Common use of Records and Compliance Clause in Contracts

Records and Compliance. Contractor shall maintain records and other compilations of data pertaining to the use, access, collection, storage, and transfer of Protected University Data and make such available to the University or regulatory authorities (including, without limitation, the Secretary of the U.S. Department of Health and Human Services and public authorities in the EEA) upon request as reasonably necessary to demonstrate compliance with applicable laws, regulations, and lawful orders. System Development: If the Contractor provides system development, Protected University Data shall not be used in the development or test environments. Records that contain these types of data elements may be used if that data is first de-identified, masked or altered so that the original value is not recoverable. For programs that process Protected University Data, initial implementation as well as applied updates and modifications must be produced from specifically authorized and trusted program source libraries and personnel. Contractor shall provide documentation of a risk assessment of new system development or changes to a system. RIDER D SERVICES ENGAGEMENT FORM Services Engagement to Agreement for Services University of Maine System Agreement #______________ Agreement Date: ___________________ This Services Engagement is entered into as of the date of the last signature provided between __________________________ (“Contractor”) and _________________________________ (“Institution”). This Services Engagement shall be governed by the terms and conditions of the Master Agreement identified in this form. This form may not amend any terms or conditions of the Master Agreement other than to express an institution’s engagement with the Contractor. This Service Engagement Form when fully executed by the Parties’, provides authorization to engage for the following services, products and/or licenses, identified and as offered in Agreement Rider A & A-1: SERVICES / PRODUCTS / LICENSING (Term and Agreement Rider A-1 pricing must be specified below): SIGNATURES: Institution Contractor By: _______________________________ By: ________________________________ Name: _____________________________ Name: ______________________________ Title: ______________________________ Title: _______________________________ Date: ______________________________ Date: _______________________________ UMS - Contract for Services (Rev. 07/2020) Page 10 of 14

Records and Compliance. Contractor shall maintain records and other compilations of data pertaining to the use, access, collection, storage, and transfer of Protected University Data and make such available to the University or regulatory authorities (including, without limitation, the Secretary of the U.S. Department of Health and Human Services and public authorities in the EEA) upon request as reasonably necessary to demonstrate compliance with applicable laws, regulations, and lawful orders. System Development: If the Contractor provides system development, Protected University Data shall not be used in the development or test environments. Records that contain these types of data elements may be used if that data is first de-identified, masked or altered so that the original value is not recoverable. For programs that process Protected University Data, initial implementation as well as applied updates and modifications must be produced from specifically authorized and trusted program source libraries and personnel. Contractor shall provide documentation of a risk assessment of new system development or changes to a system. RIDER D SERVICES ENGAGEMENT FORM Services Engagement to Agreement for Services University of Maine System Agreement #______________ Agreement Date: ___________________ University of Maine System PO# _______________ This Services Engagement is entered into as of the date of the last signature provided between __________________________ (“Contractor”) and _________________________________ (“Institution”). This Services Engagement shall be governed by the terms and conditions of the Master Agreement identified in this form. This form may not amend any terms or conditions of the Master Agreement other than to express an institution’s engagement with the Contractor. This Service Engagement Form when fully executed by the Parties’, provides authorization to engage for the following services, products and/or licenses, identified and as offered in Agreement Rider A & A-1: SERVICES / PRODUCTS / LICENSING (Term and Agreement Rider A-1 pricing must be specified below): SIGNATURES: Institution Contractor By: _______________________________ By: ________________________________ Name: _____________________________ Name: ______________________________ Title: ______________________________ Title: _______________________________ Date: ______________________________ Date: _______________________________ UMS - Contract for Services (Rev. 07/2020) Page 10 of 1415

Records and Compliance. Contractor shall maintain records and other compilations of data pertaining to the use, access, collection, storage, and transfer of Protected University Data and make such available to the University or regulatory authorities (including, without limitation, the Secretary of the U.S. Department of Health and Human Services and public authorities in the EEA) upon request as reasonably necessary to demonstrate compliance with applicable laws, regulations, and lawful orders. System Development: If the Contractor provides system development, Protected University Data shall not be used in the development or test environments. Records that contain these types of data elements may be used if that data is first de-identified, masked or altered so that the original value is not recoverable. For programs that process Protected University Data, initial implementation as well as applied updates and modifications must be produced from specifically authorized and trusted program source libraries and personnel. Contractor shall provide documentation of a risk assessment of new system development or changes to a system. RIDER D SERVICES ENGAGEMENT FORM Services Engagement to Agreement for Services University of Maine System Agreement #______________ Agreement Date: ___________________ This Services Engagement is entered into as of the date of the last signature provided between __________________________ (“Contractor”) and _________________________________ (“Institution”). This Services Engagement shall be governed by the terms and conditions of the Master Agreement identified in this form. This form may not amend any terms or conditions of the Master Agreement other than to express an institution’s engagement with the Contractor. This Service Engagement Form when fully executed by the Parties’, provides authorization to engage for the following services, products and/or licenses, identified and as offered in Agreement Rider A & A-1: SERVICES / PRODUCTS / LICENSING (Term and Agreement Rider A-1 pricing must be specified below): SIGNATURES: Institution Contractor By: _______________________________ By: ________________________________ Name: _____________________________ Name: ______________________________ Title: ______________________________ Title: _______________________________ Date: ______________________________ Date: _______________________________ UMS - Contract for Services (Rev. 07/2020) Page 10 13 of 1417

Records and Compliance. Contractor shall maintain records and other compilations of data pertaining to the use, access, collection, storage, and transfer of Protected University Data and make such available to the University or regulatory authorities (including, without limitation, the Secretary of the U.S. Department of Health and Human Services and public authorities in the EEA) upon request as reasonably necessary to demonstrate compliance with applicable laws, regulations, and lawful orders. System Development: If the Contractor provides system development, Protected University Data shall not be used in the development or test environments. Records that contain these types of data elements may be used if that data is first de-identified, masked or altered so that the original value is not recoverable. For programs that process Protected University Data, initial implementation as well as applied updates and modifications must be produced from specifically authorized and trusted program source libraries and personnel. Contractor shall provide documentation of a risk assessment of new system development or changes to a system. RIDER D SERVICES ENGAGEMENT FORM Services Engagement to Agreement for Services University of Maine System Agreement #______________ Agreement Date: ___________________ This Services Engagement is entered into as of the date of the last signature provided between __________________________ (“Contractor”) and _________________________________ (“Institution”). This Services Engagement shall be governed by the terms and conditions of the Master Agreement identified in this form. This form may not amend any terms or conditions of the Master Agreement other than to express an institution’s engagement with the Contractor. This Service Engagement Form when fully executed by the Parties’, provides authorization to engage for the following services, products and/or licenses, identified and as offered in Agreement Rider A & A-1: SERVICES / PRODUCTS / LICENSING (Term and Agreement Rider A-1 pricing must be specified below): SIGNATURES: Institution Contractor By: _______________________________ By: ________________________________ Name: _____________________________ Name: ______________________________ Title: ______________________________ Title: _______________________________ Date: ______________________________ Date: _______________________________ RIDER E IMPLEMENTATION PLAN AND TIMELINE <<ENTER IMPLEMENTATION AND TIMELINE HERE>> UMS - Contract for Services (Rev. 07/2020) Page 10 11 of 1416

Records and Compliance. Contractor shall maintain records and other compilations of data pertaining to the use, access, collection, storage, and transfer of Protected University Data and make such available to the University or regulatory authorities (including, without limitation, the Secretary of the U.S. Department of Health and Human Services and public authorities in the EEA) upon request as reasonably necessary to demonstrate compliance with applicable laws, regulations, and lawful orders. System Development: If the Contractor provides system development, Protected University Data shall not be used in the development or test environments. Records that contain these types of data elements may be used if that data is first de-identified, masked or altered so that the original value is not recoverable. For programs that process Protected University Data, initial implementation as well as applied updates and modifications must be produced from specifically authorized and trusted program source libraries and personnel. Contractor shall provide documentation of a risk assessment of new system development or changes to a system. RIDER D SERVICES ENGAGEMENT FORM Services Engagement to Agreement for Services University of Maine System Agreement #______________ Agreement Date: ___________________ This Services Engagement is entered into as of the date of the last signature provided between __________________________ (“Contractor”) and _________________________________ (“Institution”). This Services Engagement shall be governed by the terms and conditions of the Master Agreement identified in this form. This form may not amend any terms or conditions of the Master Agreement other than to express an institution’s engagement with the Contractor. This Service Engagement Form when fully executed by the Parties’, provides authorization to engage for the following services, products and/or licenses, identified and as offered in Agreement Rider A & A-1: SERVICES / PRODUCTS / LICENSING (Term and Agreement Rider A-1 pricing must be specified below): SIGNATURES: Institution Contractor By: _______________________________ By: ________________________________ Name: _____________________________ Name: ______________________________ Title: ______________________________ Title: _______________________________ Date: ______________________________ Date: _______________________________ UMS - Contract for Services (Rev. 07/2020) Page 10 11 of 1415