caused event) should cause a material disruption of the Services or pose a significant threat to Vendor’s critical assets. Vendor’s organizational resilience program will be consistent with industry standards and best practices relevant to the healthcare industry, with any standards imposed on Vendor or Customer by a relevant regulatory authority, and with the specific requirements (if any) set forth in the applicable Statement of Work. Vendor will provide its organizational resilience program documentation (or relevant components thereof) to Customer for review at Customer’s request, within [***] of Customer’s request. In addition, Vendor will make available for discussion its personnel who are responsible for the organizational resilience program. Statements of Work under this Agreement may specify different obligations with respect to Vendor’s organizational resilience program or specific aspects of that program. These different obligations will apply to the Services or products provided under the applicable Statement of Work only, and will not be construed to apply to any other Statement of Work.

 

Section 9.2 Testing; Resiliency Reviews. Vendor will periodically update relevant components of its organizational resilience program to address changes to Vendor’s critical assets, the Services, and relevant regulatory requirements or private sector standards for organizational resiliency and corporate preparedness. In addition, Vendor will test the operability of all components of its organizational resilience program at least [***] (and more frequently, if required under a Statement of Work or under the terms of the relevant business continuity plan or disaster recovery plan) to confirm that such plans are fully operational. Vendor will functionally test disaster recovery plans for critical technology and systems infrastructure at least [***] and provide the results of such test to Customer at its request. At Customer’s request, Vendor will certify to Customer in writing that all components of Vendor’s organizational resilience program (specifically including business continuity plans and disaster recovery plans) are fully operational. At Customer’s request (no more than [***]), Vendor will participate in a resiliency review and will meet with Customer and provide Customer with all information (including detailed business continuity plans and disaster recovery plans) reasonably necessary for Customer to review Vendor’s organizational resilience program. If at any time Customer reasonably determines that Vendor is materially non-compliant with the organizational resiliency requirements set forth herein or in the applicable Statement of Work, or if Vendor fails to meet its obligations with respect to testing, certification, or participation in the resiliency review [***].

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Section 9.3 Implementation of Resiliency Plans. Upon the occurrence of any event that disrupts the provision of Services, Vendor will promptly implement the relevant components of its organizational resilience program (including relevant business continuity plans and disaster recovery plans) and will restore the disrupted Services within the earliest of: (a) the timeframes required in the relevant recovery/continuity plan, (b) the timeframes required in the applicable Statement of Work or elsewhere in this Agreement, or (c) otherwise as necessary to continue to meet applicable Service Levels. Vendor will not increase its charges or charge Customer any usage fees with respect to the implementation of any component of Vendor’s organizational resilience program. Whenever any event, including a Force Majeure Event, causes Vendor to allocate limited resources between or among Vendor’s customers, Vendor will not give any other customers priority over Customer, subject to the Service Levels or recovery time objectives set forth in this Agreement and any applicable Statement of Work.

 

Section 9.4 Force Majeure.

 

(A)            As used in this Agreement, a “Force Majeure Event” means an act of God, riot, civil disorder, or any other similar event beyond the reasonable control of a party, provided that the event is not caused, directly or indirectly, by such party. Notwithstanding the foregoing, no event will be considered a Force Majeure Event if and to the extent that the nonperforming party could have (1) prevented the event (or any resulting defaults or delays in performance) by taking reasonable precautions, or (2) circumvented the event (or any resulting defaults or delays in performance) through the use of alternate sources, workaround plans or other means (in the case of Vendor, including by meeting its obligations with respect to developing, maintaining and implementing an organizational resilience program as described in this Section 9 or an applicable Statement of Work).

 

(B)            Subject to Section 9.5, in the case of a Force Majeure Event the nonperforming party will be excused from further performance or observance of the obligation(s) so affected for as long as such circumstances prevail and such party continues to use commercially reasonable efforts to recommence performance to whatever extent possible without delay. Any party so delayed in its performance will promptly notify the party to whom performance is due by telephone and in writing and will describe at a reasonable level of detail the circumstances causing such default or delay.

 

Section 9.5 Alternate Source; Termination Rights.

 

(A)            With respect to Critical Services (as defined below), if the performance of all or a portion of such Critical Services is prevented or delayed (including by a Force Majeure Event) for more than [***], then Customer may procure such Services from an alternate source [***]. As used in this Agreement, “Critical Services” means those specific Services identified in the applicable Statement of Work as “critical,” [***]. The timeframes set forth in this paragraph may, for any or all components of the Services, be superseded by more specific requirements set forth in the applicable Statement of Work.

 

(B)            With respect to Non-Critical Services (as defined below), if the performance of all or a portion of such Non-Critical Services is prevented or delayed (including by a Force Majeure Event) for more than [***], then Customer may procure such Services from an alternate source[***]. As used in this Agreement, “Non-Critical Services” means all Services that are not Critical Services. The timeframes set forth in this paragraph may, for any or all components of the Services, be superseded by more specific requirements set forth in the applicable Statement of Work.

 

(C)            If the performance of any Services is prevented or delayed (including by a Force Majeure Event) for more than [***] (in the case of Critical Services) or [***] (in the case of Non-Critical Services), then Customer will have the option to terminate this Agreement or any impacted Statement of Work [***]. The timeframes set forth in this paragraph may, for any or all components of the Services, be superseded by more specific requirements set forth in the applicable Statement of Work.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Section 10. Term and Termination

 

Section 10.1 Agreement Term and Termination. This Agreement shall commence and be effective as of the date above and shall continue until (a) terminated by Customer at any time with or without cause, upon written notice to Vendor without any charge, liability, or obligation whatsoever, except for payment for Services performed by Vendor specified in a SOW but not yet paid for by Customer; or (b) terminated by either party if the other party materially breaches or defaults on any of the provisions of this Agreement, and such breach is not cured within [***] after the breaching party receives written notice. Termination of this Agreement shall not impact any signed SOWs then in effect, which shall continue in effect until completed or otherwise terminated under Section 10.2 or Section 10.3, and shall be governed by the terms of this Agreement while in effect.

 

Section 10.2 SOW Termination for Convenience. The term of an SOW shall be as outlined thereunder. Upon [***] Customer may, for its own convenience and with or without cause, terminate any SOW, in whole or in part, without any charge, liability or obligation whatsoever except for payment for Services performed by Vendor but not yet paid for by Customer.

 

Section 10.3 SOW Termination for Cause. If either party materially breaches or defaults on any of the provisions of any SOW, and such breach is not cured within [***] after the breaching party receives written notice, then in addition to all other rights and remedies of law or equity or otherwise, the injured party shall have the right to terminate any SOW(s) impacted by such breach without any obligation or liability, at any time thereafter.

 

Section 10.4 Termination for Change of Control. Notwithstanding anything to the contrary in this Agreement or SOW, Customer may terminate this Agreement and/or a SOW without further liability, upon [***] in the event of a Change of Control of Vendor. For purposes of this Agreement, “Change in Control” means (a) the acquisition by any person, entity or group, within the meaning of Section 13(d)(3) or 14(d)(2) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), of beneficial ownership (as defined in the Exchange Act) of 20% or more of the outstanding shares of common stock of Vendor or the combined voting power of Vendor’s then-outstanding voting securities in a single transaction or series of related transactions; (b) a change in 50% or more of the directors of Vendor in any 12 month period; (c) a reorganization, merger, consolidation or share exchange in which the shareholders of Vendor immediately prior to such transaction hold less than 51% of the outstanding shares of Vendor after such transaction; (d) the sale (in a single transaction or a series of related transactions) of either: (i) all or substantially all of the assets of Vendor, or (ii) the assets which are provided to Customer hereunder or used to provide Services to Customer hereunder; or (e) the first purchase under any tender offer or exchange offer pursuant to which shares of Vendor common stock or other voting securities are purchased.

 

Section 10.5 Insolvency. Either party will have the right to immediately, or with such written notice as such party deems reasonable, terminate this Agreement and any SOWs in the event the other party: (a) ceases to do business as a going concern; (b) becomes subject to any bankruptcy or insolvency proceeding under federal or state statute (and if the proceeding is involuntary, it is not dismissed within 60 days of its commencement); (c) becomes insolvent or becomes subject to direct control by a trustee, receiver or similar authority; (d) has wound up, dissolved or liquidated, voluntarily or otherwise; (d) makes a general assignment for the benefit of its creditors; or (e) takes any action authorizing or in furtherance of any of the foregoing.

 

Section 10.6 Effect of Termination. Upon expiration or termination of this Agreement (or any SOW, as applicable) each party shall, upon the request of the other: (a) return all papers, materials and properties of the other held by such party; and (b) provide reasonable assistance in the termination of this Agreement, as may be necessary for the orderly, non-disrupted business continuation of each party. In no event will Vendor inhibit in any way Customer’s attempt to effect a smooth transition. At Customer’s option, upon termination of this Agreement or a Statement of Work for any reason, Vendor will: (1) certify to Customer in writing that all Confidential Information of Customer has been returned or destroyed, as required under this Agreement [***].

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Section 10.7 Survival. Customer and Vendor’s respective obligations hereunder which by their nature would continue beyond the termination of this Agreement or expiration of any SOW, shall survive. This includes, by way of example but not limited to, the obligations provided under the Sections or Exhibits with the following headings: "CONFIDENTIALITY", “INDEMNIFICATION", any warranty by Vendor, Exhibit D (HIPAA and GLBA), Exhibit H (Medicare Advantage Regulatory Requirements Appendix), Exhibit I (Master Community & State Appendix), and Exhibit J (Exchange Regulatory Appendix).

 

Section 11. Assignment; Divestiture.

 

Vendor may not assign this Agreement or any SOW, or any of Vendor’s rights (except the right to receive payments hereunder) or duties under this Agreement, without the prior written consent of Customer. Any attempted assignment without Customer’s consent will be void. Customer may freely assign all or any part of this Agreement, without the consent of Vendor, either: (a) to an Affiliate; or (b) incidental to a sale, transfer or other disposition by Customer or an Affiliate of all or substantially all of the assets of that component of Customer’s business or its Affiliate's business having the benefit of the goods and/or services under this Agreement. In the event Customer either: (a) acquires any entity which has entered into an Agreement with Vendor, or (b) acquired any goods or services from Vendor under a separate agreement within any twelve (12) months prior to the Effective Date, Vendor shall in both cases, upon Customer notice, execute any documents necessary to allow such goods and services to be governed by this Agreement, and any price adjustments shall be made immediately on a go forward basis. All benefits under this Agreement shall accrue and inure to each party's valid and legal heirs, successors and assigns. From time to time, Customer (or its Affiliates) may divest some or all interests in certain business units or Affiliates. Following the divestiture, at Customer’s request, Vendor will continue to provide Services to such divested business unit or entity under the terms of this Agreement and any applicable SOWs (including for the then-current charges) for 24 months, or any shorter period specified by Customer.

 

Section 12. Export Related to Services

 

Vendor shall not, absent proper authorization and licensing, if applicable, from all United States agencies having jurisdiction, including without limitation the United States Bureau of Industry and Security (United States Department of Commerce) and the United States Department of State, and from any other relevant jurisdiction that requires any license or other government approval, Export any Item in the course of performing the Services hereunder. Customer makes no representations as to whether or under what conditions any Item supplied by Customer may be Exported. For purposes of this Section, “Item” means any data, technology, commodity or other item, including without limitation, computer software, computer hardware, or telecommunications hardware or software or encryption device or algorithm, and “Export” means “export,” “release,” or “reexport,” as those terms are defined in 15 Code of Federal Regulations §734.2(b), as such regulation may be amended and in effect from time to time.

 

Section 13. Record Keeping and Audit

 

Vendor agrees to maintain accurate and complete records relating to the provision of Services under this Agreement. If Vendor has a formal records management program which includes a documented and compliant records retention schedule (based on applicable federal, state and industry recordkeeping requirements) and a corresponding employee training program, during the term of this Agreement and for [***] following the expiration or termination of this Agreement, Vendor will apply records retention practices in the normal course of business according to the retention periods set forth in Vendor’s records retention schedule. If Vendor does not maintain a documented and compliant records retention schedule, then Vendor will maintain records relating to the provision of Services under this Agreement for a period of [***] from the creation of the applicable record, except to the extent that Customer may require a longer or shorter retention period for specific categories of records. Vendor agrees that, during the term of this Agreement and for a period of [***] after the expiration or termination of this Agreement or the applicable Statement of Work, as appropriate, Customer or its designee(s) may, at any time upon not less than [***] notice to Vendor, (i) examine the books and records of Vendor (and its subcontractors hereunder, if any) related to Vendor’s and any of its subcontractors’ performance under this Agreement, and (ii) verify the integrity of Customer data and examine the systems that process, store, secure, support, and transmit that data (“Audit”). Vendor will cooperate fully, and cause its subcontractors to cooperate fully, with any such Audit(s) and will provide all books, records, data and other documentation reasonably requested by Customer. Customer may make copies of such documentation. The Audit(s) will be conducted during normal business hours, and at Customer’s expense; provided however if such Audit reveals overcharges to Customer, Vendor will bear the cost of such Audit.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Section 14. Entire Agreement; Order of Precedence.

 

This Agreement contains the entire understanding of the parties and may be amended only by a writing signed by the parties. This Agreement (including its Exhibits), and any SOWs placed hereunder shall constitute the entire agreement between Customer and Vendor. In the event of a conflict between the terms and conditions of this Agreement and the terms and conditions of any Statement of Work, the terms and conditions of this Agreement will control, unless the Statement of Work makes specific reference to the Section of this Agreement that is to be amended in the Statement of Work. Any exceptions expressly agreed upon in writing by Customer (or an applicable Affiliate) and Vendor under a particular Statement of Work will apply only for purposes of that Statement of Work, and will not be deemed to in any way amend, modify, cancel, or waive the provisions of this Agreement or any other Statement of Work. Notwithstanding the foregoing, no Statement of Work or any provision thereof will be effective to: (A) decrease any limitation of liability, reduce the scope of recoverable damages, or restrict or eliminate exceptions to the limitation of liability; (B) expand, eliminate or restrict the scope of any indemnity obligations set forth in this Agreement or any Exhibit hereto; or (C) waive, settle or resolve any claims or disputes between the Parties. Any amendment or modification to this Agreement or any duly executed SOW hereunder shall not be valid, enforceable, or binding on the parties unless such amendment or modification (a) is a written instrument duly executed by the authorized representatives of both parties and (b) references this Agreement and any SOW, if applicable, and identifies the specific sections contained therein which are amended or modified. No amendment or modification shall adversely affect vested rights or causes of action that have accrued prior to the effective date of such amendment or modification. The terms and conditions of the Exhibits and any SOW hereunder are integral parts of this Agreement and are fully incorporated herein by this reference. No conflicting or supplemental pre-printed provisions on Vendor and Customer forms (including without limitation shrink wrap terms, terms on purchase orders or invoices) shall be binding on the parties.

 

Section 15. Choice of Law/Venue

 

This Agreement and the rights and obligations of the parties hereunder shall be construed in accordance with and governed by the laws of the State of Minnesota, excluding its conflict of laws principles and excluding the Uniform Computer Information Transactions Act (UCITA) as may be enacted, amended, or modified by the various states. The parties hereby agree that the United Nations Convention on Contracts for the International Sale of Goods will not apply to this Agreement or any related transaction between the parties. The parties irrevocably and unconditionally consent to venue in Hennepin County, Minnesota (and hereby waive any claims of forum non conveniens with respect to such venue) and to the non-exclusive jurisdiction of competent Minnesota state courts in Hennepin County or federal courts in the District of Minnesota for all litigation which may be brought with respect to the terms of, and the transactions and relationships contemplated by, this Agreement. The parties further consent to the jurisdiction of any state court located within a district that encompasses assets of a party against which a judgment has been rendered for the enforcement of such judgment against the assets of such party.

 

Section 16. Use of Name and Publicity

 

Vendor will not have any right to use the names, logos, trademarks, trade names, or other marks of Customer or any of its Affiliates (collectively, the “Customer Marks”), including in connection with any advertising, sales promotions, press releases and other publicity matters, unless and until each use is approved in advance and in writing by the UnitedHealth Group Chief Communications Officer. Customer may withdraw its permission for Vendor to use any of the Customer Marks at any time at its sole discretion by giving written notice to Vendor.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Section 17. Severability

 

If any provision of this Agreement is held to be invalid or unenforceable by a court of competent jurisdiction, then the remaining portions of this Agreement shall be construed as if not containing such provision, and all other rights and obligations of the parties shall be construed and enforced accordingly.

 

Section 18. Notices

 

All notices, approvals, waivers, and other communications under this Agreement (other than routine operational communications), will be in writing and will be deemed duly given (A) when delivered by hand, (B) one business day after being given to an express courier with a reliable system for tracking delivery, or (C) four business days after the date of mailing, when mailed by United States mail, registered or certified mail, return receipt requested, postage prepaid, and addressed as follows:

 

Notices to Customer:	Notices to Vendor:
Attn: Legal Department	Attn: Jason Melton
UnitedHealth Group	Innovation Specialists, LLC d/b/a 2nd.MD
9900 Bren Road East	1300 Post Oak Blvd., Suite 725
MN008-T502	Houston, TX 77056
Minnetonka, MN 55343
With a copy to:	With a copy to:
Attn: Enterprise Sourcing & Procurement	Attn: Legal
UnitedHealth Group	Innovation Specialists, LLC d/b/a 2nd.MD
9900 Bren Road East	1300 Post Oak Blvd., Suite 725
MN008-W240	Houston, TX 77056
Minnetonka, MN 55343

 

Section 19. Non-Solicitation

 

During the term of this Agreement and for a period of [***] thereafter, neither Customer nor Vendor will directly or indirectly solicit or seek to procure (other than by general advertising) the employment of: (A) in the case of Customer, any Vendor employee engaged in the provision of the Services; and (B) in the case of Vendor, any Customer personnel.

 

Section 20. No Waiver

 

No waiver or failure to exercise any option, right, or privilege under the terms of this Agreement on any occasion or occasions shall be construed to be a waiver of the same or any other option, right or privilege on any other occasion.

 

Section 21. Third Party Beneficiaries.

 

This Agreement is entered into solely between, and may be enforced only by, Customer and Vendor. This Agreement will not be deemed to create any rights in third parties or to create any obligations of a party to any third parties, other than in and to Customer’s Affiliates receiving Services hereunder.

 

(SIGNATURE PAGE TO FOLLOW)

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

ACCEPTED AND AGREED:
UNITED HEALTHCARE SERVICES, INC.			INNOVATION SPECIALISTS, LLC D/B/A 2ND.MD
By:	/s/ Eric J Noyes		By:	/s/ Jason Melton
	(Authorized Signature)			(Authorized Signature)
Name:	Eric J Noyes		Name:	Jason Melton
	(Print or Type)			(Print or Type)
Title:	Sr. Director		Title:	Chief Executive Officer
Date:	12/20/2016		Date:	12/20/2016

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT A

ORM OF STATEMENT OF WORK

 

STATEMENT OF WORK NO.       

 

This is Statement of Work (“SOW”) No. to the MASTER SERVICES AGREEMENT dated etween: [***] (the “Agreement”),

 

United HealthCare Services, Inc., (“Customer”) on behalf of itself and its Affiliates; and

 

Innovation Specialists, LLC d/b/a 2nd.MD (“Vendor”). All capitalized terms not otherwise defined in this SOW will have the meanings assigned to them in the Agreement. Unless modified herein, all terms in the Agreement shall remain unchanged and in full force and effect.

 

1.	CUSTOMER SEGMENT(S) RECEIVING SERVICES:

 

2.	PURPOSE AND HIGH-LEVEL SCOPE OF SERVICES:

 

3.	DETAILED DESCRIPTION OF SERVICES:

 

4.	PERSONNEL:

 

5.	WORK PRODUCT/DELIVERABLES:

 

6.	MILESTONES/DEADLINES:

 

7.	FEES: [Select from Fixed-Bid or Time & Materials options below, delete both Option headings, text of non- choice and this note]

 

Option1: Fixed-Bid

 

Based on the above tasks and assumptions, Vendor will perform the Services and provide the Work Product for a fixed price of [insert $] which will be invoiced [insert payment schedule].

 

If Customer terminates this SOW prior to delivery of all Work Product, the charges will be prorated at the time of termination and Customer agrees to pay for Services through the termination date. Applicable federal, state and local taxes are not included in the estimated charges.

 

Option 2: Time & Materials

 

Vendor will perform the Services and provide the Work Product at an hourly rate of [insert rate $]. Customer will be charged only for the actual hours provided by Vendor in performing the Services and providing the Work Product. Vendor estimates the total number of hours to complete the Services to be [insert # hours] for an estimated funding requirement of [insert $]. The total fees incurred by Customer under this SOW shall not exceed [insert same $ as estimated funding requirement] without Customer’s prior written consent.

 

If Customer terminates this SOW, Customer agrees to pay Vendor for actual hours worked by Vendor in performing the Services prior to the date of termination.

 

The terms and conditions contained in this SOW constitute the parties’ complete understanding and agreement relating to the subject matter hereof. Notwithstanding anything to the contrary in the Agreement or elsewhere, in the event of a conflict between this SOW and the Agreement, the Agreement will control. No other terms and conditions, beyond those contained herein, will be valid unless mutually agreed to by Customer and Vendor in a writing signed by authorized representatives of each party.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

ACCEPTED AND AGREED:
UNITED HEALTHCARE SERVICES, INC.			INNOVATION SPECIALISTS, LLC D/B/A 2ND.MD
By:			By:
	(Authorized Signature)			(Authorized Signature)
Name:			Name:
	(Print or Type)			(Print or Type)
Title:			Title:
Date:			Date:

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT B

CERTIFICATE OF COMPLIANCE FOR CONTRACTORS AND SUPPLIERS

 

Vendor certifies and represents that it is, as of the Effective Date, and shall remain throughout the term of the Agreement in compliance with the following federal laws, to the extent applicable to Vendor and the Services:

 

1.

General.

 

FAR Clause	Date	Title
52.204-9	Jan 2011	Personal Identify Verification of Contractor Personnel
52.222-21	Feb 1999	Prohibition of Segregated Facilities
52.222-26	Mar 2007	Equal Opportunity
52.222-35	Sep 2010	Equal Opportunity for Veterans
52.222-36	Oct 2010	Affirmative Action for Workers with Disabilities
52.222-37	Sep 2010	Employment Reports on Veterans
52.222-40	Dec 2010	Notification of Employee Rights Under the National Labor Relations Act
52.222-50	Feb 2009	Combating Trafficking in Persons
52.223-18	Aug 2011	Encouraging Contractor Policies to Ban Text Messaging While Driving
52.244-6	Dec 2010	Subcontracts for Commercial Items

 

DFARS Clause	Date	Title
252.204-7000	Dec 1991	Disclosure of Information

 

2.	Contract Value > $150,000.

 

If the total fees under the Agreement, including all SOWs executed pursuant to the Agreement, exceed an aggregate total of $150,000, then Vendor shall comply with the Laws listed in Section 1 above and the following:

 

FAR Clause	Date	Title
52.219-8	Jan 2011	Utilization of Small Business Concerns

 

3.	Contract Value > $5 Million.

 

If the total fees under the Agreement, including all SOWs executed pursuant to the Agreement, exceed an aggregate total of $5,000,000, then Vendor shall comply with the Laws listed in Section 1 above and the following:

 

FAR Clause	Date	Title
52.203-13	Apr 2010	Contractor Code of Business Ethics and Conduct

 

4.	Equal Opportunity.

 

This contractor and subcontractor shall abide by the requirements of 41 CFR 60- 1.4(a), 60-300.5(a) and 60-741.5(a). These regulations prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities, and prohibit discrimination against all individuals based on their race, color, religion, sex, or national origin. Moreover, these regulations require that covered prime contractors and subcontractors take affirmative action to employ and advance in employment individuals without regard to race, color, religion, sex, national origin, protected veteran status or disability.

 

To the extent applicable, the employee notice requirements set forth in 29 C.F.R. Part 471, Appendix A to Subpart A, are hereby incorporated by reference into this contract.

 

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT C
PRICE LIST

 

Consulting Services

Hourly Rate/Discount off List

	a.	Training
	b.	Implementation/Installation
	c.	Configuration
	d.	Customization
	e.	Other consulting

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT D
HIPAA and GLBA

(BUSINESS ASSOCIATE AGREEMENT)

 

The parties hereby agree as follows:

 

1.	DEFINITIONS

 

1.1            All capitalized terms used in this Exhibit not otherwise defined in this Exhibit have the meanings established in either the Agreement or for purposes of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended and supplemented by HITECH, as each is amended from time to time (collectively, “HIPAA”). To the extent a term is defined in both the Agreement and in this Exhibit or in HIPAA, the definition in this Exhibit or in HIPAA, shall govern.

 

1.2            “Affiliate” shall have the meaning ascribed to it in the Agreement. If the term “Affiliate” is not defined in the Agreement, then “Affiliate” shall mean, for purposes of this Exhibit, any subsidiary of UnitedHealth Group Inc.

 

1.3            “Breach” means the acquisition, access, use or disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the PHI as defined, and subject to the exclusions set forth, in 45 C.F.R. § 164.402.

 

1.4            “Breach Rule” means the federal breach regulations, as amended from time to time, issued pursuant to HIPAA and codified at 45 C.F.R. Part 164 (Subpart D).

 

1.5            “Compliance Date” means the later of September 23, 2013 or the effective date of the Agreement.

 

1.6            “Electronic Protected Health Information” or “ePHI” means PHI that is transmitted or maintained in Electronic Media.

 

1.7            “HITECH” means Subtitle D of the Health Information Technology for Economic and Clinical Health Act provisions of the American Recovery and Reinvestment Act of 2009, 42 U.S.C. §§ 17921-17954, and all associated existing and future implementing regulations, when and as each is effective.

 

1.8            “PHI” means Protected Health Information, as defined in 45 C.F.R. § 160.103, and is limited to the Protected Health Information received from, or received, maintained, created or transmitted on behalf of, Customer (for itself and/or applicable Covered Entity customers) by Vendor in performance of the Services.

 

1.9            “Privacy Rule” means the federal privacy regulations, as amended from time to time, issued pursuant to HIPAA and codified at 45 C.F.R. Parts 160 and 164 (Subparts A & E).

 

1.10          “Security Rule” means the federal security regulations, as amended from time to time, issued pursuant to HIPAA and codified at 45 C.F.R. Parts 160 and 164 (Subparts A & C).

 

1.11          “Services” as used in this Exhibit, means, to the extent and only to the extent they involve the receipt, creation, maintenance, transmission, use or disclosure of PHI, the services provided by Vendor to Customer as set forth in the Agreement.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

2.	RESPONSIBILITIES OF VENDOR

 

With regard to its use and/or disclosure of PHI, Vendor agrees to:

 

2.1            not use and/or further disclose PHI except as necessary to provide the Services, as permitted or required by this Exhibit, and in compliance with each applicable requirement of 45 C.F.R. § 164.504(e), or as otherwise Required by Law; provided that, to the extent Vendor is to carry out a Covered Entity’s obligations under the Privacy Rule, Vendor will comply with the requirements of the Privacy Rule that apply to that Covered Entity in the performance of those obligations.

 

2.2            implement and use appropriate administrative, physical and technical safeguards and, as of the Compliance Date, comply with applicable Security Rule requirements with respect to ePHI, to prevent use or disclosure of PHI other than as provided for by this Exhibit, including at a minimum, but in any event not limited to, any safeguards set forth in the Agreement or other applicable contracts or agreements between the parties. For the avoidance of doubt, the requirements set forth in the Agreement or other applicable contracts or agreements between the parties do not limit in any way whatsoever Vendor’s obligations under this Section 2.2 to comply with applicable Security Rule requirements.

 

2.3            without unreasonable delay, and in any event on or before [***] after its discovery by Vendor, report to Customer in writing: (i) any use or disclosure of PHI not provided for by this Exhibit of which it becomes aware in accordance with 45 C.F.R. § 164.504(e)(2)(ii)(C); and/or (ii) any Security Incident of which Vendor becomes aware in accordance with 45 C.F.R. § 164.314(a)(2)(i)(C).

 

2.4            without unreasonable delay, and in any event on or before [***] after its Discovery by Vendor, notify Customer of any incident that involves an unauthorized acquisition, access, use or disclosure of PHI, even if Vendor believes the incident will not rise to the level of a Breach. The notification shall include, to the extent possible, and shall be supplemented on an ongoing basis with: (i) the identification of all individuals whose Unsecured PHI was or is believed to have been involved; (ii) all other information required for or requested by Customer (or the applicable Covered Entity) to perform a risk assessment in accordance with 45 C.F.R. § 164.402 with respect to the incident to determine whether a Breach of Unsecured PHI occurred; and (iii) all other information reasonably necessary to provide notice to the applicable Covered Entities individuals, HHS and/or the media, all in accordance with the Breach Rule. Notwithstanding the foregoing, in Customer’s sole discretion and in accordance with its directions, and without limiting in any way any other remedy available to Customer at law, equity or contract, including but not limited to any rights or remedies the Customer may have under the Agreement, Vendor [***].

 

2.5            in accordance with 45 C.F.R. § 164.502(e)(1)(ii) and 45 C.F.R. § 164.308(b)(2), ensure that any subcontractors of Vendor that create, receive, maintain or transmit PHI on behalf of Vendor agree, in writing, to the same restrictions and conditions on the use and/or disclosure of PHI that apply to Vendor with respect to that PHI, including complying with the applicable Security Rule requirements with respect to ePHI; provided that, in any event Vendor shall require its subcontractors (and shall require those subcontractors to require their subcontractors) to report to Vendor any use or disclosure of PHI or Security Incident required to be reported under Sections 2.3 and 2.4 on or before [***] after its discovery by any of those subcontractors.

 

2.6            make available its internal practices, books and records relating to the use and disclosure of PHI to the Secretary for purposes of determining the applicable Covered Entity’s compliance with the Privacy Rule.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

2.7            document, and within [***] after receiving a written request from Customer, make available to Customer information necessary for Customer or its applicable Covered Entity customer to make an accounting of disclosures of PHI about an Individual or, when and as requested by Customer, make that information available directly to an Individual, all in accordance with 45 C.F.R. § 164.528 and, as of the later of the date compliance is required by final regulations or the effective date of the Agreement, 42 U.S.C. § 17935(c).

 

2.8            provide access to Customer, within [***] after receiving a written request from Customer, to PHI in a Designated Record Set about an Individual, or when and as requested by Customer, provide that access directly to an Individual, all in accordance with the requirements of 45 C.F.R. § 164.524, including as of the Compliance Date, providing or sending a copy to a designated third party and providing or sending a copy in electronic format in accordance with 45 C.F.R. § 164.524.

 

2.9            to the extent that the PHI in Vendor’s possession constitutes a Designated Record Set, make available, within [***] after a written request by Customer, PHI for amendment and incorporate any amendments to the PHI as requested by Customer, all in accordance with 45 C.F.R. § 164.526.

 

2.10            accommodate reasonable requests for confidential communications in accordance with 45 C.F.R. § 164.522(b), as requested by Customer or as directed by the Individual to whom the PHI relates.

 

2.11            notify Customer in writing within [***] after Vendor’s receipt directly from an Individual of any request for an accounting of disclosures, access to or amendment of PHI or for confidential communications as contemplated in Sections 2.7-2.10.

 

2.12            request, use and/or disclose only the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure; provided, that Vendor shall comply with 45 C.F.R. §§ 164.502(b) and 164.514(d) as of the Compliance Date.

 

2.13            not directly or indirectly receive remuneration in exchange for any PHI as prohibited by 45 C.F.R. § 164.502(a)(5)(ii) as of the Compliance Date.

 

2.14            not make or cause to be made any communication about a product or service that is prohibited by 45 C.F.R. §§ 164.501 and 164.508(a)(3) as of the Compliance Date.

 

2.15            not make or cause to be made any written fundraising communication that is prohibited by 45 C.F.R. § 164.514(f) as of the Compliance Date.

 

2.16            mitigate, to the extent practicable, any harmful effect that is known to Vendor of a use or disclosure of PHI by Vendor that is not permitted by the requirements of this Exhibit.

 

2.17            comply with all applicable federal, state and local laws and regulations.

 

2.18            not use, transfer, transmit or otherwise send or make available, any PHI outside of the geographic confines of the United States of America without Customer’s advance written consent.

 

2.19            Government Program Requirements. To the extent that Vendor receives, uses or discloses PHI pertaining to Individuals enrolled in managed care plans through which Customer or one or more of its affiliates participate in government funded health care programs, receipt, use and disclosure of the PHI pertaining to those individuals shall comply with the applicable program requirements.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

2.20            Privacy and Safeguards for NPI. Vendor understands and acknowledges that to the extent it is a nonaffiliated third party under GLBA that creates or receives NPI from or on behalf of Customer or an Affiliate, Vendor and its authorized representatives: (i) shall not use or disclose NPI for any purpose other than to perform its obligations under the Agreement; (ii) shall implement appropriate administrative, technical, and physical safeguards designed to ensure the security and confidentiality of the NPI, protect against any anticipated threats or hazards to the security or integrity of the NPI and protect against unauthorized access to or use of the NPI that could result in substantial harm or inconvenience to any consumer; and (iii) shall, for as long as Vendor has NPI, provide and maintain appropriate safeguards for the NPI in compliance with this Exhibit and the GLBA.

 

3.	OTHER PERMITTED USES AND DISCLOSURES OF PHI

 

Unless otherwise limited in this Exhibit, in addition to any other uses and/or disclosures permitted or required by this Exhibit, Vendor may:

 

3.1            use and disclose PHI, if necessary, for proper management and administration of Vendor or to carry out the legal responsibilities of Vendor, provided that the disclosures are Required by Law or any third party to which Vendor discloses PHI for those purposes provides written assurances in advance that: (i) the information will be held confidentially and used or further disclosed only for the purpose for which it was disclosed to the third party or as Required by Law; and (ii) the third party promptly will notify Vendor of any instances of which it becomes aware in which the confidentiality of the information has been breached.

 

4.	TERMINATION AND COOPERATION

 

4.1            Termination. If Customer knows of a pattern or practice of Vendor that constitutes a material breach or violation of this Exhibit then Customer may provide written notice of the breach or violation to Vendor and Vendor must cure the breach or end the violation on or before [***] after receipt of the written notice. If Vendor fails to cure the breach or end the violation within the specified timeframe, Customer may terminate this Exhibit and the Agreement. Customer also may terminate this Exhibit and the Agreement to the extent that any of Customer’s applicable Covered Entity customers terminates its agreement with Customer.

 

4.2            Effect of Termination or Expiration. Within [***] after the expiration or termination for any reason (or to any extent) of the Agreement and/or this Exhibit, Vendor shall return or destroy all applicable PHI, if feasible to do so, including all applicable PHI in possession of Vendor’s subcontractors. To the extent return or destruction of the PHI is not feasible, Vendor shall notify Customer in writing of the reasons return or destruction is not feasible and, if Customer agrees, may retain the PHI subject to this Section 4.2. Under any circumstances, Vendor shall extend any and all protections, limitations and restrictions contained in this Exhibit to Vendor’s use and/or disclosure of any applicable PHI retained after the expiration or termination (to any extent) of the Agreement and/or this Exhibit, and shall limit any further uses and/or disclosures solely to the purposes that make return or destruction of the PHI infeasible.

 

4.3            Cooperation. Each party shall cooperate in good faith in all respects with the other party in connection with any request by a federal or state governmental authority for additional information and documents or any governmental investigation, complaint, action or other inquiry.

 

5.	MISCELLANEOUS

 

5.1            Construction of Terms. The terms of this Exhibit to the extent they are unclear, shall be construed to allow for compliance by the applicable Covered Entity and Customer with HIPAA.

 

5.2            Survival. Sections 4.2, 4.3, 5.1, 5.2, and 5.3 shall survive the expiration or termination for any reason of the Agreement and/or of this Exhibit.

 

5.3            No Third Party Beneficiaries. Nothing in this Exhibit shall confer upon any person other than the parties and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT E
STANDARD CONTRACTUAL CLAUSES

 

Data Processing Agreement Supplemental Terms and Conditions (Standard Contractual Clauses (processors))

 

For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, these terms and conditions are entered into between

 

(i)            United HealthCare Services, Inc., a Minnesota corporation with offices at 9900 Bren Road East, Minnetonka, MN 55343, on behalf of itself and its subsidiaries ("UHS") ("Data Exporter"), and

 

(ii)            Innovation Specialists, LLC d/b/a 2nd.MD, with offices at 1300 Post Oak Blvd., Suite 725, Houston, Texas 77056 (the "Data Importer").

 

each a "Party", and together the "Parties"

 

Recitals

 

A

Data Importer provides services to UHS and or various of its subsidiaries outside the European Economic Area (EEA) (the "Services"). For the purpose of these Clauses, Data Importer is receiving Personal Data, as defined in Attachment 1, as part of the performance of services as a Data Importer, and UHS shall transfer Personal Data to Data Importer as Data Exporter.

 

B

The Parties agree that all processing and movement of Personal Data, performed as part of or otherwise in connection with the Services shall be governed by these Clauses which are hereby incorporated into all agreements between the Data Importer and UHS or its subsidiaries and governing the Services, if any.

 

C

The Parties have therefore agreed on the following Contractual Clauses (the "Clauses") in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the Data Exporter to the Data Importer of the Personal Data specified in Attachment 1.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Attachment 1

 

Processing of Personal Data

 

1.	DEFINITIONS

 

For the purposes of this Attachment 1:

 

(a)

'applicable data protection law' means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the Processing of Personal Data applicable to a Controller in the Member State in which the Data Exporter is established;

 

(b)

'Controller' means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of Personal Data;

 

(c)

'Data Exporter' means United HealthCare Services, Inc. (“data exporter”), on behalf of itself and its Affiliates;

 

(d)

'Data Importer' means Innovation Specialists, LLC d/b/a 2nd.MD;

 

(e)

'Directive' means Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the Processing of Personal Data and on the free movement of such data

 

(f)

'Personal Data' means any information relating to an identified or identifiable natural person ('Data Subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;

 

(g)

'Process/Processing', means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

 

(h)

'Processor' means a natural or legal person, public authority, agency or any other body which processes Personal Data on behalf of the Controller;

 

(i)

'Special Categories of data' means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health, sex life, criminal convictions, and actual or alleged criminal offences;

 

(j)

'Subprocessor' means any Processor engaged by the Data Importer or by any other Subprocessor of the Data Importer who agrees to receive from the Data Importer or from any other Subprocessor of the Data Importer Personal Data exclusively intended for Processing activities to be carried out on behalf of the Data Exporter after the transfer in accordance with his instructions, the terms of this Exhibit and the terms of the relevant written subcontract;

 

(k)

'Supervisory Authority' means a public authority responsible for monitoring the application within its territory of the provisions adopted by a Member State pursuant to the Directive;

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

(l)

'technical and organisational security measures' means those measures aimed at protecting Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the Processing involves the transmission of data over a network, and against all other unlawful forms of Processing.

 

2.	DETAILS OF THE TRANSFERS

 

The details of the transfers of Personal Data are specified in Appendix 1 which forms an integral part of this Exhibit.

 

3.	THIRD-PARTY BENEFICIARY CLAUSE

 

3.1	The Data Subject can enforce against the Data Exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6.1 and 6.2, Clause 7, Clause 8.2, and Clauses 9 to 12 as third-party beneficiary.

 

3.2

The Data Subject can enforce against the Data Importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8.2, and Clauses 9 to 12, in cases where the Data Exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the Data Exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the Data Exporter, in which case the Data Subject can enforce them against such entity.

 

3.3

The Data Subject can enforce against the Subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8.2, and Clauses 9 to 12, in cases where both the Data Exporter and the Data Importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the Data Exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the Data Exporter, in which case the Data Subject can enforce them against such entity. Such third-party liability of the Subprocessor shall be limited to its own Processing operations under this Exhibit.

 

3.4	The parties do not object to a Data Subject being represented by an association or other body if the Data Subject so expressly wishes and if permitted by national law.

 

4.	OBLIGATIONS OF THE DATA EXPORTER

 

The Data Exporter agrees and warrants:

 

(a)

that the Processing, including the transfer itself, of the Personal Data has been carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the Data Exporter is established) and does not violate the relevant provisions of that State;

 

(b)

that it has instructed and throughout the duration of the Personal Data Processing services will instruct the Data Importer to Process the Personal Data transferred only on the Data Exporter's behalf and in accordance with the applicable data protection law and this Exhibit;

 

(c)

that the Data Importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;

 

(d)

that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the Processing involves the transmission of data over a network, and against all other unlawful forms of Processing, and that these measures ensure a level of security appropriate to the risks presented by the Processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

(e)

that it will ensure compliance with the security measures;

 

(f)

that, if the transfer involves Special Categories of data, the Data Subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of the Directive;

 

(g)

to forward any notification received from the Data Importer or any Subprocessor pursuant to Clause 5(b) and Clause 8.3 to the Supervisory Authority if the Data Exporter decides to continue the transfer or to lift the suspension;

 

(h)

to make available to the Data Subjects upon request a copy of this Exhibit, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with this Exhibit, unless this Appendix 1 or the Agreement contain commercial information, in which case it may remove such commercial information;

 

(i)

that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a Subprocessor providing at least the same level of protection for the Personal Data and the rights of the Data Subject as the Data Importer under this Exhibit; and

 

(j)

that it will ensure compliance with Clause 4(a) to (i).

 

5.	OBLIGATIONS OF THE DATA IMPORTER

 

The Data Importer agrees and warrants:

 

(a)

to Process the Personal Data only on behalf of the Data Exporter and in compliance with its instructions and this Exhibit; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the Data Exporter of its inability to comply, in which case the Data Exporter is entitled to suspend the transfer of data and/or terminate the Agreement;

 

(b)

that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the Data Exporter and its obligations under the Agreement and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by this Exhibit, it will promptly notify the change to the Data Exporter as soon as it is aware, in which case the Data Exporter is entitled to suspend the transfer of data and/or terminate the Agreement;

 

(c)

that it has implemented the technical and organisational security measures specified in Appendix 2 before Processing the Personal Data transferred;

 

(d)

that it will promptly notify the Data Exporter about:

 

(i)

any legally binding request for disclosure of the Personal Data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation;

 

(ii)

any accidental or unauthorised access; and

 

(iii)

any request received directly from a Data Subject without responding to that request, unless it has been otherwise authorised to do so;

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

(e)

to deal promptly and properly with all inquiries from the Data Exporter relating to its Processing of the Personal Data subject to the transfer and to abide by the advice of the Supervisory Authority with regard to the Processing of the data transferred;

 

(f)

at the request of the Data Exporter to submit its data Processing facilities for audit of the Processing activities covered by this Exhibit which shall be carried out by the Data Exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the Data Exporter, where applicable, in agreement with the Supervisory Authority;

 

(g)

to make available to the Data Subject upon request a copy of this Exhibit, or any existing contract for subprocessing, unless this Exhibit or the contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the Data Subject is unable to obtain a copy from the Data Exporter;

 

(h)

that, in the event of subprocessing, it has previously informed the Data Exporter and obtained its prior written consent;

 

(i)

that the Processing services by the Subprocessor will be carried out in accordance with Clause 11; and

 

(j)

to send promptly a copy of any Subprocessor agreement it concludes under this Exhibit to the Data Exporter.

 

6.

Liability

 

6.1	The parties agree that any Data Subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or Subprocessor is entitled to receive compensation from the Data Exporter for the damage suffered.

 

6.2

If a Data Subject is not able to bring a claim for compensation in accordance with paragraph 6.1 against the Data Exporter, arising out of a breach by the Data Importer or its Subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the Data Exporter has factually disappeared or ceased to exist in law or has become insolvent, the Data Importer agrees that the Data Subject may issue a claim against the Data Importer as if it were the Data Exporter, unless any successor entity has assumed the entire legal obligations of the Data Exporter by contract or by operation of law, in which case the Data Subject can enforce its rights against such entity.

 

6.3	The Data Importer may not rely on a breach by a Subprocessor of its obligations in order to avoid its own liabilities.

 

6.4

If a Data Subject is not able to bring a claim against the Data Exporter or the Data Importer referred to in paragraphs 6.1 and 6.2, arising out of a breach by the Subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the Data Exporter and the Data Importer have factually disappeared or ceased to exist in law or have become insolvent, the Subprocessor agrees that the Data Subject may issue a claim against the Subprocessor with regard to its own processing operations under this Exhibit as if it were the Data Exporter or the Data Importer, unless any successor entity has assumed the entire legal obligations of the Data Exporter or Data Importer by contract or by operation of law, in which case the Data Subject can enforce its rights against such entity. The liability of the Subprocessor shall be limited to its own processing operations under this Exhibit.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

the Data Subject can enforce its rights against such entity. The liability of the Subprocessor shall be limited to its own processing operations under this Exhibit.

 

7.	Mediation and jurisdiction

 

7.1	The Data Importer agrees that if the Data Subject invokes against it third-party beneficiary rights and/or claims compensation for damages under this Exhibit, the Data Importer will accept the decision of the Data Subject:

 

(a)

to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;

 

(b)

to refer the dispute to the courts in the Member State in which the Data Exporter is established.

 

7.2	The parties agree that the choice made by the Data Subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

 

8.	CO-OPERATION WITH SUPERVISORY AUTHORITIES

 

8.1	The Data Exporter agrees to deposit a copy of this contract with the Supervisory Authority if it so requests or if such deposit is required under the applicable data protection law.

 

8.2	The parties agree that the Supervisory Authority has the right to conduct an audit of the Data Importer and of any Subprocessor which has the same scope and is subject to the same conditions as would apply to an audit of the Data Exporter under the applicable data protection law.

 

8.3

The Data Importer shall promptly inform the Data Exporter about the existence of legislation applicable to it or any Subprocessor preventing the conduct of an audit of the Data Importer, or any Subprocessor, pursuant to paragraph 8.2. In such a case the Data Exporter shall be entitled to take the measures foreseen in Clause 5(b).

 

9.	GOVERNING LAW

 

This Exhibit shall be governed by English law.

 

10.	VARIATION OF CONTRACT

 

The parties undertake not to vary or modify this Exhibit. This does not preclude the parties from adding clauses on business-related issues where required as long as they do not contradict the Exhibit.

 

11.	SUBPROCESSING

 

11.1

The Data Importer shall not subcontract any of its Processing operations performed on behalf of the Data Exporter under this Exhibit without the prior written consent of the Data Exporter. Where the Data Importer subcontracts its obligations under this Exhibit, with the consent of the Data Exporter, it shall do so only by way of a written agreement with the Subprocessor which imposes the same obligations on the Subprocessor as are imposed on the Data Importer under this Exhibit. Where the Subprocessor fails to fulfil its data protection obligations under such written agreement the Data Importer shall remain fully liable to the Data Exporter for the performance of the Subprocessor's obligations under such agreement.

 

11.2

The prior written contract between the Data Importer and the Subprocessor shall also provide for a third- party beneficiary clause as laid down in Clause 3 for cases where the Data Subject is not able to bring the claim for compensation referred to in paragraph 6.1 against the Data Exporter or the Data Importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the Data Exporter or Data Importer by contract or by operation of law. Such third-party liability of the Subprocessor shall be limited to its own processing operations under this Exhibit.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

 

11.3	The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 11.1 shall be governed by English law.

 

11.4	The Data Exporter shall keep a list of subprocessing agreements concluded under this Exhibit and notified by the Data Importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the Data Exporter's Supervisory Authority.

 

12.	OBLIGATION AFTER THE TERMINATION OF PERSONAL DATA PROCESSING SERVICES

 

12.1

The parties agree that on the termination of the provision of data Processing services, the Data Importer shall, at the choice of the relevant Data Exporter, return all the Personal Data transferred and the copies thereof to the Data Exporter or shall destroy all the Personal Data and certify to the Data Exporter that it has done so, unless legislation imposed upon the Data Importer prevents it from returning or destroying all or part of the Personal Data transferred. In that case, the Data Importer warrants that it will guarantee the confidentiality of the Personal Data transferred and will not actively Process the Personal Data transferred any more.

 

12.2	The Data Importer warrants that upon request of the Data Exporter and/or of the Supervisory Authority, it will submit its data Processing facilities for an audit of the measures referred to in paragraph 12.1.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

APPENDIX 1

 

Data Exporters

 

The Data Exporter is a healthcare services and information technology company.

 

Data Importer

 

The Data Importer is a company undertaking data processing activities.

 

Data Subjects

 

The Personal Data transferred may concern the following categories of Data Subjects:

 

1.	Customers of the Data Exporter and personnel employed by or working on behalf of such customers.

 

2.	Persons whose data are relevant to contracts for health care entered into by customers with the Data Exporter.

 

Categories of data

 

The Personal Data transferred may concern the following categories of data:

 

(a)

[***]

 

(b)

[***]

 

(c)

[***]

 

(d)

[***]

 

(e)

[***]

 

(f)

[***]

 

(g)

[***]

 

(h)

[***]

 

(i)

[***]

 

(j)

[***]

 

(k)

[***]

 

(l)

[***]

 

(m)

[***]

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Special Categories of data

 

The Personal Data transferred concern the following special categories of data:

 

·

[***]

 

Processing operations

 

Members book and attend a virtual consultation with a specialist using the 2nd.MD application which is downloadable through their Apple or Android phone or tablet device (the “App”). During the consultation, the specialist will capture information relating to the Member’s condition and the outcome of the consultation. This will be recorded securely in the App and will not be shared with the data exporter without the Member’s consent.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

APPENDIX 2

 

Technical and Organisational Security Measures

 

The Data Importer has implemented a suitable set of information security controls including policies, practices, procedures and organizational structures to protect the confidentiality, integrity and availability of personal data entrusted to it and to protect against unauthorised or accidental access, change, loss or destruction, unauthorised transmission or other unauthorised processing as well as other misuse. Furthermore, the Data Importer has a security assessment program where periodic independent assessments are undertaken with an aim to ensure continual effectiveness.

 

The technical/ organizational security measures implemented by the Data Importer in accordance with Clause 4(c) of this Exhibit are as set out below (as amended and updated from time to time by the Data Importer):

 

Organizational Measures

 

With regard to organizational protection the Data Importer undertakes to apply at least the following measures:

 

Security Management

 

·	The security measures set forth in Exhibit F (Security) and Exhibit D (HIPAA and GLBA – Business Associate Agreement) to the Agreement to which these Standard Contractual Clauses are attached.

 

Personnel Security (Human Resources Security)

 

·	The security measures set forth in Exhibit F (Security) and Exhibit G (Background Investigations) D.

 

Business Continuity Planning

 

·	The measures set forth in Exhibit F (Security) and Section 9 of the Agreement to which these Standard Contractual Clauses are attached.

 

Physical & Environmental Security

 

·	The security measures set forth in Exhibit F (Security) to the Agreement to which these Standard Contractual Clauses are attached.

 

Technical Measures

 

With regard to technical protection the Data Importer undertakes to apply at least the following measures:

 

Workstation Security

 

·

Access rights will be granted based on job role, terminated upon transfer or termination. Maintain a strong password policy requiring a minimum length, complexity, password expiration and account lockout upon multiple failed logon attempts. Workstations will be protected with boot passwords, hard drive encryption and antivirus, as well as other applicable security measures set forth in Exhibit F (Security) to the Agreement to which these Standard Contractual Clauses are attached.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Server Security

 

·

In addition to the other applicable security measures set forth in Exhibit F (Security) to the Agreement to which these Standard Contractual Clauses are attached, access rights will be granted based on job role, terminated upon transfer or termination. Maintain a strong password policy requiring a minimum length, complexity, password expiration and account lockout upon multiple failed logon attempts. [***].

 

Network Security

 

·

In addition to the other applicable security measures set forth in Exhibit F (Security) to the Agreement to which these Standard Contractual Clauses are attached, the production network will be protected by firewalls. Strict ingress / egress rules will be configured to restrict communications between servers to only those the application requires. The production network will be monitored by an intrusion detection system and administrators will receive security alerts. All network access will be logged. [***].

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT F
SECURITY

 

The requirements of this Exhibit are applicable if and to the extent that: (1) Vendor accesses Customer Information Systems (as defined below); or (2) Vendor creates, has access to, or receives from or on behalf of Customer any Customer Information (as defined below) in electronic format. The requirements set forth in this Exhibit are in addition to, and do not substitute for: (i) any of Vendor’s other obligations under the Agreement, including any Exhibits or applicable Statements of Work; and (ii) any requirements imposed upon Vendor by applicable law. To the extent that any requirements set forth in this Exhibit conflict with other requirements under the Agreement (including any Exhibits or applicable Statements of Work), then the requirement most protective of Customer, in Customer’s reasonable determination, shall apply.

 

1.            Definitions. The following terms shall have the meanings as set forth below:

 

1.1            “Confidential Information” has the meaning set forth in the Agreement.

 

1.2            “Customer” means United Healthcare Services, Inc.

 

1.3            “Customer Information” means any Confidential Information of Customer that includes or is comprised of any of the following:

 

(a)            Protected health information (i.e., any information that would be termed “protected health information” under the provisions of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations);

 

(b)            Non-public personal information (i.e., any information that would be termed “non-public personal information” under the Federal Gramm-Leach-Bliley Act, any related state statutes, and any related federal or state regulations);

 

(c)            Personal data (i.e., any information relating to an identified or identifiable natural person, as further defined under the European Union Directive 95/46/EC and each EU member state's implementing laws, including any regulations and codes of conduct issued under such laws);

 

(d)            Cardholder data, as that term is defined in the most current version of the Payment Card Industry (PCI) Data Security Standard; or

 

(e)            Other personal information (i.e., other personally identifiable information about individuals, or information that can be used to identify individuals, the disclosure and/or use of which is restricted by applicable federal or state law, including social security numbers).

 

1.4            “Customer Information Systems” means information systems resources supplied or operated by Customer or its contractors, including without limitation, network infrastructure, computer systems, workstations, laptops, hardware, software, databases, storage media, proprietary applications, printers, and internet connectivity that are owned, controlled or administered by or on behalf of Customer.

 

1.5            “HITRUST” means the Health Information Trust Alliance.

 

1.6            “HITRUST CSF” or “CSF” means the HITRUST common security framework against which Vendor’s security program will be assessed, validated and certified. The common security framework is comprised of a common set of information security requirements with standardized assessment and reporting processes accepted and adopted by healthcare organizations.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

1.7            “HITRUST CSF Certification” means a CSF third-party validated report with certification, which certification has been issued by HITRUST based on testing performed by an independent CSF assessor and reviewed, approved and certified by HITRUST.

 

1.8            “HITRUST CSF Self-Assessment Report” means the report issued by HITRUST upon its validation of the self-assessment conducted by Vendor using the standard methodology, requirements, and tools provided under HITRUST’s CSF Assurance Program.

 

1.9            “HITRUST CSF Validated Report” means a CSF third-party validated report, issued by an authorized CSF assessor based on on-location testing.

 

1.10            “Independent Certification/Attestation” means: (a) a HITRUST CSF Certification; or (b) an alternative certification (e.g., EHNAC, SOC 2 Type 2, or ISO27001) designed to document and measure performance against control objectives that map to applicable HITRUST CSF requirements, controls, and control specifications and/or other relevant standards (“Alternative Certification”), as approved by Customer pursuant to Section 3.4 and described in Attachment 2.

 

1.11            “Mitigate” means Vendor has deployed security controls as necessary to reduce the adverse effects of threats and reduce risk exposure to a level reasonably acceptable by Customer.

 

1.12            “Remediation” or “Remediate”, as applicable, means that Vendor has completely resolved a security exposure or Security Incident, such that the vulnerability no longer poses a risk to Customer Information Systems or Vendor Processing Resources, as applicable.

 

1.13            “Security Incident” means the unauthorized access, use, disclosure, modification, or destruction of Customer Information or access to or interference with the operations of any Customer Information Systems or Vendor Processing Resources. Security Incidents are classified as follows:

 

(a)            “High Severity” or severity 1 (severe impact) means [***].

 

(b)            “Medium Severity” or severity 2 (major impact) means [***].

 

(c)            “Low Severity” or severity 3 (moderate impact) means [***].

 

1.14            “Services” has the meaning set forth in the Agreement. If the term “Services” is not defined in the Agreement, then Services means any services or functions provided by Vendor to Customer under the Agreement.

 

1.15            “Vendor Processing” means any information collection, storage or processing performed by Vendor or its subcontractors that: (i) directly or indirectly supports the Services or functions now or hereafter furnished to Customer; and (ii) involves the storage, processing, use or creation of, or access to, any Customer Information.

 

1.16            “Vendor Processing Resources” means information processing resources supplied or operated by Vendor, including without limitation, network infrastructure, computer systems, workstations, laptops, hardware, software, databases, storage media, printers, proprietary applications, Internet connectivity, printers and hard copies which are used, either directly or indirectly, in support of Vendor Processing.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

2.	General Requirements.

 

2.1            Security Program. Vendor shall maintain a comprehensive security program under which Vendor documents, implements and maintains the physical, administrative, and technical safeguards necessary to: (a) comply with applicable law; and (b) protect the confidentiality, integrity, availability, and security of Vendor Processing Resources and Customer Information. Vendor’s security program shall be consistent with the requirements of this Exhibit and shall be designed to ensure compliance with the provisions of applicable law, including without limitation the Health Information Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH), the Payment Card Industry Data Security Standards (PCI DSS), and Sarbanes-Oxley (SOX).

 

2.2            Vendor Security Contact. Vendor shall designate [***] to serve as Vendor’s points of contact for Customer on all security issues. Vendor’s Security Representatives shall be responsible for overseeing compliance with this Exhibit. Vendor shall maintain [***] for the Security representatives’ roles, and will replace a Security Representative within [***] should an individual serving as one of the Security Representatives change roles or no longer be employed by Vendor. Within [***] of the Effective Date and within [***] of identifying a new individual to serve in such role, Vendor will provide Customer with the name and title of, and the [***] contact information (including email and phone number) for the Security Representatives.

 

2.3            Policies and Procedures. Vendor shall maintain written security management policies and procedures to identify, prevent, detect, contain, and correct violations of measures taken to protect the confidentiality, integrity, availability, or security of Vendor Processing Resources and/or Customer Information. Such policies and procedures shall: (a) assign specific data security responsibilities and accountabilities to specific role(s); (b) include a formal risk management program which includes periodic risk assessments; and (c) provide an adequate framework of controls that safeguard Vendor Processing Resources, Customer Information Systems and Customer Information. Vendor shall provide such policies and procedures to Customer for review upon Customer’s request at any time during the Term.

 

2.4            Subcontractors. To the extent that any Vendor subcontractor accesses Customer Information Systems or creates, has access to, or receives from or on behalf of Customer any Customer Information in electronic format, Vendor shall enter into a written agreement with such subcontractor [***].

 

2.5            IT Change and Configuration Management. In addition to any specific requirements set forth in the applicable Statement of Work, Vendor shall employ reasonable processes, consistent with industry best practices, for change management, code inspection, repeatable builds, separation of development and production environments, and testing plans. Code inspections must include a comprehensive process to identify vulnerabilities and malicious code, including but not limited to logic-bombs, sniffers, and backdoors. In addition, Vendor shall ensure that processes are documented and implemented for vulnerability management, patching, and verification of system security controls prior to their connection to production networks.

 

2.6            Change Notifications. In addition to any specific requirements and subject to any specific conditions set forth in the Agreement or the applicable Statement of Work, Vendor shall provide Customer with at least [***] prior written notice of any relevant material changes that will negatively impact security, to Vendor’s information technology infrastructure, facilities, or resources associated with information security governance and oversight, security, network, and infrastructure operations and any key personnel responsible for ensuring a secure environment spanning Vendor, any of its subcontractors, and Customer.

 

2.7            Data Retention. Vendor shall not retain any Customer data following completion of the applicable Services, except to the extent: (a) required by law; (b) required pursuant to Exhibit H (Medicare Advantage Regulatory Requirements Appendix); or (c) expressly required by Customer in writing. At Customer’s request, Vendor shall certify to Customer in writing that all Customer data has been returned or destroyed, as required under this Agreement.

 

 

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

3.	Security Assessment and Independent Certification Requirements

 

3.1            Applicability. Vendor is required to demonstrate to Customer, through an Independent Certification / Attestation as further set forth in this Section 3, that Vendor has in place appropriate controls to protect Customer Information.

 

3.2            Security Assessment. [***] Vendor shall have completed a security assessment conducted by Customer’s Information Risk Management department (“Security Assessment”). The Security Assessment may: (a) rely on the Independent Certification/Attestation Vendor provided to Customer; or (b) be in addition to the Independent Certification/Attestation, in Customer’s sole discretion. In addition, Customer may require additional Security Assessments in connection with Statements of Work for new or additional Services. Any remediation requirements identified during a Security Assessment will be documented and tracked using a tool provided by Customer (e.g., a vendor portal or spreadsheet). Vendor will complete such remediation requirements within the agreed upon timeframes. Material remediation requirements may also be set forth in Attachment 1 or the applicable Statement of Work. [***].

 

3.3            Independent Certification / Attestation – HITRUST CSF Certification. Vendor shall have, as of the Effective Date, and shall maintain through the period described in Section 3.6, a HITRUST CSF Certification. To the extent that Vendor does not have a HITRUST CSF Certification as of the Effective Date, or is the process of obtaining a HITRUST CSF Certification, the requirements of Section 3.4 or Section 3.5, as applicable, shall apply. In order to meet the requirements of this Exhibit, the scope of all assessment, review, testing, validation and certification activities under Vendor’s HITRUST CSF Certification must include all Vendor Processing Resources and Vendor Processing, as well as applicable Vendor facilities used in connection with the provision of the Services.

 

3.4            Independent Certification / Attestation – Other. Subject to Customer’s prior written consent, which may be withheld or conditioned in Customer’s sole discretion, Vendor may meet the requirements of this Section 3 by obtaining and maintaining an Alternative Certification. To the extent that Customer approves the use of an Alternative Certification, the approved Alternative Certification and a description of the relevant control objectives or similar requirements shall be set forth in Attachment 2.

 

3.5            HITRUST CSF Implementation Requirements. To the extent that Vendor has not obtained a HITRUST CSF Certification (and Customer has not approved the use of an Alternative Certification), then: (a) the requirements of Section 3.7 shall apply; and (b) Vendor shall (i) complete and provide to Customer a HITRUST CSF Self-Assessment Report, (ii) obtain and provide to Customer a HITRUST CSF Validated Report, and (iii) obtain and provide to Customer a HITRUST CSF Certification by the respective deadlines set forth in Attachment 3. Vendor’s failure to meet the foregoing requirements shall be deemed to be a material breach of the Agreement. If Vendor has begun the process of obtaining a HITRUST CSF Certification before the Effective Date, then Vendor represents and warrants to Customer that all corrective action plans that are necessary to obtain a HITRUST CSF Validated Report and/or HITRUST CSF Certification and that have been identified to Vendor prior to the Effective Date are included in Attachment 3.

 

3.6            Independent Certification / Attestation Timing Requirements. To the extent that an Independent Certification/Attestation is required under this Exhibit, Vendor shall maintain such Independent Certification/Attestation (and continue to meet the applicable requirements of this Exhibit regarding such Independent Certification/Attestation) until the later of: (a) the expiration or earlier termination of the Agreement; or (b) Vendor no longer maintains (including in archived or secure storage) or has access to, any Customer Information.

 

3.7            Interim Requirements. Until such time as Vendor obtains either a HITRUST CSF Certification or an Alternative Certification approved by Customer, the requirements of Attachment 4 shall apply.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

3.8            Reporting of Findings. Upon Customer’s request, Vendor shall report to Customer any findings and associated corrective action plans identified during a self-assessment or any third party assessment, including any assessment related to Vendor’s Independent Certification / Attestation. Vendor will provide Customer with any further information associated with such findings, as reasonably requested by Customer.

 

4.	Security Monitoring and Response

 

4.1            Mitigation and Remediation of Security Exposures. Vendor will Mitigate or Remediate any High Severity security exposure or finding discovered by Customer or Vendor within [***] from the time Vendor becomes aware of the exposure or finding. Vendor will Mitigate or Remediate any Medium Severity or Low Severity security exposure or finding discovered by Customer or Vendor within [***] from the time Vendor becomes aware of the exposure or finding. With respect to security exposures that are Mitigated (but not Remediated), Vendor must Remediate such security exposures within [***] after being Mitigated (in the case of High Severity exposures) and [***] after being Mitigated (in the case of Medium Severity exposures), and [***] after being Mitigated (in the case of Low Severity exposures). If Vendor fails to Mitigate or Remediate any security exposure or finding within the required timeframe: [***].

 

4.2            Incident Response. Vendor shall maintain formal processes to detect, identify, report, respond to, Mitigate, and Remediate Security Incidents in a timely manner.

 

4.3            Incident Notification. Vendor shall notify Customer in writing within [***] of any Security Incident(s) which result in, or which Vendor reasonably believes may result in, unauthorized access to, modification of, or disclosure of Customer Information, Customer Information Systems or other Customer applications. Vendor shall provide Customer with a written Remediation plan within [***] of the Security Incident. Notwithstanding the notice provisions of the Agreement, Vendor shall send all notifications and written communications required under this Section to Customer at SIR@uhc.com.

 

4.4            Incident Remediation. Upon becoming aware of a Security Incident, Vendor will assign a severity level (i.e., High Severity, Medium Severity or Low Severity) based on the definitions set forth in this Exhibit. Vendor will reclassify the Severity Level of any Security Incident upon Customer’s reasonable request. Vendor will Mitigate or Remediate any High Severity Security Incident within [***] from the time Vendor becomes aware of the incident. Vendor will Mitigate or Remediate any Medium Severity or Low Severity Security Incident within [***] from the time Vendor becomes aware of the incident. With respect to Security Incidents that are Mitigated (but not Remediated), Vendor must Remediate such Security Incidents within [***] after being Mitigated (in the case of High Severity incidents) and [***] after being Mitigated (in the case of Medium Severity incidents), and [***] after being Mitigated (in the case of Low Severity incidents). If Vendor fails to Mitigate or Remediate any Security Incident within the required timeframe: [***].

 

4.5            Site Outage. Vendor shall promptly report to Customer any Vendor site outages where such outage may impact Customer or Vendor’s ability to fulfill its obligations to Customer.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

5.	Hosting, Virtualization Services, and Data Aggregation

 

5.1            Limits on Shared Hosting and Virtualization. Vendor shall not utilize (nor permit any subcontractor to utilize) any shared hosting or virtualized “cloud” hosting arrangements in support of Customer without Customer’s prior written approval.

 

5.2            Co-Mingled or Aggregated Data. Vendor shall not [***] Customer Information or any Confidential Information of Customer (including, for example, program code, database scripts, data extracts, process flows, calculations, macros, and business logic) [***] without Customer’s prior written approval. Vendor will obtain Customer’s prior written approval of each Vendor (or subcontractor) data center in which Customer Information is stored or processed.

 

5.3            Logical and Physical Segregation. Vendor shall physically and/or logically segregate Customer data from data of other Vendor customers.

 

6.	Licenses; Software Development

 

6.1            No License Granted. Nothing in this Exhibit grants to Vendor, either expressly or by implication, any right or license to access or use for any purpose any Customer Information, Customer Information Systems, or any software in Customer’s computing environments. This Exhibit does not transfer to Vendor title of any ownership rights or rights in patents, copyrights, trademarks and trade secrets included in Customer Information Systems.

 

6.2            Software Usage. Vendor shall not attempt to copy, alter, decompile, reverse engineer, or disassemble any of the software programs contained in Customer Information Systems.

 

6.3            Software Development. If the Services include the development of software product(s), including web applications, for Customer, such software shall be developed and maintained in accordance with the development methodology specified by Customer. Such software shall satisfy the appropriate Customer information security policies and guidelines that are furnished by Customer to Vendor (which are incorporated herein by reference). Vendor shall comply with any instructions, guidelines or minimum compliance controls that are furnished by Customer to Vendor (which are incorporated herein by reference) to enable Customer to comply with SOX and/or other applicable laws and regulations. To the extent that Vendor uses internally-developed software or web applications to provide the Services, even if such items are not developed exclusively for Customer, then (a) Vendor shall insure that such items comply with any instructions, guidelines or minimum compliance controls that are furnished by Customer to Vendor (which are incorporated herein by reference) to enable Customer to comply with applicable laws and regulations, and (b) Vendor will provide Customer with such information as is reasonably necessary for Customer to confirm that applicable compliance controls are in place.

 

7.             Audit. Notwithstanding anything to the contrary in the Agreement, Vendor will provide to Customer, its auditors (including internal audit staff and external auditors), inspectors, regulators and other representatives as Customer may from time to time designate in writing, access [***] to any facility or part of a facility at which either Vendor or any of its subcontractors is performing Vendor Processing or which contains Vendor Processing Resources, and to data and records relating to Vendor Processing, Vendor Processing Resources, and information security for the purpose of performing audits and inspections of Vendor and any of its subcontractors to (a) verify the integrity of Customer Information and examine the systems that process, store, secure, support and transmit Customer Information; (b) verify Vendor’s and its subcontractors’ compliance with the requirements of this Exhibit, and (c) review general controls and security practices and procedures. Vendor will cooperate fully with Customer or its designees in connection with audit functions and with regard to examinations by regulatory authorities. Customer’s auditors and other representatives will comply with Vendor’s reasonable security requirements in the performance of such audit.

 

8.             Amendments. Notwithstanding anything to the contrary set forth in the Agreement, Customer may amend this Exhibit by providing at least [***] prior written notice to Vendor if Customer reasonably determines that such amendment is necessary for Customer to comply with the Standards for Privacy of Individually Identifiable Health Information or the Security Standards for the Protection of Electronic Protected Health Information (both of which are set forth at 45 CFR Parts 160 and 164) or any other federal, state or local law, regulation, ordinance, or requirement relating to the confidentiality, integrity, availability, or security of Customer Information.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Attachment 1

Security Assessment Remediation Requirements

 

¨           Not applicable.

 

x          Applicable.

 

#	Remediation Requirement	Completion Criteria	Implementation Date
Independent	[***]	[***]	No later than [***]
Review of		be performed [***] in order to	from the Effective Date of
Information		provide reasonable assurance	of this MSA
Security		that security practices and
		operations are effective.

 

(add rows as necessary)

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Attachment 2

Alternative Certification Requirements

 

¨            Not applicable.

 

x            Applicable.

 

Customer approves and consents to the SOC 2 Type II submitted by Vendor as an Alternative Certification in compliance with Section 3.3 of this Exhibit E (Security), until such time that Vendor obtains the SOC 2 Type 2 report mapped with HITRUST CSF. Vendor shall maintain such Alternative Certification in compliance with this Agreement at all times.

 

Furthermore, Vendor is in the process of obtaining SOC 2 Type 2 report mapped with HITRUST CSF. The controls tested during this process, as well as in future assessments, as part of the SOC 2 Type II shall cover all of the HITRUST controls in the then current mapping principles to HITRUST CSF or as otherwise communicated to Vendor in writing during the term of this Agreement. The current version can be found at: https://hitrustalliance.net/csf-rmf-related-documents/ OR https://hitrustalliance.net/soc2/]. Vendor will obtain the SOC 2 Type 2 report mapped with HITRUST CSF no later than [***] from the Effective Date of this MSA. Vendor will provide Customer with a copy of the SOC 2 Type 2 report mapped with HITRUST CSF documentation, along with any supporting documentation requested of Vendor, within [***] of receipt from the certifying authority. Vendor shall maintain its certification in compliance with this Agreement at all times.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Attachment 3

HITRUST CSF Implementation Plan

 

x            Not applicable.

 

¨            Applicable.

 

1.	Implementation Deadlines.

 

Requirement	Deadline
HITRUST CSF Self-Assessment Report	[[***] after the Effective Date]
HITRUST CSF Validated Report	[[***] after the Effective Date]
HITRUST CSF Certification	[[***] after the Effective Date]

 

2.	Corrective Action Plans.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Attachment 4
Interim Requirements

 

x           Not applicable.

 

¨           Applicable.

 

1.	Definitions. The following terms shall have the meanings as set forth below:

 

1.1            “Device” means equipment or electronic media on which Customer Information is accessed, stored or processed, including without limitation storage drives or tapes, removable drives or media (to the extent permitted by Customer), desktop and laptop computers, tablets, and mobile devices.

 

1.2            “Vendor Personnel” will mean employees, contractors or agents of Vendor, or of its subcontractors, who provide Services (or any component thereof) to Customer.

 

2.	Security Management (Infrastructure Protection)

 

Vendor shall maintain industry standard procedures to protect Vendor Processing Resources, including, at a minimum:

 

(a)

Formal security programs (e.g., policies, standards, processes);

(b)

Content aware solutions (i.e., data loss prevention) to discover, monitor, and protect data during transit/at rest across network, storage, and endpoint systems;

(c)

Processes for becoming aware of and maintaining security patches and fixes;

(d)

Router filters, firewalls, and other mechanisms to restrict access to the Vendor Processing Resources, including without limitation, all local site networks that may be accessed via the Internet (whether or not such sites transmit information);

(e)

Resources used for mobile access to Customer Information Systems shall be protected against attack and penetration through the use of firewalls, malware detection/prevention, and encryption; and

(f)

Processes to prevent, detect, and eradicate malicious code (e.g., viruses) and to notify Customer of instances of malicious code detected on Vendor Processing Resources that may affect Customer Information or Customer Information Systems. Notwithstanding the notice provisions of the Agreement, Vendor shall send all notifications and written communications required under this Section to Customer at SIR@uhc.com.

 

3.	Risk Management

 

3.1            General Requirements. Vendor shall maintain appropriate safeguards and controls and exercise due diligence to protect Customer Information and Vendor Processing Resources against unauthorized access, use, and/or disclosure, considering all of the factors and/or requirements listed below. In the event of any conflict or inconsistency between relevant requirements, Vendor shall protect the Customer Information and Vendor Processing Resources in accordance with [***]:

 

(a)

Federal and state legal and regulatory requirements;

(b)

Information technology and healthcare industry best practices (e.g., HITRUST Common Security Framework);

(c)

Sensitivity of the data;

(d)

Relative level and severity of risk of harm should the integrity, confidentiality, availability or security of the data be compromised, as determined by Vendor as part of an overall risk management program;

(e)

Customer’s data security requirements, as set forth in this Exhibit, the due diligence process and/or in the Agreement; and

(f)

Any further information security requirements which are included in a Statement of Work or equivalent document which is attached to or relates to the Agreement.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

3.2            Internal Risk Assessment. Vendor shall periodically [***] evaluate its processes and systems to ensure continued compliance with obligations imposed by law, regulation or contract with respect to the confidentiality, integrity, availability, and security of Customer Information and Vendor Processing Resources. Vendor shall document the results of these evaluations and any remediation activities taken in response to such evaluations, and provide a copy to Customer, upon Customer’s request.

 

3.3            Internal Records. Vendor shall maintain mechanisms to capture, record, and examine information relevant to Security Incidents and other security-related events. In response to such events, Vendor shall take appropriate action to address and remediate identified vulnerabilities to Customer Information and Vendor Processing Resources, including as set forth in this Exhibit.

 

3.4            Vulnerability Assessment and Patch Management. Vendor shall provide Customer with the results of external vulnerability testing, internal infrastructure vulnerability testing, and application vulnerability testing. Vendor will perform (and, at Customer’s request, allow Customer to perform) penetration tests of applicable Vendor environments, including perimeter vulnerability testing, internal infrastructure vulnerability testing, and application testing. Vendor shall also ensure that appropriate patches and security updates are applied in accordance with OEM recommendations or (subject to Customer’s prior written approval) industry standards and best practices. Vendor shall provide process documentation and assessment results to Customer upon Customer’s request.

 

3.5            Audit and Attestation Practices. Vendor shall provide to Customer [***] information on its audit processes, procedures and controls, including a report on any findings and remediation efforts. If Vendor has not, as of the Effective Date, obtained a HITRUST CSF Certification or an Alternative Certification approved by Customer to permanently substitute for the HITRUST CSF Certification, then Vendor shall provide Customer an interim Alternative Certification. Vendor shall provide such Alternative Certification as of the Effective Date and [***] thereafter until (a) Vendor obtains a HITRUST CSF Certification approved by Customer, or (b) the Agreement expires or is terminated.

 

3.6            Vendor Locations. Unless previously authorized by Customer in writing, all work performed by Vendor related to the Agreement shall be performed from the Vendor location(s) designated in the Agreement and/or relevant Statement of Work(s).

 

4.	Personnel Security

 

4.1            Access to Customer Information. Vendor shall require that Vendor Personnel who have, or may be expected to have, access to Customer Information or Customer Information Systems comply with the provisions of the Agreement, including this Exhibit and any confidentiality agreement(s) or Business Associate Agreement(s) binding upon Vendor. Vendor will remain responsible for any breach of this Exhibit by Vendor Personnel.

 

4.2            Security Awareness. Vendor shall ensure that Vendor Personnel remain aware of industry standard security practices, and their responsibilities for protecting the Customer Information. Vendor shall provide information security awareness training and education to all Vendor Personnel upon hire, during the on-boarding process, and annually thereafter. Such information security awareness education and training shall address the responsibilities related to the Services provided to Customer. Customer may, at its option, review the content of, and request modifications to, the training curriculum. Vendor shall accommodate all of Customer’s reasonable requests in this regard. Participation in such training by Vendor Personnel shall be mandatory and Vendor shall track attendance and, at Customer’s request, provide a confirmation that all Vendor Personnel have completed such training. Vendor’s information security awareness training shall include, but not be limited to:

 

(a)

Protection against malicious software (such as viruses);

(b)

Appropriate password protection and password management practices;

(c)

Appropriate use of workstations and computer system accounts;

(d)

HIPAA and HITECH requirements, including the Privacy Rule and Security Rule;

(e)

Vendor’s information security policies;

(f)

Any applicable acceptable use policies;

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

(g)

Relevant obligations set forth in the Agreement; and

(h)

Procedures for reporting Security Incidents.

 

4.3            Sanction Policy. Vendor shall maintain a sanction policy to address violations of Vendor’s internal security requirements or security requirements which are imposed on Vendor by law, regulation, or contract.

 

4.4            Supervision of Workforce. Vendor shall maintain processes for authorizing and supervising Vendor Personnel and for monitoring access to Customer Information, Customer Information Systems and/or Vendor Processing Resources.

 

5.	Physical Security.

 

Vendor shall maintain appropriate physical security controls (including facility and environmental controls) to prevent unauthorized physical access to Vendor Processing Resources and areas in which Customer Information is stored or processed. Where practicable, this obligation shall include controls to physically protect hardware (e.g., lockdown devices). Vendor shall adopt and implement a written facility security plan which documents such controls and the policies and procedures through which such controls will be maintained. Vendor shall maintain appropriate records of maintenance performed on Vendor Processing Resources and on the physical control mechanisms used to secure Vendor Processing Resources. Vendor shall obtain Customer’s prior written approval before moving storage or processing of Customer Information, or Vendor Personnel who have access to Customer Information or Customer Information Systems, to any location not previously authorized by Customer. Vendor agrees and acknowledges that any such relocation may require updates to any applicable Independent Attestation/Certification, and Vendor will not complete any such relocation until such updates have been completed.

 

6.	Security Monitoring and Response

 

6.1            Incident Response. Vendor shall maintain formal processes to detect, identify, report, respond to, Mitigate, and Remediate Security Incidents in a timely manner.

 

6.2            Incident Notification. Vendor shall notify Customer in writing within [***] of any Security Incident(s) which result in, or which Vendor reasonably believes may result in, unauthorized access to, modification of, or disclosure of Customer Information, Customer Information Systems or other Customer applications. Vendor shall provide Customer with a written Remediation plan within [***] of the Security Incident. Notwithstanding the notice provisions of the Agreement, Vendor shall send all notifications and written communications required under this Section to Customer at SIR@uhc.com.

 

6.3            Incident Remediation. Upon becoming aware of a Security Incident, Vendor will assign a severity level (i.e., High Severity, Medium Severity or Low Severity) based on the definitions set forth in this Exhibit. Vendor will reclassify the Severity Level of any Security Incident upon Customer’s reasonable request. Vendor will Mitigate or Remediate any High Severity Security Incident within [***] from the time Vendor becomes aware of the incident. Vendor will Mitigate or Remediate any Medium Severity or Low Severity Security Incident within [***] from the time Vendor becomes aware of the incident. With respect to Security Incidents that are Mitigated (but not Remediated), Vendor must Remediate such Security Incidents within [***] after being Mitigated (in the case of High Severity incidents) and [***] after being Mitigated (in the case of Medium Severity incidents), and [***] after being Mitigated (in the case of Low Severity incidents). If Vendor fails to Mitigate or Remediate any Security Incident within the required timeframe: [***].

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

6.4            Site Outage. Vendor shall promptly report to Customer any Vendor site outages where such outage may impact Customer or Vendor’s ability to fulfill its obligations to Customer.

 

7.	Data and Communications Security

 

7.1            Exchange of Customer Information. Vendor shall utilize a method of transmitting Customer Information electronically that limits the unauthorized access to and/or modification of such information.

 

7.2            Data Retention. Vendor shall not retain any Customer data following completion of the applicable Services, except to the extent (a) required by law, (b) required pursuant to Exhibit H (Medicare Advantage Regulatory Requirements Appendix), or (c) expressly required by Customer in writing. Subject to the foregoing, Vendor shall ensure that following the completion of the applicable Services, the Customer data used in connection with such Services is Securely Deleted in accordance with Vendor’s records retention policy, which shall be developed by Vendor and reviewed by Customer. At Customer’s request, Vendor shall certify to Customer in writing that all Customer data has been destroyed as required hereunder. As used herein, “Securely Deleted” (or “Securely Delete”) means that (i) hard copy materials are destroyed and cannot be reconstructed (e.g., shredded);

 

(ii) electronic files are deleted and overwritten to a level sufficient to ensure that they cannot be retrieved or reconstructed and that any Customer data contained in the files is rendered unreadable, unusable and indecipherable; and (iii) Devices are physically destroyed, degaussed or overwritten in accordance with NIST Special Publication 800-88. Vendor shall Securely Delete any Customer data provided by Customer but not required by Vendor for performance of the applicable Services promptly after Vendor discovers that such data is not needed, provided, however, that if such prompt deletion would require Vendor to reallocate resources and impact Vendor’s ability to meet Service Level requirements or deadlines established by Customer, then Customer and Vendor will work together to establish a schedule for such deletion.

 

7.3            Encryption. Vendor shall ensure that all Customer data containing Customer Information whether stored (i.e., “data at rest”) or that Vendor transmitted (i.e., “data in motion”) over the public internet is encrypted using valid encryption processes. Full disk encryption must be implemented on any desktop or laptop computer on which Customer data is stored or processed. Valid encryption processes for data at rest are consistent with NIST Special Publication 800-111, Guide to Storage Encryption Technologies for End User Devices. Valid encryption processes for data in motion are those which comply, as appropriate [***]: (a) NIST Special Publications 800-52, Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations; 800- 77, Guide to IPsec VPNs, or (b) the requirements of applicable data security and/or privacy laws in the country from which the Customer Information originates, or (c) other which are Federal Information Processing Standards (FIPS) 140-2 validated. Vendor shall maintain such encryption for all transmissions by Vendor of Customer data via public networks (e.g., the Internet). Such transmissions include, but are not limited to:

 

(i)

Sessions between web browsers and web servers;

(ii)

Email containing Customer Information (including passwords);

(iii)

Transfer of files via the Internet (e.g., FTP);

(iv)

Laptop / desktop encryption;

(v)

Mobile Device encryption; and

(vi)

Removable storage media encryption (e.g., thumb drive, external hard drives, writable CD drives, backup tapes).

 

7.4            Protection of Systems, Devices and Storage Media. With respect to all Vendor systems or Devices containing Customer data, Vendor shall ensure all reasonable, industry-standard measures are taken to physically secure such Devices to prevent any unauthorized disclosure while in transit and while at rest. Vendor shall ensure that all Devices on which Customer data was stored or processed are Securely Deleted before such Devices are used for any other purpose. No Device on which Customer data was stored or processed may be sold, donated, discarded, or otherwise disposed of or used by any organization unless such Device has been Securely Deleted. All media on which Customer data is stored shall be protected against unauthorized access or modification. Vendor shall maintain reasonable and appropriate processes and mechanisms to maintain accountability and tracking of the receipt, removal and transfer of Devices, including certification of the Device being Securely Deleted.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

7.5            Data Integrity. Vendor shall maintain processes to prevent unauthorized or inappropriate modification of Customer Information, for both data in transit and data at rest.

 

8.	Access Control

 

8.1            Identification and Authentication. All access to any Customer Information or any Vendor Processing Resources shall be Identified and Authenticated as defined in this Section. “Identification” (or “Identify,” as the context requires) refers to processes which establish the identity of the person or entity requesting access to Customer Information and/or Vendor Processing Resources. “Authentication” (or “Authenticate,” as the context requires) refers to processes which validate the purported identity of the requestor. For access to Customer Information or Vendor Processing Resources, Vendor shall require Authentication by the use of an individual, unique user ID and an individual password or other appropriate Authentication technique approved by Customer in writing. Vendor shall obtain written approval from Customer prior to using digital certificates as part of Vendor’s Identification or Authorization processes. Vendor shall maintain procedures to ensure the protection, integrity, and soundness of all passwords created by Vendor and/or used by Vendor in connection with the Agreement.

 

8.2            Account Administration. Vendor shall maintain appropriate processes for requesting, approving, and administering accounts and access privileges for Vendor Processing Resources and Customer Information. These processes shall be required for both Customer-related accounts and Vendor’s internal accounts for Vendor Processing Resources, and shall include procedures for granting and revoking emergency access to Vendor Processing Resources and Customer Information. All access by Vendor Personnel to Customer Information Systems shall be subject to prior approval by Customer and shall follow Customer standard policies and procedures.

 

8.3            Access Control. Vendor shall maintain appropriate access control mechanisms to prevent all access to Customer Information and/or Vendor Processing Resources, except by (a) specified users expressly authorized by Customer and (b) Vendor Personnel who have a “need to access” to perform a particular function in support of Vendor Processing. The access and privileges granted shall be limited to the minimum necessary to perform the assigned functions. Vendor shall maintain processes to ensure that Vendor Personnel access to Customer Information is revoked no later than [***] upon termination and [***] in the case of involuntary termination. Vendor shall maintain appropriate mechanisms and processes for detecting, recording, analyzing, and resolving unauthorized attempts to access Customer Information or Vendor Processing Resources. If Vendor Personnel change roles or for any other reason no longer require access to Customer Information Systems, Vendor will notify Customer within [***]. In the case of involuntary termination, Vendor will notify Customer within [***]. Notwithstanding the notice provisions of the Agreement, Vendor shall send all notifications and written communications required under this Section to Customer at [***].

 

8.4            Personal Devices and Removable Media. Vendor shall ensure the Vendor Personnel will not be permitted to, and will not, utilize personal computing equipment for accessing Customer Information Systems or processing Customer Information. Vendor shall monitor and prevent Customer data from being sent via social media or personal email accounts. Vendor shall restrict access to, and the use of removable media, such as USB ports, writable optical media, portable hard drives, and other removable media. Vendor may not (and shall cause Vendor Personnel to not) use any such removable media to store or transfer Customer Information without Customer’s prior written approval.

 

9.	Network Security

 

Vendor shall only have access to Customer Information Systems authorized by Customer and shall use such access solely for providing Services to Customer. Vendor shall not attempt to access any applications, systems or data which Customer has not authorized Vendor to access or which Vendor does not need to access in order to perform Services for Customer. Vendor further agrees to access such applications, data and systems solely to the extent minimally necessary to provide Services to Customer. Vendor's attempt to access any applications, data or systems in violation of the terms in this Section shall be a material breach of the Agreement.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT G
BACKGROUND INVESTIGATIONS

 

Vendor shall, at its own expense, perform a background investigation on each individual assigned to perform Services under the Agreement which will involve: (i) unescorted access to any Customer facility, (ii) direct access or connectivity to any Customer Information Systems (as defined in Exhibit F), (iii) access to protected health information or non-public personal information, or (iv) driving on behalf of Customer (collectively, “High Access Services”).

 

Prior to the assignment of any individual to perform High Access Services, Vendor shall provide Customer with written confirmation that a background investigation have been successfully completed and passed in accordance with the requirements set forth below. Vendor shall be responsible for obtaining any necessary consent from such individuals to permit Customer full access to the background investigation reports. Vendor agrees to keep all such reports for a period of at least [***] past the last date the individual was assigned to Customer.

 

Vendor shall not permit any former employee of Customer, UnitedHealth Group, or any of their Affiliates to perform High Access Services without the prior written approval of the UnitedHealth Group Employee Relations department.

 

Should Vendor become aware, at any time during an individual’s assignment for Customer, that the individual is disqualified from performing High Access Services, Vendor shall immediately remove such individual from his or her assignment with Customer and shall notify Customer in writing within [***] of gaining such knowledge.

 

Customer reserves the right to regularly audit Vendor to determine whether the terms set forth herein are being completed to the satisfaction of Customer. Should Vendor fail to comply with any term of this Exhibit, Vendor shall, upon written request from Customer, pay to Customer a penalty of [***] per occurrence (i.e., per individual), which amounts Customer, at its sole discretion, may offset against sums otherwise owed to Vendor. Notwithstanding anything to the contrary in the Agreement or otherwise, this remedy is cumulative and in addition to any remedies available at law or in equity.

 

Nothing contained in this Agreement shall be construed to create any obligation on the part of Customer to disclose to Vendor, or to any individual, the reasons for its determination to terminate, or to decline, the assignment of an individual, or share any information obtained through a background investigation, except to the extent required by law.

 

Vendor shall meet the requirements of the Fair Credit Reporting Act, any regulations issued thereunder, and any other applicable state and federal laws.

 

Background Investigation Requirements:

 

1.	Background investigations shall include:

 

•

Social Security Number (SSN) trace verification (including disclosure of all other names by which the individual has been known and a check for validity, a suspicious issuance date or a deceased person result);

•

System for Award Management (SAM) database for debarment from federal programs;

•

Office of Foreign Assets Control Specially Designated Nationals (SDN) List;

•

Felony and misdemeanor convictions filed at federal, state, and county government levels for the individual’s home, school and work addresses for the previous seven year period, including participation in court-ordered programs, deferred adjudication, probation and parole;

•

the US Department of Justice National Sex Offender Public Website (NSOPW); and

•

The following investigations, as applicable:

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

In the event the assignment requires:	…the background investigation must include:
Driving on behalf of Customer	Motor Vehicle history in state of current licensure, state of residence, and state of assignment, if different.
Licensed health professional	FACIS Level 3 search
Educational degrees, licenses, or professional certifications required for the position	Verifications of such degrees / licenses / certifications

 

2.	Vendor Assignment Screening Matrix

 

Vendor shall make an initial determination as to whether an individual to be assigned to perform High Access Services has passed or failed the background investigation, or requires further review, in accordance with the following screening matrix:

 

If the background investigations results in a discrepancy or a positive hit, as applicable, consult this matrix and the legend below:
SSN	R
SAM Database	F
SDN List	F
NSOPW	R
Educational Degree*	R
License(s) *	F
Certification(s) *	F
	Year 1	Year 2	Year 3	Year 4	Year 5	Year 6	Year 7
Felony	F	F	F	F	F	F	F
Misdemeanor Involving Theft, Fraud, Drugs or Violence	F	F	F	R	R	R	R
DMV – Major Violation(s)*	F	F	F	R	R	R	R
DMV – Minor Violation(s)*	R	R	P	P	P	P	P
FACIS Level 3 *	R	R	R	R	R	R	R

 

^* = If applicable to the position

 

LEGEND

 

F = FAIL

P = PASS 

R = Requires evaluation and approval by Customer’s Employee Relations Department (HRdirect).

DMV – Minor Violation(s) = Any moving violation other than a Major Violation, as defined below.

DMV – Major Violation(s) = Hit and run, negligent homicide, reckless driving, careless driving, driving while license is suspended or revoked, driving while intoxicated, driving under the influence, and/or possession of open container of alcoholic beverage.

 

3.	Drug Free Workplace Policy

 

Vendor is committed to protecting the safety, health, and well-being of its employees and all people who come into contact with its workplace(s) and property, and/or use its products and services. Recognizing that drug abuse poses a direct and significant threat to this goal, Vendor is committed to ensuring a drug-free working environment for all of its employees. Vendor will implement and enforce a policy that prohibits the illicit use, possession, sale, conveyance, distribution, or manufacture of illegal drugs, intoxicants, or controlled substances in any amount or in any manner.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT H

MEDICARE ADVANTAGE REGULATORY REQUIREMENTS APPENDIX
VENDOR – DELEGATED ENTITY

 

THIS MEDICARE ADVANTAGE REGULATORY REQUIREMENTS APPENDIX (this “Exhibit”) supplements and is made part of the Agreement.

 

SECTION 1
APPLICABILITY

 

This Exhibit applies to the administrative services performed and products provided by Vendor pursuant to the Agreement as such services and products relate to Medicare Advantage Benefit Plans. In the event of a conflict between this Exhibit and other appendices or any provision of the Agreement, the provisions of this Exhibit shall control except: (1) with regard to Benefit Plans outside the scope of this Exhibit; or (2) as required by applicable law.

 

SECTION 2
DEFINITIONS

 

For purposes of this Exhibit, the following terms shall have the meanings set forth below.

 

2.1           Benefit Plan: A certificate of coverage, summary plan description, or other document or agreement, whether delivered in paper, electronic, or other format, under which a Payer is obligated to provide coverage of Covered Services for a Customer.

 

2.2           CMS Contract: A contract between the Centers for Medicare & Medicaid Services (“CMS”) and a Medicare Advantage Organization for the provision of Medicare benefits pursuant to the Medicare Advantage Program under Title XVIII, Part C of the Social Security Act.

 

2.3           Covered Service: A health care service or product for which a Customer is entitled to receive coverage from a Payer, pursuant to the terms of the Customer’s Benefit Plan with that Payer.

 

2.4           Customer: For the purposes of this Exhibit, Customer means a person eligible and enrolled to receive coverage from a Payer for Covered Services.

 

2.5           Medicare Advantage Benefit Plans: Benefit Plans sponsored, issued or administered by a Medicare Advantage Organization as part of the Medicare Advantage program or as part of the Medicare Advantage program together with the Prescription Drug program under Title XVIII, Part C and Part D, respectively, of the Social Security Act (as those program names may change from time to time).

 

2.6           Medicare Advantage Customer or MA Customer: A Customer eligible for and enrolled in a Medicare Advantage Benefit Plan that is covered under the Agreement.

 

2.7	Medicare Advantage Organization or MA Organization: For purposes of this Exhibit, MA Organization is:

 

(a) UnitedHealthcare Insurance Company or one of its affiliates that has entered into a contract with CMS for the purpose of offering a Benefit Plan to MA Customers; or (b) Payer.

 

2.8           Payer: An entity obligated to a Customer to provide reimbursement for Covered Services under the Customer’s Benefit Plan.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

SECTION 3
DELEGATED ACTIVITIES

 

3.1           MA Organization Accountability; Delegated Activities. Vendor acknowledges and agrees that MA Organization oversees and is accountable to CMS for any functions and responsibilities described in the CMS Contract and applicable Medicare Advantage regulations, including those that MA Organization has delegated to Vendor under the Agreement. In addition to the other provisions of this Exhibit, the following shall apply with respect to any functions and responsibilities under the CMS Contract that MA Organization has delegated to Vendor pursuant to the Agreement:

 

(a)            Vendor shall perform or arrange for the provision of those delegated activities set forth in the Agreement.

 

(b)

Vendor shall comply with any reporting responsibilities as set forth in the Agreement.

 

(c)            If MA Organization has delegated to Vendor any activities related to the credentialing of health care providers, Vendor must comply with all applicable CMS requirements for credentialing, including but not limited to the requirement that the credentials of medical professionals must either be reviewed by MA Organization, or the credentialing process must be reviewed, preapproved, and audited on an ongoing basis by MA Organization.

 

(d)            If MA Organization has delegated to Vendor the selection of health care providers to be participating providers in MA Organization’s Medicare Advantage network, or the selection of contractors or subcontractors to perform services under the CMS Contract, MA Organization retains the right to approve, suspend or terminate the participation status of such health care providers and the agreements with such contractors or subcontractors.

 

(e)            Vendor acknowledges that MA Organization shall monitor Vendor’s performance of delegated activities on an ongoing basis. Such monitoring activities may include site visits and periodic audits. If CMS or MA Organization determines that Vendor has not performed satisfactorily, or has failed to meet all reporting and disclosure requirements in a timely manner, MA Organization may revoke any or all of the delegated activities and reporting requirements. Vendor shall cooperate with MA Organization regarding the transition of any delegated activities or reporting requirements that have been revoked by MA Organization.

 

SECTION 4
VENDOR REQUIREMENTS

 

4.1           Data. Vendor shall submit to MA Organization risk adjustment data as defined in 42 CFR 422.310(a) if applicable. By submitting data to MA Organization, Vendor represents to MA Organization, and upon MA Organization’s request, shall certify in writing, that the data is accurate, complete, and truthful, based on Vendor’s best knowledge, information and belief.

 

4.2           Customer Protection. Vendor agrees that in no event, including but not limited to, non-payment by Vendor or MA Organization, insolvency of Vendor or MA Organization, or breach of the Agreement, shall Vendor bill, charge, collect a deposit from, seek compensation, remuneration or reimbursement from, or have any recourse against any MA Customer or person (other than MA Organization) acting on behalf of the MA Customer for any fees that are the legal obligation of MA Organization under the CMS Contract.

 

4.3           Eligibility. Vendor agrees to immediately notify MA Organization in the event Vendor is or becomes excluded from participation in any federal or state health care program under Section 1128 or 1128A of the Social Security Act. Vendor shall not employ or contract for the provision of health care services, utilization review, medical social work or administrative services and products, (collectively “Eligibility Services”), with or without compensation, with any individual or entity that is or becomes excluded from participation in any federal or state health care program under Section 1128 or 1128A of the Social Security Act. Vendor shall review the (1) Department of Health and Human Services Officer of Inspector General List of Excluded Individuals and Entities and (2) the System for Award Management (SAM), a portal for the Federal Procurement System, (and any successor lists) prior to the hiring or contracting of any new employee, temporary employee, volunteer, consultant, governing body member or subcontractor for the provision of Eligibility Services. Vendor must continue to review these lists on a monthly basis thereafter to ensure that none of these persons or entities are excluded or become excluded from participation in federal programs.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

4.4           Laws. Vendor shall comply with all applicable federal and Medicare laws, regulations, and CMS instructions, including but not limited to: (a) federal laws and regulations designed to prevent or ameliorate fraud, waste, and abuse, including but not limited to, applicable provisions of federal criminal law, the False Claims Act (31 U.S.C. §3729 et seq.), and the anti-kickback statute (§1128B of the Social Security Act); and (b) HIPAA administrative simplification rules at 45 CFR Parts 160, 162, and 164.

 

4.5           Federal Funds. Vendor acknowledges that MA Organization receives federal payments under the CMS Contract and that payments Vendor receives from or on behalf of MA Organization are, in whole or in part, from federal funds. Vendor is therefore subject to certain laws that are applicable to individuals and entities receiving federal funds.

 

4.6           CMS Contract. Vendor shall perform the services and provide the products set forth in the Agreement in a manner consistent with and in compliance with MA Organization’s contractual obligations under the CMS Contract.

 

4.7

Records.

 

(a)            Maintenance; Privacy and Confidentiality; Customer Access. Vendor shall maintain records and information related to services performed and products provided by Vendor under the Agreement, in an accurate and timely manner. Vendor shall maintain such records for the longer of the following periods:

 

(i)      in the case of records containing information related to the medical loss ratio information reported to CMS by the MA Organization, including, for example, information related to incurred claims and quality improvement activities, at least [***] from the date such medical loss ratio information is reported to CMS by the MA Organization, or

 

(ii)     in the case of all records, at least [***] from the final date of the CMS Contract period in effect at the time the records were created, or such longer period as required by law.

 

Vendor shall safeguard MA Customer privacy and confidentiality, including but not limited to the privacy and confidentiality of any information that identifies a particular MA Customer, and shall comply with all federal and state laws regarding confidentiality and disclosure of medical records or other health and enrollment information, including the requirements established by MA Organization and the Medicare Advantage program, as applicable.

 

(b)           Government Access to Records. Vendor acknowledges and agrees that the Secretary of Health and Human Services, the Comptroller General, or their designees shall have the right to audit, evaluate and inspect any pertinent books, contracts, computer or other electronic systems (including medical records), patient care documentation and other records and information belonging to Vendor that involve transactions related to the CMS Contract. This right shall extend through the longer of the following periods:

 

(i)      in the case of records containing information related to the medical loss ratio information reported to CMS by the MA Organization, including, for example, information related to incurred claims and quality improvement activities, at least [***] from the date such medical loss ratio information is reported to CMS by the MA Organization, or

 

(ii)     in the case of all records, at least [***] from the later of the final date of the CMS Contract period in effect at the time the records were created or the date of completion of any audit, or longer in certain instances described in the applicable Medicare Advantage regulations.

 

For the purpose of conducting the above activities, Vendor shall make available its premises, physical facilities and equipment, records relating to the services performed and the products provided under the Agreement, and any additional relevant information CMS may require.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

(c)            MA Organization Access to Records. Vendor shall grant MA Organization or its designees such audit, evaluation, and inspection rights identified in subsection 4.7(b) as are necessary for MA Organization to comply with its obligations under the CMS Contract. Whenever possible, MA Organization will give Vendor reasonable notice of the need for such audit, evaluation or inspection, and will conduct such audit, evaluation or inspection at a reasonable time and place.

 

4.8           Subcontracts. If Vendor has any arrangements, in accordance with the terms of the Agreement, with affiliates, subsidiaries or any other subcontractors, directly or through another person or entity, to perform any of the services or provide any products Vendor is obligated to perform or provide under the Agreement that are the subject of this Exhibit, Vendor shall ensure that all such arrangements are in writing, duly executed, and include all the terms contained in this Exhibit. Vendor shall provide proof of such to MA Organization upon request. In addition, Vendor agrees to oversee and monitor, on an ongoing basis, the services Vendor has subcontracted to another person or entity. Vendor further agrees to promptly amend its agreements with such subcontractors, in a manner consistent with the changes made to this Exhibit by MA Organization, to meet any additional CMS requirements that may apply to the performance of the services or the provision of the products.

 

4.9           Offshoring. Unless previously authorized by MA Organization in writing, all services provided by Vendor pursuant to the Agreement that are subject to this Exhibit must be performed within the United States, the District of Columbia, or the United States territories.

 

If MA Organization authorizes Vendor in writing to perform Medicare-related services that involve Medicare beneficiary protected health information (“PHI”) pursuant to the Agreement at locations outside of one of the fifty United Sates, the District of Columbia, or one of the United States Territories (American Samoa, Guam, Northern Marianas, Puerto Rico and Virgin Islands), the following provisions apply:

 

(a)            Vendor represents and warrants to MA Organization that Vendor has in place and will comply with policies and procedures to ensure that all PHI and other personal information remains secure. Vendor will provide written evidence of the policies and procedures upon MA Organization’s request.

 

(b)            Vendor will provide prior written notice to MA Organization of (a) any material change in the Medicare-related services that involve PHI that Vendor performs offshore, (b) any material change in Vendor’s policies and procedures to ensure that all PHI and other personal information remains secure, and

 

(c)            any material change in the tools and systems used by Vendor to ensure that all PHI and other personal information remains secure.

 

(c)            Vendor is prohibited from receiving access to any PHI or other personal information that is not associated with its contractual relationship with MA Organization. If Vendor receives access to PHI or other personal information of MA Organization’s members that is not associated with Vendor’s contractual relationship with MA Organization, Vendor will immediately notify MA Organization that it has received such access, return all PHI or personal information accessed by Vendor, and destroy any such PHI or personal information that remains in Vendor’s possession after doing so (i.e. copies, electronic records, back-ups or temporary files).

 

(d)           Vendor’s services under the Agreement may be terminated [***] upon discovery of a significant security breach.

 

(e)

Vendor authorizes MA Organization or its designee to conduct an audit of Vendor [***].

 

(f)            Vendor acknowledges and agrees that MA Organization will use the results of its audit of Vendor to evaluate the continuation of MA Organization’s relationship with Vendor.

 

(g)            Vendor authorizes MA Organization or its designee to share the results of audits of Vendor with CMS.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

SECTION 5
OTHER

 

5.1 Regulatory Amendment. MA Organization may unilaterally amend this Exhibit to comply with applicable laws and regulations and the requirements of applicable regulatory authorities, including but not limited to CMS. MA Organization shall provide written notice to Vendor of such amendment and its effective date. Unless such laws, regulations or regulatory authority(ies) direct otherwise, the signature of Vendor will not be required in order for the amendment to take effect.

 

rev. 08-13

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT I

 

MASTER COMMUNITY & STATE APPENDIX

 

THIS MASTER COMMUNITY & STATE APPENDIX (this “Exhibit”) supplements and is made part of the Agreement. This Exhibit applies with respect to the provision of services Vendor provides for any Customer health plan Affiliate administering a Medicaid or other state-specific (“State”) government funded and regulated program (“State Program”). In the event of a conflict between this Exhibit and other appendices or any provision of the Agreement, the provisions of this Exhibit shall control except with regard to benefit plans outside the scope of this Exhibit or unless otherwise required by law or applicable State regulatory agency. Vendor will comply with the following requirements to the extent applicable to Vendor’s performance of services under the Agreement.

 

Capitalized terms used but not defined in this Exhibit shall have the meaning assigned to them in the Agreement or other applicable appendix.

 

1.             Regulatory Approval and Filing. In the event Customer is required to file the Agreement with federal, state or local governmental authorities, Customer shall be responsible for filing the Agreement with such authorities as required by any applicable law or regulation. If following any such filing, the governmental authority requests changes to the Agreement, Vendor agrees to cooperate with Customer in preparing the response to the governmental authority.

 

2.             Compliance with Law and Government Contracts. Vendor and Customer agree to comply with all applicable federal, State, and local laws, rules, and regulations in connection with the performance of their obligations under the Agreement. All tasks under the Agreement also must be performed in accordance with the requirements of applicable contracts between any Customer Affiliate and State and/or federal regulatory agencies. Customer will provide or otherwise communicate such requirements to Vendor. Vendor shall ensure all agents, employees, assigns and subcontractors, if any, that are involved in providing services under the Agreement also comply with this Section.

 

3.             Delegation and Oversight. In compliance with the delegation and oversight obligations imposed on Customer Affiliates under their contracts with State and/or federal regulatory agencies, Customer reserves the right to revoke any functions or activities delegated to Vendor under the Agreement, if in the reasonable judgment of Customer or an applicable Customer Affiliate, Vendor’s performance under the Agreement does not comply with obligations under applicable government contracts. This right shall be in addition to Customer’s termination rights under the Agreement.

 

4.             Press Release; Marketing; Advertising; Use of Name and Trademarks. Except as otherwise set forth in the Agreement, Vendor shall not publicly use the name, logo, trademark, trade name, or other marks of Customer without Customer’s prior written consent. The parties mutually agree to provide, at a minimum, at least [***] and opportunity to comment on all press releases, advertisements or other media statements and communications regarding the Agreement, the services or the business relationship between the parties. A party shall obtain the other party’s written consent prior to any publication or use of such materials or communications. Nothing herein shall be construed to create a right or license to make copies of any copyrighted materials.

 

5.             Offshoring. Unless previously authorized in writing by the appropriate Customer health plan Affiliate and State governing agency, if required, all work performed under the Agreement shall be performed from location(s) in the 50 United States. If Vendor receives authorization pursuant to this Section 5 to offshore certain obligations under the Agreement, Customer will provide, and Vendor shall comply with, all applicable offshoring regulations, requirements or restrictions, including any applicable security controls. The parties agree that any offshoring restrictions or requirements may be updated at any time to comply with applicable law and any other requirements.

 

6.             Subcontracts. To the extent required by any regulatory agency governing any Medicare or Medicaid or other governmental benefit plans (or as may be set forth in an appendix) or any accrediting agency, Vendor shall provide advance notice to Customer and obtain Customer’s consent prior to any subcontracting of any of its responsibilities under the Agreement.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

7.             Regulatory Amendment. Customer may unilaterally amend this Exhibit to comply with applicable regulatory requirements required under law. Upon Customer’s notification of such changes, Customer will provide notice to Vendor. If such regulatory amendment materially affects the position of either party or renders it illegal for a party to continue to perform under the Agreement in a manner consistent with the parties’ intent, then the parties shall negotiate further amendments to this Exhibit or the Agreement as necessary to correct any inequities, to the greatest extent possible.

 

8.             Effect of Termination or Expiration. Within [***] after the expiration or termination for any reason (or to any extent) of the Agreement and/or this Exhibit, Vendor shall return or destroy all applicable PHI, if feasible to do so, including all applicable PHI in possession of Vendor’s agents or subcontractors. To the extent return or destruction of the PHI is not feasible, Vendor shall notify Customer in writing of the reasons return or destruction is not feasible and, if Customer agrees, may retain the PHI subject to this section. Under any circumstances, Vendor shall extend any and all protections, limitations and restrictions contained in this Exhibit to Vendor’s use and/or disclosure of any applicable PHI retained after the expiration or termination (to any extent) of the Agreement and/or this Exhibit, and shall limit any further uses and/or disclosures solely to the purposes that make return or destruction of the PHI infeasible.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT J

EXCHANGE REGULATORY APPENDIX

 

THIS EXCHANGE REGULATORY APPENDIX (this “Exhibit”) supplements and is made part of the Agreement and shall survive termination of the Agreement to the extent it or applicable law imposes continuing obligations.

 

SECTION 1
APPLICABILITY

 

Customer is operating as a certified Qualified Health Plan Issuer (“QHP Issuer”) in one or more public Health Care Exchanges (“Exchange”) created under the terms of the Federal Patient Protection and Affordable Care Act (“PPACA”) and any implementing State law. Customer may be delegating certain of its QHP Issuer's activities, reporting responsibilities, and/or other obligations, to Vendor.

 

This Exhibit applies solely to the services performed and provided with respect to any Exchange business delegated by United to Vendor pursuant to the Agreement. In the event of a conflict between this Exhibit and other appendices or any provision of the Agreement, the provisions of this Exhibit shall control, except as required by applicable law. Terms in this Agreement shall be as defined in PPACA, as supplemented by any applicable State Exchange law.

 

SECTION 2
PROVISIONS

 

This Exhibit is intended to comply with Exchange laws and substantive requirements.

 

1.             The delegated activities and reporting responsibilities are set forth in the Agreement to which this Exhibit is attached. To the extent such delegated activities and reporting responsibilities serve Exchange business, they are designated as “QHP Services”.

 

2.             Vendor acknowledges and agrees that Customer may revoke the delegated activities and reporting standards of Vendor or specify other remedies, for the respective Exchange, in instances where the U.S. Department of Health and Human Services (“HHS”), a State Exchange regulator, or Customer determines that such parties have not performed satisfactorily. To the extent that HHS or a State Exchange regulator directs the revocation, Customer shall provide immediate written notice of such to Vendor, and such revocation shall become effective as directed by HHS or the State Exchange regulator. Vendor shall cooperate with Customer regarding the transition of any QHP Services that have been revoked by United.

 

3.             Vendor must comply with all applicable laws and regulations relating to the standards specified in 45 CFR § 156.340, as it may be amended from time to time, and all other Federal and/or State laws relevant to Customer’s Exchange business being serviced.

 

4.             Vendor must permit access by the Secretary of HHS and the Office of Inspector General or their designees, in the case of Federally Facilitated Exchange (“FFE”) business, or comparable State regulators, in the case of State Exchange business, in connection with their right to evaluate through audit, inspection, or other means, to Vendor's books, contracts, computers, or other electronic systems, including medical records and documentation, relating to the Customer’s obligations as a QHP Issuer in accordance with Federal standards under 45 CFR §156.340, as it may be amended from time to time, with all records retained for at least [***] from the final date of the Agreement period or such lesser period which may be specified in State law for State Exchanges.

 

5.             If submitting FFE data is involved, Vendor is bound by the terms of Customer’s agreement between Qualified Health Plan Issuer and The Centers for Medicare and Medicaid Services or any applicable trading partners or comparable State Exchange agreement, to test its software, and receive Customer’s approval of software as being in the proper format and compatible with the FFE or the applicable State system.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

6.             If any State Exchange or HHS for FFEs requires additional specific provisions to be in Customer’s agreement with any delegated or downstream entity, they will be provided to Vendor by Customer and are incorporated herein by reference or by attaching a copy of such provisions to this Exchange Regulatory Exhibit.

 

7.             If Vendor delegates any QHP Services to a downstream entity (as such term is defined in 45 C.F.R. § 156.20), Vendor shall provide written advance notification to Customer of such delegated activities and reporting responsibilities before the applicable effective date of the delegation under federal regulations, Vendor shall bind the downstream entity to all the terms of this Exhibit, including providing for revocation of the delegated activities.

 

 

Exhibit 10.33

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

STATEMENT OF WORK NO. 3

 

This is Statement of Work (“SOW”) No. 03 to the MASTER SERVICES AGREEMENT dated December 19, 2016 (the “Agreement”), between United HealthCare Services, Inc., (“Customer”) on behalf of itself and its Affiliates and Innovation Specialists, LLC d/b/a 2nd.MD (“Vendor”). This SOW is effective as of September 1^st, 2019 (the “SOW Effective Date”), regardless of the execution dates hereof. All capitalized terms not otherwise defined in this SOW will have the meanings assigned to them in the Agreement. Unless modified herein, all terms in the Agreement shall remain unchanged and in full force and effect.

 

1.	CUSTOMER BUSINESS SEGMENT RECEIVING SERVICES:

 

Optum Consumer Solutions Group. Key operating differences for Customer’s Client UnitedHealthcare Global are set forth in Exhibit A-6.

 

2.	DEFINITIONS

 

Capitalized terms used in this SOW, but not defined herein, have the respective meaning given to them in the Agreement. In addition to terms otherwise defined in this SOW or in the Agreement, the following terms have the meanings set forth below:

 

2.1

“Care Team” means the team of doctors, nurses and other medical professionals, hired and employed by Vendor who each shall have a valid, unrestricted license to engage in their respective profession in a state in the United States.

 

2.2

“Client” means organizations that have purchased, or may purchase, the Services from Customer.

 

2.3

“Client Contract” means the terms of a binding contract executed by and between the Client and Customer under which the parties agreed that Services will be offered to Client by Customer.

 

2.4

“Consultation” means the clinical second opinion review and consultation services performed in accordance with Section 4.3 of this SOW.

 

2.5

“Flow Down Provisions” means all applicable requirements related to the Services, including, but not limited to, subcontractor restrictions, service level agreements or termination rights, from a Client Contract.

 

2.6

“Hosted Services” means Vendor’s secure, proprietary HIPAA-compliant system utilized for Services, including, but not limited to, managing data for Consultations and User data; and, is more fully described in in Section 3.2 of the SOW.

 

2.7

“Member” means an individual within an eligible population of Client that may receive Services under this SOW under the terms of a Client Contract.

 

2.8

“Mobile App” means the secure mobile application provided by Vendor, which is made available to Members for Services.

 

2.9

“Optum” means the UHS Affiliate that is receiving the Services under this SOW, and marketing such Services, in addition to Vendor, to Clients of Optum.

 

2.10

“Participant” means a Member that is receiving Services under this SOW.

 

2.11

“Targeted Outreach” means Vendor targeted outbound calling for high impact conditions for Participants identified by Customer by daily batch files, in which Participants are identified by Customer’s prior authorization process and/or Optum care management algorithm identifying high impact cases. Targeted Outreach will be included for all Clients and Clients can opt-out, if needed.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

2.12

“Services”, as referenced herein this SOW, means the Services, as set forth in Sections 3 and 4.

 

2.13

“Specialist” means a board certified, licensed medical doctor, located in the United States, who (i) has completed a multiple year residency in a specific specialty of medicine, (ii) is selected by Vendor based upon their credentials, and (iii) (1) has studied, trained, or are currently working at a leading hospital or teaching institution or (2) has led multiple peer reviewed studies in their field of specialty or (3) is a recognized expert in their field of subspecialty.

 

2.14

“Users” means each of the named individuals (Participants, Customers, and Clients) who have access credentials established by Vendor and are authorized to access and use the Hosted Service in accordance with this SOW and the Agreement.

 

3.	PURPOSE AND HIGH-LEVEL SCOPE OF SERVICES:

 

Vendor will provide the Services as set forth below and more fully described in this SOW including any exhibits attached hereto.

 

3.1

Health Education and Clinical Consultation Services

 

Vendor will perform Consultations, as directed and requested by a Participant pursuant to the process described in Section 4. Vendor will cause the Specialists who provide clinical consultations to generally educate Participants about their clinical condition, the treatment options available for their clinical condition and the risks and benefits associated with such options. In arranging for the performance of Consultations, Vendor will conduct certain other administrative services in support of the same, including, but not limited to, Participant medical record retrieval related to the requested Consultation, development of communication to Participants (which includes the Consultation summary), development of communication to a Participant’s treating doctor, if requested, secure transmittal and storage of data associated with the Consultation, and reporting as more fully described herein.

 

Additionally, Members can text a question through Vendor’s secure Mobile App, and receive an answer within [***]. This service is utilized for a quick response to questions that can be answered without the need to review medical records. This service only applies to clients who have elected to use this service prior to [***]. All new clients sold after [***] will automatically receive this service.

 

The parties agree to offer the Services to Clients who have a Client Contract with the Customer business segment set forth in Section 1 of this SOW.

 

3.2

Hosted Services

 

Vendor will, in accordance with the terms and conditions of this SOW and the Agreement, grant access to and use of its website and Mobile App, in English only and other languages as they become available, to the following parties: (i) Customer for (a) testing the delivery of the Services and (b) access via a secure web-dashboard (the “Client Self Reporting Dashboard”), no later than [***], access to reporting as set forth in Section 4.5; and, as applicable, (ii) Members for service delivery of the Services.

 

3.3

Supplementary Services

 

For the provision of the Services, Vendor will provide supplementary services related to: (1) the “Nurse Portal” to better facilitate access to and delivery of data between Customer and Vendor and Participant; and (2) the delivery of certain other services, as set forth in this SOW, in support of the Services; and, if requested by Customer, (3) the implementation of the “Three Day Gateway”, upon mutual agreement in writing between Vendor and Customer via an amendment to the SOW; and, (4) ancillary services, including, but not limited to, Services marketing, implementation of the Services for Clients, and technical support, as is more fully described in this SOW. The services set forth in this paragraph shall be referred to as “Supplementary” services.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

4.	DETAILED DESCRIPTION OF SERVICES:

 

4.1

Generally.

 

4.1.1

Licensure. Before performing the Services set forth in this SOW, Vendor will secure and obtain, at Vendor’s sole cost and expense, all licenses, credentials, permits, approvals, and authorizations that are required by applicable law for Vendor’s proper and lawful performance of the Services under this SOW.

 

4.1.2

Guidelines.

 

•

Policies. For the purposes of performing the Services as required under this SOW, Vendor will provide all Services in accordance with any Customer policies, processes or methodologies, provided Vendor has received notice of such policies. Furthermore, Vendor will cause its personnel to follow and comply with all policies, and, where applicable, methodologies related to the performance of Services.

 

•

Applicable Laws. In Vendor’s performance of Services under this SOW, Vendor will comply with all applicable federal rules, regulations, laws, and guidelines and all applicable rules, regulations, laws and guidelines of a state that are applicable to Vendor’s provision of Services within the state (“Laws”). Vendor shall comply with all Laws to which the Services become subject after the SOW Effective Date. Vendor shall adopt all applicable changes in Laws into Vendor’s business practices within timeframes required by the Laws or, if no time frame is required, within [***] of Vendor becoming aware of the Law. Vendor shall modify or revise its business practices as necessary to comply with changes in Laws, applicable state agency requirements, and applicable licensing requirements.

 

4.1.3

Data; Records; Archival. Vendor will securely store, transmit, and archive all raw and processed data files consistent with the requirements set forth in Exhibit E (Security) and Section 13 (Record Keeping and Audit) of the Agreement, respectively. Customer data must be archived for a period [***]. This data will be secured pursuant to Exhibit F (Security) of the Agreement and, when permitted under HIPAA and any applicable laws relating to the privacy of personal information, will be made available to Customer within [***] of receipt of a written request. For purposes of this SOW, “securely archived” means, with respect to electronic materials, such materials are encrypted consistent with NIST Special Publication 800-111, Guide to Storage Encryption Technologies for End User Devices.

 

4.1.4

Participant Relationship with Doctor. [***].

 

4.1.5

Use of Name

 

•

General. Notwithstanding anything to the contrary in Section 16 (Use of Name and Publicity) of the Agreement, Vendor may disclose that Customer is a client of Vendor only to the extent strictly necessary in order for Vendor to distribute, market, and perform the Services set forth in this SOW.

 

•

Clients. Unless otherwise set forth in writing by both Customer and Client, Vendor will not use the name or logo of any Client, or other identifying marks belonging to Client, in any context. The foregoing sentence will not preclude Vendor from using the names, logos, trademarks, trade names, or other marks of any Client when Vendor is contractually permitted to do so under an alternate agreement with such Client. Vendor may obtain Client’s written consent to use Client name and logos for Vendor’s internal marketing purposes, to include Vendor sales presentations. Vendor sales presentations will not be printed or distributed if they contain Client name and logos.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

4.2

Management of Services

 

4.2.1

Oversight. Vendor will use its best efforts to timely perform the Services, deliverables, quality control, and service level compliance. Vendor will maintain oversight of the personnel and Specialists performing Services to ensure they are performed in accordance with this SOW.

 

4.2.2

Quality Expertise.

 

•

Quality Assurance. Vendor will provide quality assurance services in its oversight of the Services and performance of the Services.

 

•

Quality Improvement. The parties acknowledge and understand that the Services may require improvements of any one or more individual components to improve the success of the Services and Services (i) offered by Vendor, or, more specifically, (ii) offered to Clients of Customer. Vendor agrees to cooperate with Customer, or any Client of Customer who receive Services hereunder, in an effort to continually improve the User experience and Services offered by Vendor. For purposes of example, Customer may suggest changes to the User experience, and if Vendor is agreeable to such Customer suggested changes, Vendor may voluntarily choose to implement, at its sole cost and expense, the suggestion made by Customer, unless such changes are documented in a SOW as Work Product of Customer.   Vendor will continually improve its design and delivery of the Services, including the Hosted Services.

 

4.2.3

Project Management.

 

•

Meetings. The Vendor Project Manager (“Vendor PM”) will participate in telephone conference meetings with Customer, for a mutually agreed upon period and frequency, to discuss project-specific deliverables, including, but not limited to, project-specific needs, data transfers, progress, specification interpretation, milestones, and collaborative resolution of data collection and/or performance issues.

 

•

Issue Notification; Resolution. In the event that an error occurs or an issue arises during the SOW Term regarding the Services or Client implementation hereunder (each, an “Issue”), the Vendor will notify Customer of the Issue within [ ***] from the time the Issue is identified. Vendor will work with Customer to determine best course of action to resolve the Issue, which Customer may approve in its sole discretion. Vendor will be liable for all costs associated with resolving such Issue, unless the Issue is directly attributed to Client or Customer.

 

•

Training. Vendor will provide training via webinar, or otherwise mutually agreed upon format, as may be customized by Vendor for the Services set forth in this SOW, to Customer (or its employees) regarding the Services, including the Services and Hosted Service, being offered under this SOW.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

4.2.4

Participant Experience.

 

•

Documentation. The parties have mutually agreed to certain Documentation, and will continue to mutually agree to Documentation that may be developed or determined to be necessary for the performance of Services over the SOW Term. Documentation will be incorporated in the performance of Services after Vendor has received written approval (email is sufficient) from Customer. As used herein, “Documentation” means all operating manuals, user manuals, training and marketing materials, templates, job aids, engagement processes, guides, product descriptions, product specifications, technical manuals, supporting materials, and other information relating to the Services provided by or on behalf of Vendor to Customer.

 

•

Language Requirements. Vendor will provide Services in English and such other languages and modes of communication as required by Customer. For purposes of clarification, this will include all Documentation, communication which may occur over the phone, and any verbiage on the Hosted Services. To overcome any Participant language barriers, Vendor will provide access to: (i) its bilingual employees, (ii) an over-the-phone translation service, via the Subcontractor set forth in this SOW, and (iii) other necessary modes of translation as may be agreed upon by the parties.

 

4.2.5

Time is of the Essence. Vendor acknowledges that time is of the essence in the performance of the Services set forth in this SOW. Therefore, if Customer believes, in good faith, that Vendor is not or will not be able to perform the Services in the manner and timelines prescribed, then Customer will notify Vendor, and if Vendor cannot provide Customer with reasonable assurances that, in Customer’s sole discretion, provide Customer with the comfort that the Services will be performed in the manner and timelines prescribed, then Customer may, notwithstanding anything to the contrary herein, engage another vendor to perform the Services.

 

4.3

Consultation Services.

 

4.3.1

Overview. Vendor shall provide Consultations, via video or telephonically, for Participants with Specialists as more fully described in this Section. Consultations are available for a range of medical conditions, currently covering each of the American Board of Medical Specialties and sub-specialties.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

4.3.2

Data.

 

•

Eligibility Data. [***], Customer or its designee will electronically transmit to Vendor via a mutually agreeable secure, electronic means an eligibility file containing the covered population of Members (the “Eligibility File”). Such Eligibility File will contain an accurate and complete file of Members associated with each Client [***] and will be provided in mutually agreed upon file format and data specifications as to be determined by the parties. If there are issues with Eligibility File, Vendor may agree to perform registration in advance of Customer providing an initial Eligibility File.

 

•

Notice of Termination of Benefits. In the event a Member is no longer eligible to participate in the Services, Customer or its designee will provide to Vendor a file denoting that such Member is no longer eligible for Services. For purposes of clarification, Vendor will perform Services in accordance with this SOW for Participants who initiated their Consultation prior to the date in which their benefits were terminated.

 

•

Data Acceptance. Each file will be deemed acceptable on the date when Vendor notifies Customer via email that each file was accepted, but not more than [***] after receipt.

 

4.3.3

Consultation.

 

•

Pre-Consultation. To obtain a Consultation, Member must have received a diagnosis, and/or treatment plan from a licensed medical practitioner, or remain undiagnosed after multiple visits to specialists, or be identified by Customer for Vendor’s targeted outreach efforts. Members shall access Vendor’s Services, as set forth below, by referral from a Customer program, calling a toll-free number [***], logging into the Landing Page (by entering the following information: [***]), engaging with Vendor following receipt of a communication from Vendor as part of Vendor’s targeted outreach, or using Vendor’s Mobile App (which is available once an account is created via the Vendor’s website). Member agrees to Participant Terms when activating membership through Vendor portal, and can unsubscribe to Vendor communications at any time. Once a Member completes the pre- consultation items set forth above, such Member becomes a Participant, at which time Vendor will make initial contact with the Member [***], including, if needed, making up to [***]. Participant will sign a release of information form when Vendor makes initial contact with the Member.

 

•

Consultation by Video or Phone. Participant may select a Specialist with the assistance of the Care Team from Vendor’s list of Specialists. At Participant’s request, Participant shares their medical background with the Care Team. At Participant’s request, the Care Team schedules a Consultation with the selected Specialist. The Participant may speak with a Specialist by secure video or phone.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

•

Consultation by Text. When available and as mutually agreed upon by the parties, Participant can text a question through the Vendor’s secure Mobile App and Vendor will provide a text response within [***]. The Participant can review the Care Team’s written response through eithereview the Care Team’s written response through either the Mobile App or through the website.r the Mobile App or through the website.

 

•

Consultation by Local In-Network Doctor. When available and as mutually agreed upon by the parties, Vendor shall provide the Participant with recommendations of local, in-network physicians, if requested by the Participant and shall transfer all pertinent medical records and a Consultation summary, as directed by the Participant. Vendor will use Participant’s location to locate a physician for the Participant’s needs, located within a [***] radius of the Participant’s home, or other radius as determined by the Participant.

 

•

Post-Consultation. Regardless of the mode of Consultation utilized by a Participant, Vendor will provide to Participant, [***] of their Consultation, a Consultation summary. The Consultation summary will include the written notes, health education information and recommendations from the Specialist. Participants can access the summary through the Member Portal or receive the summary via overnight mail. Within the Consultation summary, Vendor may, if mutually agreed upon by the parties, refer a Participant to Customer for further support or inquiries.

 

4.3.4

Medical Record Retrieval; Provider Communication

 

•

Generally. Vendor will ensure that its Care Team conduct themselves in a professional and respectful manner when in contact with providers (or their respective agents).

 

•

Provider Outreach. Vendor will begin retrieval of Participant’s medical records no later than [***] from receipt of written authorization of the Participant. Vendor will make as many outreach attempts as is necessary to obtain the applicable medical records for a Consultation. Vendor will ensure its record retrieval efforts include a verification process prior to the delivery (via fax, email or telephonically) of any and all PHI. Vendor shall be accountable for working with provider offices to determine the appropriate methods to retrieve medical records.

 

•

Medical Record Images. Vendor will store a Participant’s medical records within the Hosted Services, per the record keeping requirements set for the in Section 4.1.3 of this SOW and in accordance with HIPAA and Exhibit F (Security) of the Agreement.

 

•

Provider Questions. Vendor will provide a toll-free telephone helpline for providers who may have questions about the Consultation or Consultation procedures, including medical record retrieval. The helpline will be staffed during the hours from [***] during regular business days.

 

4.3.5

Vendor Care Team.

 

•

Roles and Responsibilities. Each Participant’s case shall be assigned to a Care Team case manager. A Care Team case manager will conduct the initial intake call with each Member and listen to the Participant’s medical concerns. The Care Team case manager will assist each Member throughout the Consultation process, including the creation of a Participant profile, the scheduling of an appropriate Specialist, and the retrieval and secure digitization of the Participant's medical records. Vendor’s post-session follow-up with Participant will include Consultation satisfaction ratings and effectiveness surveys as agreed to by Customer to evaluate the impact of the Consultation service.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

•

Response Time: Care Team case managers will support phone service from [***] during regular business days [***]. An answering message service will document all inbound calls during off-hours and deliver messages left by Participants to Vendor on the next business day. The automated attendant will allow the Participant to select ‘urgent’ or ‘non-urgent’. If Participant indicates that the call is urgent (and related to a Consultation or the Services), the Participant will have the opportunity to speak with a live nurse, including during off- hours. The Care Team will respond to all non-urgent Participant requests within [***]. The Care Team shall correspond with Participant digitally, telephonically, or both digitally and telephonically, per the Participant’s designated preferred method of communication. Vendor will endeavor to provide Participant available times for a Consultation with a Specialist within [***] on average after Participant completes their medical record release forms and selects a Specialist.

 

4.4

Training; Education.

 

4.4.1

Member Education. Vendor will educate Members who are Users about its services, via email, if and when provided permission to perform such education by Customer and Member.

 

4.4.2

Customer Training. During the SOW Term, Vendor will provide initial comprehensive training to Customer and, upon Customer request, provide incremental training to Customer in support of the Services throughout the SOW Term.

 

4.4.3

Client Training. During the SOW Term, if requested by Customer, Vendor will provide initial comprehensive training to Clients and, upon Customer request, provide incremental training to Clients in support of the Services throughout the term of such Client Contract.

 

4.5

Reporting. Vendor will provide, at a minimum, the following reports, in both PDF and Excel formats, to Customer and each Client (as set forth below) per a mutually agreed upon frequency, format and delivery method. Vendor will ensure Customer is able to download the following reports in both PDF and Excel formats when the following reports are made available via the Client Self Reporting Dashboard.

 

4.5.1

Telephony Reporting. Vendor will provide to Customer monthly, the following data per the calculations agreed upon by the parties:

 

(a)

[***]

(b)

[***]

(c)

[***]

 

4.5.2

Service Metric Reporting.

 

•

On Demand. Vendor will provide, at a minimum, the following metrics to Customer through the Client Self-Reporting Dashboard, at each of the following levels: Client and Optum book of business. The data in each report shall be delivered per the requirements mutually agreed upon by the parties.

 

(a)

[***]

(b)

[***]

(c)

[***]

(d)

[***]

(e)

[***]

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

•

Quarterly. Vendor will provide, at a minimum, the following metrics to Customer [***], at each of the following levels: Client and Optum book of business. The data in each report shall be delivered per the requirements mutually agreed upon by the parties.

 

(a)

[***]

(b)

[***]

(c)

[***]

(d)

[***]

(e)

[***]

 

4.5.3

Quality Reports. Vendor will also provide Customer with periodic reports [***]

 

4.5.4

regarding Vendor’s quality assurance and quality improvement activities (both more fully described in Section 4.2.2).

 

4.5.5

Regulatory Data and Reports. Vendor will provide reasonable cooperation to Customer in the generation of data and reports as may be required by local, state, or federal oversight agencies, including CMS. Such data and reporting shall be provided in a timely manner and in an electronic format mutually agreeable to the parties.

 

4.5.6

Client Data and Reports. Vendor will provide reasonable cooperation to Customer in the generation of data and reports as may be required by Clients of Customer. Such data and reporting shall be provided in a timely manner and in an electronic format mutually agreeable to the parties.

 

4.5.7

Ad Hoc Reports; Custom Reports. Vendor will provide reasonable cooperation to Customer in the generation of data and reports as may be required by Clients or, if applicable, regulatory oversight agencies. Such data and reporting shall be provided in a timely manner and in an electronic format mutually agreeable to the parties. If additional fees are to be incurred, the parties will mutually agree to such terms via an amendment to this SOW.

 

5.	PERSONNEL:

 

5.1

Generally. Vendor shall provide, without the advice, control, or supervision of Customer, an adequate number of staff, who are fully qualified and competent and, where applicable, who have all licenses required by applicable law to perform or deliver the Services.

 

5.2

Resource Management.

 

5.2.1

Constraints. Vendor represents and warrants that it will not perform all or a part of the Services hereunder using off-shore (i.e., non-United States located) resources unless Vendor has been specifically granted written consent to do so by Customer, which consent will not be unreasonably withheld or delayed.

 

5.2.2

Subcontracting.

 

•

Vendor will ensure that any subcontractors who perform any part of the Services are approved by UHS in accordance with the terms and conditions of the Agreement (hereinafter, “Approved Subcontractors”), and that such Approved Subcontractors abide by the terms and conditions of the Agreement and this SOW. Vendor is ultimately responsible to ensure that the Services subcontracted to Approved Subcontractors are performed in accordance with the Agreement and this SOW.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

•

Any changes to Approved Subcontractors will require prior written approval by Customer but will not require the Parties to enter into a written amendment to this SOW.

 

5.2.3

Account Management. Vendor will provide a named account manager (“Vendor AM”) to support Customer for the SOW Term. Vendor will provide Customer with reasonable access to the Vendor AM during normal business hours. The Vendor AM will promptly respond to Customer’ requests no later than [***] from the time of request and shall act in a manner that is consistent with commercially acceptable account management standards. If Vendor AM is unavailable for a period of [***], an alternate Vendor AM will be assigned.

 

5.2.4

Project Management. Vendor PM will be the single point of contact to Customer to answer general operational questions, address any issues related to the Services or the performance of the Services, and to provide any important operational updates. Vendor PM will promptly respond to Customer’s requests no later than [***] from the time of request. If Vendor PM is unavailable for a period of [***], an alternate Vendor PM will be assigned.

 

5.2.5

Specialists.

 

•

Warranty. Vendor represents and warrants that all personnel assigned to perform Services under this SOW shall have the proper skill, licensure, certification, training and background to be able to perform Services in a competent and professional manner, without the advice, control, or supervision of Customer.

 

•

Engagement. Vendor will maintain active training, support, and communication with Specialists in performance of Services in accordance with this SOW and the Agreement. Vendor will provide Specialists with one or more Vendor points of contact to train and support Specialists in performance of Services in accordance with the terms of this SOW. Vendor will ensure Specialists are familiar with the Services and System.

 

•

Oversight. Vendor is responsible to ensure that its Specialists perform the Services contracted to Specialists and comply with all applicable requirements in the Agreement in the SOW.

 

5.3

Training. Vendor will provide its staff, personnel, and Specialists with ongoing training in the proper procedures relative to performance of the Services, including, but not limited to, the obligations under HIPAA. Vendor will cause its personnel to follow and comply with all Customer written or otherwise documented standards, policies and guidelines, and, where applicable, methodologies, related to the performance of Services.

 

5.4

Professionalism. Vendor will cause its staff to conduct themselves in a professional and respectful manner, including, but not limited to, Exhibit G (Vendor Code of Conduct) of the Agreement, while performing the Services and otherwise in accordance with Laws, rules and regulations, including, but not limited to, HIPAA.

 

5.5

Key Personnel. Customer agrees that Vendor personnel performing the Services set forth in this SOW shall not be Key Vendor Personnel (as defined in the Agreement).

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

6.	HOSTED SERVICE:

 

6.1

Generally.

 

6.1.1

Viruses; Disabling Codes. Vendor warrants that the Hosted Service is tested against viruses, Trojan horses, worms, time bombs, cancelbots or other similar harmful devices that could disrupt or disable a computer system or any of its components and said Hosted Service contains no such devices, to the best of Vendor's knowledge based on such testing.

 

6.1.2

Advertising and Links to the Hosted Services. Vendor will ensure the Hosted Service does not include any third-party advertising, without Customer’s prior written consent, nor will Vendor establish, initiate or permit any hypertext links to or from the third party services without Customer’s prior written consent. Vendor will routinely ([***]) audit hypertext links to ensure that the links are working and that such content meets professional standards. Vendor shall provide to Customer a report on any findings and, if applicable, remediation efforts.

 

6.1.3

Web Analytics. Vendor shall not establish, initiate or permit any third-party site tagging (or similar web usage triggers, tracking or web analytics mechanisms) or hypertext links to or from the Hosted Services without Customer’s prior written consent. Vendor’s use of any third-party site tagging (or similar web usage triggers, tracking or web analytics mechanisms) or hypertext links to or from the Hosted Services will be governed by the Terms of Use, set forth in Exhibit A-3 attached hereto.

 

6.1.4

Subcontractor. Customer hereby acknowledges and agrees that the Platform is hosted on servers within the United States that are owned and operated by Amazon Web Services, Inc. Vendor warrants that it has entered into a Business Associate Agreement with Amazon Web Services, Inc., in accordance with Exhibit D of the Agreement.

 

6.2

Vendor Platform.

 

6.2.1

Services. Vendor will cause its software, website, and Mobile App (including all upgrades and improvements as they become available) to perform, throughout the SOW Term, the following core functions, which include the: Member registration, Consultation tracking, records management, User support, and reporting.

 

6.2.2

Availability. The website and Mobile App shall be available as set forth in Exhibit A-2 of this SOW, excluding limited periods of maintenance, or periods of emergency maintenance, internet-wide disruptions, Force Majeure Events, or attributable to the Participant’s software or hardware used to attempt access.

 

6.2.3

Connectivity. Vendor will ensure its Hosted Service is and will continue to be accessible through internet connectivity via the following devices: a smartphone (iOS or Android) or tablet or home computer with internet access (e.g., Internet Explorer, Chrome or Firefox). As between the parties, Customer, Client and Participant shall be responsible for procuring and maintaining the aforementioned devices and services, as required.

 

6.2.4

Service Levels. Vendor shall provide the Hosted Services in accordance with the service levels set forth on Exhibit A-2 of the SOW (the “Service Levels”). In the event that a Service Level has not been met, Vendor shall: [***]. In the event that the Hosted Services have not been provided in accordance with the applicable Service Levels, Customer shall receive the credits and payments from Vendor as identified in Exhibit A-2 of the SOW.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

6.3

Access and Use.

 

6.3.1

Grant. [***].

 

6.3.2

Authorized Use. In addition to the license grant set forth in this SOW, a Participant’s use of the Mobile App and receipt of the Services will be considered authorized use under such license grant. As it relates to Participants, Vendor is granting Customer a license in accordance for Participant’s personal use of the Mobile App and personal benefit of the Services.

 

6.4

Acceptance of Hosted Services. Vendor will afford Customer up to [***] to test the Hosted Services to determine whether they operate properly and in accordance with all specifications (the “Acceptance Criteria”). Such period of time will commence on the date of access to the Hosted Services (i.e., the SOW Effective Date). If, in Customer’s reasonable discretion, any Hosted Service does not meet the Acceptance Criteria, Customer will inform Vendor, and Vendor will at its own expense, correct all deficiencies identified by Customer within a reasonable period of time and until such time as the Hosted Service meets the Acceptance Criteria.   Customer will perform testing on the Hosted Service and any Client-specific landing page that provides Users access to the Hosted Service (for example, www.2nd.MD/Client).

 

6.5

Users.

 

6.5.1

Users of Customer. Customer or its designee will electronically transmit to Vendor a file containing the users of Customer for the purposes of testing the Services and accessing the secure web-based dashboard set forth in this SOW (the “Customer User File”). Such Customer User File will contain an accurate and complete database of Customer users, setting forth the following data elements: full name, email address, and phone number.

 

6.5.2

Participants as Users. Participants who create an account via the Hosted Services will be Users. When Participants are creating such account, Vendor will provide Participants with access credentials (and/or a mechanism that permits such Participant to specify access credentials), through their corresponding Client account.

 

6.6

User Support.

 

6.6.1

Customer Technical Support. Vendor will provide Customer with ongoing technical support (telephone, email and web-based) to employees of Customer. Customer will report problems to Vendor AM (or as otherwise directed) either by telephone or email. Vendor will provide Customer with technical support during the hours from [***] during regular business days. Vendor will use commercially reasonable efforts address reported technical issues within [***] of a report from Customer.

 

6.6.2

Client Technical Support. Vendor will provide Clients of Customer with ongoing technical support (telephone, email and web-based) to employees of Client. Vendor will provide Client with technical support during the hours from [***] during regular business days. Vendor will use commercially reasonable efforts address reported technical issues within [***] of a report from Client.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

6.6.3

Participant Technical Support. Vendor will provide first-line technical support to Participants. This support covers all non-health related software questions and questions that are specific to the Hosted Service (e.g., mobile app download & install support, product questions, and wireless issues). For the purposes of clarification, Vendor will provide non- technical questions (i.e., Consultation support) via the Care Team per the response time set forth in Section 4.3.5.2 of the SOW.

 

7.	Marketing.

 

7.1

Protocols for Business Development. The parties will utilize the below methods for marketing and distributing the Services to Clients and prospective clients. Vendor will work with Customer, as solely requested by Customer or Customer’s Client, as set forth in the subsections below.

 

7.1.1

Mutual Clients. [***].

 

7.1.2

Existing Clients or Prospects of Vendor. [***].

 

7.1.3

Existing Clients or Prospects of Optum. [***].

 

7.2

Information for Business Development.

 

7.2.1

General. Vendor shall offer to Customer, as may be requested by Customer throughout the SOW Term, information related to the Services being offered under this SOW, including, but not limited to, accessibility, Participant experience, and metrics.

 

7.2.2

Materials. Vendor will provide its logo(s), product name and product information (the “Source Materials”) to Customer, and Customer, in cooperation with Vendor, will create and produce co-branded marketing materials, for the purposes of (i) marketing the Services to Clients and (ii) providing product information to Members regarding the Service. Vendor hereby consents to Customer’s use of its Source Materials in accordance with the terms and conditions of this SOW.

 

7.2.3

Pricing. See Section 12.2.2 of this SOW for long term pricing requirements related to marketing of Vendor’s Services to Clients.

 

7.3

Client Management.

 

7.3.1

Ownership. Optum owns client relationships once the sales process is initiated, regardless of the originator of the opportunity, except when Vendor has an existing relationship with a client or Client, or when a client or Client requests a direct relationship with Vendor.

 

7.3.2

Meetings with Clients; Meetings with Potential Clients. Vendor will participate in meetings with Customer and proposed clients, or Customer and Clients, to discuss matters related to the Services, including, but not limited to, sales meetings, implementation strategy, and collaborative resolution related to any of the same. At the request of Customer, Vendor will participate in such meetings, which will be scheduled at a time as mutually agreed upon by the parties.

 

7.3.3

Pipeline Management. Vendor will provide to Customer a monthly pipeline report, delivered on the first Monday of each month, detailing the status of Clients in progress under this SOW and potential new clients which shall include, at minimum: the name of each Client or prospect client, estimated close and launch dates, number of employees, probability or stage of sale (the “monthly sales report”). The monthly sales report shall be regarded as Confidential Information for the purpose of this SOW.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

7.4

Notices. Notwithstanding anything to the contrary in Section 18 (Notices) of the Agreement, a copy of all notices regarding Clients shall be sent by Vendor, via email, to the following Customer contact: [***], or their designee.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

8.	CLIENT SERVICES:

 

8.1

Implementation.

 

8.1.1

Specifications. Vendor will work with the Client and Customer to design, implement, and launch the Services per the terms of this SOW and the Agreement.

 

8.1.2

Tasks. Vendor will perform the implementation activities necessary to establish its ability to accomplish the following for the Services set forth in this SOW: (i) accept all data, including, but not limited to, medical records and Participant data, required to perform the Services set forth in this SOW; (ii) create a landing page for Client; and, if necessary, (iii) expand their network of Specialists to include Client-requested areas of specialty. The activities set forth for an implementation of a Client shall be implemented by Vendor at the direction of Customer (the “Project Plan”).

 

8.1.3

Resources. Vendor will provide an adequate number of implementation resources with the expertise necessary to perform each Client’s implementation per the Project Plan.

 

8.1.4

Timeline. For each Client implementation, Vendor will perform the activities necessary to launch each Client by the date that is mutually agreed upon in the Project Plan.

 

8.1.5

Approval. Each Project Plan shall require the review and approval of Customer, which shall not be unreasonably withheld, and, where applicable, Customer’s Client.

 

8.2

Communication. The parties will work together to evaluate the need for joint marketing campaigns to promote new capabilities and target Members who may benefit the most from the Services. Vendor will make available to Customer best practices for all Client program launches through a digital engagement and marketing plan and soft launch for Client managers and other key personnel, management training and digital communications. In the event that Customer and Vendor agree that it would be mutually beneficial to implement an ongoing print communication strategy including Member ID cards, fliers, posters or other deliverables for onsite or U.S. mail promotion, Customer or Client may incur additional costs. Vendor shall not proceed with any print communication strategies which include additional costs without receiving prior written approval (email is sufficient) from Customer.

 

8.3

Branding. If requested by Client, Customer and Vendor will work together to develop specific branding requirements for such Client.

 

8.4

Toll Free Number. Vendor will provide, at no charge, an exclusive toll-free number for a designated Client, if requested by Customer or Client.

 

8.5

Metrics. Customer and Vendor will work together to determine success metrics for each Client, and will agree upon acceptable goals based upon use and adherence of Vendor best practices.

 

8.6

Landing Page. Vendor will create a unique branded URL (uniform resource locator) for the Users of each Client to access the Hosted Services (e.g., 2nd.MD/Client) and welcome the new Users (the “Landing Page”). Vendor will configure and brand the Landing Page for each Client using Vendor’s standard template and, at a minimum, both the Customer’s name and logo and the Client’s name and logo as provided by Customer.

 

9.	WORK PRODUCT/DELIVERABLES:

 

As a result of performing the Services under this SOW, Vendor will provide Customer with the Work Product (as defined under the Agreement) and deliverables set forth in the SOW, including, but not limited to:

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

A.

[***].

 

B.

[***].

 

C.

[***].

 

D.

[***].

 

10.

MILESTONES/DEADLINES:

 

Vendor will provide the Services, including the Hosted Services, in accordance with the timelines and deadlines set forth in this SOW or, as applicable, as mutually agreed upon in writing between Vendor and Customer; and in accordance with the implementation timelines and deadlines set forth for a Client by Customer or, as applicable to a Client, as mutually agreed upon in writing between Vendor and Customer and Client.

 

11.

PRIVACY POLICY AND TERMS OF USE:

 

Vendor will post, implement and comply with the Terms of Use, set forth in Exhibit A-3 of this SOW, and the Privacy Policy, set forth in Exhibit A-4 of this SOW, respectively (collectively, "Participant Terms"). In the event of any conflict or inconsistency between the terms set forth in the Agreement and the Participant Terms, the terms in this Agreement shall control as between Vendor and Customer.

 

12.

PERFORMANCE GUARANTEES:

 

12.1.1

The performance guarantees (“PGs”) outlined in Exhibit A-1(b) – Optum Clinical Program Performance Guarantee Summary have been agreed to by the Customer and Vendor. They will be in effect throughout the duration of this SOW. Performance Guarantees are only available for clients who meet the performance guarantee requirements outlined in Exhibit A-1(b). Cross carrier client populations are included in the performance guarantee calculation, only if the requirements are met.

12.1.2

[***].

12.1.3

[***].

 

13.

FEES:

 

13.1

Minimum Commitment. Customer does not guarantee Vendor or commit to Vendor any particular amount of Services under this SOW.

 

13.2

Service Fees.

 

13.2.1

Pricing. The pricing set forth in Exhibit A-1 (Pricing) of this SOW, attached hereto, is set forth for a period of [***] in order to market these Services to Clients and to cover any renewal of this scope of work. For the purposes of clarification, Customer may sell the Services to Client for equal to or above the pricing set forth in Exhibit A-1.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

13.3

Invoices

 

13.3.1

Delivery. Vendor will send invoices via the third party internet-based platform specified by Customer.

 

13.3.2

Schedule. Vendor will issue invoices in accordance with the terms set forth in Exhibit A-1 of this SOW and the Agreement.

 

13.3.3

Payment Terms. Customer will pay all invoices in accordance with the payment terms set forth in the Agreement.

 

13.4

Effect of Termination.

 

13.4.1

Services Fees. Upon termination of this SOW, Customer shall pay Vendor for all Service Fees due and payable as of the date of termination.

 

13.4.2

Timing. All payments due and payable under this Section will be paid in accordance with the payment terms in Section 2.3 (Invoicing and Payment) of the Agreement.

 

14.

TERM AND TERMINATION:

 

14.1

Term

 

This SOW will commence on the SOW Effective Date and remain in effect through December 31, 2020 (the “Initial Term”), unless earlier terminated as provided for in this SOW or in the Agreement. This SOW will [***] after the Initial Term. Thereafter, the parties may renew this SOW for another term with a mutually agreed upon amendment to this SOW.

 

14.2

Termination

 

This SOW may be terminated as provided for in the SOW or in the Agreement.

 

14.3

Additional Termination Rights of Customer

 

Customer may terminate all, or a portion of, this SOW immediately upon written notice to Vendor and with no liability to Vendor in the event that: (i) all Client Contracts related to this SOW are terminated or not renewed, (ii) following a judgment of a governmental authority or change in any applicable laws and regulations (including a change in the interpretation or enforcement of existing laws and regulations) that would make performance of this SOW, in all material respects, unlawful or illegal for Customer or (iii) in the event that a Client or governmental authority requires Customer to terminate the SOW.

 

15.

MISCELLANEOUS; ENTIRE AGREEMENT:

 

15.1

Client Contracts.

 

Vendor acknowledges that Customer has entered into a Client Contract, and pursuant to each Client Contract, Customer has passed through to Vendor all Flow Down Provisions. Vendor will comply with all applicable Flow Down Provisions as they relate to the Services set forth herein.

 

15.2

Customer Data License.

 

Customer grants to Vendor a non-exclusive, royalty-free, limited license to access and use Customer Data solely for the purpose of delivering the Services pursuant to this SOW and expressly subject to the limitations set forth in this Agreement. As used in this SOW, “Customer Data” shall also mean all data, information or other materials provided by Customer to Vendor and intended for use with the Services or stored or processed by Vendor as part of the Services. Customer Data is Confidential Information and Proprietary of Customer.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

15.3

Intellectual Property.

 

[***].

 

[***].

 

15.4

Counterparts

 

This SOW may be executed in one or more counterparts, each of which will be deemed to be an original copy of this SOW and all of which, when taken together, will be deemed to constitute one and the same instrument, and will become effective when there exists copies hereof (by facsimile or otherwise) which, when taken together, bear the authorized signatures of each of the parties.

 

15.5

Entire Agreement

 

The terms and conditions contained in this SOW constitute the parties’ complete understanding and agreement relating to the subject matter hereof. Notwithstanding anything to the contrary in the Agreement or elsewhere, in the event of a conflict between this SOW and the Agreement, the Agreement will control. No other terms and conditions, beyond those contained herein, will be valid unless mutually agreed to by Customer and Vendor in writing signed by authorized representatives of each party.

 

ACCEPTED AND AGREED:
UNITED HEALTHCARE SERVICES, INC.			INNOVATION SPECIALISTS, LLC d/b/a 2nd.MD
By:	/s/Peder D. Gustafson		By:	/s/Kristin Herrera
	(Authorized Signature)			(Authorized Signature)
Name:	Peder D. Gustafson		Name:	Kristin Herrera
	(Print or Type)			(Print or Type)
Title:	VP, Enterprise Sourcing & Procurement		Title:	Chief Growth Officer
Date:	12/17/2019		Date:	12/18/2019

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT A-1

PRICING

 

I.

Pricing for Clients sold Prior to March 1, 2019: Clients sold before March 1, 2019 will maintain their existing pricing arrangement until Client’s contract renewal. At that time, the Parties will present the pricing options for Pricing for Clients sold between January 1, 2020 through December 31, 2021 (Section III below). See Exhibit A-2 for grandfathered pricing details for Clients sold before March 1, 2019.

 

II.

Pricing effective March 1, 2019 through December 31, 2019:

 

a.

Customer and Vendor mutually agree to the following pricing for Clients not sold prior to March 1, 2019 during the period March 1, 2019 and December 31, 2019, with the following requirements:

·

Targeted Outreach for musculoskeletal conditions is implemented for existing and new clients as soon as approval to standardize is obtained by Customer’s development and release process.

b.

PMPM Option

i.

[***]:

1.[***]      [***]]      [***]

2.      [***]      [***]      [***]

3.      [***]      [***]      [***]

ii.

[***]

c.

[***]

i.

[***]

ii.

[***]

d.

[***]

e.

[***]

 

III.

Pricing effective January 1, 2020 through December 31, 2021 for all Clients not sold prior to March 1, 2019:

 

a.

Customer and Vendor mutually agree to the following pricing for Clients not sold prior to March 1, 2019 during the period January 1, 2020 and December 31, 2021, with the following requirements:

·

[***].

§

Pricing for Moderate Utilization is subject to change to pricing for Optimal Utilization in the next contract year if utilization [***] in the current contract year.

§

Client’s contract with UHC/UMR/Optum will include the following:

·

Pricing for Moderate Utilization is subject to change to pricing for Optimal Utilization in the next contract year if utilization [***] in the current contract year.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

UHC/UMR/Optum: Second Opinion Pricing – Moderate Utilization

(effective 1/1/20-12/31/21)

 

1/1/20-12/31/21	PMPM	Case Rate
Client Profile	Customers who	Customers who prefer
	prefer fixed monthly	utilization-based
	or embedded pricing	pricing
	and utilization is less
	than [***]
UHC/UMR/Optum 2,000-30K ee’s 30,001-60K ee’s	[***]	[***]
60,001+ ee’s
	[***]
	[***]
Implementation	n/a	[***]
Fee
Other Details	• [***] access to 2nd.MD consult services within each contract year. • [***]	• Pay for consults as they occur • Monthly invoices will be issued for cases that occurred in the prior month
Included in Pricing	• Expert medical consultations, Text-a-Clinician and Personalized Local Support. • Targeted Outreach • Customized engagement package for clients with [***]

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

UHC/UMR/Optum: Second Opinion Pricing – Optimal Utilization

(effective 1/1/20-12/31/21)

 

1/1/20-12/31/21	PMPM	Case Rate
Client Profile	Customers who	Customers who prefer
	prefer fixed monthly	utilization-based
	or embedded pricing	pricing
	and utilization is
	greater than [***]
UHC/UMR/Optum 2,000-30K ee’s 30,001-60K ee’s	[***]	[***]
60,001+ ee’s
	[***]
	[***]
Implementation	n/a	[***]
Fee
Other Details	• [***] access to 2nd.MD consult services within the contract year • [***]	• Pay for consults as they occur • Monthly invoices will be issued for cases that occurred in the prior month
Included in Pricing	• Expert medical consultations, Text-a-Clinician and Personalized Local Support. • Targeted Outreach • Customized engagement package for clients with over [***]

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT A-1(b) 
PERFORMANCE GUARANTEES

 

Optum Clinical Program Performance Guarantee Summary

 

Guarantee Terms & Conditions

 

·

These guarantees become effective on the later of the service implementation date or execution of an Administrative Services Only Agreement (or Amendment); in the event of early termination of this services agreement, all guarantees are void; performance guarantees shall not apply to contract renewals or extensions of [***].

·

Vendor shall not be required to meet any guarantee to the extent the guarantee’s failure is due to Customer or Client actions or inactions, including failure to execute agreed-upon communications or incentive strategies or failure to maintain [***] for those members identified for telephonic outreach (unless another level is specified by a specific guarantee). In the event the valid phone number rate is [***], the targets on all guaranteed measures will be scaled based on a percentage of the valid phone number target delivered. [***].

·

Fees at risk are waived in all cases where our performance failure is caused in whole or part by a Force Majeure event of by a labor dispute resulting in a strike; or Optum’s required compliance with any law, regulation, or governmental agency mandate; or anything beyond Optum’s reasonable control.

·

Prior to the end of the guarantee period, and provided that this agreement remains in force, Optum may specify to the client, in writing, new performance guarantees for the subsequent guarantee period. If new performance guarantees are specified, a new exhibit will be provided that replaces this exhibit for that subsequent guarantee period.

·

These guarantees can be revised should the services implemented vary from those quoted or agreed upon, an award is not made within [***] of submission of these proposed guarantees, communications or incentive strategies change from the information and descriptions provided to UHC at the time of this quote, or where covered members or average contract size (ACS) varies by more than [***]from assumptions used here of actives and pre-65 retiree members and ACS of respectively.

·

Results are measured and reported on a plan year basis unless otherwise indicated; results are rounded to the nearest whole number unless the target is specified with more precision. A [***] qualified members are required to provide measurement for any guarantee, although individual programs/guarantees may have additional higher thresholds. Performance guarantees that are not settled [***] of the completion of measurement are considered void.

·

Any penalties payable pursuant to this Exhibit shall be [***].

·

A variety of interventions and reporting mechanisms can be used to collect data and report against these PGs, including but not limited to IVR (interactive voice response), online survey tools and assessments, claims mining or other methodologies. Acceptance of these PGs includes client approval for any and all of these methods to be utilized without additional express or prior permission.

·

Client agrees that the penalties payable under this agreement are client’s sole remedies for such performance standards hereunder, and that failure to meet a performance standard for which a penalty has been paid or is payable shall not, by itself, constitute a terminable breach under the agreement.

·

Performance guarantees apply only when applicable to services provided and programs purchased during an entire measurement period.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Client Name: Contract Start Date: Contract End Date:

 

Metric	Definition	Guaranteed Result	Result Timeframe	% 2nd.MD Fees at Risk			Calculation	Terms and Conditions
				Year 1	Year 2	Year 3
Outcomes: Savings and ROI
ROI: 2nd.MD	Meet or exceed the targeted return on investment for the 2nd.MD program	[***]	[***]	[***]	[***]	[***]	[***].     [***].	*Requires the purchase of 2nd.MD program *PG requires a minimum of [***] *2nd.MD team has to be involved in implementation meetings and have a direct relationship with the client to help design and implement the communications program *Follow 2nd.MD’s communication plan and launch the communication [***] of the contract start date *Implementation of Targeted Outreach efforts or a [***] or greater incentive or penalty for musculoskeletal and other mutually agreeable high-impact conditions and properly communicate that incentive to employees *Incentives may include: *Positive incentive (cash awards, deductible credits, HSA contributions, plan design changes); *Punitive disincentives (e.g. copay or co-insurance for individuals not receiving a second opinion for defined conditions) *Payout: In the event of a shortfall in actual gross savings required to reach the ROI guaranteed above, Optum will pay down Client’s investment such that the Gross Savings delivered constitutes the agreed upon rate of return on the net investment after our payout, subject to the agreed to fees at risk.
							*Credible cost estimate providers may include but are not limited to: United Healthcare Healthcare Bluebook Up-to-date FH Consumers Cost Lookup GoodRx.com Health.Costhelper.com Howmuchisit.org Peer reviewed publications
Member	Percent of	[***]	[***]	[***]	[***]	[***]	[***]	*Related to 2nd.MD
Satisfaction	members						[***]	programs only
Guarantee	who complete a Consultation and would recommend 2nd.MD to a family member or friend.						[***]	*In the event that less than [***] survey responses are returned, the measure will be reported at the book of business level *Margin of error is added to the actual results in measuring against the target.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

A-2

SERVICE LEVELS

for Vendor’s Hosted Services

 

Section 1. General

 

The Service Levels referenced in Section 6.2.4 of the SOW are set forth in this Exhibit. This Exhibit describes the methodology pursuant to which Service Levels are implemented and Fee Reductions are calculated and paid by Vendor to Customer. The Service Levels are intended to measure how effectively the Hosted Services are provided to Customer. Vendor shall perform the Hosted Services in a manner consistent with the requirements of the SOW and the Service Levels. This Exhibit does not replace or supersede the specific requirements set forth in the SOW.

 

Section 2. Service Level Requirements

 

(A)            General. Vendor shall perform the Hosted Services in accordance with the Service Levels. Vendor’s compliance with the Service Levels shall be measured for each period set forth in the table in Section 5 (“Measurement Period”). With respect to those components of the Hosted Services for which a Service Level is not defined, Vendor shall perform such Hosted Services to standards satisfied by well-managed operations performing services similar to the Hosted Services.

 

(B)            Measurement. Vendor shall provide, implement, maintain and utilize the necessary measurement and monitoring tools and procedures, required to measure and report on Vendor’s performance of the Hosted Services against the applicable Service Levels. Such measurement and monitoring shall permit reporting at a level of detail sufficient to verify compliance with the Service Levels, and shall be subject to audit by Customer pursuant to Section 13 of the Agreement. Vendor shall provide Customer with information about and access to such procedures upon request for purposes of verification.

 

(C)            Reporting. Vendor shall provide Customer with monthly reports (each, a “Service Level Report”) with respect to Service Level performance in the preceding month by no later than [***] during the term of this SOW. Service Level Reports shall be in such form and have such content as is reasonably required for Customer to verify Vendor’s performance against the Service Levels. In no event shall the Service Level Report be deemed a substitute for compliance with independent notice requirements specified in the Agreement. The contents of Service Level Reports shall be Confidential Information of Customer.

 

(D)            Adjustments to Service Levels. The Parties expect and intend that the Hosted Services shall be improved over time during the term of the applicable SOW. Accordingly, Vendor shall propose reasonable improvements to the Hosted Services (with appropriate modifications to the applicable Service Levels) [***], commencing on the first anniversary of the SOW Effective Date. At a minimum, such improvements (and modifications to the applicable Service Levels) [***]. Such improvements shall not be implemented or become effective until agreed upon by the Parties in writing.

 

Section 3. Cooperation and Excused Performance

 

Section 3.1 Cooperation. In order to meet the Service Levels, Vendor may be required to coordinate its efforts with those of Vendor’s subcontractors or Customer’s subcontractors (collectively, “Third Party Vendors”). With respect to Service Level Defaults (as defined below) caused by Third Party Vendors, (A) Vendor shall provide a single point of contact for the management of the prompt resolution of such Service Level Defaults, and (B) Vendor’s failure to meet such Service Levels shall not be excused, and Vendor shall remain responsible for the performance of the Hosted Services in accordance with the Service Levels, except as set forth in Section 3.2.

 

Section 3.2 Excused Performance. To the extent that Vendor demonstrates to Customer’s reasonable satisfaction that any Service Level Default is directly attributable to (A) a breach of the Agreement by Customer or Client that prevents Vendor from meeting the applicable Service Level, or (B) acts or omissions of Customer, its Affiliates, or Clients or Customer subcontractors (other than Vendor), then such Service Level Default shall be excused, and no Fee Reduction shall accrue with respect to such Service Level Default, provided that, in each case, Vendor was not able to intervene and either alert Customer of the consequences of such acts or omissions or to take reasonable steps to avert such consequences.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Section 4. Fee Reductions

 

In the event that Vendor [***] any Service Level during an applicable Measurement Period (each such event, a “Service Level Default”), and such failure is not excused pursuant to Section 3.2, then Customer shall be entitled to receive a credit (“Fee Reduction”) as set forth in Section 5 and paid as set forth below. If Customer becomes entitled to a Fee Reduction, Vendor shall notify Customer of the applicable Service Level Default and the corresponding Fee Reduction, which notice shall be contained in the next Service Level Report. At any time [***] of Vendor’s notice of a Service Level Default, Customer may elect to claim the corresponding Fee Reduction by issuing a written notice to Vendor. If Customer does not elect, in writing, to waive or collect a Fee Reduction [***], Customer will be deemed to have elected to claim such Fee Reduction.

 

Customer’s notice of election to claim a Fee Reduction shall create a debt of Vendor to Customer, which shall be discharged by crediting the amount of the applicable Fee Reduction against Vendor’s next invoice(s) to Customer.

 

Section 5. Service Level Metrics

 

Section 5.1 Metrics. Service Levels, Measurement Periods, and Fee Reductions are set forth in the table below. To the extent necessary, Service Levels are further defined below.

 

Service Level	Definition & Metric	Measurement Period	Fee Reduction
Availability	See Section 5.2	[***]	· [***] · [***] · [***]
Transaction Response Time	[***], defined as the interval from the time the user sends a transaction to the time a visual confirmation of transaction completion is received. This metric shall not apply to the Client Self Reporting Dashboard.	[***]	[***]
Problem Resolution Time	See Section 5.3	[***]	See Section 5.3. The aggregate maximum Fee Reduction payable for this Service Level in any given month is [***] per Measurement Period.

 

Section 5.2 Availability. Vendor will make the Hosted Services Available continuously, as measured on a [***] basis over the course of each Measurement Period, [***], excluding unavailability caused by Exceptions (as defined below). “Available” means the Hosted Services are available for access and use by Customer in accordance with their full intended functionality. For purposes of calculating Availability percentage, the following are “Exceptions” to the Service Level required and the Hosted Services shall not be considered unavailable to the extent due to: (A) Customer, Client, or Participant’s acts or omissions, (B) Customer, Client, or Participant’s internet connectivity, or (C) Vendor’s regularly-scheduled downtime (which shall occur weekly, Sundays, from [***]).

 

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Section 5.3 Problem Resolution Time. The Service Level for problem resolution time measures the percentage of problems that Vendor resolves within the required timeframes, based on problem severity level (as defined in Section 5.4). For purposes of this Service Level, “resolve” means that the Hosted Services component impacted by the problem has been restored or that Vendor has put in place a suitable workaround, reasonably approved by Customer, that enables the Hosted Services to be provided as required under the applicable SOW and in accordance with other Service Levels.

 

Severity Level	Resolution Time	Fee Reduction
Urgent	[***]	If Vendor fails to meet the resolution time requirement [***], [***] per Measurement Period
High	[***]	If Vendor fails to meet the resolution time requirement [***], [***] per Measurement Period
Medium	[***]	If Vendor fails to meet the resolution time requirement [***], [***]  per Measurement Period
Low	As reasonably agreed by the Parties	N/A

 

Section 5.4 Severity Level Definitions.

 

Severity Level	Definition
Urgent	Highest priority. Used for when the end user is unable to access or use the Hosted Services or when significant and substantial adverse operational impact occurs preventing any useful work from being done.
High	Used when the end user’s production use of the Hosted Services is severely impaired or degraded preventing major functions from being performed.
Medium	Used when the end user’s production use of an important (but not critical or essential) function of the Hosted Services is disabled or impaired.
Low	Used for all other Hosted Services interruptions or inquiries. Indicates that the issue causes minor adverse impact to end user’s use of the Hosted Services.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT A-3
TERMS OF USE

for HOSTED SERVICES of VENDOR

 

Acceptance of Terms

 

This website, located at www.2nd.md ("Website"), is owned and operated by Innovation Specialists LLC (d/b/a 2nd.MD) ("2nd.MD").

 

This Website provides users with online access to Specialists who may provide health education to Members who have chosen to participate in this Service. 2nd.MD DOES NOT PROVIDE MEDICAL DIAGNOSIS, TREATMENT, OR PRESCRIPTION OF ANY KIND. ALL INFORMATION PROVIDED ON THIS WEBSITE OR IN CONNECTION WITH ANY COMMUNICATIONS SUPPORTED BY 2nd.MD, INCLUDING, WITHOUT LIMITATION, REAL-TIME VIDEO OR EMAIL COMMUNICATIONS BETWEEN PROFESSIONALS UTILIZING THE WEBSITE AND CONSUMERS IS INTENDED TO BE FOR GENERAL INFORMATIONAL AND HEALTH EDUCATION PURPOSES ONLY, AND IS IN NO WAY INTENDED TO CREATE A PHYSICIAN – PATIENT RELATIONSHIP AS DEFINED BY STATE AND FEDERAL LAW. 2nd.MD IS NOT A SUBSTITUTE FOR PROFESSIONAL MEDICAL DIAGNOSIS OR TREATMENT. RELIANCE ON ANY INFORMATION PROVIDED BY 2nd.MD OR ANY PROFESSIONALS THAT UTILIZE 2nd.MD AT THE INVITATION OF 2nd.MD IS SOLELY AT YOUR OWN RISK.

 

IF YOU THINK YOU MAY  HAVE A MEDICAL EMERGENCY, IMMEDIATELY CALL YOUR DOCTOR OR DIAL 911.

 

The Website also contains text, pictures, graphics, logos, button items, images, works of authorship, and other content (collectively with all information and material about 2nd.MD, "Content"). This Website is intended for use only by users who are at least 18 years of age.

 

PLEASE NOTE: Your access to and use of this Website are subject to these terms of use ("Terms of Use"), as well as all applicable laws and regulations. Please read these Terms of Use carefully. If you do not accept and agree to be bound by any of these Terms of Use, you are not authorized to access or otherwise use this Website or any information or Content contained on this Website. Your access to and use of this Website constitutes your acceptance of and agreement to abide by each of these terms and conditions set forth below. Unless otherwise indicated, any new Content added to this Website will also be subject to these Terms of Use effective upon the date of any such addition. You are encouraged to review the Website and these Terms of Use periodically for updates and changes.

 

If you have any questions about these Terms of Use, please contact us at feedback@2nd.md.

 

Independence of Specialists and Professionals - The specialists and professionals utilizing or featured on the Website site are subscribers and licensees to the Website and not employees. Any health education, opinions, advice, or information expressed by a professional or specialist utilizing or featured on the Website are of the professional and the professional alone. They do not reflect the opinions of 2nd.MD. 2nd.MD does not recommend or endorse any specific tests, physicians, products, procedures, opinions, or other information that may be mentioned on 2nd.MD or by a licensee of 2nd.MD.

 

The inclusion of professionals and specialists on the Website or in any professional directory located on the 2nd.MD Website does not imply recommendation or endorsement of such professional nor is such information intended as a tool for verifying the credentials, qualifications, or abilities of any professional contained therein. SUCH INFORMATION IS PROVIDED ON AN "AS-IS" BASIS AND 2nd.MD DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR PARTICULAR PURPOSE. 2nd.MD SHALL IN NO EVENT BE LIABLE TO YOU OR TO ANYONE FOR ANY DECISION MADE OR ACTION TAKEN BY ANY PARTY (INCLUDING, WITHOUT LIMITATION, ANY USER) IN RELIANCE ON INFORMATION ABOUT PROFESSIONALS AND SPECIALISTS ON THE WEBSITE. The use of the Website by any

 

entity or individual to verify the credentials of professionals or specialists is prohibited.

 

All opinions and statements expressed by a Specialist or Professional on this website and during any session facilitated through this Website are solely the individual and independent opinions and statements of the Specialist or Professional and do not reflect the opinions of 2nd.MD, its affiliates or any other organizations or institutions to which such Specialist or Professional is affiliated or provides services.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Password Accounts, Passwords, and Security - By registering on the Website, users of the Website ("Users") can receive access to the password-protected portions of the Website (the "User Portal"). When accessing the User Portal, you are entirely responsible for maintaining the confidentiality of your password and account and for any and all activities that occur under your account. You agree to (a)immediately notify 2nd.MD of any unauthorized use of your account or any other breach of security of which you become aware, and (b) exit completely from your account at the end of each online session. 2nd.MD will not be liable for any loss that you may incur as a result of someone else using your password or account, either with or without your knowledge. However, you could be held liable for losses incurred by 2nd.MD or another party due to someone else using your account or password if the use was caused or permitted by You. You may not use anyone else's account at any time, without the permission of the account holder.

 

Code of Conduct - Users may be asked to comply with a User code of conduct, which will consist of policies and procedures governing User conduct on the Website ("Code of Conduct"). Such Code of Conduct, once added to the Website, may be updated from time to time by 2nd.MD. The most recent Code of Conduct will be posted on the Website and any new material added to the Code of Conduct will be effective upon the date of publication on the Website.

 

Limited License and Site Access; All Rights Reserved - 2nd.MD hereby grants you a limited license to access and make personal use of this Website, but not to download (other than page caching) or modify it, or any portion of it, except with express written consent of 2nd.MD (e.g., downloading of PDF forms, applications, etc.). This license does not include any resale or commercial use of this Website or the Content; any derivative use of this Website or the Content; or any use of data mining, robots, or similar data gathering and extraction tools. This Website or any portion of this Website may not be reproduced, duplicated, copied, sold, resold, visited, or otherwise exploited for any commercial purpose without the express written consent of 2nd.MD. You may not frame or utilize framing techniques to enclose any trademark, logo, or other proprietary information (including images, text, page layout, or form) of 2nd.MD without 2nd.MD's express written consent. You may not use any meta-tags or any other "hidden text" utilizing any of 2nd.MD's name(s) or service marks without the express written consent of their owners. We (or the respective third party owners of Content) retain all right, title, and interest in this Website and any Content and features offered on this Website, including any and all intellectual property rights. We (or the respective third party owners of Content) reserve all rights not expressly granted herein. Any unauthorized use terminates the permission or license granted by 2nd.MD.

 

Copyright - Except as otherwise expressly stated, all Content appearing on this Website is the copyrighted work of 2nd.MD or its third party content suppliers and is protected by U.S. and international copyright laws. The compilation (meaning the collection, arrangement and assembly) of all Content is also the exclusive property of 2nd.MD or its third party content suppliers and is protected by U.S. and international copyright laws.

 

You may download information from this Website and print out a hard copy for your personal use provided that you keep intact and do not remove or alter any copyright or other notice (e.g., trademark, patent, etc.) contained in the information. Except as otherwise expressly stated herein, you may not alter, modify, copy, distribute (for compensation or otherwise), transmit, display, perform, reproduce, reuse, post, publish, license, frame, download, store for subsequent use, create derivative works from, transfer, or sell any information or Content obtained from this Website, in whole or in part, including any text, images, audio, and video in any manner, without the prior written authorization of 2nd.MD or any applicable third party suppliers. The use of Content, including images, by you, or anyone else authorized by you, is prohibited unless specifically permitted by 2nd.MD. Any unauthorized use of text or images may violate copyright laws, trademark laws, the laws of privacy and publicity, and applicable regulations and statutes. 2nd.MD does not warrant or represent that your use of Content or any other materials displayed on this Website will not infringe rights of third parties. Your use of any of the Content beyond the scope of personal use may require a license from the owner of the rights to the data with respect to the use of portrait right, trademark, copyright, design right, right of utilization or any other rights of the persons, products or landscape portrayed in the provided Content. 2nd.MD is not responsible for any claims of ownership rights to any images or data against you. You will indemnify, defend and hold harmless 2nd.MD from and against any losses or claims, by an owner of data or image rights or any third party resulting from any violation by You of these Terms of Use.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

If you believe that any Content on this Website violates or infringes upon your intellectual property rights pursuant to Title 17, United States Code, Section 512(c)(2), please notify us immediately at feedback@2nd.md with all specifics necessary for us to consider and respond to your complaint. You may be asked to provide additional information and follow additional procedures for us to act on your complaint.

 

Trademarks and Service Marks - Certain trademarks on the Website are the service marks and trademarks of 2nd.MD, the specialists, the professionals or other licensees of 2nd.MD or other third parties. The domain name for this Website, all page headers, custom graphics, and button icons are service marks, trademarks, logos, and/or trade dress of 2nd.MD. All other trademarks, service marks, trade dress, product names, company names or logos, whether registered or not, on the Website are the property of their respective owners. In addition to complying with all applicable laws, you agree that you will not use any such trademarks, service marks, trade dress, or other logos from this Website without the prior written authorization of 2nd.MD and/or other third parties which authorization may be withheld in such parties’ sole discretion.

 

Connection Requirements - You are responsible for providing and maintaining, at your own risk, option and expense, any hardware, software and communication lines required to access and use this Website, and 2nd.MD reserves the right to change the access configuration of this Website at any time without prior notice.

 

Prohibited Use - Any use or attempted use of this Website (i) for any unlawful, unauthorized, fraudulent or malicious purpose, or (ii) that could damage, disable, overburden, or impair any server, or the network(s) connected to any server, or (iii) interfere with any other party's use and enjoyment of the Website, or (iv) to gain unauthorized access to any other accounts, computer systems or networks connected to any server or systems through hacking, password mining or any other means, or (v) to access systems, data or information not intended by 2nd.MD to be made accessible to a user, or (vi) attempt to obtain any materials or information through any means not intentionally made available by 2nd.MD, or (vii) any use other than the business purpose for which it was intended, is prohibited.

 

In addition, in connection with your use of the Website, you agree you will not:

 

a) Upload or transmit any message, information, data, text, software or images, or other content ("Material") that is unlawful, harmful, threatening, abusive, harassing, tortious, defamatory, vulgar, obscene, libelous, or otherwise objectionable, or that may invade another's right of privacy or publicity;

 

b) Create a false identity for the purpose of misleading others or impersonate any person or entity, including, without limitation, any 2nd.MD representative, or falsely state or otherwise misrepresent your affiliation with a person                                                         or                                                              entity;

 

c) Upload or transmit any material that you do not have a right to reproduce, display or transmit under any law or under contractual or fiduciary relationships (such as nondisclosure agreements);

 

d) Upload files that contain viruses, trojan horses, worms, time bombs, cancel-bots, corrupted files, or any other similar software or programs that may damage the operation of another's computer or property of another;

 

e) Delete any author attributions, legal notices or proprietary designations or labels that you upload to any communication feature;

 

f) Use the Website's communication features in a manner that adversely affects the availability of its resources to other users (e.g., excessive shouting, use of all caps, or flooding continuous posting of repetitive text);

 

g) Upload or transmit any unsolicited advertising, promotional materials, "junk mail," "spam," "chain letters," "pyramid schemes" or any other form of solicitation, commercial or otherwise;

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

h)   Violate any applicable local, state, national or international law;

 

i)     Upload or transmit any material that infringes any patent, trademark, service mark, trade secret, copyright or other proprietary rights of any party;

 

j)    Delete or revise any material posted by any other person or entity;

 

k)    Manipulate or otherwise display the Website by using framing, mirroring or similar navigational technology or directly link to any portion of the Website other than the main homepage, www.2nd.md, in accordance with the Limited License and Site Access outlined above;

 

l)    Probe, scan, test the vulnerability of or breach the authentication measures of, this Website or any related networks or systems;

 

(m) Register, subscribe, attempt to register, attempt to subscribe, unsubscribe, or attempt to unsubscribe, any party for any services or any contests, promotions or sweepstakes if you are not expressly authorized by such party todo        so;

 

(n)  Harvest or otherwise collect information about others, including e-mail addresses; or

 

(o)  Use any robot, spider, scraper, or other automated or manual means to access this Website, or copy any content or information on this Website. 2nd.MD reserves the right to take whatever lawful actions it may deem appropriate in response to actual or suspected violations of the foregoing, including, without limitation, the suspension or termination of the user's access and/or account. 2nd.MD may cooperate with legal authorities and/or third parties in the investigation of any suspected or alleged crime or civil wrong. Except as may be expressly limited by the Privacy Policy, 2nd.MD reserves the right at all times to disclose any information as required by Law after first giving you the opportunity to seek a protective order or motion to quash, unless prohibited by law.

 

Right to Monitor - 2nd.MD neither actively monitors general use of this Website under normal circumstances nor exercises editorial control over the content of any third party's website, e-mail transmission, news group, or other material created or accessible over or through this Website. However, 2nd.MD does reserve the right to monitor such use at any time as it deems appropriate and to remove any materials that, in 2nd.MD's sole discretion, may be illegal, may subject 2nd.MD or other third party to liability, may violate these Terms of Use, or are, in the sole discretion of 2nd.MD, inconsistent with 2nd.MD's purpose for this Website.

 

No 2nd.MD Editorial Control of Third Party Content; No Statement as to Accuracy - To the extent that any of the Content included in the Website is provided by third party content providers or other Website users, 2nd.MD has no editorial control or responsibility over such Content. Therefore, any opinions, statements, products, services or other information expressed or made available by third party suppliers or users on this Website are those of such third party suppliers or users, respectively. 2nd.MD does not represent or endorse the accuracy or reliability of any opinion, statement or other information provided by any third party, or represent or warrant that your use of the Content displayed on this Website or referenced content or service providers will not infringe rights of third parties not owned by or affiliated with 2nd.MD.

 

Links to Third Party Websites - This Website may contain hyperlinks to other sites owned and operated by parties other than 2nd.MD. Such hyperlinks are provided only for ready reference and ease of use. We do not control such websites and cannot be held responsible for their content or accuracy and do not endorse these sites unless we specifically so state. In the event this Website provides hyperlinks to other websites that are not owned, operated or maintained by 2nd.MD, you acknowledge and agree that 2nd.MD is not responsible for and is not liable for the content, products, services or other materials on or available from such websites. We accept no liability for any information, products, advertisements, content, services or software accessible through these third party websites or for any action you may take as a result of linking to any such website. Any such websites are likely to set forth specific terms of use and privacy policies that you should review. 2nd.MD is under no obligation to maintain any link on this Website and may remove a link at any time in its sole discretion for any reason whatsoever. 2nd.MD shall not be responsible or liable, directly or indirectly, for any damages or losses caused or alleged to be caused by or in connection with the use of or reliance on such content, products, services or other materials available on or through any such website. 2nd.MD is not responsible for the privacy practices of any other websites.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Disclaimer - Content and other information contained on this Website has been prepared by 2nd.MD as a convenience to its users and is not intended to constitute advice or recommendations upon which a user may rely. 2nd.MD has used reasonable efforts in collecting, preparing and providing quality information and material, but makes no warranty or guarantee about the accuracy, completeness, or adequacy of the Content or other information contained in or linked to this Website or any other Website maintained by 2nd.MD. Users relying on Content or other information from this Website do so at their own risk.

 

THE 2nd.MD WEBSITE IS PROVIDED ON AN "AS IS" OR "AS AVAILABLE" BASIS. 2nd.MD AND ITS LICENSEES (INCLUDING THE SPECIALISTS AND PROFESSIONALS UTILIZING THE WEBSITE), TO THE FULLEST EXTENT PERMITTED BY LAW, DISCLAIM ALL WARRANTIES AND CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY, NON- INFRINGEMENT OF THIRD PARTIES' RIGHTS, SATISFACTORY QUALITY AND FITNESS FOR PARTICULAR PURPOSE. 2nd.MD MAKES NO WARRANTY THAT THE CONTENT IS ACCURATE, TIMELY, UNINTERRUPTED, VIRUS- FREE OR ERROR-FREE, OR THAT ANY SUCH PROBLEMS WILL BE CORRECTED.

 

Limitation of Liability

 

IN NO EVENT SHALL 2nd.MD, ITS LICENSEES (INCLUDING THE SPECIALISTS AND PROFESSIONALS UTILIZING THE WEBSITE), OR ANY THIRD PARTIES MENTIONED ON THE WEBSITE BE LIABLE FOR ANY DAMAGES (INCLUDING, WITHOUT LIMITATION, INCIDENTAL AND CONSEQUENTIAL DAMAGES, PERSONAL INJURY/WRONGFUL DEATH, LOST PROFITS, OR DAMAGES RESULTING FROM LOST DATA OR BUSINESS INTERRUPTION) RESULTING FROM THE USE OF OR INABILITY TO USE THE WEBSITE, WHETHER BASED ON WARRANTY, CONTRACT, TORT, OR ANY OTHER LEGAL THEORY, AND WHETHER OR NOT 2nd.MD ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 2NDMD, ITS LICENSEES (INCLUDING THE SPECIALISTS AND PROFESSIONALS UTILIZING THE WEBSITE), OR ANY THIRD PARTIES MENTIONED ON THE WEBSITE SHALL BE LIABLE ONLY TO THE EXTENT OF ACTUAL DAMAGES INCURRED BY YOU, NOT TO EXCEED U.S. $1,000. 2nd.MD, ITS LICENSEES (INCLUDING THE SPECIALISTS AND PROFESSIONALS UTILIZING THE WEBSITE), OR ANY THIRD PARTIES MENTIONED ON THE WEBSITE ARE NOT LIABLE FOR ANY PERSONAL INJURY, INCLUDING DEATH, CAUSED BY YOUR USE OR MISUSE OF THE WEBSITE. ANY CLAIMS ARISING IN CONNECTION WITH YOUR USE OF THE WEBSITE MUST BE BROUGHT WITHIN ONE (1) YEAR OF THE DATE OF THE EVENT GIVING RISE TO SUCH ACTION OCCURRED. YOU UNDERSTAND AND AGREE THAT YOUR USE OF THE WEBSITE IS PREDICATED UPON YOUR WAIVER OF ANY RIGHT TO PARTICIPATE IN A CLASS ACTION SUIT FOR ANY LOSSES OR DAMAGES RESULTING FROM YOUR USE OF THE WEBSITE.

 

CERTAIN STATE LAWS DO NOT ALLOW LIMITATIONS ON IMPLIED WARRANTIES OR THE EXCLUSION OR LIMITATION OF CERTAIN DAMAGES. IF THESE LAWS APPLY TO YOU, SOME OR ALL OF THE ABOVE DISCLAIMERS, EXCLUSIONS, OR LIMITATIONS MAY NOT APPLY TO YOU, AND YOU MIGHT HAVE ADDITIONAL RIGHTS.

 

Notices - Any notices to you from 2nd.MD regarding the Website or these Terms of Use will be posted on this Website or made by e-mail or regular mail.

 

Electronic Communications - When you visit this Website or send e-mails to us, you are communicating with us electronically. You consent to receive communications from us electronically. We will communicate with you by e- mail or by posting notices on this Website. You agree that all agreements, notices, disclosures and other communications that we provide to you electronically satisfy any legal requirement that such communications be in writing. You further agree that any notices provided by us electronically are deemed to be given and received on the date we transmit any such electronic communication as described in these Terms of Use.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

General Provisions

 

Entire Agreement - These Terms of Use, the Contract, and other policies 2nd.MD may post on this Website constitute the entire agreement between 2nd.MD and you in connection with your use of this Website including, without limitation, the User Portal, and supersedes any prior agreements between 2nd.MD and you regarding use of this Website, including prior versions of these Terms of Use.

 

Governing Law; Severability of Provisions - The Terms of Use are governed by the laws of the State of Texas, USA and controlling United States Federal Law without regard to any conflicts of law provisions. All parts of these Terms of Use apply to the maximum extent permitted by law. We both agree that if we cannot enforce a part of this contract as written, then that part will be replaced with terms that most closely match the intent of the part we cannot enforce to the extent permitted by law. The invalidity of part of these Terms of Use will not affect the validity and enforceability of the remaining provisions. The section headings are for convenience and do not have any       force                                                              or                                                  effect.

 

No Agency Relationship - Neither these Terms of Use, nor any Content, materials or features of this Website create any partnership, joint venture, employment, or other agency relationship between us. You may not enter into any contract on our behalf or bind us in any way.

 

Remedies - You agree that any violation, or threatened violation, by you of these Terms of Use constitutes an unlawful and unfair business practice that will cause us irreparable and unquantifiable harm. You also agree that monetary damages would be inadequate for such harm and consent to our obtaining any injunctive or equitable relief that we deem necessary or appropriate. These remedies are in addition to any other remedies we may have at law or in equity.

 

Contacting Us – If you have any questions or concerns about these Terms of Use, please contact us at support@2nd.md. We will attempt to respond to your questions or concerns promptly after we receive them.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT A-4
PRIVACY POLICY

for HOSTED SERVICES of VENDOR

 

Introduction

 

2nd.MD is committed to respecting the privacy rights of our customers, visitors, doctors and other users of 2nd.MD's services.

 

Website Privacy Policy

 

The management and staff of Innovation Specialists LLC "2nd.MD" are committed to maintaining the confidentiality of non-public, personal information we collect from individuals who visit our website. We want you to understand how and why we collect, use and disclose the personal information about you on our website. This Website Privacy Policy ("Policy") provides you with information concerning our practices and procedures as they relate specifically to information we collect at this website. If you have additional questions or would like further information on this topic, please feel free to write to us at legal@2nd.MD. We may update this Policy from time to time, so please check this Policy periodically for changes. This Privacy Policy applies to this website and does not apply to any other products or services or to information collected in any other way (whether offline or online) by Innovation Specialists or its partnering entities.

 

Personal Information We Collect and Use at this Website

 

When you request information, subscribe to a mailing list or for a service or respond to an online survey, we may collect your personal information. We define "personal information" as information that is unique to you and might include your name, e-mail address(es), mailing address(es), telephone number and certain information related to the business you represent such as number of employees and industry type. If you encounter a screen or page that requests information you do not want to share with us, do not enter the information and do not proceed with that screen or page. If your personal information is required in order to allow us to respond to your inquiry, you will receive a notice advising you of this. In each such instance, you will know what personal information we collect through the website, because you actively submit it.

 

If you do provide us with personal information, we will only use it for the purposes described where it is collected, and we will not sell, license, transmit or disclose this information outside of Innovation Specialists or its partnering entities unless (1) you expressly authorize us to do so, (2) it is necessary to allow our service providers, partnering entities or agents to provide services for us or for you, (3) in order to provide our products or services or those of our partnering entities to you, (4) it is disclosed to entities that perform marketing services on our behalf or to other entities with whom we have joint marketing agreements, (5) it is necessary in connection with a sale of all or substantially all of the assets of Innovation Specialists or the merger of Innovation Specialists into another entity or any consolidation, equity exchange, combination, reorganization, or like transaction in which Innovation Specialists is not the survivor, or (6) otherwise as we are required or permitted by law.

 

If you are a California resident, you may ask us to refrain from sharing your information (whether collected online or offline) with third parties for their marketing purposes. Please tell us your preference by contacting us as indicated in the "How to Contact Us" section of this Policy.

 

Email

 

We appreciate your questions and comments about our website and services and welcome your email messages to mailboxes listed on our website. We will share your messages with those within our organization who are most capable of addressing the issues contained in your message. We will keep a copy of your message until we have had an opportunity to address your concerns. We may archive your message for a certain period of time or discard it, but your email address will not be used for any other purpose.

 

Confidentiality and Security Measures

 

We restrict access to personal information collected about you at our website to our employees or others who need to know that information to provide services to you or in the course of conducting our normal business operations. While no website can guarantee security, we maintain appropriate physical, electronic, and procedural safeguards to protect your personal information collected via the website. We protect our databases with various physical, technical and procedural measures and we restrict access to your information by unauthorized persons. We also advise all Innovation Specialists employees about their responsibility to protect customer data and we provide them with appropriate guidelines for adhering to our company's business ethics standards and confidentiality policies.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

We respect our current and former customers' privacy and we value your business.

 

Innovation Specialists will comply with applicable HIPAA Security and HITECH requirements to develop, document, implement, maintain and use reasonable administrative, technical and physical safeguards to preserve the integrity, availability and confidentiality of Protected Health Information created for or received from "covered entities" as defined under HIPAA.

 

Use of "Cookies" or Other Data Collection Tools

 

A cookie is a piece of information which a web server may place on your computer when you visit a website. Cookies are commonly used by websites to improve the user experience and have not been known to transmit computer viruses or otherwise harm your computer. Many cookies last only through a single website session, or visit. Others may have an expiration date, or may remain on your computer until you delete them.

 

We may use cookies for a number of purposes - for example, to maintain continuity during a user session, to gather data about the usage of our website for research and other purposes, to store your preferences for certain kinds of information and marketing offers, or to store a user name or encrypted identification number so that you do not have to provide this information every time you return to our website.

 

Our cookies will track only your activity relating to your online activity on this website, and will not track your other Internet activity. Our cookies do not gather personally identifiable information.

 

You can decide if and how your computer will accept a cookie by configuring your preferences or options in your browser. However, if you choose to reject cookies, you may not be able to use certain of our online products and services or website features.

 

We may occasionally use other companies to set cookies on our website and gather cookie information for us. In some cases, we may also use another company to operate web servers for our website. We use the cookie information gathered by these companies in the same manner as stated above.

 

In addition to the information we collect from cookies, we also obtain information which you provide to us online - for example, when you sign up for product updates or when you purchase products or otherwise communicate with us. In some cases, we retain both the cookie information and/or the information you provide to us online - for example, to complete a transaction you requested or to keep historical records of your past transactions. In other cases, we only retain the cookie and/or online information you give us if you request us to do so for your use in subsequent sessions.

 

Certain pages on our websites contain "web beacons" (also know as Internet tags, pixel tags and clear GIFs). These web beacons allow third parties to obtain information such as the IP address of the computer that downloaded the page on which the beacon appears, the URL of the page on which the beacon appears, the time the page containing the beacon was viewed, the type of browser used to view the page, and the information in cookies set by          the                                                  third                                      party.

 

An Internet Protocol ("IP") address is a unique identifier that certain electronic devices use to identify and communicate with each other on the Internet. When you visit our website, we may view the IP address (which may include the city, domain address and service provider) of the device you use to connect to the Internet. We use this information to determine the general physical location of the device and understand from what regions of the world our website visitors come. We also may use this information to enhance our website.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

Opt-Out

 

In connection with promotions or other projects, we may ask you specifically whether you have objections with respect to a certain kind of data use or sharing. If you opt-out under such circumstances, we will respect your decision. To opt out of receiving commercial communications, please click on the "opt-out" or "unsubscribe" link in the communication or please contact us at legal@2nd.MD. Your e-mail address will be removed from our marketing list. Please allow us a reasonable period of time in order to satisfy your request, as some promotions may already be in process.

 

Access

 

If personal information you have submitted through the website is no longer accurate, current, or complete, and you wish to update it, please send an e-mail to legal@2nd.MD. Upon appropriate request we will usually be glad to update or amend your information, but we reserve the right to use information obtained previously to verify your identity or take other actions that we believe are appropriate and lawful.

 

Links to other Websites

 

For your convenience we may provide links to other websites and web pages that we do not control. We cannot be responsible for the privacy practices of any websites or pages not under our control and we do not endorse any of these websites or pages, the services or products described or offered on such sites or pages, or any of the content contained on those sites or pages.

 

Visiting our Site from Outside of the United States

 

If you are visiting our site from outside the United States, please be aware that your information may be transferred to, stored or processed in the United States, where our central database is operated. The data protection and other laws of the United States and other countries might not be as comprehensive as those in your country, but please be assured that we take steps to protect your privacy.

 

Changes to Our Website Privacy Policy

 

We may change this Policy at any time and from time to time. The most recent version of the Policy is reflected by the version date located at the bottom of this Policy. This Policy is not intended to and does not create any contractual or other legal right in or on behalf of any party.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

EXHIBIT A-5
UHCGS

 

PREAMBLE

 

WHEREAS UnitedHealthcare Global Solutions provides certain network access and claims administrations services to foreign insurers and administrators around the world who provide insurance or administrative services to individuals who may receive medical treatment while they are in the U.S.;

 

WHEREAS UnitedHealthcare Global Solutions seeks to offer Vendor’s Services to its clients’ Members, who may be physically located in the U.S. or outside of the U.S. when accessing Vendor’s Services;

 

WHEREAS Vendor is willing to provide such Services in accordance with the terms set forth in the Agreement, this SOW and the additional terms and conditions set forth hereunder.

 

NOW, THEREFORE, in consideration of the mutual promises and covenants contained herein, Vendor and Customer agree as follows:

 

This Exhibit A-5 addresses key operational differences pertaining to Customer’s Client, UnitedHealthcare Global Solutions’ U.S. Networks and Administrative Services business (“UHCGS”), and the clients of UHCGS.

 

1.            For the purposes of the Services provided to UHCGS, “Member” means an individual who has been pre- screened and pre-authorized by UHCGS and who may receive Services pursuant to the terms of a Client Contract. Prior to providing any Services for a UHCGS Member or Participant, Vendor must seek written confirmation from UHCGS that the Member or Participant has been pre-screened and pre-authorized by UHCGS to receive Services. If a Participant seeks to access the Services again after the initial or any subsequent Consultation, Vendor may not provide any Services to that Participant unless and until that Participant has been re-screened and re-authorized by UHCGS in each instance (screening of Members by UHCGS will include, but not be limited to screening to ensure compliance with U.S. Treasury Department Office of Foreign Assets Control (“OFAC”) requirements and approval of fees by UHCGS’s Client).

 

2.            Notwithstanding Section 3.3 (Supplementary Services) of the SOW, Vendor will not provide any Supplementary Services except implementation of the Services and technical support for UHCGS and its clients.

 

3.            Notwithstanding Section 4.1.5 (Use of Name) of the SOW, Vendor may not use UHCGS’s name or marks or the name or marks of UHCGS clients except as strictly necessary in order for Vendor to perform the Services set forth in the SOW or as otherwise agreed by UHCGS in writing. Vendor may not market or distribute sales or services material or to otherwise communicate with UHCGS clients or Members unless a Consultation has been initiated by UHCGS.

 

4.            Notwithstanding Section 4.3.2 (Data) of the SOW, UHCGS will not send eligibility data to Vendor. Instead, UHCGS will nominate pre-screened and pre-authorized individuals to receive Services from Vendor on a case-by- case basis.

 

5.            Notwithstanding Section 4.3.3 (Consultation) of the SOW, UHCGS will initiate all Consultations by nominating eligible UHCGS Members and providing the Member information directly to Vendor. Vendor will not direct UHCGS Members to a local, in-network provider. Instead, Vendor will transfer the UHCGS Member back to UHCGS for assistance in finding an appropriate provider. Prior to providing any Services for a UHCGS Member or Participant, Vendor must seek written confirmation from UHCGS that the Member or Participant has been pre- screened and pre-authorized to receive Services. If a Participant seeks to access the Services again after the initial or any subsequent Consultation, Vendor may not provide any Services to that Participant unless and until that Participant has been re-screened and re-authorized by UHCGS in each instance.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

6.            Notwithstanding Section 4.4.1 (Member Education) of the SOW, Vendor will not perform any outreach whatsoever to UHCGS Clients or their Members or Participants unless a Consultation has been initiated by UHCGS.

 

7.            Notwithstanding Section 7.1 (Protocols for Business Development) and Section 7.3.3 (Pipeline Management) of the SOW, UHCGS will not exchange UHCGS client or prospect information with Vendor, nor will UHCGS modify any sales or marketing activities pursuant to the terms of this SOW.

 

8.            Notwithstanding Section 7.3.2 (Meetings with Clients, Meeting with Potential Clients) of the SOW, Vendor will participate in meetings with UHCGS and UHCGS’s proposed clients only at the request of UHCGS.

 

9.            Notwithstanding the various pricing options set forth in Exhibit A-1 (Pricing) of the SOW, Vendor will charge Customer a Case Rate per Consultation plus any charges for translation services for UHCGS client Consultations. Pricing for Services for UHCGS will not be contingent upon UHCGS’s participation in any targeted outreach programs, minimum utilization or volume targets or monthly pricing. Pricing shall be as follows:

 

Item	Cost	Notes
Consultation Case Rate	[***]	·      Case rate does not include Text-A-Specialist. ·      If translation services are needed during the Consultation, additional fees may apply. ·      UHCGS, Customer and Vendor have agreed to revisit Case Rate if translation services are needed for majority of cases. ·      If Participant fails to provide notice of cancellation or change [***] of the scheduled Consultation time, Vendor may bill UHCGS the case rate for the missed Consultation.
Implementation fee (one time fee)	[***]	·      Includes: ○    Configuration of Vendor's platform to accept UHCGS cases. ○    Development and configuration of UHCGS client reports. ○    Training support for UHCGS account teams and other teams as necessary to explain value of Vendor services to clients. ○    Development of customer-facing materials including a one-page flyer and delivery of client webinars.
Translation Services	[***]	·      If translation services are needed for medical records collection or written consultation summary, UHCGS will be billed at [***].
Development of an Eligibility Feed	[***]	·      UHCGS does not currently need any eligibility feed. If, in the future, Vendor will develop an eligibility feed with a higher frequency than monthly, there will be a fee for development.

 

10.          Vendor agrees to perform Services in accordance with all applicable laws, which may include U.S. and non-U.S. laws and may vary depending upon the physical location of the Member or Participant when the Services are performed. Applicable laws may include, but are not limited to, all applicable sanctions laws, export control laws and laws governing the Services in the jurisdiction in which the Member or Participant is physically located.

 

 

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

 

11.          Vendor represents and warrants that: (a) it is a duly organized and validly existing legal entity in good standing under the laws of its jurisdiction of organization; (b) it has all requisite corporate power and authority to conduct its business as presently conducted, and to execute, deliver and perform its obligations under this Agreement; and (c) it shall comply with all applicable laws and regulations, including without limitation obtaining and holding all registrations, permits, licenses, and other approvals and consents and making all filings required to conduct its business as presently conducted and to enter into and perform its obligations under this Agreement.

 

12.          Vendor agrees that it shall not cause through its actions or omissions, in whole or in part, UHCGS to be in violation of applicable laws and regulations, including without limitation the U.S. Foreign Corrupt Practices Act (15 U.S.C. Sections 78dd-1 et seq.), U.S. Anti-boycott laws (15 CFR Part 760 et seq.) and Office of Foreign Asset Control statutes and regulations (31 C.F.R. Chapter V).

 

 

Exhibit 23.1

 

Consent of Independent Registered Public Accounting Firm

 

The Board of Directors

Accolade, Inc.:

 

We consent to the use of our report dated June 16, 2020, with respect to the consolidated balance sheets of Accolade, Inc. as of February 28, 2019 and February 29, 2020, and the related consolidated statements of operations, convertible preferred stock and stockholders’ deficit, and cash flows for the years then ended, and the related notes included herein and to the reference to our firm under the heading “Experts” in the prospectus.

 

/s/ KPMG LLP

 

Philadelphia, Pennsylvania

April 1, 2021