SERVICES AND LICENSE AGREEMENT
SERVICES AND LICENSE AGREEMENT
AGREEMENT made as of the 1st day of January, 2005 (“Effective Date”), by CareAdvantage, Inc. (“CareAdvantage” or “CAI”), a Delaware corporation with its principal place of business at 000-X Xxxxx Xxx Xxxxx, Xxxxxx, Xxx Xxxxxx 00000, and Xxxxxx Foundation Health Plan of the Northwest, (“Kaiser”), with its principal place of business at 000 XX Xxxxxxxxx Xx., Xxxxx 000, Xxxxxxxx, Xxxxxx 00000.
WHEREAS, CareAdvantage offers to process health care data through its proprietary RPNavigator software (which uses Clinical Risk Groups (“CRGs”) and to make the results available through its web-based RPNavigator Secure Information Portal (“Portal”);
WHEREAS, CareAdvantage also offers certain services with respect to health care data;
WHEREAS, Kaiser desires CareAdvantage to process certain health care data (e.g.., inpatient, outpatient, professional and pharmacy claims as well as physician encounter data), to license from CareAdvantage access to CareAdvantage’s RPNavigator Secure Information Portal and to purchase from CareAdvantage certain consulting services;
WHEREAS, Kaiser affiliates may desire CareAdvantage to process data for them in the future, in which event the parties agree that, except as provided below, additional agreements shall provide the terms and conditions of such undertakings;
WHEREAS, the parties have been operating under a Service Agreement dated as of February 9, 2004 (“Service Agreement”), which they now desire to replace with the instant agreement;
NOW, THEREFORE, in consideration of the premises the parties agree as follows:
1. Services.
1.1. Generally. During the term of this Agreement, CareAdvantage shall perform the services (“Services”) described in Attachment 1.1.
1.2. Additional Services. At Xxxxxx’x request, CareAdvantage shall perform such additional services as the parties may agree.
2. License.
2.1. Definitions. As used in this Agreement, the terms below are defined as follows:
(a) “Kaiser Data” means data provided to CareAdvantage by Kaiser pursuant to this Agreement.
1
(b) “Information” means all information made available through the Portal, including Kaiser Data that is categorized, aggregated, displayed, arrayed, or otherwise made available through the Portal.
(c) “PMPM” means Per Member Per Month.
(d) “Covered Population” means the members eligible to participate in Xxxxxx’x or Xxxxxx Permanente Health Alternative’s HMO, self funded, POS and other products.]
2.2. Grant of License. Subject to the terms and conditions of this Agreement, during the term of this Agreement CareAdvantage grants Kaiser the non-exclusive right to access and use CareAdvantage’s Portal. CareAdvantage will provide Kaiser with accounts accessible solely by password for fifteen (15) concurrent users. Kaiser may purchase licenses for additional concurrent users for an additional annual fee of $* per additional concurrent user.
2.3. Portal Access. Kaiser shall be responsible for obtaining the requisite common carrier communication lines and Internet connections to access the Portal.
2.4. Security. CareAdvantage requires and enforces 128 bit encryption for web access to the Portal. CareAdvantage will limit access to the Kaiser Data maintained at the Portal to those persons authorized by Kaiser and provided a password by Kaiser. Kaiser shall be responsible for the confidentiality of passwords assigned to it and shall be solely responsible for any authorized or unauthorized access to Kaiser Data using such passwords. In addition, Kaiser shall be responsible for the configuration and maintenance of the web browser software. CareAdvantage represents and warrants that its responses to Xxxxxx’x ASP Screening Questionnaire, transmitted via e-mail to Faith A. Long by Xxxxxx Xxxxx on September 10, 2004 at 9:38 a.m. are true and correct, and that CareAdvantage complies with the Standard for Security for Protected Health Information, codified at 45 CFR parts 160 and 164, subpart C. Within one (1) hour of discovering any security breach of the Portal or the Kaiser Data, CareAdvantage will notify Kaiser of the breach, its scope and CareAdvantage’s plan for remediation.
2.5. Ownership. Kaiser acknowledges that CareAdvantage represents that the Portal contains materials (including but not limited to programs, methods, design and screen formats) proprietary to CareAdvantage and/or to third parties (“Third Party Suppliers”) and licensed to CareAdvantage (collectively, “CareAdvantage Materials”). CareAdvantage and Third Party Suppliers retain title and ownership to the CareAdvantage Materials; provided, however, that in no event shall CareAdvantage Materials be deemed to include Kaiser Data, which shall remain the sole property of Kaiser.
| * | Portions of this page have been omitted pursuant to Confidential Treatment request and filed separately with the Commission. |
2
2.6. Proprietary Rights; Corporate Names. Kaiser understands and agrees that CareAdvantage and its Third Party Suppliers represent that they have proprietary rights in certain trademarks, service marks, trade names, corporate names and in the format of the reports used for displaying and arraying the Kaiser Data (the “Intellectual Property”). Kaiser agrees not to use such Intellectual Property other than as permitted under this Agreement Kaiser agrees not to alter, remove, or obscure any copyright notices or other proprietary notices on and in any part of the Portal.
2.7. Authorized Use of Portal and Information; Portal Availability.
2.7.1 Kaiser is authorized to use the Portal and Information solely in accordance with this Agreement. Kaiser is authorized to view the Kaiser Data in any of the reports available at the Portal, to print any such report, and to use any such report solely for its own purposes in marketing, providing and administering health insurance and benefits (including but not limited to making copies of such reports and providing copies of such reports to its customers, prospective customers or regulatory or accreditation bodies). Any other use of the Portal or Information by Kaiser is prohibited and except as authorized herein, Kaiser shall not transmit, divulge, or publish any part of the contents or substance of the Portal or in any way provide the Information, or any part thereof, to any other person; provided, however, that the foregoing shall not in any way limit Xxxxxx’x use of the Kaiser Data.
2.7.2 CareAdvantage will use commercially reasonable efforts to ensure that the Portal is accessible for a minimum of 99% of scheduled uptime (the “Portal Service Levels”). Scheduled uptime shall consist of 6:00 a.m. to 6:00 p.m. Pacific Time, Monday through Friday. Access to the Portal generally will be available at times other than scheduled uptime, except when CareAdvantge is conducting maintenance, but CareAdvantage cannot guarantee the extent to which the Portal will be accessible at these other times. CareAdvantage will notify Kaiser at least five (5) days in advance of any maintenance that may be required during scheduled uptime; provided, however, total down time for maintenance or other reasons shall not exceed 1% of scheduled uptime. Kaiser acknowledges and agrees that access to the Internet is subject to unexpected outages due to equipment failure that can occur through a variety of external causes, and which may have an affect on CareAdvantage’s ability to satisfy the Portal Service Levels. Kaiser agrees that CareAdvantage is not responsible for any unexpected outages of the Portal caused by external circumstances beyond CareAdvantage’s control. Kaiser may contact CareAdvantage to report problems with Portal access anytime twenty-four hours a day. CareAdvantage will use all commercially reasonable efforts in restoring unscheduled outages of the Portal whenever they occur. If the Portal Service Levels fall below 99% of scheduled uptime in one or more monthly periods, CareAdvantage will (i) use all reasonable efforts to diagnose the problem(s) causing the excessive downtime, as required, and (2) prepare and implement a remediation plan to resolve the issues. If, notwithstanding CareAdvantage’s remediation efforts, Portal Service Levels continue below 99% for a period of ninety (90) days or more, Kaiser may terminate the Agreement for cause, providing no further cure period, and pursue all of its available remedies at law and equity.
3
2.8. Warranties.
2.8.1. CareAdvantage warrants that it is the owner of the Portal and that it has the full power, authority and right to license such Portal in the manner set forth in this Agreement.
2.8.2 CareAdvantage represents and warrants that it is duly organized in its state of formation, that it is authorized to enter into this Agreement; and that entry into and performance under this Agreement are not prohibited by law, regulation, loan, security, financing, contractual or other agreement of any kind.
2.8.3 CareAdvantage warrants that the Portal as provided by CareAdvantage to Kaiser under this Agreement are CareAdvantage’ original work, or that CareAdvantage will have acquired all rights necessary to fulfill its obligations under this Agreement, including granting the license hereunder.
2.8.4. CareAdvantage shall comply with all federal, state and local laws, statutes, regulations and ordinances applicable to its provision of the Portal.
2.8.5. CareAdvantage represents and warrants that the Services under this Agreement shall be provided in a diligent, prompt, and professional manner by qualified individuals with the necessary knowledge and training to provide such Services.
2.9. Disclaimer of Warranty. EXCEPT AS PROVIDED ABOVE, CAREADVANTAGE HEREBY DISCLAIMS ANY AND ALL WARRANTIES WITH RESPECT TO THE PROGRAM AND MATERIALS, WHETHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.
2.10. Limitation on Damages. THE PARTIES UNDERSTAND AND AGREE THAT UNDER NO CIRCUMSTANCES SHALL EITHER PARTY BE LIABLE TO THE OTHER FOR CONSEQUENTIAL DAMAGES OR LOST PROFITS OR REVENUES RESULTING FROM OR IN ANY WAY RELATED TO ANY ACTION ARISING OUT OF THIS AGREEMENT, WHETHER IN CONTRACT, TORT, UNDER ANY WARRANTY THEORY, NEGLIGENCE, OR OTHERWISE, OR TERMINATION OF THIS AGREEMENT, EVEN IF THE PARTY HAS BEEN PREVIOUSLY ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, AND NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY HEREIN.
2.11. Intellectual Property Indemnification. CareAdvantage shall defend, indemnify and hold harmless Kaiser, and Xxxxxx’x parents, subsidiaries, directors, officers, members, employees, agents, successors and assigns from and against any and all claims, liabilities, losses, judgments, fines, assessments, damages, penalties, awards and other expenses of any kind or
4
nature whatsoever, including, without limitation, reasonable attorney’s fees, expert witness fees, and costs of investigation, litigation or dispute resolution (collectively “Claims”) arising out of or relating to any actual or alleged infringement or misappropriation (collectively “Infringement”) of any third party’s trade secrets, trademarks, copyright, or other intellectual property rights to the extent such Claims arise in connection with Xxxxxx’x (a) use, reproduction, distribution or display of the Information or the Services. Such obligation of CareAdvantage is contingent on (1) CareAdvantage being notified promptly in writing by Kaiser of any such Claim; (2) CareAdvantage having control of the defense and settlement of the Claim, provided that no settlement will be entered into that involves an admission of culpability by Kaiser or imposes an affirmative obligation on Kaiser without Xxxxxx’x prior written approval; and (3) Kaiser cooperating with CareAdvantage, at CareAdvantage’s expense, in all reasonable respects to facilitate the settlement or defense of the Claim. If CareAdvantage does not remedy the Infringement as set forth above, or is unable to make the allegedly infringing materials non-infringing, Kaiser may terminate this Agreement and its license granted hereunder and CareAdvantage shall refund a pro rata refund of the unused portion of the license fees paid hereunder.
2.12 Insurance and General Indemnity. CareAdvantage shall maintain or cause to be maintained sufficient insurance coverage as shall be necessary to insure CareAdvantage and its agents or subcontractors against any claim or claims for damages arising under this Agreement. Such insurance coverage shall apply to the Portal and to all services provided by CareAdvantage or its agents or subcontractors under this Agreement.
CareAdvantage shall indemnify, hold harmless and defend Kaiser and its affiliated entities from and against any and all claims, losses, liabilities, costs and other expenses (including reasonable attorneys’ fees and costs, and administrative penalties and fines) incurred as a result of, or arising directly or indirectly out of or in connection with any negligent or intentional act or omission of CareAdvantage, its agents or subcontractors, under this Agreement. The indemnification obligation of CareAdvantage shall survive termination of this Agreement.
3. Business Associate Addendum. CareAdvantage agrees to comply with the requirements relating to business associates in HIPAA and regulations promulgated thereunder by the U.S. Department of Health and Human Services (“HIPAA Regulations”). Such requirements as exist as of the Effective Date are set forth in Attachment 3, which is attached hereto and incorporated herein by reference. Attachment 3 may be modified periodically by the parties to accord with any changes to the obligations imposed by HIPAA or the HIPAA Regulations, and such modification shall be deemed accepted by the parties and shall serve to amend this Agreement if no written objection is submitted by either party to the other party within thirty (30) days of notice of such modification.
5
4. Compensation.
4.1. Generally. Kaiser shall pay CareAdvantage for the services and license provided under this Agreement * for each member in the Covered Population, commencing as of the Effective Date. Compensation shall be payable without invoice as of the last day of each month during the term of this Agreement. Payments made pursuant to the foregoing sentence shall be reconciled to the eligibility data for the Covered Population Kaiser makes available to CareAdvantage each recurring update, and CareAdvantage shall pay any reconciling adjustment to Kaiser within thirty (30) days of its making a determination that such adjustment is owing, and Kaiser shall pay any reconciling adjustment to CareAdvantage within thirty (30) days of CareAdvantage’s notifying it in writing that such adjustment is owing.
4.2. Additional Services. Kaiser shall pay CareAdvantage for Additional Services in accordance with Attachment 4.2, or on such other terms as the parties may agree.
4.3. Expenses. Kaiser shall reimburse CareAdvantage for CareAdvantage’s reasonable out-of-pocket expenses incurred in providing Services, including expenses for travel, lodging and meals. Kaiser shall pay CareAdvantage within thirty (30) days of its receipt of CareAdvantage’s invoice for such expenses.
4.4. Adjustments.
4.4.1. On Account of Changes in Kaiser Northwest’s Covered Population. CareAdvantage’s compensation under Section 4.1 has been determined by assuming that Kaiser Northwest will provide a Covered Population of at least 440,000 members. If the Covered Population increases beyond 499,999 members or decreases below 400,000 members, then in lieu of the * rate provided by Section 4.1, the rate shall be determined in accordance with Attachment 4.4.1.
4.4.2 On Account of CareAdvantage’s Agreeing to License Access and Use of the Portal for Additional Kaiser Divisions. In the event that CareAdvantage enters into an agreement with Kaiser to license access and use of the Portal with respect to members of an additional division of Kaiser, then CareAdvantage agrees to negotiate with Kaiser in good faith for a downward revision in the PMPM rate provided to the Northwest Division under this Agreement pursuant to Section 4.1 (as modified, if appropriate, by Section 4.4.1). The amount of the downwardly revised rate should reflect the number of new members from the additional Kaiser division for whom Kaiser provides data to CareAdvantage, the number of total members for whom Kaiser provides data to CareAdvantage, the number of new claims systems employed by the additional Kaiser division providing data to CareAdvantage, and the complexity of the business rules of the additional Kaiser division.
| * | Portions of this page have been omitted pursuant to Confidential Treatment request and filed separately with the Commission. |
6
4.5. Taxes. Kaiser shall be solely responsible for the payment of any taxes, charges or assessments, and any penalties or interest thereon, relating to the services or Xxxxxx’x access to and use of the Portal (except for income taxes, if any, imposed on CareAdvantage).
5. Term and Termination.
5.1. Term. The term of this Agreement shall commence on the Effective Date and continue in effect until December 31, 2006. Subsequently, this Agreement shall automatically renew for successive one-year terms unless either party provides the other with written notice of termination.
5.2 Termination. Either party may terminate this Agreement without cause by giving 90 days prior written notice; provided, however, that in the event Kaiser reasonably determines that the financial viability of CareAdvantage is in jeopardy, then Kaiser may terminate this Agreement by giving CareAdvantage 30 days prior written notice. Except as provided in the last sentence of Section 2.7.2, in the event that either party materially defaults in the performance of any of its duties or obligations under this Agreement and does not substantially cure such default or defaults within 10 business days after being given written notice specifying the default or defaults, then the non-defaulting party may terminate this Agreement immediately by giving notice to that effect to the defaulting party.
6. Defense of Litigation Except as provided by Section 2.8.1, each party shall be responsible at its own expense for defending itself in any litigation brought against it, whether or not the other party is also a defendant, arising out of any aspect of activities undertaken in connection with this Agreement. Each party agrees to provide the other party information in its possession which is necessary to the other party’s defense in such litigation.
7. Additional Requirements.
7.1. Independent Contractors. The relationship of the parties under this Agreement shall be that of independent contractors. Neither shall have any claim under this Agreement or otherwise against the other party as a joint venturer or partner.
7.2. Proprietary Rights. Subject to Section 2.6, neither party shall use the name, logos, trademarks, or servicemarks of the other without the other’s prior written consent, except that CareAdvantage may include the name Xxxxxx Foundation Health Plan of the Northwest in its listing of clients.
7.3 Financial Statements. Within one (1) business day of its filing an annual or quarterly report with the Securities and Exchange Commission, CareAdvantage shall provide Kaiser with a copy of such report. In each case, such report shall be sent to the attention of Xxxxxx’x Chief Financial Officer by email at Xxxxx.X.Xxxxxx@xx.xxx, or at such other email address Kaiser may specify in writing to CareAdvantage.
7
8. Miscellaneous.
8.1. Compliance with Laws. Each party shall, throughout the term of this Agreement, use its best efforts to be in continuous compliance with all applicable laws.
8.2. Notice. All notices and other communications hereunder shall be in writing and shall be deemed to have been given upon receipt, and shall be addressed as follows:
| If to Kaiser: | Xxxxxx Permanente | |||
| 000 XX Xxxxxxxxx Xx., Xxxxx 000, | ||||
| Xxxxxxxx, Xxxxxx 00000 | ||||
| Attention: Xxxxx Xxxxxx | ||||
| Vice President Finance and Chief Financial Officer | ||||
| If to CareAdvantage: | CareAdvantage, Inc. | |||
| Metropolitan Corporate Center | ||||
| 000-X Xxxxx Xxx Xxxxx | ||||
| Xxxxxx, Xxx Xxxxxx 00000 | ||||
| Attention: Xxxxxx Xxxxxx, | ||||
| President & Chief Executive Officer | ||||
8.3. Governing Law. This Agreement shall be construed in accordance with and governed by the laws of the State of Oregon without giving effect to the principles of conflicts of laws.
8.4. Entire Agreement. Except as provided herein, this Agreement and its attachments constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all previous proposals, both oral and written, negotiations, representations, commitments, writings and all other communications between the parties. It may not be released, discharged, or modified except by an instrument in writing signed by a duly authorized representative of each of the parties. As of the Effective Date, the Service Agreement shall terminate.
8.5. Binding Agreement; Assignability. This Agreement shall be binding upon and shall inure to the benefit of the parties hereto and their respective successors and permitted assigns and subcontractors. No party hereto shall sell, assign, transfer, convey, subcontract or otherwise dispose of its rights or obligations under, title to, or interest in, this Agreement, in whole or in part, to a third party other than a wholly-owned subsidiary without the prior written consent of the other party, which consent shall not be unreasonably withheld.
8
8.6. Severability. If any provision of this Agreement is determined by a court of competent jurisdiction to be invalid or unenforceable, such determination shall not affect the validity or enforceability of any other part or provision of this Agreement.
8.7. Disputes. In the event of any dispute between the parties hereto arising out of or concerning this Agreement, the parties agree to use their reasonable best efforts to resolve any such dispute amicably, in good faith, and expeditiously prior to resorting to litigation.
8.8. Injunctive Relief. The parties acknowledge that in the event of the breach of certain provisions of this Agreement, including Sections 2.6, 2.7 and 7.2, they may not have an adequate remedy at law and will suffer irreparable damage and injury. Therefore, in addition to any other remedy available, each party agrees that if it violates any of such provisions, the non-breaching party shall be entitled to injunctive relief, without bond, from a court of competent jurisdiction.
8.9. Waiver. No waiver by any party of any breach of any provision of this Agreement shall constitute a waiver of any other breach of that or any other provision of this Agreement.
8.10. Impossibility of Performance. No party shall be deemed to be in violation of this Agreement if prevented from performing any obligation hereunder due to matters that are beyond its control, including without limitation acts of war or terrorism, strikes, riots, floods, storms, earthquakes, other elements or acts of God or the public enemy, labor disputes, strikes, or shortages.
8.11. Counterparts. This Agreement may be executed in several counterparts, each of which is an original but all of which shall constitute one and the same instrument.
IN WITNESS WHEREOF, the parties have executed this Agreement as of the date set forth above.
| CAREADVANTAGE, INC. | XXXXXX FOUNDATION HEALTH PLAN OF THE NORTHWEST | |||||
| BY: | /s/ Xxxxxx Xxxxxx |
BY: | /s/ Xxxxx Xxxxxx | |||
| TITLE: | CEO |
TITLE: | CFO | |||
9
ATTACHMENT 1.1
On a quarterly basis, at the conclusion of each three (3) month period, Kaiser will provide CareAdvantage with paid claims data for all claims in the Covered Population. Within approximately four weeks of CareAdvantage’s receipt of this data, CareAdvantage will:
| • | Load data into data processing environment |
| • | Conduct technical and initial clinical review of data (review for completeness) |
| • | Run data through conversion program |
| • | Validate data conversion |
| • | Prepare\run data files though CRG algorithms |
| • | Validate CRG assignments (validity check) |
| • | Program reports to generate analyses with updated data elements |
| • | Review RPNavigator analyses results |
| • | Move into production environment |
| • | Deliver observations summary report (which would address significant changes from previous periods) |
Thereafter, CareAdvantage will conduct at least one day of on-site consulting per quarter, including data analytical and operational integration reviews.
During the term of this Agreement, CareAdvantage will maintain telephone support for technical and clinical inquiries 6:00 a.m. through 6:00 p.m., Pacific Time, Monday through Friday.
(The four-week schedule provided by this Attachment assumes that there will be no change in Xxxxxx’x claims system(s) and business rules from those provided by Kaiser to CareAdvantage on or before September 1, 2004. In the event of any such change, the four-week schedule is subject to adjustment, and any additional services required by CareAdvantage on account of such changes will be billed in accordance with Attachment 4.2.)
10
ATTACHMENT 3
ARTICLE I: DEFINITIONS
| 1.1 | General Rule. Capitalized terms not otherwise defined in this BA Exhibit shall have the same meaning as those terms in the Privacy Rule and the Security Rule. |
| 1.2 | HIPAA means the Health Insurance Portability & Accountability Act of 1996, P.L. 104-191. |
| 1.3 | HIPAA Regulations means the regulations promulgated under HIPAA by the U.S. Department of Health and Human Services, including but not limited to, the Privacy Rule. |
| 1.4 | KP OHCA means the Organized Health Care Arrangement formed by the Covered Entities comprising Xxxxxx Permanente’s integrated health care organization in the Northwest Region, including, as of the date of execution of this BA Exhibit, Xxxxxx Foundation Health Plan, Inc., Xxxxxx Foundation Health Plan of the Northwest, Xxxxxx Foundation Hospitals, and Northwest Permanente. P.C. Physicians & Surgeons. |
| 1.5 | Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information, codified at 45 CFR parts 160 and 164, Subparts A and E, as currently in effect. |
| 1.6 | Protected Information means Protected Health Information (“PHI”) provided by KP to Business Associate, or created or received by Business Associate on KP’s behalf. |
| 1.7 | Protected Health Information (PHI) shall have the meaning given to the term under the Privacy Rule, including by not limited to, 45 CFR Section 164.501. |
| 1.8 | Security Rule means the Standards for Security for the Protection of Electronic Protected Health Information, codified at 45 CFR parts 160 and 164, Subpart C, as will be in effect April 20, 2005. |
ARTICLE II: OBLIGATIONS OF BUSINESS ASSOCIATE
| 2.1 | General Requirements. Except as otherwise limited in this BA Exhibit, Business Associate may use or disclose Protected Information to perform functions, activities, or services for, or on behalf of, KP as described in Attachment A, attached hereto and incorporated herein, provided that such Use or Disclosure would not violate the Privacy Rule if done by KP. Business Associate and its agents and subcontractors shall only request, use, and disclose the minimum amount of Protected Information necessary to accomplish the purpose of the permitted Use or Disclosure. Business Associate agrees to comply with all applicable HIPAA Regulations. |
11
| 2.2 | Uses Permitted By Law. As permitted by the Privacy Rule, Business Associate may use or disclose Protected Information: (a) as is necessary for the proper management and administration of Business Associate’s organization, or (b) to carry out the legal responsibilities of Business Associate; provided, however, that any permitted Disclosure to a third party must be either Required By Law or subject to reasonable assurances obtained by Business Associate from the third party that the Protected Information will be held confidentially, and securely, and used or disclosed only as Required By Law or for the purposes for which it was disclosed to such third party, and that any breaches of confidentiality of the Protected Information which become known to such third party will be immediately reported to Business Associate. Business Associate shall notify KP in a timely manner prior to making any Disclosure of Protected Information Required By Law, to afford KP the opportunity to respond to the request for such a Disclosure. |
| 2.3 | Data Aggregation. Business Associate may provide Data Aggregation services relating to the Health Care Operations of KP. |
| 2.4 | Disclosures to Agents and Subcontractors. Business Associate shall ensure that any agent or subcontractor to whom it provides Protected Information agrees in writing to the same terms set forth herein regarding the Use and Disclosure and security of Protected Information, including, but not limited to, implementation of administration, physical and technical safeguards, notice of prohibited Use or Disclosure, mitigation of harmful effects, responses to requests for access and Amendment, and a term permitting immediate termination of the agent’s or subcontractor’s agreement with Business Associate for improper Use or Disclosure of Protected Information. Business Associate shall terminate its agreement with any agent or subcontractor to whom it provides Protected Information if such agent or subcontractor fails to abide by any material term of such agreement. |
| 2.5 | Safeguards. Business Associate shall implement and use appropriate safeguards as necessary to prevent the Use or Disclosure of Protected Information in any manner that is not permitted by this BA Exhibit, including but not limited to, safeguards designed to limit incidental Uses or Disclosures made pursuant to an otherwise permitted or required Use or Disclosure. |
| 2.6 | Notice of Prohibited Uses or Disclosures. Business Associate shall provide written notice to KP of any Use or Disclosure of Protected Information that is in violation of this BA Exhibit, the Privacy Rule, or other applicable federal or state law within five (5) business days of becoming aware of such Use or Disclosure. Business Associate shall also notify KP in writing within five (5) business days of receipt of any complaint that Business Associate receives concerning the handling of Protected Information or compliance with this BA Exhibit. |
12
| 2.7 | Mitigation. Business Associate shall mitigate promptly, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of Protected Information by Business Associate in violation of this BA Exhibit, the Privacy Rule, or other applicable federal or state law. |
| 2.8 | Access and Amendment. To enable KP to fulfill its obligations under the Privacy Rule, Business Associate shall make Protected Information in Designated Record Sets that are maintained by Business Associate or its agents or subcontractors available to KP for inspection, copying or amendment within ten (10) days of a request by KP. If an Individual requests inspection, copying or amendment of Protected Information directly from Business Associate or its agents or subcontractors, Business Associate shall notify KP in writing within five (5) business days of receipt of the request, and shall defer to, and comply with, KP’s direction in a timely manner regarding the response to the Individual regarding the request for inspection, copying or amendment. |
| 2.9 | Accounting. Business Associate shall implement a process for recording certain Disclosures of Protected Information by Business Associate (“Accounting Information”) in order to enable KP to comply timely with its obligations under the Privacy Rule including, but not limited to, 45 CFR Section 164.528. At a minimum, this Accounting Information shall include for each Disclosure not excepted from an individual’s right to an accounting under 45 CFR Section 164.528 recordation of (a) the name and date of birth of the Individual whose Protected Information was the subject of the Disclosure; (b) the date of Disclosure; (c) the name and address of the recipient of the Protected Information; (d) a brief description of the Protected Information disclosed; and (e) a brief statement of the purpose for the Disclosure that reasonably informs the Individual of the basis for the Disclosure. Within ten (10) days of notice from KP of a request for an accounting of Disclosures of Protected Information, Business Associate shall make available to KP this Accounting Information. In addition, for any month in which Business Associate makes a Disclosure of Protected Information, Business Associate shall provide Accounting Information during the subsequent month pertaining to KP, in a format and medium specified by KP. If an Individual requests an accounting directly from Business Associate or its agents or subcontractors, Business Associate must notify KP in writing within five (5) business days of the request, and shall defer to, and comply in a timely manner with, KP’s direction regarding the response to the Individual regarding the request for an accounting. Within thirty (30) days of receipt of notice that KP has implemented an electronic, web-based or other automated Disclosure accounting system, Business Associate shall begin recording all of Business Associate’s Accounting Information using KP’s system. Use of KP’s system in compliance with all applicable policies and procedures shall satisfy Business Associate’s obligation to implement the process required by this Section 2.9, or may be used in addition to Business Associate’s own process. KP shall provide Business Associate with information necessary to access and use KP’s system. Business Associate shall comply with KP’s policies and procedures applicable to the system, including, without limitation, the requirement that Business Associate record each Disclosure within a specified time period after the |
13
Disclosure is made, and that without regard to the date on which KP’s system is implemented, Business Associate promptly must load all Disclosures made on or after the Effective Date into KP’s system. Upon determination by KP that Business Associate has successfully implemented KP’s system, Business Associate may discontinue the monthly submission of Accounting Information otherwise required by this Section 2.9.
| 2.10 | Government Officials. Business Associate shall make its internal practices, books and records relating to the Use and Disclosure of Protected Information available to the Secretary of the U.S. Department of Health and Human Services (“Secretary”) for purposes of determining KP’s compliance with the Privacy Rule. Business Associate shall notify KP regarding any Protected Information that Business Associate provides to the Secretary concurrently with providing such Protected Information to the Secretary, and upon KP’s request, shall provide KP with a duplicate copy of such Protected Information. |
| 2.11 | Insurance and Indemnity. Business Associate shall maintain or cause to be maintained sufficient insurance coverage as shall be necessary to insure Business Associate and its agents or subcontractors against any claim or claims for damages arising under this BA Exhibit. Such insurance coverage shall apply to all site(s) of Business Associate and to all services provided by Business Associate or its agents or subcontractors under this BA Exhibit. |
Business Associate shall indemnify, hold harmless and defend KP and its affiliated entities from and against any and all claims, losses, liabilities, costs and other expenses (including reasonable attorneys’ fees and costs, and administrative penalties and fines) incurred as a result of, or arising directly or indirectly out of or in connection with any negligent or intentional act or omission of Business Associate, its agents or subcontractors, under this BA Exhibit. The indemnification obligation of Business Associate shall survive termination of this Agreement.
| 2.12 | Disclosure. To the extent that Business Associate creates, receives, maintains, or transmits electronic PHI, Business Associate shall also, effective April 20, 2005, implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any electronic Protected Information that may be transmitted in conformity with the requirements of the Security Rule. |
| 2.13 | Reporting of Security Incidents. Effective April 20, 2005, if the Business Associate creates, receives, maintains, or transmits electronic PHI, Business Associate shall appropriately report any security incident, as defined by the Security Rule. |
| 2.14 | Mitigation. Effective April 20,2005, or such other date on which compliance with the Security Rule is required (“Security Rule Effective Date”) Business Associate shall mitigate promptly, to the extent practicable, any harmful effect of a security incident for |
14
which Business Associate is responsible, or of which Business Associate is aware, that involves electronic Protected Information and is in violation of this BA Agreement, the Security Rule, or other applicable federal or state law.
ARTICLE III: OBLIGATIONS OF KP
| 3.1 | Notice of Privacy Practices. KP shall notify Business Associate of limitation(s) in its notice of privacy practices in accordance with 45 CFR Section 164.520, to the extent such limitation affects Business Associate’s permitted Uses or Disclosures. |
| 3.2 | Individual Permission. KP shall notify Business Associate of changes in, or revocation of, permission by an Individual to use or disclose Protected Information, to the extent such changes affect Business Associate’s permitted Uses or Disclosures. |
| 3.3 | Restrictions. KP shall notify Business Associate of restriction(s) in the Use or Disclosure of Protected Information that KP has agreed to in accordance with 45 CFR Section 164.522, to the extent such restriction affects Business Associate’s permitted Uses or Disclosures. |
| 3.4 | Prohibited Requests. KP shall not request Business Associate to use or disclose Protected Information in any manner that would not be permissible under the Privacy Rule if done by KP. |
| 3.5 | OHCA. The provisions of this BA Exhibit regarding the obligations and rights of KP, and the obligations owed by Business Associate to KP, shall be deemed to extend to every entity in the KP OHCA as if each such entity was a party to this BA Exhibit. |
ARTICLE IV: TERM AND TERMINATION
| 4.1 | Term. This BA Exhibit shall commence as of the Effective Date and shall continue in effect unless and until terminated by KP under this Section 4.1 or Section 4.2, below. KP may terminate this BA Exhibit, without cause, on five (5) days’ prior written notice to Business Associate. |
| 4.2 | Termination for Cause. If KP determines that Business Associate, or any of its agents or subcontractors, has breached any material provision of this BA Exhibit, which may include a pattern of activity or practice that constitutes a material breach, then KP, in its sole discretion, may (a) notify Business Associate of the material breach and request that it be cured; (b) terminate this BA Exhibit and KP’s business relationship with Business Associate immediately or upon such notice as KP may determine; or (c) report the material breach to the Secretary of the Department of Health and Human Services, if KP determines in its sole discretion that termination of its business relationship with Business Associate is infeasible. In the event that KP notifies Business Associate of the material breach and requests that it be cured under (a) above, but KP subsequently determines in |
15
its sole discretion that Business Associate has failed to cure the material breach to the reasonable satisfaction of KP, then KP may in its sole discretion follow the procedures set forth in (b) or (c) above without further notice.
| 4.3 | Effects of Termination. Upon termination of the business relationship between the parties and/or the BA Exhibit for any reason, Business Associate shall, at KP’s direction, return or destroy all Protected Information that Business Associate or its agents or subcontractors still maintain in any form, and shall retain no copies of such Protected Information. Upon KP’s request, Business Associate shall certify in writing that such return or destruction has occurred. If Business Associate determines that return or destruction is not feasible, Business Associate shall explain to KP in writing why conditions make the return or destruction of such Protected Information not feasible. If KP agrees that the return or destruction of Protected Information is not feasible, Business Associate shall retain the Protected Information, subject to all of the protections of this BA Exhibit, and shall make no further Use or Disclosure of the Protected Information, except as for those purposes that make the return or destruction of the Protected Information not feasible. In any event, upon termination of the business relationship between the parties and/or the BA Exhibit, Business Associate shall retain for no less than six (6) years the Accounting Information compiled by Business Associate pursuant to section 2.9 of this BA Exhibit, and shall make such Accounting Information available to KP within five (5) business days of a request. |
| 4.4 | Survival. The obligations of Business Associate under this Article IV shall survive the termination of the business relationship between the parties and/or the BA Exhibit. |
ARTICLE V: MISCELLANEOUS
| 5.1 | Assistance. In the event of an administrative or judicial action commenced against KP where Business Associate may be at fault, in whole or in part, as the result of its performance under this BA Exhibit, Business Associate agrees to defend or to cooperate with KP in the defense against such action. |
| 5.2 | Subcontracts and Assignment. Business Associate shall not subcontract its obligations, assign its rights, or delegate its duties under this BA Exhibit without the express written consent of KP. |
| 5.3 | Amendment. If any modification to this BA Exhibit is required for conformity with federal or state law or if KP reasonably concludes that an amendment to this BA Exhibit is required because of a change in federal or state law, or by reason of KP’s status as a business associate of another covered entity, KP shall notify Business Associate of such proposed modification(s) (“Required Modifications”). Such Required Modifications shall be deemed accepted by Business Associate and this BA Exhibit so amended, if Business Associate does not, within thirty (30) calendar days following the date of the notice, deliver to KP its written rejection of such Required Modifications. If Business Associate submits a written rejection of the Required Modification, KP may terminate its business |
16
relationship with Business Associate upon thirty (30) days written notice, or such longer period as may be required by law. Other modifications to this BA Exhibit may be made on mutual agreement of the parties.
| 5.4 | Business Relationship. Except as specifically required to implement the purposes of this BA Exhibit, and except to the extent inconsistent with this BA Exhibit, all terms of the business relationship between the parties shall remain in full force and effect. In the event of a conflict between the terms of the business relationship between the parties and this BA Exhibit, this BA Exhibit shall control. |
| 5.5 | Ambiguity. Any ambiguity in this BA Exhibit relating to the Use and Disclosure of Protected Information shall be resolved in favor of a meaning that furthers the obligations to protect the privacy and security of the Protected Information, whether electronic or other medium, in accordance with the Privacy Rule. |
| 5.6 | State Law. In addition to HIPAA and all applicable HIPAA Regulations, Business Associate shall comply with all applicable state and federal security and privacy laws. |
| 5.7 | Third Party Beneficiaries. Except as expressly provided for in this BA Exhibit or the Privacy Rule, there are no third party beneficiaries to this BA Exhibit. |
| 5.8 | Counterparts. This BA Exhibit and any attachments hereto may be executed in one or more counterparts; each counterpart shall be deemed an original. |
| 5.9 | Notices. All notices required or permitted to be given under this BA Exhibit shall be in writing and shall be sufficient in all respects if delivered personally, by nationally recognized overnight delivery service, or by registered or certified mail, postage prepaid, addressed as provided in Section 8.2 of this Agreement, and in the case of KP, to the attention of the Privacy Officer as well as to the Chief Financial Officer. Notice shall be deemed to have been given upon transmittal thereof as to those personally delivered, upon the first day after mailing as to those sent by nationally recognized overnight delivery service, and upon the third day after mailing as to those sent by United States Mail. The above addresses may be changed by giving notice in the manner provided for above. |
17
ATTACHMENT A
| 1. | Description of Business Relationship Between KP and Business Associate: |
Business Associate is an application service provider that processes health care data from Xxxxxx Foundation Health Plan of the Northwest and makes results available through a web portal, all as set forth in that certain Services and License Agreement to which this Business Associate Agreement is Attachment 3.3.
| 2. | Permitted Uses and Disclosures of Protected Information by Business Associate: |
None other than those specifically authorized in that certain Services and License Agreement to which this Business Associate Agreement is Attachment 3.3
.
18
ATTACHMENT 4.2
FEES FOR ADDITIONAL SERVICES
| CAI Standard Rates |
|||
| Consulting Level |
Daily Rates | ||
| Analyst |
$ | * | |
| Consultant |
$ | * | |
| Sr. Consultant |
$ | * | |
| Manager |
$ | * | |
| Sr. Manager |
$ | * | |
| Director |
$ | * | |
| Sr. Medical Director |
$ | * | |
| Vice President |
$ | * | |
| VP, National Medical Director |
$ | * | |
| * | Portions of this page have been omitted pursuant to Confidential Treatment request and filed separately with the Commission. |
19
ATTACHMENT 4.4.1
PMPM FEES FOR CHANGES IN COVERED POPULATION
| Covered Population |
PMPM Fees | ||
| 100,000-199,999 |
$ | * | |
| 200,000-299,999 |
$ | * | |
| 300,000-399,999 |
$ | * | |
| 400,000-499,999 |
$ | * | |
| 500,000-599,999 |
$ | * | |
| 600,000-699,999 |
$ | * | |
| 700,000-799,999 |
$ | * | |
| 800,000-899,999 |
$ | * | |
| 900,000-999,999 |
$ | * | |
| 1,000,000-1,499,999 |
$ | * | |
| 1,500,000-1,999,999 |
$ | * | |
| 2,000,000-2,499,999 |
$ | * | |
| * | Portions of this page have been omitted pursuant to Confidential Treatment request and filed separately with the Commission. |
20
