TPA Services Terms & Conditions

1. AGREEMENT, TERM, &TERMINATION

1.1 Agreement. These Terms and Conditions (“Terms”) govern the provision by TPA of any services (“Services”) including any software-as-a-service and/or mobile software applications (“Platform”) (collectively, a “Solution”), or professional services in connection with Sponsor’s self-funded employee welfare benefit plan (“TPA Services”) and its databases of individual and demographic and behavioral data (“TPA Data”) pursuant to the Employee Retirement Income Security Act of 1974 (“ERISA”) as amended, (“Plan”) for enrolled employees of Sponsor and for enrolled dependents of such employees (collectively “Participants”). These Terms will remain in effect during the duration of the Term of the ASA and will terminate upon the expiration or termination thereof. The Services and Platform features are subject to immaterial change at TPA’s discretion without notice.

1.2 Performance of Services. All TPA Services shall be performed pursuant to the provisions of the plan document that describes each Participant’s rights, benefits, and obligations within the Plan, as well as the Plan’s terms and conditions for administering the Plan (“Plan Document”), as amended by Sponsor and incorporated by reference herein. Sponsor shall be the final arbiter as to the interpretations of the Plan and shall make the final determination regarding issues referred by the TPA, including all claims requiring the exercise of discretion and the payment of any benefits thereunder. TPA shall consult with Sponsor in the event extraordinary benefit matters arise. In the event an exception is to be made, Sponsor shall notify TPA in writing of such exception. TPA shall not be responsible for any delay or error caused by Sponsor’s failure to furnish correct information or make any determination or provide any direction in a timely manner. All Services provided via a Platform shall also be subject to TPA’s Terms of Use, privacy policy, and any end-user agreements acknowledged by the applicable Participant (“Participant Agreement”).

1.3 Term. These Terms will remain in effect during the duration of the Term of the Agreement and will terminate upon the expiration or termination thereof. The Agreement shall be legally binding as of the Effective Date and shall have a term of twelve (12) months (“Initial Term”), unless terminated earlier in accordance with this Section 1. This Agreement shall automatically renew for subsequent twelve (12) month renewal periods (each a “Renewal Term” and together with the Initial Term, the “Term”) unless written notice is provided by either party at least ninety (90) days prior to the next twelve (12) month Renewal Term of its intent not to renew. If Company fails to provide at least ninety (90) days’ notice, it will be obligated to pay a termination fees (“Late Termination Service Fee”) for the equivalent of ninety (90) days. The Late Termination Service Fee shall be the average of the last six (6) months of fees multiplied by four (4) months and shall be due within thirty (30) days of invoice.

1.4 Termination. Either Party may terminate this Agreement if: (i) the other Party seeks bankruptcy protection, or is adjudicated as a bankrupt entity, makes an assignment for the benefit of creditors, ceases to do business, terminates its business operations, or becomes insolvent, or proceedings are instituted by or against it that are not terminated within sixty (60) days, (ii) their business operations come into possession of or under the control of any trustee in bankruptcy, (iii) a receiver is appointed for the party’s business or operations, (iv) makes a general assignment for the benefit of creditors, (v) the other Party materially breaches this Agreement and does not cure such failure within ten (10) days’ of receipt of notice from the non-breaching Party; or (vi) a change in Law occurs that materially and adversely impairs TPA’s ability to provide the Services in compliance with Applicable Laws (as defined below) and the Parties acting in good faith are unable to reach agreement on an amendment to account for such change in Applicable Laws within a reasonable period of time, but no later than the first date on which the change in law becomes effective. If Sponsor initiates proceedings pursuant to any chapter of the U.S. Bankruptcy Code, whether voluntary or involuntary, then Sponsor, shall immediately notify TPA, all plan participants, and applicable governmental or regulatory authorities. Should Sponsor fail such notification, Sponsor expressly authorizes TPA to provide such notifications and Sponsor shall reimburse TPA for the reasonable costs of such notifications.

1.5 Effect of Termination. The parties shall use the period between the date it receives notice of termination (“Notice Date”) and the effective date of termination (“Termination Date”) to facilitate an orderly transfer of records and funds, as Sponsor may designate in writing; provided, however, TPA shall cease the provision of Services upon the Termination Date, and these Terms shall remain in full force and effect solely with respect to any other ASAs that remain in effect. Upon request, TPA shall return any records and delete any Sponsor Data in its possession or control and certify such deletion in writing to Sponsor within thirty (30) days of the request. Termination of this Agreement will not relieve either Party from any obligation or liability that has accrued prior to the effective date of termination, including Sponsor’s obligation to pay TPA for the Services incurred up to the Termination Date or any ETF (as defined below).

1.6 Failure to Provide Required Notice. If Sponsor fails to provide at least ninety (90) days’ notice prior to the next Renewal Term it will be obligated to pay a termination fees (“Late Termination Service Fee”) for the equivalent of ninety (90) days and all Run-Out fees for a period of twelve months from the Termination Date. The Late Termination Service Fee shall be the current Medical Claims Administration fee multiplied by four (4) months multiplied by the average number of covered employees on the first day of each month for the last (6) months of services prior to the termination date. The Late Termination Service Fee and Run-Out Service fees are not duplicative of the other. The Late Termination Service Fee shall be due thirty (30) days from the notice of termination.

1.7 Run-Out Services. Upon Sponsor’s request, TPA, in its sole discretion, shall provide twelve (12) months of assistance to Sponsor for transition of the Services at the prices agreed upon in the ASA., (“Run-Out Services”). Separate Run-Out Service fees may be charged from PPO vendors.

1.8 Early Termination Fees. Sponsor may terminate this Agreement for convenience upon ninety (90) days’ notice and payment of an early termination fee (“ETF”) equal to the Medical Claims Administration fee multiplied by the remaining months of the current term multiplied by the average number of covered employees on the first day of each month for the last (6) months of Services prior to the termination date payable thirty (30) days from the Notice Date. All pharmaceutical rebates will be forfeited.

2. SCOPE OF RELATIONSHIP

2.1 Parties. The Agreement does not create any rights or legal relationships between TPA and any of the Participants or beneficiaries under the Plan or to any other third party. If Sponsor fails to comply with any federal or state law,mandatory filings, or the termsof the Plan (“Applicable Law”), TPA shall not be liable in any action brought in regard thereto. TPA’s relationship with Sponsor shall be that of an independent contractor, and nothing herein shall be construed as creating the relationship of employer and employee, partnership, or joint venture between the parties. Sponsor acknowledges that TPA is not a party to any contract entered into on behalf of Sponsor for the purpose of obtaining discounts, network access, or other purposes which are intended primarily to benefit the Plan. Sponsor assumes all contractual and financial obligations related thereto unless otherwise specified in writing in one of those contracts.

2.2 Fiduciary.

a. TPA is neither fiduciary of the Plan or the “Plan Administrator” for purposes of ERISA. The TPA Services are ministerial in nature and this Agreement does not confer or delegate to TPA any discretionary authority or discretionary responsibility in the administration of the Plan. TPA shall exercise its obligations under the Agreement in accordance with industry-accepted standards regarding the ordinary interpretation, definition, and application of the Plan Document.

b. Solely in the event that TPA has assumed in writing the role of Claims Appeals/Fiduciary, then TPA shall for the purposes of TPA Services provided under that specific ASA be the Claims Fiduciary with respect to the duties and obligations limited to the Medical Claims Administration Services in sections 3.2 and 3.3, which it performs on behalf of the Plan pursuant hereto. Sponsor shall retain the role of Plan Administrator and Plan Fiduciary of the Plan and shall retain full and final authority and responsibility for the Plan and its operation. Except as set forth herein, TPA’s fiduciary duties and obligations shall not include any duties, obligations or liabilities of Sponsor, Plan Administrator or Plan Fiduciary.

2.3 Communications. TPA shall be entitled to rely upon any written or oral communication from Sponsor or its directors, officers, employees, human resource and benefit personnel, other authorized employees, agents/brokers and others acting on Sponsor’s behalf.

3. OBLIGATIONS OF TPA

3.1 Documentation. TPA shall review and adhere to the written instrument(s), including plan and/or trust instruments required by ERISA (“Plan Documents”) describing the Plan; provided, however, that Sponsor shall have sole responsibility with respect to such Plan Documents and with respect to the design, amendment, distribution or validity of such instrument(s).

3.2 Claims Services. TPA shall perform the following TPA services:

provide claim forms to Sponsor for submission of claims to provider;
receive claims and claims documentation;
correspond with Participants and providers if additional information is deemed necessary by TPA;
examine claims and supporting documentation submitted by Participants incurred and received during the term of this Agreement, in order to (i) determine the qualification of such claims, (ii) make any necessary investigation, and (iii) calculate the amount of benefits due;
refer to Sponsor, for consideration and final decision, any claim or class of claims, including but not limited to claims that are specified as requiring special handling, appeals, questions with respect to the amount due or benefits payable, questions with respect to qualification of claims submitted under the terms of the Plan, and any other controversy; provided, however, that TPA shall not be liable for failure to process a claim for which all information has not been received or is untimely received;
coordinate benefits payable under the Plan with any other benefit plans;
prepare disbursement checks/EFTs for the amount of benefits determined to be payable under the Plan;
respond to all reasonable telephone calls (during regular business hours);
provide notice and explanations to Participants for denial of benefits and provide for an advisory (and not discretionary) review of denied claims including appeals in accordance with the Plan terms; provided, however, that TPA shall not render legal advice regarding any claim or denial of benefits or take legal action or otherwise enforce provisions of the Plan or recover any loss;
use its commercially reasonable efforts in the normal course of its Services to identify claims: (i) for which there is potential for collection through subrogation (except for those amounts paid prior to the Effective Date of this Agreement); or (ii) that may be subject to reimbursement based upon the existence of any Stop-Loss Policy. In no event shall TPA be held liable for any claims not covered by the Stop-Loss Carrier, irrespective of the reasons or bases provided as reason for the denial of those claims; and (iii) that contain fraudulent charges. In no event shall TPA be held liable for claims which are later determined to contain fraudulent charges.

3.3 Administrative Services. TPA shall perform the following TPA Services with respect to the administration of the Plan:

maintain Participant enrollment for eligibility for payment of claims and census data;
provide bookkeeping details of all billing and collections;
maintain reinsurance reporting;
provide experience reporting for coverages;
provide enrollment forms and identification cards to Sponsor;
At Sponsor’s expense, (including any third-party fees), obtain professional reviews, independent medical evaluations, and audits of hospital or other health care provider costs, expenses and credit balances in accordance with group health industry standards and practices to determine if hospital and physician charges are accurate, appropriate and necessary;
provide cost saving services for Sponsor, including negotiating with providers, performing medical chart audits, pursuing subrogation liens, reprice claims, participating in required arbitrations and negotiating settlements to obtain discounts, reductions or reimbursements on claims filed with and otherwise paid/payable by the Plan, and recovery of any overpayments (“Enhanced Cost Containment”). As compensation for these Services, TPA shall receive the fee set forth in the Fee Schedule of any discount, reduction, or reimbursement realized by the Plan as a result of these Services. If the discount, reduction, or reimbursement, or any portion thereof, is subsequently changed by request of the Plan Sponsor or by any required arbitration process, TPA shall not be required to reimburse all or any portion of TPA’s fee;
provide a cost saving service for dialysis claims to Sponsor, that includes the management of Participant dialysis claims, determining the Medicare allowable for each claim, determining the payable Plan benefit at a defined percentage, providing Plan amendment for this service, and handling all appeals from providers (“Dialysis Claims Management”);
provide those additional Services as selected by Sponsor in the Fee Schedule; and
provide any ancillary services or access to subcontractors selected by Sponsor. To provide such Services, TPA may enter into subcontracts with other service providers to perform all or some of the Services. With respect to any separately stated fee charged to Sponsor for an ancillary service, TPA may retain a portion of such fee for discharging its duties and obligations, with the remainder paid to the ancillary service provider pursuant to the subcontract between TPA and the ancillary service provider. TPA may also receive fees from various subcontractors for performance of services to assist the subcontractor in performing their services. With respect to certain pharmacy benefit manager (“PBM”) Sponsor hereby authorizes TPA to collect a service fee from the PBM for performing services of the PBM on behalf of Sponsor. TPA shall not conduct any pharmaceutical management for Sponsor.

3.4 Records and Files. TPA shall establish and maintain a record keeping system concerning the Services to be performed hereunder. All such records, including an accumulator report and Participant eligibility listing of such, and all hard copy files shall be the property of Sponsor and shall be delivered to Sponsor upon termination of the Agreement, subject to the right of TPA to copy and retain all or any of such records as may be required by Applicable Law. All such records shall be available for inspection by Sponsor upon reasonable prior written notice, and at any time during TPA’s normal business hours.

3.5 Reports. TPA shall provide: (a) check register, (b) report of claims paid identified as to Participants, (c) statement of account, (d) reports of claims incurred but not reported; and (e) annual report of Plan’s operation. If TPA is not providing run-out services upon termination of this Agreement, TPA will charge $2,500 for our Standard Termination Reporting Package. If utilization management is a selected service, the following reports will be provided electronically (virtual review available upon request) on a semiannual basis, as applicable, as it relates to case management and utilization review services for Sponsor: (a) utilization review approvals & denials, and (b) utilization review turnaround times.

3.6 Recovery of Payments. The Parties will reasonably cooperate to recover overpayments of benefits under the Plan (each an “Overpayment”). In the event of an Overpayment, TPA will make a demand to the payee with respect to the Participant in writing for the return of such Overpayment. If that effort is unsuccessful, TPA may use an outside vendor, collection agency or attorney(“Agent”) to pursue recovery. Overpayment recoveries made through Agents are credited to Sponsor net of Agent’s fees. TPA shall have no further obligation with respect to any Overpayment, except that TPA is hereby authorized to offset such payment against any unpaid claim of such payee for any employee Participant or covered dependent.

3.7 Forms 5500. Sponsor and not TPA shall be responsible for the preparation and/or filing of Forms 5500.

4. ACCESS GRANTS AND OWNERSHIP

4.1 By TPA. During the Term, TPA grants to Sponsor a limited, non-exclusive, revocable, non-transferable, royalty-free (subject to payment of all applicable Fees) license, to access, reproduce, use, perform, and display (and to sublicense the foregoing rights to its Participants) its software-as-a-service platform and any logos, trademarks, service marks, or content contained therein (“TPA Platform”) , subject to any limits on users.As between Sponsor and TPA, TPA owns all right, title, and interest in and to the TPA Platform and all IP rights therein, including any data related to, or derived from, the use and performance of the TPA Platform. Sponsor acknowledges that: (a) Solutions are provided on a multi-tenant, access only-basis and (b) Sponsor does not acquire any rights of ownership or exclusive use in any the TPA Platform or in any derivative work thereof or work product produced as a result of using the TPA Platform. “IP Rights” means all patents, trademarks (and associated goodwill therewith), trade secret rights, know how, copyrights and other forms of intellectual property rights and protections throughout the world, whether currently existing or hereafter developed or acquired and whether now known or hereafter recognized, including, without limitation, any internet domain names. Sponsor will ensure the security and Confidentiality of its Account Information and is responsible for all activities performed in the Hosted Service with its Account Information. Sponsor will not (and Sponsor will not permit any third party to): (i) make the Hosted Service available to any third party (via a services arrangement, service bureau, lease, sale, resale, or otherwise); (ii) modify, adapt, or otherwise create a derivative work of the Hosted Service; (iii) circumvent any usage or access limits on the use of the Hosted Service; (iv) damage, disable, overburden, impair, or disrupt the Hosted Service or attempt to gain unauthorized access to any systems or networks that connect thereto or otherwise interfere with the operation of the Hosted Service or in any way with the use or enjoyment of the Hosted Service by others; or, (v) use the Hosted Service in any unlawful manner or for any unlawful purpose or in any jurisdiction where any such use is illegal. Sponsor will immediately notify TPA in writing of any unauthorized use of any Account Information or the Hosted Service, in each case, that comes to Sponsor’s attention. In the event of any such unauthorized use by any third party that obtained access to the Hosted Service through Sponsor, Sponsor will take all steps necessary to terminate such unauthorized use. Sponsor will provide TPA with such cooperation and assistance related to any such unauthorized use as TPA may reasonably request.

4.2 By Sponsor. During the Term, Sponsor grants to TPA a non-exclusive right and license to: (i) store, use, and process any data provided by Sponsor (including eligibility files) (“Sponsor Data”) and/or any information provided by or on behalf of Participants (“Participant Data”) to provide the Platform and Services; (ii) de-identify and aggregate Participant Data with data from other sources to provide the Services and Platform, and/or improve its Products (“De-Identified Data”).; and (iii) reproduce, translate, encode, publish, use, and display any logos, trademarks, service marks, or content provided by Sponsor (“Sponsor Brand”) on any Sponsor-branded interfaces or materials included in Participant ship cards (“Sponsor Materials”; and (ii) display the Sponsor Brand in marketing materials solely for the purposes of identifying Sponsor as a client of TPA. Sponsor owns all right, title and interest in and to the Client Brand, Sponsor Data, Eligibility Files, and Sponsor Confidential Information (as defined below) (collectively, the “Client Materials”) and except for any rights granted herein, TPA acknowledges that it neither owns nor acquires any additional rights in and to the Client Materials. “IP Rights” means all patent, copyright, trademarks, trade secrets, know-how, techniques, concepts, ideas, methods, algorithms, models, formulas, and database rights, including any applications, continuations, and goodwill.

4.3 By Participant. TPA manages Participant Data for the benefit of such Participants in accordance with this Agreement, applicable Law and TPA’s Terms of Use, privacy policy, and any end-user agreements acknowledged by the applicable Participant (“Participant Agreement”). Nothing under this Agreement or any other agreement entered into between the Parties shall prevent or restrict TPA’s ability to seek a Software Participant’s acceptance of Participant Agreement prior to granting access to a Solution, which permits TPA to use Participant Data for any lawful purpose, including as necessary for the operations, administration, and development of TPA’s product or services and providing the Solutions to the applicable Participant.

4.4 Data Grants. TPA shall store all Sponsor Data in accordance with the Data Security Standards and Business Associate Agreement attached as Appendices D and E of this Agreement (“Security Policies”) and all Applicable Laws, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Clinical Health (“HITECH”) Act,(“HIPAA”) and ERISA. Sponsor agrees that TPA may permit persons physically located outside of the United States (“Offshore Resource”) to access Sponsor Data (including Protected Health Information (“PHI”)) and Participant Data where: (a) access to Sponsor Data and Participant Data is strictly limited to connection via virtual desktop infrastructure (“VDI”) provided, monitored, and maintained by TPA within the United States (“Secure Remote Worker Application”); (b) each offshore resource is employed directly by TPA at a location owned or operated by TPA or by a U.S. Based Subcontractor that is subject to and compliant with HIPAA and regulations promulgated by the U.S. Department of Health and Human Services, and for the acts and omissions of which TPA remains liable; and (c) TPA ensures that any computer used by Offshore Resources to remotely access Secure Remote Worker Application via the VDI is technically restricted from simultaneously accessing the Internet or using any virtual private network or any other third party network while logged on to the VDI; and (d) the VDI prevents downloading, printing, extracting, storing or transmitting the information and/or data through personally owned, rented, or borrowed equipment, including but not limited to, laptops, personal digital assistants, instant messaging devices, Universal Serial Bus (“USB”) devices, and cell phones. Sponsor acknowledges and agrees that in the event Sponsor prohibits use of an Offshore Resource that complies with the forgoing conditions, such withholding or delay shall excuse TPA from any delay in meeting resolution service level agreements associated with any issue, defect, or break for which an Offshore Resource was offered and shall result in an increase to the applicable Fees. Notwithstanding the foregoing, TPA may disclose the information: (i) in response to a court order; (ii)for an examination conducted by the Commissioner of Insurance; (iii) for an audit or investigation conducted under ERISA; (iv) to, or at the request of, Sponsor or its stop-loss/reinsurance carrier; or (v) with the written consent of the individual identified by the information, or their legal representative.

5. FEES AND EXPENSES; PAYMENTS

5.1 Service Fee. Sponsor shall pay all fees set forth in the ASA (“Fees”) within fifteen (15) days of the date of TPA’s invoiceand all disputed amounts within ten (10) business days of resolution of such dispute. Any undisputed amounts shall accrue interest at a rate equal to the greater of: (i) one and a half percent (1.5%) per month, or (ii) the highest rate permitted by Applicable Law. Sponsor agrees to pay all amounts due without any setoff, deduction, or withholding for any reason. If TPA does not receive payment of any sum within fifteen (15) days of the invoice, TPA may suspend the Services until the default has been cured to TPA’s satisfaction. Failure to timely pay fees shall also be deemed a breach of this Agreement and TPA may terminate this contract in accordance with Section 1 of this Agreement.

5.2 Change of Service Fees. TPA reserves the right to change the Service Fees applicable to the Agreement at any time, provided TPA provides written notice of such change at least thirty (30) days prior to the effective date for the new Service Fees in the following situations: (a) that the then-current Service Fees have been applicable for a period of twelve (12) months; or (b) any time there are changes to this Agreement or the Plan, which affect the Service Fees; or (c) when there are changes in laws or regulations which affect, change or increase the Services TPA is providing or will be required to provide; or (d) if there is a decrease in the eligible census count of greater than ten percent (10%) over a three (3) month period of time.

5.3 Audit. TPA shall maintain records in accordance with generally accepted accounting principles and practices and in accordance with statutory requirements and Applicable Laws. During the Term, Sponsor shall have the right to audit books and records at its own expense to substantiate TPA’s Fees (“Fee Audit”). Additionally, Sponsor will have the right to perform, at its own expense, an audit for purposes of claims payment accuracy (“Claims Audit”). All Fee Audits and Claims Audits shall be subject to confidentiality protection and shall be subject to TPA availability, and no more than once annually. Sponsor agrees to pay TPA the Service Fee set forth in the Fee Schedule for Services not previously listed for any TPA staff time required by such an audit. Sponsor also agrees that TPA will have the right to submit written responses to any audit findings, and that such written responses will be included in any audit report which is prepared.

5.4 Liability for Benefits. It is understood and agreed that payment of benefits under the Plan is the sole liability of Sponsor, and that TPA shall not have any liability for such benefits, specifically includes Medicare Secondary Payer Claims and contractual obligations under provider network agreements. .

5.5 Taxes and Other Assessments Nothing in this Agreement shall be deemed to confer on TPA any responsibility for any federal, state or local tax liability, (excluding its own income and payroll taxes), which may be imposed upon TPA, Sponsor, Trust, Administrator, Fiduciary or any Participant or Beneficiary of the Plan. Sponsor shall promptly pay TPA any tax or charge, federal, state, or local, assessed against TPA which may be incurred by reason of (a) this Agreement, (b) a ruling or other determination by an Insurance Department or other governmental authority to the effect that any fees charged or payable hereunder or the amount of claim payments made in accordance with the Plan or this Agreement is an insurance premium and subject to the premium tax provisions of the applicable statutes, including any retroactive assessment; (c) any sales tax imposed on or related to TPA’s Services; or (d) a change in any charges relating to this Agreement and imposed on TPA exclusive of Federal or State Income Taxes.

5.6 Wellbeing Rewards. In the event that any Participant earns or accrues a reward but such Participant’s participation in the Platform is terminated by the Participant and/or the Sponsor, then such Participant shall have a period of thirty (30) days following the date of termination to redeem the applicable reward value. If the Participant fails to redeem the reward by such date (the “Expiration Date”), then TPA shall be entitled to retain all such unredeemed amounts (“Forfeited Rewards”) in consideration of its administration of the rewards and incentive program in lieu of charging any administration fee or service charge. Sponsor expressly acknowledges and agrees that the amount for Forfeited Rewards does not constitute a penalty of any kind but rather is an equitable allocation of the cost of incentive administration.

6. OBLIGATIONS OF SPONSOR

6.1 Plan Documents and Amendments. Sponsor shall provide TPA with all Plan Documents at least thirty (30) days prior to the Effective Date of this Agreement. Sponsor shall also notify TPA in writing of any changes in the Plan Documents at least thirty (30) days prior to the effective date of such changes. TPA shall have thirty (30) days following receipt of such notice of change to inform Sponsor whether they can and will administer such proposed changes. TPA shall not be held responsible for any delay or errors in claims administration caused by Sponsor’s failure to timely provide Plan Documents or notice of changes to Plan Documents. As applicable, provide and distribute in a timely manner, to Participants, all materials and documents, including but not limited to the Plan Document and forms or notices as may be necessary for the operation of the Plan or to satisfy requirements of governing law.

6.2 Census. Sponsor agrees to promptly furnish TPA such information in writing as may be necessary or required by TPA from time to time to maintain adequate records for eligibility of Sponsor’s Participants. TPA assumes no responsibility to verify employee or dependent eligibility under the Plan, either before or after a claim is made for benefits under the Plan.

6.3 Selection of Service Providers. Sponsor shall select the preferred provider network, pharmacy benefit manager, repricing services (if needed), auditor or any additional service providers (“Service Providers”). Engagement of a selected Service Provider will be performed as an accommodation and convenience to Sponsor and shall not result in liability or responsibility being imposed on TPA for any acts or omissions of the Service Provider. Each Service Provider is directly responsible to Sponsor who will pay any fees relating to the service.

6.4 Accessing Provider Networks. When accessing a preferred provider network, Sponsor will comply with provisions dealing with the payment of health care services and access fees of any applicable network provider agreements and any applicable network access agreement. Sponsor will be solely responsible to timely pay the network providers the reimbursement rates contained in the network provider agreements for covered services, as well as network access fees and any lost or forfeited discounts regardless of the reason. Sponsor will sign a written agreement that shows Sponsor’s acceptance of the terms of the network access agreement if required to do so by the network or provider.

6.5 Claims Funding. Sponsor shall establish a Sponsor Medical Claims Fund Account and shall: (a) maintain a positive balance in such account at all times; (b) provide funds to cover all outstanding claims payments within one (1) business day of notice, (c) deposit into the account an amount sufficient to enable TPA to initiate ACH debit transactions to release all checks drawn on the account for payment of medical claims for that period; (d) institute check tracing for missing checks, a stop payment order for any outstanding check that is missing, and notify TPA of such stop payment; and (e) reconcile the account on a monthly basis.

7. REPRESENTATIONS, WARRANTIES, AND DISCLAIMERS.

7.1 Representations; Warranties. Each Party hereby represents and warrants (a) that it is duly organized, validly existing and in good standing under the laws of its jurisdiction of incorporation or organization; (b) the execution and performance of this Agreement will not conflict with or violate any Applicable Law; and (c) that this Agreement, when executed and delivered, will constitute a valid and binding obligation of such Party and will be enforceable against such Party in accordance with its terms.

7.2 By TPA. TPA represents and warrants to Sponsor that: (a) the Solution shall perform in compliance with the product descriptions listed in the ASA; and (b) it shall perform the Services in a professional and workmanlike manner in accordance with Applicable Laws. Sponsor shall report any non-conformity with the foregoing warranties to TPA within ten (10) days after the date on which such failure first occurs. If TPA fails to remedy a non-conformity within thirty (30) days of such notice, then TPA’s entire liability and Sponsor’s sole and exclusive remedy for such failure, shall be for Sponsor to terminate the ASA by written notice to TPA and receive a pro rata refund of any prepaid fees.

7.3 By Sponsor. Sponsor represents and warrants: (a) that it shall use TPA Data in accordance with this Agreement; (b) that it is solely responsible for the program design of its Plan; (c) that it will obtain and maintain in effect all required reporting elements and/or consents required under Applicable Law to allow TPA to provide the Services on Sponsor’s behalf and (d) that its Plan and Sponsor shall comply with all Applicable Laws including in connection with: (i) its use and design of any custom questions added to Sponsor’s health risk assessment or Sponsor designed and built custom Surveys and (ii) obtaining and maintaining in effect all consents required by the Telephone Consumer Protection Act (“TCPA”) and the Health Insurance Portability and Accountability Act of 1996 as amended (“HIPAA”) to allow TPA to host and process Sponsor Data and/or to authorize TPA to send SMS or pre-recorded messages using an autodialer (“Calls”) on Sponsor’s behalf and promptly reporting to TPA any revocations of consent or opt-outs it receives; and (d) it will not use the Solution for as a replacement for medical services or other critical uses where the failure or the potential failure of the Services can cause injury, harm or death

7.4 Exclusive Warranties; Disclaimer of Warranties. THE WARRANTIES CONTAINED IN THIS SECTION 7 CONSTITUTE THE EXCLUSIVE WARRANTIES MADE BY TPA AND, TO THE MAXIMUM EXTEND PERMITTED BY APPLICABLE LAW, TPA EXPRESSLY DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, EXCEPT AS SET FORTH IN THIS SECTION 7, ALL SOLUTIONS AND SERVICES ARE PROVIDED ON AN “AS IS,” “WHERE IS” AND “AS AVAILABLE” AND TPA DOES NOT WARRANT THAT THE SOLUTIONS OR SERVICES WILL MEET SPONSOR’S REQUIREMENTS OR WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT ALL ERRORS WILL BE CORRECTED. TPA IS NOT RESPONSIBLE FOR ANY DELAYS, DELIVERY FAILURES, OR OTHER DAMAGE RESULTING FROM USE OF THE INTERNET. TPA MAKES NO REPRESENTATION AS TO THE VERACITY OF ANY PARTICIPANT DATA. THE PARTIES AGREE THAT SPONSOR SHALL BE A THIRD PARTY BENEFICIARY OF AGREEMENTS MADE BETWEEN TPA AND CERTIFIED PARTNER(S) FOR THE BENEFIT OF SPONSOR’S PARTICIPANTS. THE PARTIES AGREE THAT TPA IS NOT A CARE PROVIDER AND DOES NOT PROVIDE DIAGNOSTIC SERVICES OR MEDICAL ADVICE. THE SOLUTIONS, SERVICES AND CONTENT ARE NOT INTENDED TO BE A SUBSTITUTE FOR ANY MEDICAL EVALUATION, EXAMINATION, ADVICE, DIAGNOSIS OR TREATMENT. FURTHER, THE CONTENT PROVIDED THROUGH THE SERVICES IS NOT MEDICAL ADVICE, IS FOR INFORMATIONAL PURPOSES ONLY AND IS INTENDED TO PROVIDE BROAD USER UNDERSTANDING OF VARIOUS HEALTH-RELATED TOPICS. THE PARTIES HEREBY IRREVOCABLY DISCLAIM AND OPT-OUT OF ALL APPLICABLE PROVISIONS OF THE UNIFORM COMMERCIAL CODE, THE UNIFORM COMPUTER INFORMATION TRANSACTIONS ACT AND ANY OTHER LAW THE PROVISIONS OF WHICH ARE IMPLIED IF NOT DISCLAIMED OR OPTED-OUT OF BY THE PARTIES.

8. INDEMNIFICATION.

8.1 By TPA. TPA agrees to defend Sponsor, and its directors, officers, employees, and agents (“Related Parties”) against any and all claims by any third party and pay for any resulting judicially determined (or agreed in a settlement) losses and costs (“Losses”) directly arising out of or related to (a) any claim that any Solution or TPA’s provision of any Services infringes any third party’s IP Rights (a “Infringement Claim”); or (b) an unauthorized disclosure or access to PHI stored on TPA’s systems (“Incident Claim”). TPA will not be liable for an Infringement Claim based on (i) modifications made to the Solution by Sponsor; or (ii) the use or combination of the Solution with non-TPA programs. In the event of an Infringement Claim, TPA may, at its option, either (A) obtain for Sponsor, at no additional cost, the right to continue to use the Solution or receive the Services, (B) replace or modify the Solution or Services to eliminate the Infringement Claim, or (C) terminate the Agreement and refund to Sponsor a pro rata portion of any pre-paid but unused Fees paid for the Solution or Services. THIS SECTION STATES TPA’S ENTIRE OBLIGATION AND LIABILITY WITH RESPECT TO ANY INFRINGMENT CLAIM OR INCIDENT CLAIM.

8.2 Indemnification of TPA. Sponsor agrees to indemnify, defend, release, and hold harmless TPA and its Related Parties from and against any Losses, arising out of or related to: (a) a claim by any Plan Participant, health care provider, or network claiming benefits or right to payment under the Plan; (b) Sponsor’s breach of any Applicable Law, including failure of any Plan to comply with Applicable Law; (c) data sharing with Sponsor Plan Participant, health care provider, or network at the direction of Sponsor; (d) the Client Data; (e) any failure by Sponsor to obtain any consents required under the TCPA; (f) Sponsor’s mis-use of Sponsor administrative tools, including but not limited to the Platform, or (g) the gross negligence of Sponsor or Sponsor’s reckless acts or omissions.

8.3 Indemnification Procedure. The party seeking indemnification (the “Indemnified Party”) shall provide the party obligated to provide such indemnification (the “Indemnifying Party”) with: (a) prompt written notification of the claim; (b) sole control and authority over the defense or settlement of the claim; and (c) reasonable assistance. The Indemnifying Party may settle the claim provided that if any settlement requires any action or admission by the Indemnified Party other than payment of money, the Indemnifying Party shall obtain Indemnified Party’s prior written consent. Failure by the Indemnified Party to provide prompt notice of a claim shall not relieve the Indemnifying Party of its obligations unless such failure or delay materially prejudices the defense of the claim.The Indemnified Party will have the right, at its option, to defend itself against any such claim or to participate in the defense thereof by counsel of its own choice at its own expense

8.4 Limitation of Liability – Indirect Damages. NEITHER PARTY SHALL BE LIABLE TO THE OTHER, OR TO ANY OTHER PERSON, FOR ANY SPECIAL, EXEMPLARY, INDIRECT, PUNITIVE, INCIDENTAL, RELIANCE, OR CONSEQUENTIAL DAMAGES, INCLUDING ANY DAMAGES RESULTING FROM LOSS OF USE OF DATA OR THE SERVICES, LOST BUSINESS, LOSS OF GOODWILL, LOST REVENUES, FAILURE TO REALIZE ANTICIPATED SAVINGS, OR LOST PROFITS, AND ANY OTHER DAMAGES FOR ECONOMIC LOSS ARISING OUT OF OR RELATED TO THIS AGREEMENT OR THE INSTALLATION, IMPLEMENTATION, CUSTOMIZATION, USE, INABILITY TO USE, OPERATION OR SUPPORT OF THE SERVICES.

8.5 Limitation of Liability – Damages Cap. NOTWITHSTANDING ANYTHING SET FORTH HEREIN, TPA’S MAXIMUM AGGREGATE LIABILITY TO SPONSOR FOR ANY LOSS ARISING OUT OF OR RELATED TO THIS AGREEMENT OR THE INSTALLATION, IMPLEMENTATION, CUSTOMIZATION, USE, INABILITY TO USE, OPERATION OR SUPPORT OF THE SOLUTION OR SERVICES SHALL NOT EXCEED THE TOTAL FEES PAID AND/OR PAYABLE BY SPONSOR IN THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT(S) GIVING RISE TO SUCH LIABILITY. NOTWITHSTANDING THE FOREGOING, THE LIMITATIONS OF LIABILITY SET FORTH IN THIS SECTION 8 SHALL NOT APPLY TO LIABILITY OF EITHER PARTY RELATED TO SUCH PARTY’S OBLIGATION OF INDEMNIFICATION, WHICH LIABILITY SHALL BE LIMITED IN THE AGGREGATE OVER THE ENTIRE TERM OF THIS AGREEMENT TO FIVE MILLION DOLLARS ($5 MILLION).

8.6 Statute of Limitations. Either party seeking indemnification or any other damages under the terms of the Agreement or any ASA must commence litigation within twenty-four (24) months of the date of the act giving rise to such liability, irrespective of when the Party learns of such acts, or such litigation will be deemed barred as untimely.

9. CONFIDENTIAL INFORMATION.

9.1 Confidential Obligations The Parties acknowledge that during the performance of this Agreement, each Party will have access to certain written or oral information disclosed by the other that has been identified as confidential or that or should be known to a reasonable person given the facts and circumstances of the disclosure, as being confidential or proprietary (“Confidential Information”). The Parties agree to treat and maintain as confidential and proprietary all Confidential Information furnished by the other Party pursuant to or in connection with this Agreement and an ASA to the same extent and with the same degree of care as it uses in handling its own confidential and proprietary information of similar nature (but with not less than a reasonable degree of care), and further agree not to use such Confidential Information for any purpose other than the performance of any obligation under this Agreement or an ASA. Neither Party shall disclose any Confidential Information to anyone other than each Party’s respective employees or its legal counsel, auditors, agents or consultants (collectively, “Representatives”) who are subject to appropriate confidentiality policies or are bound by appropriate confidentiality agreements with terms at least as protective as the terms set forth in this Section 9 and who have a need to know the Confidential Information.

9.2 Confidentiality Exceptions. Notwithstanding the foregoing, Section 9.1 will not apply to Confidential Information that (a) is publicly available or in the public domain at the time disclosed; (b) is or becomes publicly available or enters the public domain through no fault of the recipient; (c) is rightfully communicated to the recipient by persons not bound by confidentiality obligations with respect thereto; (d) is already in the recipient’s possession free of any confidentiality obligations with respect thereto at the time of disclosure; (e) is independently developed by the recipient; or (f) is approved for release or disclosure by the disclosing Party without restriction; (f) consists of any comments, commentary on any new features, functionality or improvements for Products and/or error reports provided by Sponsor to TPA, provided that such use shall not identify Sponsor (“Feedback”); or (g) constitutes De-Identified Data. Either Party may disclose Confidential Information to the limited extent required to establish such Party’s rights under this Agreement or comply with the order of a court or other governmental body, provided that the Party making the disclosure pursuant to the order shall first have given written notice to the other Party and make a reasonable effort to obtain a protective order. Sponsor agrees that it will not assert any limitations to TPA’s right to use the Feedback or entitlement to compensation or recognition for TPA’s use of the Feedback.

10. GENERAL PROVISIONS

10.1 Fair Reading and Joint Construction. The Agreement is a result of negotiations between the Parties and will not be construed strictly against or in favor of any Party but shall be considered to have been jointly drafted by the parties. The Parties intend that the Agreement will be given a fair reading and reasonable construction in accordance with the intentions of the parties.

10.2 Notices. All notices required by or relating to this Agreement will be in writing and will be sent by means of certified mail, postage prepaid, to the Parties at their respective addresses set forth in the ASA or addressed to such other address as the receiving Party may have given by written notice in accordance with this provision. All notices required by or relating to this Agreement may also be communicated by electronic communications provided that the sender receives and retains confirmation of successful transmittal to the recipient. Such notices will be effective on the date indicated in such confirmation.

10.3 Assignment; Delegation. Except in the case of merger, acquisition or sale of all, or substantially all, of a party’s assets or capital stock, neither Party shall assign any of its rights or delegate any of its duties under this Agreement without the express, prior written consent of the other Party, and, absent such consent, any attempted assignment or delegation will be null, void and of no effect.

10.4 Force Majeure. Except with respect to payment obligations hereunder, if a Party is prevented or delayed in performance of its obligations hereunder as a result of circumstances beyond such Party’s reasonable control, including, by way of example, Internet access outside of TPA’s control, war, terror, riot, fires, floods, epidemics, or failure of public utilities or public transportation systems, such failure or delay will not be deemed to constitute a material breach of this Agreement, but such obligation will remain in full force and effect, and will be performed or satisfied as soon as reasonably practicable after the termination of the relevant circumstances causing such failure or delay, provided that if such Party is prevented or delayed from performing for more than ninety (90) days, the other Party may terminate this Agreement upon thirty (30) days’ written notice.

10.5 Governing Law. This Agreement shall be governed by the laws of the State of Rhode Island (except for any conflicts-of-law principles of such state that would result in the application of the law of another State). Any legal action brought under or in connection with this Agreement shall be brought only in the United States District Court or the State Court sitting in the state of Rhode Island. Each Party waives any objection to such venue and agrees not to claim that any action has been brought in an inconvenient forum.

10.6 Dispute Resolution. Prior to the initiation of any litigation, a Party will provide written notice describing the dispute in reasonable detail and the Parties will use good faith efforts to resolve their dispute informally for sixty (60) days. The Parties will use good faith efforts to arrange personal meetings and/or telephone conferences as needed with representatives with the authority to resolve the dispute. However, after such sixty (60) day period, if the dispute has not been resolved, either party may commence litigation proceedings.

10.7 Injunctive Relief. The Parties acknowledge that misuses or disclosure of the other Party’s Confidential Information (or violation of other proprietary data rights) may give rise to irreparable injury to the other Party that is inadequately compensable in damages. Accordingly, either Party may seek and obtain injunctive relief against the breach or threatened breach of Confidential Information, pending resolution of any dispute and/or in addition to any other legal remedies that may be available. Each Party acknowledges and agrees that the covenants contained in this Section are necessary for the projection of legitimate business interest of the Parties and are reasonable in scope and content.

10.8. Affiliated Entities. TPA hereby represents and warrants to Sponsor that all representations and warranties made in this Agreement shall apply to Affiliates (as defined below). “Affiliate” of TPA means any other entity that directly or indirectly, through one or more intermediaries, controls, is controlled by, or is under common control with, such entity. The term “control” (including the terms “controlled by” and “under common control with” means the direct or indirect power to direct or cause the direction of the management and policies of the entity, whether through: (i) ownership of more than 51 % of the voting securities of such entity; or (ii) by contract.

10.9 Miscellaneous. This Agreement, as executed by the Parties, constitutes the entire Agreement of the Parties with respect to its subject matter and supersedes any and all oral or written representations, understandings, or agreements relating thereto. This Agreement has been drafted jointly by the Parties and any ambiguities shall not be construed in favor of or against either Party. This Agreement may be executed in any number of counterparts, each of which shall be deemed an original, but all of which shall constitute one and the same instrument. This Agreement may be modified only by an agreement in writing that is signed by both TPA and Sponsor. In the event of a conflict among the documents composing this Agreement, the order of precedence and control will be: (i)the Plan Documents; (ii) the ASA; and (iii) these Terms. If any provision of this Agreement is found to be unenforceable by a court of law, the parties shall negotiate in good faith to agree upon a substitute provision that is consistent with the intentions underlying the original provision and the remainder shall be enforced to the extent permitted by Law. No waiver will be valid unless in writing and signed by the Party against which such waiver is sought to be enforced. The waiver or failure of either Party to exercise any right will not be deemed a waiver of any future right. The following Sections shall survive termination or expiration of the Agreement for any reason: 3, 5, 6, 7, 8, 9 and 10. The Agreement is a result of negotiations between the Parties and will not be construed strictly against or in favor of any Party but shall be considered to have been jointly drafted by the parties. The Parties intend that the Agreement will be given a fair reading and reasonable construction in accordance with the intentions of the parties.

11. STOP LOSS SPECIFIC TERMS

11.1. GENERAL. SPONSOR ACKNOWLEDGES THAT TPA SHALL HAVE NO OBLIGATION TO REIMBURSE SPONSOR FOR ANY LOSSES NOT COVERED BY THE MEDICAL STOP-LOSS INSURER. SPONSOR SHALL NOT BE ENTITLED TO SEEK ANY DAMAGES OR RECOVERY AGAINST TPA RESULTING FROM, OR RELATING TO, ANY DENIAL OF REIMBURSEMENT UNDER ANY MEDICAL STOP-LOSS INSURANCE POLICY REGARDLESS OF THE REASON FOR SUCH DENIAL (INCLUDING BUT NOT LIMITED TO CONFLICTING LANGUAGE BETWEEN THE PLAN DOCUMENT AND THE STOP-LOSS POLICY CONCERNING CONDITIONS OR EXCLUSIONS OF BENEFITS, OR CONFLICTING LANGUAGE BETWEEN THE PLAN DOCUMENT AND THE TERMS OF ANY CONTRACT WITH A THIRD-PARTY VENDOR OR SERVICE PROVIDER SUCH AS NETWORK PROVIDER AGREEMENTS), WITH THE SOLE EXCEPTION BEING FOR DENIALS BASED SOLELY UPON THE REASON THAT SUCH REIMBURSEMENT REQUEST WAS NOT TIMELY SUBMITTED TO THE MEDICAL STOP-LOSS INSURER, AND WHERE TPA HAD POSSESSION OF THE CLAIM AND ALL DOCUMENTATION AND INFORMATION NEEDED TO PROCESS AND SUBMIT THE CLAIM (INCLUDING BUT NOT LIMITED TO NETWORK PRICING, MEDICAL REVIEWS, AND MEDICAL RECORDS) AT LEAST FIFTEEN (15) BUSINESS DAYS PRIOR TO THE DEADLINE FOR SUBMITTING CLAIMS TO THE STOP-LOSS INSURER UNDER THE THEN-APPLICABLE POLICY.

11.2 Payments Outside the Plan. Sponsor may instruct TPA to pay claims in TPA’s opinion are not payable under the Plan, upon the condition that it is hereby agreed that such instruction releases TPA from any liability in connection therewith. Sponsor hereby acknowledges that such payments may not qualify for credit toward or reimbursement from stop loss insurance coverage, if any, and as such are considered “outside” the Plan. Sponsor also hereby acknowledges that stop loss claims may not be covered by the stop loss carrier based on the stop loss policy and independent claim review for a variety of reasons including, but not limited to, payment of claims after the policy eligibility date or coverage interpretation. These are part of the anticipated liability of the Plan and Sponsor assumes all legal requirements, responsibility, and liability for such payments.

11.3 No Stop Loss Procurement. This Section 11.3 applies if Sponsor has not requested TPA assist with the procurement of its stop loss policy and is subject to Section 11.1 and 11.2 above. TPA agrees to submit claims to and attempt to obtain reimbursement from Sponsor’s medical stop-loss insurer; provided, however, that Sponsor acknowledges and agrees that TPA has not been contracted by Sponsor to procure Stop Loss coverage and therefore disclaims any losses related to Stop Loss coverage. Sponsor shall, and hereby does, agree to: (a) indemnify, defend, release, and hold harmless TPA from and against any Losses related to Stop Loss coverage; and (b) assume all liability related to procurement and operation of any Stop Loss Coverage related to the Plan.

11.4. Stop Loss Procurement Services. This Section 11.4 applies if Sponsor has requested TPA assist with the procurement of its stop loss policy and is subject to Sections 11.1 and 11.2 above.

If requested by Sponsor in writing, TPA shall prepare bid specifications for medical stop-loss insurance. Such stop-loss insurance is intended to provide reimbursement to Sponsor in the event medical claims exceed selected attachment points.
TPA shall submit bid specification prepared at Sponsor’s request to insurers and/or managing general underwriters that have authority to bind one or more insurers that TPA believes will provide suitable bids. Sponsor shall review and specifically approve in writing any disclosure form that is submitted to a prospective insurer. The number of insurers to which TPA will submit bid specifications is small when compared with the total number of insurers issuing medical stop-loss insurance. TPA selects this small number of insurers for many reasons, including the size and rating of the insurer, TPA’s claim paying experiences with the insurer and other factors relevant to the suitability of the insurer. The fitness of any such Stop Loss coverage is a decision made by Sponsor and is not determined by TPA. Any such Stop Loss coverage is issued by an independent party and TPA does not guarantee solvency or fitness of purpose of any such coverage. As such, TPA disclaims any losses related to Stop Loss coverage. Sponsor shall, and hereby does, agree to: (a) indemnify, defend, release, and hold harmless TPA from and against any Losses related to Stop Loss coverage; and (b) assume all liability related to procurement and operation of any Stop Loss Coverage related to the Plan.
TPA and/or Sponsor’s broker may receive a commission or other remuneration from the issuing stop-loss insurance provider upon placement of the medical stop-loss. TPA may receive a contingent commission dependent upon the volume and persistency of the premium, but not dependent on the loss ratio of the coverage. The amount of any commissions received by TPA may vary depending on which insurer is selected, and TPA will provide further information and disclosure of such fees upon request by Sponsor once an insurer is selected.
TPA agrees to submit claims to and attempt to obtain reimbursement from Sponsor’s medical stop-loss insurer.
Sponsor acknowledges that TPA shall have no obligation to reimburse Sponsor for any losses not covered by the medical stop-loss insurer. Sponsor shall not be entitled to seek any damages or recovery against TPA resulting from, or relating to, any denial of reimbursement under any medical stop-loss insurance policy regardless of the reason for such denial (including but not limited to conflicting language between the Plan Document and the stop-loss policy concerning conditions or exclusions of benefits, or conflicting language between the Plan Document and the terms of any contract with a third-party vendor or service provider such as network agreements), with the sole exception being for denials based solely upon the reason that such reimbursement request was not timely submitted to the medical stop-loss insurer, and where TPA had possession of the claim and all documentation and information needed to process and submit the claim (including but not limited to network pricing, medical reviews, and medical records) at least fifteen (15) business days prior to the deadline for submitting claims to the stop-loss insurer under the then-applicable policy.
Sponsor shall indemnify, hold harmless, and defend TPA and its Related Parties from and against any and all Losses which arise from any acts, failure to act, or the manner of performance of acts related to Plan’s Stop Loss coverage. The foregoing indemnity shall not be subject to any limitations of liability set forth herein.

DATA SECURITY STANDARTS APPENDIX

1. Scope; Definitions: TPA shall comply with the requirements set forth in this Appendix. This Appendix relates to Services whereby TPA collects, accesses, processes, stores, transfers, transmits, uses, discloses, or otherwise handles any Personal Data. In the event of a conflict or inconsistency between any provision of this Appendix and the Agreement, the more stringent requirement shall prevail. Capitalized terms in this Appendix not herein defined are defined in the Agreement or have the following meanings:

a.“Agreement” shall mean the agreement between Sponsor and TPA to which this Appendix is attached.
b. “Personal Data” shall mean, relative to the Services provided to Sponsor, any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; including individually identifiable information contained in Eligibility Files and Participant Data, each as defined in the Agreement.
c. “PII” shall mean information (i) that identifies an individual, (ii) with respect to which there is a reasonable basis to believe the information can be used to identify an individual, or (iii) is considered personally identifiable information by applicable codes, laws, guidelines, rules or regulations, including, without limitation, industry self-regulation. The term PII shall also include any “Personal Data” as defined in the General Data Protection Regulation (Regulation (EU) 2016/679).
d. “TPA” shall have the meaning outlined on page 1 of the Agreement.
e. “TPA Personnel” shall mean each director, officer, manager, employee, representative and each natural person employed or retained by TPA.
f. “TPA Sites” shall mean locations owned or leased by TPA from which it provides services to its Sponsors
g. “Security Incident” shall mean any confirmed unauthorized access, disclosure, misappropriation, theft, loss, acquisition, or use of Personal Data.
h. “Services” shall mean the services to be provided and performed by TPA pursuant to the Agreement.
i. “Systems” shall mean hardware, software, networks, applications and other equipment that comprise a technical environment used to store or process Personal Data.
j. “Industry Standard Security Practices” shall mean the core security practices appropriate to the TPA’s business and services which are commonly implemented as standards across the information technology industry. For example, many of the authoritative sources listed in the HITRUST CSF, ISO-27001, SOC2 and NIST CSF.
k. “Security Policies” shall mean TPA’s policies for securing information or data according to Industry Standard Security Practices and in compliance with applicable laws and regulations. Typically, Security Policies are high level instructions to management on how the organization is to be run with respect to Industry Standard Security Practices.

l. “User” shall mean TPA Personnel authorized by TPA to access Personal Data stored on any TPA Systems.

2. Information Security Program: TPA has established and, during the term of the Agreement, will maintain:

a. An ongoing program of Security Policies and controls that comply with the HITRUST Common Security Framework, ISO-27001, SOC2, or similar Industry Standard Security Practices.

b. A Security Incident management program intended to detect and respond to Security Incidents.

c. A security awareness and training program that includes both User and administrator training in methods, procedures, and security.

d. A Business Continuity / Disaster Recovery (BCDR) program in place for critical systems used for storing, transmitting, or processing Personal Data or used for business-to-business communications that includes documented policies and plans, and must test that plan at least annually.

e. Change control procedures for any Systems TPA uses to store, transmit, transfer, or process Personal Data for Sponsor.

f. Procedures to conduct periodic independent security risk evaluations and penetration tests to identify critical information assets, assess threats to such assets, determine potential vulnerabilities, and provide for timely remediation for TPA’s key Systems used to deliver the Services.

g. A vulnerability management program to assess and manage threats to the TPA’s Systems with timely remediation of issues found.

3. Physical Access: TPA has established and, during the term of the Agreement, will maintain:

a. Physical controls to protect Personal Data stored in any TPA data center.

b. Appropriate facility entry controls are in place to limit physical access to systems that store or process data.

c. Processes to block access to facilities by default and only grant such access on a “need to know” basis.

d. Processes to monitor access to any facility where TPA processes Personal Data.

e. Controls to physically secure all Personal Data and to properly destroy such information when no longer needed using a process equal to or above that specified by NIST Special Publication 800–88, Guidelines for Media Sanitization, such that the Information cannot be retrieved.

f. Procedures to store securely hardcopy documents, removable media or portable devices containing Personal Data where access is limited to a need-to-know basis.

g. Procedures to ship physical copies of Personal Data, when required to do so under the Agreement, using secure, reputable shipping services with shipment tracking and confirmed deliver options.

4. Logical Access: TPA, with respect to the internal systems used to support the Services, has established and, during the term of the Agreement, will maintain:

a. Appropriate mechanisms for User authentication and authorization in accordance with a restricted “need to know” and “principle of least privilege” policy, including restrictions on copies and backup copies of all Personal Data.

b. Procedures to remove or update User access when a User’s role changes or terminates.

c. Procedures to monitor and review User access to validate that User access grants are in line with their current roles.

d. Multi-Factor authentication for any remote Users or internet facing applications, User portals, User VPN’s, virtual desktops or similar internet facing exposures.

e. Controls to enforce access restrictions for remote Users, contractors, and service providers.

f. Timely and accurate administration of User account and authentication management.

g. Processes to assign unique IDs to each User with computer access and limit use to such User.

h. Processes to change any vendor supplied defaults for passwords and security parameters for Systems prior to deployment.

i. Controls to validate that User passwords meet minimum length and complexity requirements, and are appropriately changed, managed, and maintained on a regular basis consistent with Industry Standard Security Practices.

j. Mechanisms to track all access to Personal Data by unique ID to individual Users, and recording the date, time, individual, and nature of the access in a log file, such log files to be kept for a minimum of 1 year.

k. Mechanisms to encrypt or hash all passwords in storage.

l. Processes to immediately revoke accesses of inactive accounts or terminated/transferred Users in a timely manner, not to exceed 24 hours.

m. Controls to restrict copy and paste functions or any other method of information disclosure to the minimum necessary to provide the Services.

5. Subcontractors and Third Parties: When TPA engages a subcontractor to store, collect, or process Personal Data, TPA will enter into an agreement with such subcontractor that includes data protection terms and provisions substantially similar to those contained in this Appendix. When Sponsor directs TPA to exchange Personal Data with, or otherwise collaborate with, a third party in relation to the Services, Sponsor will be responsible for enforcing relevant data protection terms against such third party and TPA will be entitled to rely on Sponsor to conduct any relevant security assessment.

6. Background Checks and Screening: Prior to the start of employment, TPA shall conduct, or require a relevant third party to conduct, criminal background checks on TPA Personnel, in alignment with Industry Standard Security Practices.

7. Security Architecture and Design: TPA has established and, during the term of the Agreement, will maintain:

a. A security architecture designed to support Industry Standard Security Practices.

b. Documented and enforced technology configuration standards.

c. Processes to encrypt Personal Data, including all backup copies of the same, in transmission and in storage, including storage on any portable media when such media is required to perform the Services, using current industry standard methods (AES 256bit or higher).

d. Processes for regular testing of security systems and processes on an annual basis or more frequently as appropriate.

e. A system of effective firewall(s) and intrusion detection technologies to protect Personal Data.

f. Database and application layer design processes that include data protection requirements to protect Personal Data that is collected, processed, and transmitted through such systems.

g. Procedures to backup critical systems that contain Personal Data no less frequently than weekly.

8. System and Network Management: TPA has established, and during the term of the Agreement, will maintain:

a. Mechanisms to keep Systems security patches current by installing all high risk or higher patches as soon as they can safely be installed but in any event within 90 days from learning about the patch.

b. Processes to monitor, analyze, and respond to security alerts issued by hardware and software vendors.

c. Appropriate network security design elements that provide for segregation of data.

d. Anti-virus and malware detection software on all Systems processing Personal Data to protect against malicious software, or processes in place to scan on at least a daily basis.

e. Appropriate data loss prevention (DLP) controls to protect Personal Data;

f. Processes to regularly verify the integrity of installed software and determine if any compromise of Personal Data.

g. Documented change control process to manage all changes to Systems.

9. Security Incident Notification: TPA will be responsible for detecting and responding to Security Incidents. Upon becoming aware of a Security Incident, TPA will report such Security Incident within three (3) business days by providing a written notification to the Sponsor. In the event of a Security Incident, (a) TPA will cooperate with Sponsor to comply with any legal requirement to notify individuals whose Personal Data has been or may have been compromised as a result of a Security Incident; provided that in no event will TPA serve any notice or publicize a Security Incident without the prior written consent of Sponsor, unless required by applicable laws, and (b) upon Sponsor’s request, engage a mutually acceptable, regionally recognized third party to perform or assist with forensic analysis. TPA will deliver the results of any such analysis to Sponsor in accordance with the confidentiality and notice provisions of the Agreement.

10. Right to Audit: TPA agrees to provide, upon written request, written attestation or third-party certification of TPA’s compliance with industry standard security framework audits such as HITRUST, ISO-27001, SOC 2, PCI-DSS, NIST sp800-53, or similar as validation of TPA compliance with this Data Security Standard on an annual basis, or as reasonably required in response to a Security Incident involving TPA or provided service(s). In the event TPA is unable to produce the forms of validation as indicated above, then TPA agrees to submit to the Sponsor the organization’s Standardized Information Gathering (“SIG”) to address any Sponsor risk assessment questions.