Master Services Agreement Agreement Effective Date: Month __, 2020 Customer Information Company Name: Contact Person: Address: Contact Email: This Master Services Agreement (collectively with all Work Orders (as defined herein) or written amendments entered into between the Parties, the “Agreement”) is entered into between the Customer referred to above and Intraprise Health, LLC, which has its principal place of business at 19 W College Avenue, Yardley, PA 19067. Intraprise Health and Customer (each a “Party” and collectively the “Parties”) hereby agree that from time to time during the term of this Agreement, Intraprise Health will provide certain consulting services (“Services”) as set forth in written and signed statement of works between the Parties (each a “Work Order” or “WO”) and Fees and Payment Terms, if any, which are attached hereto and incorporated herein by reference. This Agreement and all Work Orders entered into between Intraprise Health and Customer shall be subject to Intraprise Health’s Standard Terms and Conditions, attached hereto and incorporated herein as Exhibit B. Intraprise Health and Customer agree be bound to the terms of this Agreement, which they have caused to be duly executed as of the day and year first written above (the “Effective Date”). Intraprise Health, LLC Customer: By: By: Name: Name: Title: Title: Date: Date: Exhibit B Standard Terms and Conditions These Standard Terms and Conditions are part of and are incorporated into the Agreement between Parties. Any capitalized term not otherwise defined herein shall have the meaning specified in the Agreement. Limited Warranty. Intraprise Health warrants that the Services will be performed in a professional and workmanlike manner. In the event of a breach of the foregoing warranty, Intraprise Health’s entire liability and Customer’s sole and exclusive remedy shall be, re-performance of the applicable Service. This warranty is void if an error in the Service results from accident, abuse, or misapplication, or if Customer fails to substantially fulfill its obligations as set forth in this Agreement. Intraprise Health represents that (a) it has not been convicted of a criminal offense related to health care; (b) it is not currently listed by a federal or state agency as debarred, excluded or otherwise ineligible for participation in federally or state funded health care programs; (c) it is approved by HITRUST as a CSF Assessor for performing assessment and services associated with the CSF Assurance Program and the HITRUST CSF. For purposes of this paragraph, “Intraprise Health” is defined as the entity entering into this Agreement, and/or its principals, employees, directors and officers. Intraprise Health further agrees that it will promptly notify Customer in the event that it, or to Intraprise Health’s knowledge, any person in its employ who provides services hereunder, has been excluded, debarred, or has otherwise become ineligible for participation in any federal or state health care program, and in the event that Intraprise Health becomes aware that any employees, contractors and/or agents are subject to the actions set forth in the preceding sentence, then Intraprise Health shall promptly remove them from providing services hereunder. Intraprise Health agrees to continue to make reasonable inquiry regarding the status of its employees and independent contractors on a periodic basis, by reviewing the General Services Administration’s List of Parties Excluded from Federal Programs and the HHS/OIG List of Excluded Individuals/Entities. Warranty Disclaimer. EXCEPT AS EXPRESSLY PROVIDED IN SECTION 1 OF THIS AGREEMENT, ALL SERVICES, CONTENT AND TOOLS PROVIDED TO CUSTOMER HEREUNDER ARE PROVIDED “AS IS” AND WITH ALL FAULTS ON AN “AS AVAILABLE” BASIS, AND INTRAPRISE HEALTH DISCLAIMS ALL REPRESENTATIONS, CONDITIONS AND WARRANTIES RELATING THERETO, WHETHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO ANY IMPLIED WARRANTIES, DUTIES OR CONDITIONS OF MERCHANTABILITY, NON-INFRINGEMENT, FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT, QUIET POSSESSION, LOSS OR CORRUPTION OF DATA, SECURITY, CONFORMITY TO DESCRIPTION, RELIABILITY, ACCURACY AND COMPLETENESS AND RESULTS OR ANY OTHER WARRANTIES THAT MIGHT ARISE FROM THE COURSE OF DEALING, USAGE OR TRADE PRACTICE. NO ADVICE OR INFORMATION PROVIDED BY INTRAPRISE HEALTH WILL CREATE A WARRANTY. CUSTOMER ASSUMES TOTAL RESPONSIBILITY AND ALL RISK ARISING FROM THE USE OF, OR INABILITY TO USE, ANY SOFTWARE, SERVICES, CONTENT (AS DEFINED IN SECTION 7), OR THE TOOLS (AS DEFINED IN SECTION 7) PROVIDED BY INTRAPRISE HEALTH IN CONNECTION WITH THIS AGREEMENT. Limitation of Liability. TO THE MAXIMUM EXTENT PERMITTED BY LAW, (I) IN NO EVENT SHALL EITHER PARTY OR ITS AFFILIATES BE LIABLE TO THE OTHER FOR SPECIAL, CONSEQUENTIAL, INCIDENTAL, COVER, EXEMPLARY, PUNITIVE OR INDIRECT DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA OR CONFIDENTIAL INFORMATION, BUSINESS INTERRUPTION, PERSONAL INJURY, LOSS OF PRIVACY, FAILURE TO MEET ANY DUTY INCLUDING GOOD FAITH OR REASONABLE CARE, NEGLIGENCE OR ANY OTHER PECUNIARY OR OTHER LOSS WHATSOEVER) ARISING OUT OF OR IN ANY WAY RELATED TO THE SERVICES, THE USE OR INABILITY TO USE THE SERVICES, THE CONTENT, TOOLS, THE PROVISION OF OR THE FAILURE TO PROVIDE THE SERVICES, OR OTHERWISE ARISING OUT OF THE SERVICES, THE CONTENT OR THE TOOLS, THE RESULTS OBTAINED THEREFROM, OR THIS AGREEMENT. EVEN IN THE EVENT OF FAULT, MISREPRESENTATION, STRICT LIABILITY, BREACH OF CONTRACT OR BREACH OF WARRANTY, TORT (INCLUDING NEGLIGENCE) OR OTHER ACT OR OMISSION OF SUCH PARTY AND WHETHER OR NOT ADVISED OF THE POSSIBILITY OF SUCH DAMAGE, AND (II) NEITHER PARTY’S AGGREGATE LIABILITY ARISING OUT OF THIS AGREEMENT, SHALL EXCEED THE AMOUNTS PAID OR PAYABLE BY CUSTOMER UNDER THIS AGREEMENT DURING THE TWELVE (12) MONTH PERIOD PRECEDING THE CLAIM GIVING RISE TO A CAUSE OF ACTION HEREUNDER. THESE LIMITATIONS SHALL APPLY NOTWITHSTANDING ANY FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY. Confidentiality. Obligations. Except as required by applicable law or judicial order, each Party agrees that during the term of this Agreement, and thereafter, each Party (a) will not use or authorize others to use the other Party’s Confidential Information (as defined below) in any manner or for any purpose other than for the performance of the services or obligations or to exercise rights set forth in this Agreement; and (b) will limit access to the other’s Confidential Information to the receiving Party’s personnel and contractors who need to know such information in connection with their work or obligations under this Agreement. In the event that a receiving Party is required by subpoena, court process or other applicable law to disclose the other Party’s Confidential Information, the receiving Party may do so to the extent required by law, but only, where permitted by law, after notifying the other Party and giving the other Party a reasonable opportunity to contest such disclosure. At the conclusion of this Agreement, each Party will return or destroy the other Party’s Confidential Information then in the receiving Party’s possession. Confidential Information. “Confidential Information” means all non-public information knowledge or data relating to a Party’s business or finances if such information could reasonably be construed as confidential and was obtained by a Party in the course of providing or receiving services hereunder. Confidential Information does not include information that (i) is known to a Party or its affiliates or personnel at the time of disclosure to the Party, (ii) has become publicly known or made generally available through no unlawful act of the receiving Party or (iii) has been received by the receiving Party from a third party who is authorized to make such disclosure. 5Term/Termination. 5.1Term of Work Orders. The term of each Work Order shall be for the longer of the time specified in the Work Order, if any, or until the completion of the Services specified in the Work Order. 5.2Term of this Agreement. The term of this Agreement shall commence on the Effective Date and continue for one (1) year (the “Initial Term”); provided, that the term of this Agreement shall automatically renew after the Initial Term for additional one (1) year terms (each, a “Renewal Term”) unless either Party provides written notification of its intent not to renew sixty (60) days or more before the expiration of the Initial Term or the then current Renewal Term. The Initial Term and each Renewal Term shall be referred to collectively as the “Term.” Notwithstanding the foregoing, in no event will a party’s notice of non-renewal result in a termination of this Agreement if any Work Order is in progress, and the effective date of termination for such Work Order and this Agreement shall be the date upon which the Services under such Work Order have been completed and payment in full for all Work Orders has been received by Intraprise Health. 5.3Termination. Material Breach. If either party breaches a material provision of this Agreement or any specific Work Order, and fails to remedy such material breach within thirty (30) days after receiving written notice of that breach from the other party, the non-breaching party may, at its option, terminate this Agreement, including all outstanding Work Orders, or the specific Work Order to which such breach relates. Nonpayment. Without limiting the foregoing, in the event Customer fails to meet any payment obligation pursuant to Article 9 or a Work Order, Intraprise Health shall be entitled to suspend the Services until such payment obligations are satisfied, and any schedules relevant to performance hereunder shall be appropriately and equitably extended to account for delays resulting from such suspension. Cooperation. Customer will reasonably cooperate with the Intraprise Health in order to facilitate the provision and receipt of the Services. Customer acknowledges that such Services are dependent upon such reasonable cooperation, and that its failure to so cooperate shall relieve Intraprise Health of its obligation to provide the related Services to the extent such failure renders such provision impractical or impossible; provided that Intraprise Health will promptly notify the applicable Customer of any such failure. Changes to Applicable Law. In the event of a change (including changes in interpretation of) to any federal, state, provincial or other applicable law or regulation affecting the Services, or requiring a change to the provision of all or any part of the Services or a method of delivery of such Services in use by Intraprise Health prior to such change, Intraprise Health may (a) make changes to the Agreement and/or Services with thirty (30) days’ prior written notice to Customer at no additional cost to Customer during the Initial Term or then current Renewal Term, or (b) terminate this Agreement upon thirty (30) days’ prior notice and provide Customer a pro rata refund of any prepaid, unused fees for the Services. If, upon notification of the change, Customer elects not to continue the Services, then notwithstanding anything to the contrary in the Agreement, Customer may terminate the Agreement upon thirty (30) days’ prior written notice without penalty or cancellation fees. 5.4Upon termination or expiration of this Agreement, Customer will, at Intraprise Health’s option, promptly return or destroy all material(s) Customer received from Intraprise Health in connection with the System or Services, and, if requested by Intraprise Health, certify in writing to Intraprise Health that such material(s) have been destroyed. 5.5Disputed Payments. In the event that Customer disputes in good faith amounts owed, Customer shall: (a) provide Intraprise Health with a detailed written explanation of the good faith dispute on or before the date the payment would otherwise be due; and (b) pay to Intraprise Health the amounts not disputed in good faith as stated in the applicable invoice. The Parties shall confer with respect to any disputed amounts within ten (10) business days of the dispute notification in an attempt to resolve the dispute. If the Parties are unable to resolve the dispute through this process, then the Parties may submit the dispute to confidential, binding arbitration before one arbitrator in accordance with the Expedited Rules of JAMS. The parties agree that the arbitration that shall be limited to one (1) hour and the arbitrator shall spend no more than five (5) hours before reaching a decision and the process shall be completed and the decision delivered to the Parties within ninety (90) days of the date the applicable payment was originally due. 5.6Effect of Termination. Upon termination of this Agreement, (i) Customer shall pay Intraprise Health all amounts due or accrued hereunder as of the effective date of such termination as described in Article 9 and this Section 5.5 not disputed in good faith, and (ii) Customer and Intraprise Health shall comply with their obligations under Sections 2, 4, 6, 8, 9, 10, 12 and 14. 5.7Survival. Any provision of this Agreement that imposes continuing obligations on either party shall survive the expiration or termination of this Agreement, including without limitation Sections 2, 3, 4, 6, 8, 9, 10, 11, 12, 14 and 18 hereof. Non-Solicitation. During the term of this Agreement, and for a period of one (1) year thereafter, neither Party will , without the other Party’s prior written consent, directly or indirectly, as an owner, principal, partner, member, shareholder, independent contractor, consultant, joint venture, investor, licensor, lend, employee or in any other capacity whatsoever, alone, or in association with any other person: (i) induce, solicit, recruit or attempt to induce, solicit or recruit any employee or contractor of the other Party or its affiliates to terminate employment with, or cease providing services to, the other Party or its affiliates; or (ii) solicit, attempt to do any business with, refer or intentionally interfere with the other Party’s relationship with any advertiser, customer, developer, distributor, licensor, licensee, partner, reseller, or supplier of or to the other Party. This section 6 (i) shall not apply to the extent that the sole contact with the other Party’s employee or contractor has been their response to a broadly publicized job posting or announcement. Scope. Customer is engaging Intraprise Health as an independently contracted services provider to provide the Customer with the Services pursuant to Work Orders. Intraprise Health may agree to perform such other services reasonably related to the Services as may be requested by Customer from time to time during the term of the Agreement. If so requested and agreed, the additional services shall be set forth in a mutually agreeable Work Order. If either Party wishes to modify or amend a Work Order, such Party shall submit a Work Order Change Request (“Change Request” or “WO-CR”) describing the proposed change(s), the reason for the proposed change(s), and the anticipated impact the proposed change(s) will have on the Services. The Parties will perform an assessment of the WO-CR to determine the effect that the execution and implementation of the requested change(s) will have on price, schedule and other terms and conditions of the WO. Upon completion of the assessment, both Parties will review the impact of the proposed change and, if mutually agreed, a written authorization (“Change Authorization”) must be executed by both Parties, and attached as an Attachment to the WO. In connection with the Services, Intraprise Health may also use or allow Customer to use certain proprietary content (“Content”) and proprietary tools (“Tools”). For the avoidance of doubt, the Services, Content and Tools shall not include, nor will Intraprise Health provide clinical, forensic, medical, legal, financial, accounting, regulatory compliance, physical, property, building or other security services other than those set forth herein, or any other such services or analyses pursuant to any Work Order, Work Order Attachment executed in accordance with the terms and conditions of this Agreement. The Parties further agree that the relationship created by this Agreement is that of independent contractors and that neither Party shall be an employee or agent of the other Party, nor shall either Party be granted any right or authority to assume or create any obligation or liability, express or implied, on behalf of the other Party or to accept service of process in any action on its behalf, or to bind the other Party in any manner or form whatsoever. The Parties acknowledge and agree that Intraprise Health performs services that are similar to the Services and the same types of Services on its own behalf and for third parties, and participates in the types of business and develops and provides the types of services which are the subject of this Agreement on its own behalf and for third parties and nothing in this Agreement shall limit the ability of Intraprise Health to so provide such services or to otherwise use the ideas, skills, knowledge, concepts, techniques and experience possessed or acquired by Intraprise Health as a result of its performance under this Agreement. HIPAA, HITECH, Security Program and Privacy Program Services Disclaimer. The Services provided by Intraprise Health, where so designated in a Work Order, are intended to assist Customer in assessing, and formulating information about, Customer’s security and privacy oriented controls against the requirements of the HIPAA and HITECH Security regulations. Intraprise Health may also be asked to assist Customer in other related activities to the extent that they are set forth in a Work Order or Work Order Change Authorization. Any Services, advisements, Content, tools, analyses, training and/or educational briefings are performed on a reasonable basis and are intended only to provide a point of initial guidance to Customer for identifying information about Customer’s organization. Intraprise Health’s services are only one of many sources of information and guidance that the Customer utilizes as Customer addresses Customer’s security and privacy-oriented controls under the HIPAA and HITECH Security regulations. However, none of the Services, advisements, Content, tools, analyses, training and/or educational briefings rendered constitute legal advice or compliance activities and should not be relied upon as a substitute for legal, compliance or business advice. Intraprise Health is not a law firm and use of any of its services does not create an attorney-Customer relationship. Intraprise Health has no control over, or responsibility for, the truth, accuracy, completeness or correctness of the information provided by Customer during the Services which are rendered during any engagement. It is Customer’s sole and exclusive obligation to implement, revise or remove operational policies, procedures and/or to remediation solutions. It is recommended that Customer utilize an interdepartmental security and compliance team and its legal counsel as to its security efforts and in the development, review, approval and implementation of Customer’s policies, procedures, forms, notices, and related documents before and after they are implemented. Customer recognizes that it is solely responsible for the compliance and security of its systems, networks, operations and other activities. There are many systemic and organization wide efforts beyond any assistance that Intraprise Health may provide that Customer must undertake and pursue to seek compliance and fulfill its legal obligations as to security oriented controls under the HIPAA and HITECH Security regulations. Compensation. As compensation for providing the Services, Customer shall pay Intraprise Health the fees set forth in the applicable Work Orders, plus reasonable expenses for travel, lodging, meals and other out-of-pocket expenses and in fact incurred by Intraprise Health under any Work Order; provided, that any single expense of One Thousand Dollars ($1,000) or more shall require the prior approval by Customer. Each invoice rendered by Intraprise Health will include an invoice number, the time period covered by the invoice and sufficient detail and supporting documentation to allow Customer to determine the accuracy of the invoice. Each invoice shall be paid by Customer within thirty (30) days of the date of the invoice. Compensation for future services shall be identified and documented in new mutually agreed upon Work Orders or Change Authorizations. Non-Disparagement. The Parties agree to refrain at all times after the Effective Date hereof from, directly or indirectly, making any oral or written statements of a disparaging, defamatory, false or otherwise materially misrepresentative nature to any person or entity about or relating to the other Party (including its related and affiliated companies) and each of their past, present and future directors, partners, officers, employees, attorneys, owners or agents. Nothing in this Agreement is intended to or shall be interpreted to restrict each Party's right and/or obligation: (i) to testify truthfully in any forum and/or (ii) to contact, cooperate with or provide information to any government agency or commission. Beneficiaries. Nothing in this Agreement, express or implied, is intended to or shall confer upon any other person any right, benefit or remedy of any nature whatsoever under or by reason of this Agreement. There are no third-party beneficiaries to this Agreement. Intellectual Property. General. Subject to the limited rights expressly granted hereunder, each Party and their respective licensors reserve all of their right, title and interest in and to the intellectual property that such Party (i) has at the time of the execution hereof and which they obtained or created independently of this Agreement, and (ii) licenses, develops or creates during the course of the Agreement, provided, that such intellectual property is not based on the intellectual property of the other Party, including, in both cases (i) and (ii), without limitation all derivatives thereof and all intellectual property rights therein (collectively “Intellectual Property”) and all other such rights other than the rights which are expressly licensed, transferred, granted or assigned under this Agreement in writing in an applicable Work Order or Change Authorization. Moreover, subject to the terms and conditions of this Agreement and except as may otherwise be subsequently agreed to by the Parties in a Work Order or Change Authorization: (i) neither Party transfers any right, title or interest in or to any of that Party’s Proprietary Material (as defined below) or third party software or other materials incorporated in any Services, and (ii) each Party reserves the right to use and disclose, in any manner and for any purpose, ideas, know-how, skills, knowledge, concepts, and techniques, to the extent the foregoing are not Intellectual Property, which are possessed or acquired by a Party, and source and object code of general utility, whether developed and learned prior to, independently or in the course of, its performance under this Agreement. Proprietary Material. Each Party further acknowledges and agrees that the Parties shall retain all right, title, and interest in their respective Proprietary Material that may be embodied, in whole or in part, in any Services or otherwise provided to the other Party or used in conjunction with that Parties’ performance under this Agreement. Each Party’s respective “Proprietary Material” shall mean that Party’s Intellectual Property, any and all content, software, data, source and object code, reports, and other information or materials owned or developed by or for that Party either prior to or independently of this Agreement, and (ii) any derivatives, enhancements, improvements, or modifications to those items specified item (i), above, developed by that Party in the performance of this Agreement. Each Party shall take reasonable efforts to ensure that it and any third party does not, decompile, reverse engineer or disassemble that portion of any Services that includes, in whole or in part, any of the other Party’s Proprietary Material. Feedback. If Customer provides Feedback to Intraprise Health in the course of the Agreement, then Customer agrees that such Feedback may be used by Intraprise Health, perpetually and royalty-free, in any manner whatsoever and without limitation. As used herein, "Feedback" means Customer’s comments, feedback, and suggestions regarding the Services in each case provided by Customer to Intraprise Health for the purpose of Intraprise Health’s development of enhancements to the Services. Binding Arbitration. Other than cross-claims or counter-claims for indemnification or contribution, or actions seeking injunctive or equitable relief, any dispute, claim or controversy arising out of or relating to this Agreement, or the breach, termination, enforcement, interpretation or validity thereof, including the determination of the scope or applicability of this agreement to arbitrate, shall be determined by confidential, binding arbitration before one arbitrator. The arbitration shall be administered by JAMS pursuant to its Comprehensive Arbitration Rules and Procedures and in accordance with the Expedited Procedures in those Rules or pursuant to JAMS’ Streamlined Arbitration Rules and Procedures. Judgment on the Award may be entered in any court having jurisdiction. The decision in writing of the arbitrator, and any award by an arbitrator, shall be final and binding upon the Parties hereto. Indemnification. Each Party (the “Indemnifying Party”) will defend the other Party (the “Indemnified Party”) against any third-party claims, and indemnify and hold harmless the Indemnified Party from any damage, cost, loss or expense (including reasonable attorneys’ fees) arising from such third-party claim, a related to (i) a claim that services, materials, data, or information provided by the Indemnifying Party to the Indemnified Party hereunder infringes upon any patent issued as of the Effective Date, copyright or trademark of such third party, and (iii) the Indemnifying Party’s violation of any Federal, state or local law, rule or regulation that is applicable to the Indemnifying Party. Customer will defend Intraprise Health against any third-party claim, and indemnify and hold harmless Intraprise Health, its officers, directors, members, employees, representatives and agents from and against any damages, liabilities, costs, losses or expenses (including reasonable attorneys’ fees and expert witness fees) arising from such third-party claim arising from or related to Customer’s use of the Services or any results derived from the Services. The Indemnifying Party’s obligations hereunder are conditioned on the Indemnified Party (a) promptly notifying the Indemnifying Party in writing of the claim for which indemnification is sought, (b) reasonably cooperating with the Indemnifying Party in connection with, and (c) tendering sole control over the defense and/or settlement of the claim. The Indemnified Party shall have the right to provide for a separate defense with counsel of its own choosing at its own expense. Additional Insured. Customer shall obtain and provide to Intraprise Health a certificate of additional insured on its general liability and cybersecurity insurance policies. Certificates of Insurance shall be in the name of the Intraprise Health and each such certificate shall include Intraprise Health as additional insured for general liability and umbrella policies. Customer shall provide to Intraprise Health, promptly upon receipt by Customer, renewal notices regarding such insurance policies. Intraprise Health will not be liable for the payment of any premiums or assessments with respect to the coverage described in this Section. Further, Intraprise Health, its officers, agents and employees shall be named additional insured as respects the named insured activities on or about Customer’s premises. The policies shall be endorsed to provide that the insurance shall be primary and not contributing with any other insurance available to said additional insured as respects any and all liability, loss, claims, damages or expense arising out of the negligence or alleged negligence of the named insured. Assignment. Neither Party may assign, delegate or otherwise transfer this Agreement without the other’s prior written consent, and any assignment, delegation or transfer in violation of this Section shall be null and void; provided, that either Party may, without the consent of the other Party, assign or transfer this Agreement, or any rights and obligations under this Agreement, to an entity acquiring, merging with, consolidating with, or purchasing substantially all its assets or stock, or otherwise in connection with a change of control event involving the assigning Party. Any permitted transfer, delegation or assignment of this Agreement, or rights and obligations hereunder shall be binding upon and enforceable by and against Customer’s and Intraprise Health’s successors and assigns. Force Majeure. Except for Customer's payment obligations, if any Party is delayed or prevented from performing any of its obligations hereunder due to any cause which is beyond the nonperforming Party’s reasonable control, including fire, explosion, flood, or other acts of God; acts, regulations, or laws of any government; war, terrorist acts or civil commotion; strike, lock-out or labor disputes or disturbances; failure of public utilities or common carriers, delay caused by others, lack of cooperation or lack of participation of other persons or entities, floods, fire, lightning, utility, internet, telecommunications or communications failures, earthquakes, vandalism, riots, insurrections, embargoes or laws, regulations or orders of any governmental entity (a “Force Majeure Event”), such nonperforming Party shall not be liable for breach of this Agreement, to the extent due to such Force Majeure Event, provided that the nonperforming Party gives prompt written notice to the other Party of the Force Majeure Event and that such nonperforming Party exercises all reasonable efforts to eliminate the Force Majeure Event to resume performance of its affected obligations as soon as practicable. Miscellaneous. The Parties acknowledge and agree that this Agreement shall remain in full force and effect following the Agreement Effective Date. The Parties hereto agree to execute any further instruments and take any further action reasonably necessary to carry out the provisions of this Agreement. This Agreement shall be governed exclusively by the laws of the Commonwealth pf Pennsylvania, and the sole venue for any dispute arising out of this Agreement shall be in Bucks County Pennsylvania, or, if jurisdiction is present, federal Court in Philadelphia, Pennsylvania. The Parties hereby waive the right to a trial by jury in a dispute arising out of this Agreement. This Agreement may be executed and delivered by facsimile or pdf signature and in two or more counterparts, each of which shall be deemed an original, but all of which together shall constitute one and the same instrument. Entire Agreement. This Agreement is the entire agreement between the Parties, to the exclusion of all prior or contemporaneous representations, understandings or agreements, and all warranties, expressed or implied, with reference to the subject matter hereof and supersedes all prior and contemporaneous agreements and understandings, express or implied, oral or written, except as stated or referred to in this Agreement. For the avoidance of doubt, this Agreement expressly replaces any prior work order or service agreements between the Parties, and shall govern Intraprise Health’s provision of services going forward. This Agreement may not be modified or amended except by an agreement in writing between the Parties hereto. Each Party has participated in the negotiation and drafting of this Agreement and no rule of strict construction shall be applied against any Party to this Agreement. In the event of any conflict between these Standard Terms and Conditions and the terms of any Work Order, the terms of the Work Order shall govern and prevail to the extent necessary to resolve such conflict, except with respect to any indemnity obligations, limitations of liability or disclaimers, including, without limitation, Sections 2, 3, 7 8, and 14 of these Standard Terms and Conditions, which may not be modified, amended, or superseded in a Work Order unless a Work Order specifically references this Section 18.1 and is initialed by authorized executives of both Parties. Severability. The invalidity or unenforceability of any provision in this Agreement shall not affect the other provisions hereof and this Agreement shall be construed in all respects as if such invalid or unenforceable provision were omitted. Counterparts. This Agreement may be executed in multiple counterparts, each of which shall be deemed an original and all of which shall constitute one agreement, and the signature of any Party to a counterpart shall be deemed to be a signature to, and may be appended to, any other counterpart. SIGNATURE BLOCK FOLLOWS ON NEXT PAGE Page Break IN WITNESS WHEREOF, the Parties have executed this Agreement as of the date signed by the latter of the signatories hereto as set forth below. Intraprise Health, LLC Customer: By: By: Name: Name: Title: Title: Date: Date: Page Break Exhibit C Business Associate Agreement This Business Associate Agreement (“BAA”) amends and is made part of that certain Master Services Agreement dated as of Month __, 2020 (the “Agreement”), by and between CUSTNAME (“Entity”) and Intraprise Health, LLC (“Associate”). Entity and Associate agree that the Parties incorporate this BAA into the Agreement in order to comply with the requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and their implementing regulations set forth at 45 C.F.R. Parts 160 and Part 164 (the “HIPAA Rules”). To the extent Associate is acting as a Business Associate of Entity pursuant to the Agreement, the provisions of this BAA shall apply, and Associate shall be subject to the penalty provisions of HIPAA as specified in 45 CFR Part 160. Definitions. Capitalized terms not otherwise defined in this BAA shall have the meaning set forth in the HIPAA Rules. References to “PHI” mean Protected Health Information maintained, created, received or transmitted by Associate in its capacity as a Business Associate of Entity. Uses or Disclosures. Associate will neither use nor disclose PHI except as permitted or required by this BAA or as Required By Law. To the extent Associate is to carry out an obligation of a Covered Entity under 45 CFR Part 164, Subpart E, Associate shall comply with the requirements of 45 CFR Part 164, Subpart E that apply to such Covered Entity in the performance of such obligation. Associate is permitted to use and disclose PHI: (a)to perform any and all obligations of Associate pursuant to the Agreement, provided that such use or disclosure would not violate the HIPAA Rules if done by Entity directly; (b)as otherwise permitted by law, provided that such use or disclosure would not violate the HIPAA Rules, if done by Entity directly and provided that Entity gives its prior written consent; (c)to perform Data Aggregation services relating to Entity’s health care operations; (d)to report violations of the law to federal or state authorities consistent with 45 CFR § 164.502(j)(1); (e)as necessary for Associate’s proper management and administration and to carry out Associate’s legal responsibilities (collectively “Associate’s Operations”), provided that Associate may only disclose PHI for Associate’s Operations if the disclosure is Required By Law or Associate obtains reasonable assurance, evidenced by a written contract, from the recipient that the recipient will: (1) hold such PHI in confidence and use or further disclose it only for the purpose for which Associate disclosed it to the recipient or as Required By Law; and (2) notify Associate of any instance of which the recipient becomes aware in which the confidentiality of such PHI was breached; (f)to create de-identified information in accordance with 45 CFR § 164.514(b), provided that such de-identified information may be used and disclosed only consistent with applicable law; (g)to create a limited data set as defined at 45 CFR §164.514(e)(2), provided that Associate will only use and disclose such limited data set for purposes of research, public health or health care operations and will comply with the data use agreement requirements of 45 CFR §164.514(e)(4), including that Associate will not identify the information or contact the individuals. In the event Entity notifies Associate of an Individual’s restriction request granted pursuant to 45 CFR §164.522 that would restrict a use or disclosure otherwise permitted by this Section, Associate shall comply with the terms of the restriction request. Safeguards. Associate will use appropriate administrative, technical and physical safeguards to prevent the use or disclosure of PHI other than as permitted by this BAA. Associate will also comply with the applicable provisions of 45 CFR Part 164, Subpart C with respect to electronic PHI to prevent any use or disclosure of such information other than as provided by this BAA. Subcontractors. In accordance with 45 CFR §§ 164.308(b)(2) and 164.502(e)(1)(ii), Associate will ensure that all of its Subcontractors that create, receive, maintain or transmit PHI on behalf of Associate agree by written contract to comply with the same restrictions and conditions that apply to Associate with respect to such PHI, including but not limited to the obligation to comply with the applicable provisions of 45 CFR Part 164, Subpart C. Minimum Necessary. Associate will limit its uses and disclosures of, and requests for, PHI (i) when practical, to the information making up a Limited Data Set; and (ii) in all other cases subject to the requirements of 45 CFR § 164.502(b), to the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or request. Entity Obligations. Entity shall notify Associate of (i) any limitations in its notice of privacy practices, (ii) any changes in, or revocation of, permission by an Individual to use or disclose PHI, and (iii) any confidential communication request or restriction on the use or disclosure of PHI that Entity has agreed to or with which Entity is required to comply, to the extent any of the foregoing affect Associate’s use or disclosure of PHI. Entity shall not request Associate to use or disclose PHI in a manner not permitted by the HIPAA Rules, shall obtain all permissions or authorizations, if any, required to disclose PHI to Associate in order for Associate to perform its obligations under the Agreement, and only disclose to Associate the minimum Protected Health Information necessary to allow Associate to perform its obligations under the Agreement. Access and Amendment. In accordance with 45 CFR § 164.524, Associate shall permit Entity or an Individual (or the Individual’s designee) to inspect and obtain copies of any PHI about the individual that is in Associate’s custody or control and that is maintained by Associate in a Designated Record Set. If the requested PHI is maintained electronically, Associate shall provide a copy of the PHI in the electronic form and format requested by the individual, if it is readily producible, or, if not, in a readable electronic form and format as agreed to by Entity and the individual. Associate will, upon receipt of notice from Entity, promptly amend or permit Entity access to amend PHI held in a Designated Record Set by Associate so that Entity may meet its amendment obligations under 45 CFR § 164.526. Accounting. Except for disclosures excluded from the accounting obligation by the HIPAA Rules, Associate will record for each disclosure that Associate makes of PHI the information necessary for Entity to make an accounting of disclosures pursuant to the HIPAA Rules. In the event the U.S. Department of Health and Human Services (“HHS”) finalizes regulations requiring Covered Entities to provide access reports, Associate shall also record such information with respect to electronic PHI held by Associate as would be required under the regulations for Covered Entities beginning on the required compliance date of such regulations. Associate will make information required to be recorded pursuant to this Section available to Entity promptly upon Entity’s request for the period requested, but for no longer than required by the HIPAA Rules (except Associate need not have any information for disclosures occurring before the effective date of this BAA). Inspection of Books and Records. Associate will make its internal practices, books, and records, relating to its use and disclosure of PHI, available upon request to HHS to determine compliance with the HIPAA Rules. Reporting. To the extent Associate becomes aware or discovers any use or disclosure of PHI not permitted by this BAA, any Security Incident involving electronic PHI or any Breach of Unsecured Protected Health Information involving PHI, Associate shall promptly report such use, disclosure, Security Incident or Breach to Entity. Associate shall mitigate, to the extent practicable, any harmful effect known to it of a Security Incident, Breach or a non-permitted use or disclosure of PHI by Associate. Notwithstanding the foregoing, the Parties acknowledge and agree that this Section constitutes notice by Associate to Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which no additional notice to Entity shall be required. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of electronic PHI. All reports of Breaches shall be made in compliance with 45 CFR § 164.410. Term and Termination. This BAA shall be effective as of the effective date of the Agreement and shall remain in effect until termination of the Agreement. Either Party may terminate this BAA and the Agreement effective immediately if it determines that the other Party has breached a material provision of this BAA and failed to cure such breach within thirty (30) days of being notified by the other Party of the breach. If the non-breaching Party determines that cure is not possible, such Party may terminate this BAA and the Agreement effective immediately upon written notice to other Party. Upon termination of this BAA for any reason, Associate will, if feasible, return to Entity or destroy all PHI maintained by Associate in any form or medium, including all copies of such PHI. Further, Associate shall recover any PHI in the possession of its Subcontractors and return to Entity or securely destroy all such PHI. In the event that Associate determines that returning or destroying any PHI is infeasible, Associate may maintain such PHI but shall continue to abide by the terms and conditions of this BAA with respect to such PHI and shall limit its further use or disclosure of such PHI to those purposes that make return or destruction of the PHI infeasible. Upon termination of this BAA for any reason, all of Associate’s obligations under this BAA shall survive termination and remain in effect (a) until Associate has completed the return or destruction of PHI as required by this Section and (b) to the extent Associate retains any PHI pursuant to this Section. General Provisions. In the event that any final regulation or amendment to final regulations is promulgated by HHS or other government regulatory authority with respect to PHI, the Parties shall negotiate in good faith to amend this BAA to remain in compliance with such regulations. Any ambiguity in this BAA shall be resolved to permit the Parties to comply with the HIPAA Rules. Nothing in this BAA shall be construed to create any rights or remedies in any third Parties or any agency relationship between the Parties. A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended. The terms and conditions of this BAA override and control any conflicting term or condition of the Agreement and replace and supersede any prior business associate agreements in place between the Parties. All non-conflicting terms and conditions of the Agreement remain in full force and effect. In Witness Whereof, the Parties have executed this BAA on the dates indicated below. Entity: CustomerAssociate: Intraprise Health By: By: Name: Name: Title: Title: Date: Date: