MASTER SERVICES AGREEMENT

Exhibit 10.32

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

MASTER SERVICES AGREEMENT

This Master Services Agreement (“Agreement”) is made as of December 19, 2016 (the “Effective Date”), between:

United HealthCare Services, Inc., a Minnesota corporation with offices at 0000 Xxxx Xxxx Xxxx, Xxxxxxxxxx, XX 00000 (“Customer”), on behalf of itself and its Affiliates; and

Innovation Specialists, LLC d/b/a 2nd.MD, a Texas limited liability company with principal offices at 0000 Xxxx Xxx Xxxxxxxxx, Xxxxx 000, Xxxxxxx, Xxxxx 00000 (“Vendor”).

Any Affiliate of Customer may execute a SOW hereunder and in such case, all obligations of, and references to, Customer in this Agreement shall instead refer to such Affiliate. For purposes of this Agreement, “Affiliate” means any entity directly or indirectly controlled by, controlling, or under common control with Customer.

Section 1. Services

Section 1.1 Description of Services. Vendor shall provide to Customer the services (“Services”) as specified in statements of work to this Agreement that are signed by the parties from time to time in a form substantially similar as attached hereto as Exhibit A (“SOWs” or “Statements of Work”). SOWs and any and all other documents referenced as a part of this Agreement are hereby incorporated by reference into this Agreement. SOWs shall constitute the only authorization for Vendor to take any action that will result in expense to or otherwise on behalf of Customer. Customer does not guarantee Vendor any particular amount of work under this Agreement. The Services shall be performed at the locations identified in the SOW, or if not identified, from such location specified by Customer. Vendor shall not use subcontractors without Customer’s prior written consent. Vendor shall provide the Services in accordance with the service levels set forth on in the applicable Order or SOW (“Service Levels”). In the event that a Service Level has not been met, Vendor shall: (i) perform a root-cause analysis to identify the cause of such failure; (ii) promptly correct such failure within the timeframe set forth in the applicable SOW; and (iii) provide Customer with a written report detailing the cause of, and procedure for correcting, such failure within [***] after such Service Level failure has occurred. [***].

Section 1.2 Additional Exhibit Terms. Vendor agrees to comply with the requirements outlined in the following Exhibits attached to this Agreement, which are fully incorporated herein by reference.

Exhibit A – Form of Statement of Work

Exhibit B – Certificate of Compliance for Contractors and Suppliers

Exhibit C – Price List

Exhibit D – HIPAA and GLBA (Business Associate Agreement)

Exhibit E – Standard Contractual Clauses

Exhibit F – Security

Exhibit G – Background Investigations

Exhibit H – Medicare Advantage Regulatory Requirements Appendix

Exhibit I – Master Community & State Appendix

Exhibit J – Exchange Regulatory Appendix

Section 1.3 Personnel.

(A) General Requirements. The parties are independent contractors and nothing in this Agreement or otherwise shall be deemed or construed to create any other relationship, including one of employment, joint venture or agency. Vendor shall be solely responsible for any taxes of any type, including central, state or local tax, employment, withholding or reporting tax, social security taxes, workers’ compensation taxes or costs, unemployment compensation taxes or costs, or any other taxes or charges, provident fund, gratuity, bonus, workmen’s compensation, employee state insurance, other employment law deductions, or private insurance, related to Vendor’s or Vendor’s personnel’s receipt of compensation and performance of Services under this Agreement. Vendor has withheld properly all federal, state and local employment taxes from the wages of its employees and otherwise has conducted and will conduct itself not as an individual or individuals but as a legal entity separate from the persons actually performing the Services pursuant to this Agreement. In addition, Vendor agrees to inform all of its employees performing the Services that they are employees solely of Vendor, and are not eligible to any of Customer’s employee benefit plans, incentive, compensation or other employee programs or policies. Vendor will be solely responsible for compliance with immigration and visa laws and requirements, including compliance with the Immigration and Reform Control Act of 1986 (IRCA) with respect to Vendor employees and contractors. Vendor represents and warrants that all Vendor personnel (1) will hold appropriate and valid visas or other work authorizations for the jurisdiction in which such individuals will be working, each of which will be valid for a period at least equal to the anticipated duration of each such individual’s assignment to the Customer account, and (2) will not be provided by Vendor with any technology or information in violation of any export laws of the U.S. or any other relevant country. Vendor will provide, at no cost to Customer, adequate levels of training and education for Vendor personnel, so that they are properly educated, trained and fully qualified with respect to the Services they are to perform.

Customer Confidential Page 1 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

(B) Attrition; Removal. Vendor will use commercially reasonable efforts to keep the attrition rate to a reasonably low level. Notwithstanding the transfer, attrition or other turnover of Vendor personnel, Vendor remains obligated to perform the Services without degradation (including in accordance with applicable Service Levels) and in accordance with the terms of this Agreement. If Customer determines in good faith that the continued assignment of any Vendor personnel to Customer’s account is not in Customer’s best interests, then Customer may give Vendor written notice to that effect. After receipt of such notice, Vendor will promptly remove the person in question from Customer’s account and from any Customer facilities and will replace that person with another person of suitable ability and qualifications. Vendor retains the sole right to hire and fire Vendor personnel, and will be solely responsible for oversight of Vendor personnel and any decision to fire any Vendor personnel.

(C) Key Personnel. Each Statement of Work will set forth: (1) the names of all Vendor personnel performing Services under such Statement of Work, (2) the location of each such person, (3) whether a person is designated as “key” (“Key Vendor Personnel”), and (4) with respect to Key Vendor Personnel, the period of time such personnel will be assigned to performing the Services. Vendor will not assign any Key Vendor Personnel to the account of any Customer competitor while such individual is assigned to Customer’s account and for a period of six months following the date that such individual is removed from, or ceases to provide any services in connection with, Customer’s account.

(D) Background Checks and Compliance. Vendor will comply with the applicable requirements of Exhibit G (Background Investigations) before assigning an individual to perform Services. Further, Vendor will cause all Vendor personnel to (1) comply with Customer requests, rules and regulations, and policies regarding safety and health and personal and professional conduct while on site at Customer facilities, (2) comply with applicable requirements of the Vendor Code of Conduct (as defined in Section 5.12), and (3) otherwise conduct themselves in a professional and businesslike manner.

Section 1.4 Subcontracting and Offshoring.

(A) Subcontracting. Vendor may not subcontract any of its obligations under this Agreement without Customer’s prior written approval, which will not be unreasonably withheld (subject to Section 1.4(B)). Vendor will remain responsible for obligations, services and functions performed by subcontractors to the same extent as if such obligations, services and functions were performed by Vendor employees, and for purposes of this Agreement such work will be deemed work performed by Vendor. Vendor will be Customer’s sole point of contact regarding the Services, including with respect to payment. Vendor will not disclose Customer Confidential Information to a subcontractor unless and until such subcontractor has agreed in writing to protect the confidentiality of such Confidential Information in a manner substantially equivalent to that required of Vendor under this Agreement.

Customer Confidential Page 2 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

(B) Offshoring. Before providing any component of the Services from a location outside of the United States, Vendor must obtain Customer’s written approval, which may be withheld by Customer in its sole discretion. Before entering into a subcontract for work to be performed outside of the United States, Vendor must provide to Customer a description of the scope and material terms (other than financial) of the proposed subcontract. Customer will have the right to approve or disapprove of any such subcontracts and subcontractors in its sole discretion.

Section 2. Pricing and Payment Terms

Section 2.1 Fees. All charges for the Services are set forth in the applicable Statement of Work. Customer will not be required to pay Vendor any amounts for the Services other than (A) the charges in the applicable Statement of Work, and (B) reimbursable expenses, subject to Section 2.3. The parties agree and acknowledge that, except as set forth in the applicable Statement of Work, the charges will be inclusive of, and not subject to adjustment to account for, any inflation or cost of living increases or fluctuation in any currency exchange rates. [***]. Vendor is solely responsible for managing its resources so as to provide the Services in compliance with applicable Service Levels and the other terms of this Agreement and each applicable Statement of Work.

Section 2.2 Expenses; Taxes. All pass-through or out-of-pocket expenses for which Customer is responsible must be expressly identified in the applicable Statement of Work. If a Statement of Work provides that Customer will reimburse Vendor for travel expenses, Vendor will obtain Customer’s prior written approval for travel and all travel will be consistent with Customer’s Travel and Expense Policy, which is available for Vendor to review at xxxx://xxx.xxxxxxxxxxxxxxxxx.xxx/xxxxxxxxx/xxxxxxx.xxxx?. Customer will not be responsible for the payment or reimbursement of expenses not expressly identified as a Customer responsibility in the applicable Statement of Work. With respect to services or materials paid for on a pass-through expenses basis, Customer reserves the right to obtain such services or materials directly from a third party or designate the third party source for such services or materials. Vendor will use commercially reasonable efforts to minimize the amount of pass-through and out-of- pocket expenses. Customer will be responsible for the payment of any sales or use taxes levied on Services provided under this Agreement. Each party will be responsible for any personal property taxes on property it owns or leases, for franchise and privilege taxes on its business, and for taxes based on its net income or gross receipts.

Section 2.3 Invoicing and Payment. Vendor will invoice Customer on a monthly basis in arrears, unless otherwise set forth in the applicable Statement of Work. Vendor’s rates under any Statement of Work may not exceed those set forth on Exhibit C (Price List). As directed by Customer, Vendor will establish an electronic vendor account through the third party internet-based platform specified by Customer, through which Vendor will submit invoices to and receive purchase orders from Customer (the “eProcurement System”). In addition, Vendor will be responsible for any fees or charges imposed on Vendor associated with the eProcurement System, and will not pass such fees or charges through to Customer. If Customer has established an eProcurement System applicable to this Agreement, Customer will not be required to pay any invoice unless Vendor has submitted such invoice through the eProcurement System. Undisputed invoices will be due and payable by Customer within [***] after invoice receipt, or, in the case of invoices submitted outside of the eProcurement System, within [***] after invoice receipt. Customer’s payment of any invoice will not be construed as acceptance of the underlying Services. Vendor will provide invoices with sufficient detail to enable Customer to identify the SOW to which the fees pertain and, for Services provided on a time and materials basis, the invoice will contain the name of the individual performing the Services as well as the number of hours spent performing the Services.

Section 2.4 Disputed Fees; Set-Off. Customer may withhold payment of particular charges that Customer disputes in good faith, pending the resolution of such dispute, provided that Customer provides Vendor with written notice of the amounts being withheld and the reason for withholding such amounts. With respect to any amount to be paid by Customer under this Agreement, Customer may deduct from such amount any amount that Vendor is obligated to pay or credit to Customer.

Customer Confidential Page 3 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Section 3. Confidentiality

Section 3.1 Confidentiality Obligations. During the term of this Agreement, from time to time, either party may disclose (the “Disclosing Party”) or make available to the other party (the “Receiving Party”), whether orally, electronically or in physical form, confidential or proprietary information concerning the Disclosing Party and/or its business, products or services in connection with this Agreement (together, “Confidential Information”). Confidential Information of Customer includes, without limitation, business plans, health plan relationships, acquisition plans, systems architecture, information systems, technology, data, computer programs and codes, processes, methods, operational procedures, finances, budgets, policies and procedures, customer, employee, provider, member, patient and beneficiary information, claims information, vendor information (including agreements, software and products), product plans, projections, analyses, plans or results, the existence of any business dealings or agreements between Customer and Vendor, and any other information which is normally and reasonably considered confidential. Each party agrees that during the term of this Agreement and thereafter: (a) it will use Confidential Information belonging to the Disclosing Party solely for the purpose(s) of this Agreement; and (b) it will not disclose Confidential Information belonging to the Disclosing Party to any third party (other than the Receiving Party’s employees, contractors and/or professional advisors on a need-to-know basis who are bound by obligations of nondisclosure and limited use at least as stringent as those contained herein) without first obtaining the Disclosing Party’s written consent. Upon request by the Disclosing Party, the Receiving Party will return all copies of any Confidential Information to the Disclosing Party. Vendor hereby agrees that every individual person who performs under this Agreement shall execute the appropriate documents to undertake obligations of confidentiality consistent with the terms set forth herein. Vendor hereby agrees to provide evidence and/or copies of such duly executed documents to Customer upon request.

Section 3.2 Confidentiality Exclusions. For purposes hereof, Confidential Information will not include any information that the Receiving Party can establish by convincing written evidence: (a) was independently developed by the Receiving Party without use of or reference to any Confidential Information belonging to the Disclosing Party; (b) was acquired by the Receiving Party from a third party having the legal right to furnish same to the Receiving Party without disclosure restrictions; or (c) was at the time in question (whether at disclosure or thereafter) generally known by or available to the public (through no fault of the Receiving Party).

Section 3.3 Required Disclosures. These confidentiality obligations will not restrict any disclosure required by order of a court or any government agency, provided that the Receiving Party gives prompt notice to the Disclosing Party of any such order and reasonably cooperates with the Disclosing Party at the Disclosing Party’s request and expense to resist such order or to obtain a protective order.

Section 3.4 Customer Data. [***].

Section 3.5 Injunctive Relief. The parties acknowledge and agree that the disclosure of Confidential Information may result in irreparable harm for which there is no adequate remedy at law. The parties therefore agree that the Disclosing Party may be entitled to seek an injunction in the event the Receiving Party violates or threatens to violate the provisions of this Section 3, and that no bond will be required. This remedy will be in addition to any other remedy available at law or equity.

Section 3.6 HIPAA and GLBA. Vendor understands and acknowledges that Exhibit D (HIPAA and GLBA) attached hereto will apply in the event Vendor provides Services to Customer pursuant to which Vendor has access to, receives from, creates, or receives on behalf of Customer Protected Health Information, or Vendor has access to, creates, receives, maintains or transmits on behalf of Customer Electronic Protected Health Information (as those terms are defined under the privacy or security regulations issued pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and Subtitle D of the Health Information Technology for Economic and Clinical Health Act provisions of the American Recovery and Reinvestment Act of 2009 (“ARRA”)), and/or nonpublic personal information, as defined under the Xxxxx-Xxxxx-Xxxxxx Act and implementing regulations (“GLBA”), during the performance of its obligations under this Agreement.

Customer Confidential Page 4 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Section 3.7 EU Data Protection.      If the Services involve the creation, processing, retention, deletion, use or disclosure of personal data (as that term is defined under the EU Data Protection Directive), including of Customer employees and other individuals (“Personal Data”), then Vendor will comply, and will require that its personnel and subcontractors comply, with all applicable requirements of the EU Data Protection Directive, including, without limitation, ensuring that transfers of Personal Data to third countries are made only in accordance with the following: (a) the transfer is to a jurisdiction deemed by the European Commission to have an adequate level of protection; (b) the transfer is subject to contractual provisions approved by the European Commission such as, by way of example only, the Standard Contractual Clauses attached as Exhibit E, which the parties hereby adopt and incorporate into this Agreement by this reference; or (c) pursuant to a framework deemed adequate and approved by the European Commission. For purposes of this Agreement, the “EU Data Protection Directive” means Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and any legislation implementing or revising such directive in applicable EU member states.

Section 3.8 Customer IT Systems Security. Vendor acknowledges and agrees that its access to Customer’s information technology systems will be subject to the provisions of Exhibit F (Security).

Section 4. Work Product and Customer Property

Section 4.1 [***].

Section 4.2 Customer Property. [***].

Section 4.3 Residual Knowledge. Nothing contained in this Agreement will restrict a party from the use of any general ideas, concepts, know-how, methodologies, processes, technologies, algorithms or techniques retained in the unaided mental impressions of such party’s personnel relating to the Services which either party, individually or jointly, develops or discloses under this Agreement, provided that in doing so such party does not breach its obligations under Section 3 or infringe the intellectual property rights of the other party or third parties who have licensed or provided materials to the other party.

Section 5. Representations and Warranties; Compliance with Laws

Section 5.1 General Warranties. Vendor represents and warrants to Customer that: (a) it is duly incorporated and validly existing under applicable laws and in good standing in applicable business locations as required; (b) it has all necessary right, title, license and authority to enter into and perform its obligations under this Agreement; (c) Vendor has appropriate agreements with its employees and Customer-approved subcontractors to allow it to provide the Services in accordance with the terms of this Agreement; and (d) the person signing this Agreement (including each attachment) on behalf of Vendor has full authority to bind Vendor to the terms and conditions hereof.

Customer Confidential Page 5 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Section 5.2 Performance Warranties. Vendor represents and warrants to Customer that: (a) the Services performed and the work created under this Agreement will conform with all applicable laws, industry standards and Customer’s instructions and specifications; (b) Vendor will provide the Services in a workmanlike, professional, and ethical manner; (c) the Services performed and the Work Product created under this Agreement will not infringe the copyrights, patents, trade secrets or other intellectual property or other rights of any third party; (d) performing the Services will not conflict with any other agreements to which Vendor is a party; and (e) Vendor will not use any of its own proprietary materials in the Work Product without Customer’s prior written permission and an appropriate perpetual license to Customer.

Section 5.3 Viruses; Disabling Codes. Vendor warrants that any and all computer code and/or software created or modified for, or otherwise supplied to Customer: (A) contains only what is stated in the documentation provided; (B) is free of any open source code, spyware, and any master access key (ID, password, trap door, trojan horse, back door, etc.) to the system, and (C) immediately prior to its delivery to Customer, has been checked for and deemed free of any and all computer viruses and/or other destructive code using a regularly updated, industry-standard software package designed for such purpose (for example, the most current version of Symantec Norton Antivirus) and has been inspected by Vendor’s authorized personnel. In the event any computer code and/or software created or modified for, or otherwise supplied to Customer contains destructive code, then, in addition to any other remedies available to Customer, at Customer’s request, Vendor will, at no cost to Customer:

(1) restore to the fullest extent possible any and all data lost by Customer as a result of the destructive code, and

(2) provide and install a new copy of the computer code and/or software without the presence of destructive code.

Section 5.4 Pass-Through of Third Party Warranties. If third party software or hardware is acquired hereunder, Vendor agrees to pass through to Customer all warranties from such third party software vendors, in addition to the warranties provided in this Agreement.

Section 5.5 Additional Warranties; Disclaimer. Other warranties pertaining to the services or deliverables may be set forth in an applicable Statement of Work. OTHER THAN AS PROVIDED IN THIS AGREEMENT OR ANY STATEMENT OF WORK, THERE ARE NO EXPRESS WARRANTIES AND THERE ARE NO IMPLIED WARRANTIES, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

Section 5.6 Compliance with Laws. Vendor shall comply with all applicable federal, state, county, and local laws, orders, rules, ordinances, regulations, and codes, including without limitation Vendor’s obligations as an employer regarding the health, safety and payment of its employees. Vendor’s compliance shall also include identifying and procuring the required permits, certificates, approvals, and inspections in Vendor’s performance under this Agreement. In addition, Vendor certifies and represents its compliance with the federal laws set forth in Exhibit B, to the extent applicable. Vendor will promptly notify Customer of any change of status with regard to these certifications and representations. These certifications and representations are material statements of fact upon which Customer has relied with respect to this Agreement.

Section 5.7 Payment Card Industry. To the extent that Vendor, in the course of providing Services, stores, processes, transmits or otherwise obtains cardholder data, or performs any activities regulated by the Payment Card Industry (“PCI”) Security Standards Council, Vendor shall comply with the most current version of the PCI Data Security Standard, the PIN Transaction Security Standard, the Payment Application Data Security Standard, the Point-to-Point Encryption Solution Requirements and Testing Procedures, any other applicable program or requirement that is published and/or otherwise mandated by applicable card networks or the PCI Security Standards Council.

Section 5.8 Medicare Advantage. Vendor will comply with the terms of the Medicare Advantage Regulatory Requirements Appendix attached hereto as Exhibit H when performing administrative services or providing products under this Agreement that relate to Medicare Advantage Benefit Plans, as defined in Exhibit H (Medicare Advantage Regulatory Requirements Appendix).

Customer Confidential Page 6 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Section 5.9 Other Government Requirements. Vendor will comply with all applicable federal and state legal and regulatory requirements, including but not limited to those set forth in Exhibit I (Master Community & State Appendix) when performing services or providing products under this Agreement that relate to Medicaid and other state government regulated programs, and Exhibit J (Exchange Regulatory Appendix) when performing services or providing products under this Agreement that relate to public Exchanges (as defined in Exhibit J).

Section 5.10 Conflict of Interest.

(A) Vendor hereby represents and warrants to Customer that:

(1) There is no conflict of interest between Vendor’s other contracts, business relationships, revenue-sharing arrangements or other business activities, if any, and the Services to be provided to Customer pursuant to this Agreement, and Vendor will ensure that no such conflict arises during the term of this Agreement (which includes, but is in no way limited to, use of another’s confidential and proprietary information). Accordingly, Vendor agrees that it may not perform duties for any third party, if Vendor believes its duties to such third party may result in a conflict of interest relative to Vendor’s work for Customer, unless Vendor first notifies Customer in writing of the possible conflict of interest and obtains written consent from an authorized representative of Customer.

(2) Vendor will not use for the benefit of Customer any confidential information acquired from any third party and subject to a duty of confidentiality to such third party.

(3) Unless previously disclosed in writing to an authorized representative of Customer, (a) Vendor has not, for at least [***] before the Effective Date, acted as or been paid for services as a consultant, employee or in any other capacity, to any governmental entity with respect to procurement by such governmental entity of health insurance coverage or an administrative services agreement, or (b) participated in any capacity on behalf of a governmental entity in a decision-making capacity in connection with the procurement of health insurance coverage, administrative services agreement or any related services.

(B) Vendor agrees that during the term of this Agreement Vendor will not act as or be paid for services as a consultant for any governmental entity with respect to procurement of such governmental entity’s health insurance coverage or administrative services agreement. It is understood by the parties that Customer does not have the exclusive right to Vendor’s services.

Section 5.11 Utilization of MWVBE Suppliers. As used in this Agreement, “MWVBE Supplier” means a supplier who maintains a valid certification as a minority, women, or veteran (veteran, disabled veteran, service-disabled) business enterprise from any of the following organizations: (A) the National Minority Supplier Development Council (NMSDC), (B) the Women’s Business Enterprise National Council (WBENC), (C) the US Department of Veteran Affairs, or (D) any other third party certification organization approved in advance by Customer. Vendor agrees to provide MWVBE Suppliers with the maximum practicable opportunity to participate in any subcontracts or orders it may award in connection with this Agreement. Vendor will report on a quarterly basis, or as otherwise requested by Customer, the level of MWVBE Supplier participation in this Agreement.

Section 5.12 Additional Compliance Requirements. Vendor agrees to comply with the Anticorruption Policy and Vendor Code of Conduct, which may be found at xxxx://xxx.xxxxxxxxxxxxxxxxx.xxx/xxxxxxxxx/xxxxxxx.xxxx?.

Section 6. Insurance

Section 6.1 Required Coverage. During the term of this Agreement, Vendor will obtain and maintain, at its sole cost and expense, the insurance in the types and minimum amounts outlined below or as required by applicable law, whichever is greater, and any such additional insurance necessary to insure against claims that may arise from or in connection with its obligations under this Agreement, whether such obligations are performed by or on behalf of the Vendor:

Customer Confidential Page 7 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Coverage Type	Minimum Limits of Liability
Commercial General Liability	·  [***] ·  [***] ·  [***] ·  [***]
Worker’s Compensation	In accordance with the laws of the country, state, or province, or territory exercising jurisdiction over employees
Employer’s Liability (including “Stop Gap” Liability where applicable)	·  [***] ·  [***] ·  [***]
Umbrella	·  [***] ·  [***]
Professional Liability / Errors & Omissions Liability	·  [***] ·  [***]
Cyber Liability	·  [***] ·  [***]

Section 6.2 Insurance Ratings. Subject to the Vendor’s right to self-insure coverage as set forth below, insurance shall be issued by insurance companies authorized to conduct business within the jurisdiction in which Services are provided, with a minimum A.M. Best rating of A- VII in the current edition of Best’s Key Rating Guide.

Section 6.3 Additional Insurance Requirements. In the event that any insurance required by this Agreement is written on a claims-made basis, such insurance will have a policy retroactive date that coincides with or predates the Effective Date. Vendor will continue coverage, through either policy renewals or the purchase of an extended reporting period for not less than [***], beginning at the time obligations under this Agreement have been completed. Commercial general liability will include Customer and its Affiliates as additional insured(s) with respect to liability arising out of the Services. Professional liability / errors and omissions liability will provide coverage for liability for loss or damage due to an act, error, omission, or negligence arising from the Services. Cyber liability insurance will provide coverage for liability for damages claimed by third parties arising from data destruction, extortion, theft, hacking, and denial of service attacks impacting Vendor’s operations. Vendor may arrange any required insurance under separate policies for the full minimum limits of liability required, or by a combination of underlying policies and an umbrella or excess liability policy. Any umbrella or excess liability insurance policy will be adequate to satisfy the insurance requirements of this Agreement. Vendor may, with Customer’s prior approval (which shall not be unreasonably withheld), elect to self-insure, in whole or in part, in the amounts and types of insurance required herein. Vendor will (i) maintain a separate reserve or trust for its self- insurance, (ii) provide to Customer a copy of the most recent evaluation of its self-insurance funds prepared by an independent actuary, (iii) warrant that its self-insurance fund will comply with applicable laws and regulations, and (iv) fund its self-insurance funds in accordance with the recommendations of the independent actuary and assure that funds are available at all times to pay claims in the amounts required by this Section 6. The funding of deductibles and self-insured retentions, if any, maintained by Vendor are the sole responsibility of Vendor, including any deductibles or self-insured retentions applicable to claims involving Customer.

Section 6.4 Waiver of Subrogation. Except where prohibited by law, Vendor agrees to waive all rights of subrogation, including any rights of its insurers, against Customer and its Affiliates, under the commercial general liability, automobile liability, workers’ compensation, and employer’s liability coverage, with respect to losses, damages, claims, suits, or demands, however caused.

Section 6.5 Certificates of Insurance. On or before the Effective Date, and upon Customer’s request thereafter, Vendor will provide certificate(s) of insurance providing evidence that Vendor has complied with the insurance requirements set forth in this Agreement. Vendor will give [***] prior written notice to Customer in the event of any cancellation of the insurance required hereunder.

Customer Confidential Page 8 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Section 6.6 Notices. In the case of loss or damage or other event involving Customer or its Affiliates that requires notice or other action under the terms of any insurance coverage specified in this Section 6, Vendor will be solely responsible to take such action. Vendor will provide Customer with contemporaneous notice and with such other information as Customer may request regarding the event.

Section 6.7 Subcontractors. Except to the extent (i) otherwise stated in this Agreement, or (ii) agreed by Customer in writing, Vendor shall require, in writing, that each subcontractor adhere to the same insurance requirements as outlined in this Agreement. Vendor may (1) insure any subcontractors under its own policies, or (2) modify the applicable subcontractor’s insurance requirements, with the agreement that any deficiencies in such policies shall be borne by Vendor.

Section 6.8 Limits of Liability. All insurance required of Vendor to provide coverage to Customer and its Affiliates as additional insureds [***]. Such additional insured coverage will apply to [***]. The availability or unavailability of insurance coverage shall not limit, modify or otherwise impact Vendor’s other obligations and liabilities under this Agreement. Vendor’s obligation to maintain the insurance stipulated in this Section 6 shall be in addition to, and not in lieu of, Vendor’s other obligations hereunder, and Vendor’s liability to Customer shall not be limited to the amount of coverage required hereunder. Vendor’s insurance will apply separately to each insured against whom a claim is made or lawsuit is brought, except with respect to the insurer’s limits of liability.

Section 7. Indemnification

To the maximum extent allowed by law, Vendor will defend, indemnify and hold harmless Customer and its directors, officers, employees, and agents (collectively, the “Indemnitees”), from and against any and all claims, losses, damages, suits, fees, judgments, costs and expenses (collectively referred to as “Claims”), including attorneys’ fees incurred in responding to such Claims, that the Indemnitees may suffer or incur arising out of or in connection with: (a) Vendor’s breach of warranty or damages due to Vendor’s negligence or willful misconduct; (b) any allegation that the Indemnitees’ use of any goods or services (including without limitation any computer code and Work Product) created for or provided to Customer in connection with this Agreement constitutes an infringement, contributory infringement or violation of any patent, copyright, trade secret, trademark, or other third party intellectual property right or a misappropriation of a trade secret or other personal rights of a third party; (c) any breach by Vendor of its: (i) confidentiality obligations; (ii) obligations to comply with laws; (iii) obligations under Exhibit D or Exhibit F (if applicable); or (iv) obligation to pay any compensation, fees, salary, bonuses, mandatory or fringe employee benefits, social security, taxes or other withholdings which are alleged to be owed in respect of any personnel or contractors of Vendor; (d) any personal injury (including death) or damage to property resulting from Vendor, Vendor personnel or its agents’ acts or omissions; and (e) Vendor’s introduction of any unauthorized material, including without limitation, a “computer virus” or other contaminant into Customer’s environment. The Indemnitees will give prompt notice of any Claim to Vendor, and Vendor will defend the Indemnitees at the Indemnitees’ request. Vendor may settle, at its sole expense, any Claim for which Vendor is responsible under this Section 7 provided that such settlement shall not limit, unduly interfere, or otherwise adversely affect the rights granted herein, Vendor’s obligations under this Agreement, or impose any additional liability or obligation on Customer or does not contain an unconditional and full release of the Indemnitees’ in respect of such Claim. Customer reserves the right to participate in the defense and/or settlement of any Claim. [***].

Section 8. Liability

Section 8.1 Waiver of Damages. SUBJECT TO SECTION 8.2, IN NO EVENT, WHETHER IN CONTRACT OR IN TORT (INCLUDING BREACH OF WARRANTY, NEGLIGENCE AND STRICT LIABILITY IN TORT), WILL A PARTY BE LIABLE FOR INDIRECT OR CONSEQUENTIAL, EXEMPLARY, PUNITIVE OR SPECIAL DAMAGES, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES IN ADVANCE.

Customer Confidential Page 9 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Section 8.2 Exceptions; Cumulative Remedies. The limitations set forth in Section 8.1 will not apply with respect to: [***]. The remedies specified in this Agreement are cumulative and in addition to any remedies available at law or in equity.

Section 9. Organizational Resiliency and Force Majeure

Section 9.1 Resiliency Planning. Vendor will, at its sole expense, establish and maintain an organizational resilience program designed to protect physical, intangible, environmental and human assets critical to Vendor’s provision of the Services. Vendor’s organizational resilience program will identify and address significant hazards or threats that may impact the Services or Vendor’s critical assets. Vendor’s organizational resilience program will include, to the extent applicable, (i) risk assessments and controls, (ii) written business continuity plans for the Services and supporting facilities, (iii) written disaster recovery plans for critical technology and systems infrastructure, and (iv) corporate crisis management response protocols, as necessary to enable continued performance under this Agreement if any event (including a corporate crisis, technological accident, or human- caused event) should cause a material disruption of the Services or pose a significant threat to Vendor’s critical assets. Vendor’s organizational resilience program will be consistent with industry standards and best practices relevant to the healthcare industry, with any standards imposed on Vendor or Customer by a relevant regulatory authority, and with the specific requirements (if any) set forth in the applicable Statement of Work. Vendor will provide its organizational resilience program documentation (or relevant components thereof) to Customer for review at Customer’s request, within [***] of Customer’s request. In addition, Vendor will make available for discussion its personnel who are responsible for the organizational resilience program. Statements of Work under this Agreement may specify different obligations with respect to Vendor’s organizational resilience program or specific aspects of that program. These different obligations will apply to the Services or products provided under the applicable Statement of Work only, and will not be construed to apply to any other Statement of Work.

Section 9.2 Testing; Resiliency Reviews. Vendor will periodically update relevant components of its organizational resilience program to address changes to Vendor’s critical assets, the Services, and relevant regulatory requirements or private sector standards for organizational resiliency and corporate preparedness. In addition, Vendor will test the operability of all components of its organizational resilience program at least [***] (and more frequently, if required under a Statement of Work or under the terms of the relevant business continuity plan or disaster recovery plan) to confirm that such plans are fully operational. Vendor will functionally test disaster recovery plans for critical technology and systems infrastructure at least [***] and provide the results of such test to Customer at its request. At Customer’s request, Vendor will certify to Customer in writing that all components of Vendor’s organizational resilience program (specifically including business continuity plans and disaster recovery plans) are fully operational. At Customer’s request (no more than [***]), Vendor will participate in a resiliency review and will meet with Customer and provide Customer with all information (including detailed business continuity plans and disaster recovery plans) reasonably necessary for Customer to review Vendor’s organizational resilience program. If at any time Customer reasonably determines that Vendor is materially non-compliant with the organizational resiliency requirements set forth herein or in the applicable Statement of Work, or if Vendor fails to meet its obligations with respect to testing, certification, or participation in the resiliency review [***].

Customer Confidential Page 10 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Section 9.3 Implementation of Resiliency Plans. Upon the occurrence of any event that disrupts the provision of Services, Vendor will promptly implement the relevant components of its organizational resilience program (including relevant business continuity plans and disaster recovery plans) and will restore the disrupted Services within the earliest of: (a) the timeframes required in the relevant recovery/continuity plan, (b) the timeframes required in the applicable Statement of Work or elsewhere in this Agreement, or (c) otherwise as necessary to continue to meet applicable Service Levels. Vendor will not increase its charges or charge Customer any usage fees with respect to the implementation of any component of Vendor’s organizational resilience program. Whenever any event, including a Force Majeure Event, causes Vendor to allocate limited resources between or among Vendor’s customers, Vendor will not give any other customers priority over Customer, subject to the Service Levels or recovery time objectives set forth in this Agreement and any applicable Statement of Work.

Section 9.4 Force Majeure.

(A)            As used in this Agreement, a “Force Majeure Event” means an act of God, riot, civil disorder, or any other similar event beyond the reasonable control of a party, provided that the event is not caused, directly or indirectly, by such party. Notwithstanding the foregoing, no event will be considered a Force Majeure Event if and to the extent that the nonperforming party could have (1) prevented the event (or any resulting defaults or delays in performance) by taking reasonable precautions, or (2) circumvented the event (or any resulting defaults or delays in performance) through the use of alternate sources, workaround plans or other means (in the case of Vendor, including by meeting its obligations with respect to developing, maintaining and implementing an organizational resilience program as described in this Section 9 or an applicable Statement of Work).

(B)            Subject to Section 9.5, in the case of a Force Majeure Event the nonperforming party will be excused from further performance or observance of the obligation(s) so affected for as long as such circumstances prevail and such party continues to use commercially reasonable efforts to recommence performance to whatever extent possible without delay. Any party so delayed in its performance will promptly notify the party to whom performance is due by telephone and in writing and will describe at a reasonable level of detail the circumstances causing such default or delay.

Section 9.5 Alternate Source; Termination Rights.

(A)            With respect to Critical Services (as defined below), if the performance of all or a portion of such Critical Services is prevented or delayed (including by a Force Majeure Event) for more than [***], then Customer may procure such Services from an alternate source [***]. As used in this Agreement, “Critical Services” means those specific Services identified in the applicable Statement of Work as “critical,” [***]. The timeframes set forth in this paragraph may, for any or all components of the Services, be superseded by more specific requirements set forth in the applicable Statement of Work.

(B)            With respect to Non-Critical Services (as defined below), if the performance of all or a portion of such Non-Critical Services is prevented or delayed (including by a Force Majeure Event) for more than [***], then Customer may procure such Services from an alternate source[***]. As used in this Agreement, “Non-Critical Services” means all Services that are not Critical Services. The timeframes set forth in this paragraph may, for any or all components of the Services, be superseded by more specific requirements set forth in the applicable Statement of Work.

(C)            If the performance of any Services is prevented or delayed (including by a Force Majeure Event) for more than [***] (in the case of Critical Services) or [***] (in the case of Non-Critical Services), then Customer will have the option to terminate this Agreement or any impacted Statement of Work [***]. The timeframes set forth in this paragraph may, for any or all components of the Services, be superseded by more specific requirements set forth in the applicable Statement of Work.

Customer Confidential Page 11 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Section 10. Term and Termination

Section 10.1 Agreement Term and Termination. This Agreement shall commence and be effective as of the date above and shall continue until (a) terminated by Customer at any time with or without cause, upon written notice to Vendor without any charge, liability, or obligation whatsoever, except for payment for Services performed by Vendor specified in a SOW but not yet paid for by Customer; or (b) terminated by either party if the other party materially breaches or defaults on any of the provisions of this Agreement, and such breach is not cured within [***] after the breaching party receives written notice. Termination of this Agreement shall not impact any signed SOWs then in effect, which shall continue in effect until completed or otherwise terminated under Section 10.2 or Section 10.3, and shall be governed by the terms of this Agreement while in effect.

Section 10.2 SOW Termination for Convenience. The term of an SOW shall be as outlined thereunder. Upon [***] Customer may, for its own convenience and with or without cause, terminate any SOW, in whole or in part, without any charge, liability or obligation whatsoever except for payment for Services performed by Vendor but not yet paid for by Customer.

Section 10.3 SOW Termination for Cause. If either party materially breaches or defaults on any of the provisions of any SOW, and such breach is not cured within [***] after the breaching party receives written notice, then in addition to all other rights and remedies of law or equity or otherwise, the injured party shall have the right to terminate any SOW(s) impacted by such breach without any obligation or liability, at any time thereafter.

Section 10.4 Termination for Change of Control. Notwithstanding anything to the contrary in this Agreement or SOW, Customer may terminate this Agreement and/or a SOW without further liability, upon [***] in the event of a Change of Control of Vendor. For purposes of this Agreement, “Change in Control” means (a) the acquisition by any person, entity or group, within the meaning of Section 13(d)(3) or 14(d)(2) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), of beneficial ownership (as defined in the Exchange Act) of 20% or more of the outstanding shares of common stock of Vendor or the combined voting power of Vendor’s then-outstanding voting securities in a single transaction or series of related transactions; (b) a change in 50% or more of the directors of Vendor in any 12 month period; (c) a reorganization, merger, consolidation or share exchange in which the shareholders of Vendor immediately prior to such transaction hold less than 51% of the outstanding shares of Vendor after such transaction; (d) the sale (in a single transaction or a series of related transactions) of either: (i) all or substantially all of the assets of Vendor, or (ii) the assets which are provided to Customer hereunder or used to provide Services to Customer hereunder; or (e) the first purchase under any tender offer or exchange offer pursuant to which shares of Vendor common stock or other voting securities are purchased.

Section 10.5 Insolvency. Either party will have the right to immediately, or with such written notice as such party deems reasonable, terminate this Agreement and any SOWs in the event the other party: (a) ceases to do business as a going concern; (b) becomes subject to any bankruptcy or insolvency proceeding under federal or state statute (and if the proceeding is involuntary, it is not dismissed within 60 days of its commencement); (c) becomes insolvent or becomes subject to direct control by a trustee, receiver or similar authority; (d) has wound up, dissolved or liquidated, voluntarily or otherwise; (d) makes a general assignment for the benefit of its creditors; or (e) takes any action authorizing or in furtherance of any of the foregoing.

Section 10.6 Effect of Termination. Upon expiration or termination of this Agreement (or any SOW, as applicable) each party shall, upon the request of the other: (a) return all papers, materials and properties of the other held by such party; and (b) provide reasonable assistance in the termination of this Agreement, as may be necessary for the orderly, non-disrupted business continuation of each party. In no event will Vendor inhibit in any way Customer’s attempt to effect a smooth transition. At Customer’s option, upon termination of this Agreement or a Statement of Work for any reason, Vendor will: (1) certify to Customer in writing that all Confidential Information of Customer has been returned or destroyed, as required under this Agreement [***].

Customer Confidential Page 12 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Section 10.7 Survival. Customer and Vendor’s respective obligations hereunder which by their nature would continue beyond the termination of this Agreement or expiration of any SOW, shall survive. This includes, by way of example but not limited to, the obligations provided under the Sections or Exhibits with the following headings: "CONFIDENTIALITY", “INDEMNIFICATION", any warranty by Vendor, Exhibit D (HIPAA and GLBA), Exhibit H (Medicare Advantage Regulatory Requirements Appendix), Exhibit I (Master Community & State Appendix), and Exhibit J (Exchange Regulatory Appendix).

Section 11. Assignment; Divestiture.

Vendor may not assign this Agreement or any SOW, or any of Vendor’s rights (except the right to receive payments hereunder) or duties under this Agreement, without the prior written consent of Customer. Any attempted assignment without Customer’s consent will be void. Customer may freely assign all or any part of this Agreement, without the consent of Vendor, either: (a) to an Affiliate; or (b) incidental to a sale, transfer or other disposition by Customer or an Affiliate of all or substantially all of the assets of that component of Customer’s business or its Affiliate's business having the benefit of the goods and/or services under this Agreement. In the event Customer either: (a) acquires any entity which has entered into an Agreement with Vendor, or (b) acquired any goods or services from Vendor under a separate agreement within any twelve (12) months prior to the Effective Date, Vendor shall in both cases, upon Customer notice, execute any documents necessary to allow such goods and services to be governed by this Agreement, and any price adjustments shall be made immediately on a go forward basis. All benefits under this Agreement shall accrue and inure to each party's valid and legal heirs, successors and assigns. From time to time, Customer (or its Affiliates) may divest some or all interests in certain business units or Affiliates. Following the divestiture, at Customer’s request, Vendor will continue to provide Services to such divested business unit or entity under the terms of this Agreement and any applicable SOWs (including for the then-current charges) for 24 months, or any shorter period specified by Customer.

Section 12. Export Related to Services

Vendor shall not, absent proper authorization and licensing, if applicable, from all United States agencies having jurisdiction, including without limitation the United States Bureau of Industry and Security (United States Department of Commerce) and the United States Department of State, and from any other relevant jurisdiction that requires any license or other government approval, Export any Item in the course of performing the Services hereunder. Customer makes no representations as to whether or under what conditions any Item supplied by Customer may be Exported. For purposes of this Section, “Item” means any data, technology, commodity or other item, including without limitation, computer software, computer hardware, or telecommunications hardware or software or encryption device or algorithm, and “Export” means “export,” “release,” or “reexport,” as those terms are defined in 15 Code of Federal Regulations §734.2(b), as such regulation may be amended and in effect from time to time.

Section 13. Record Keeping and Audit

Vendor agrees to maintain accurate and complete records relating to the provision of Services under this Agreement. If Vendor has a formal records management program which includes a documented and compliant records retention schedule (based on applicable federal, state and industry recordkeeping requirements) and a corresponding employee training program, during the term of this Agreement and for [***] following the expiration or termination of this Agreement, Vendor will apply records retention practices in the normal course of business according to the retention periods set forth in Vendor’s records retention schedule. If Vendor does not maintain a documented and compliant records retention schedule, then Vendor will maintain records relating to the provision of Services under this Agreement for a period of [***] from the creation of the applicable record, except to the extent that Customer may require a longer or shorter retention period for specific categories of records. Vendor agrees that, during the term of this Agreement and for a period of [***] after the expiration or termination of this Agreement or the applicable Statement of Work, as appropriate, Customer or its designee(s) may, at any time upon not less than [***] notice to Vendor, (i) examine the books and records of Vendor (and its subcontractors hereunder, if any) related to Vendor’s and any of its subcontractors’ performance under this Agreement, and (ii) verify the integrity of Customer data and examine the systems that process, store, secure, support, and transmit that data (“Audit”). Vendor will cooperate fully, and cause its subcontractors to cooperate fully, with any such Audit(s) and will provide all books, records, data and other documentation reasonably requested by Customer. Customer may make copies of such documentation. The Audit(s) will be conducted during normal business hours, and at Customer’s expense; provided however if such Audit reveals overcharges to Customer, Vendor will bear the cost of such Audit.

Customer Confidential Page 13 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Section 14. Entire Agreement; Order of Precedence.

This Agreement contains the entire understanding of the parties and may be amended only by a writing signed by the parties. This Agreement (including its Exhibits), and any SOWs placed hereunder shall constitute the entire agreement between Customer and Vendor. In the event of a conflict between the terms and conditions of this Agreement and the terms and conditions of any Statement of Work, the terms and conditions of this Agreement will control, unless the Statement of Work makes specific reference to the Section of this Agreement that is to be amended in the Statement of Work. Any exceptions expressly agreed upon in writing by Customer (or an applicable Affiliate) and Vendor under a particular Statement of Work will apply only for purposes of that Statement of Work, and will not be deemed to in any way amend, modify, cancel, or waive the provisions of this Agreement or any other Statement of Work. Notwithstanding the foregoing, no Statement of Work or any provision thereof will be effective to: (A) decrease any limitation of liability, reduce the scope of recoverable damages, or restrict or eliminate exceptions to the limitation of liability; (B) expand, eliminate or restrict the scope of any indemnity obligations set forth in this Agreement or any Exhibit hereto; or (C) waive, settle or resolve any claims or disputes between the Parties. Any amendment or modification to this Agreement or any duly executed SOW hereunder shall not be valid, enforceable, or binding on the parties unless such amendment or modification (a) is a written instrument duly executed by the authorized representatives of both parties and (b) references this Agreement and any SOW, if applicable, and identifies the specific sections contained therein which are amended or modified. No amendment or modification shall adversely affect vested rights or causes of action that have accrued prior to the effective date of such amendment or modification. The terms and conditions of the Exhibits and any SOW hereunder are integral parts of this Agreement and are fully incorporated herein by this reference. No conflicting or supplemental pre-printed provisions on Vendor and Customer forms (including without limitation shrink wrap terms, terms on purchase orders or invoices) shall be binding on the parties.

Section 15. Choice of Law/Venue

This Agreement and the rights and obligations of the parties hereunder shall be construed in accordance with and governed by the laws of the State of Minnesota, excluding its conflict of laws principles and excluding the Uniform Computer Information Transactions Act (UCITA) as may be enacted, amended, or modified by the various states. The parties hereby agree that the United Nations Convention on Contracts for the International Sale of Goods will not apply to this Agreement or any related transaction between the parties. The parties irrevocably and unconditionally consent to venue in Hennepin County, Minnesota (and hereby waive any claims of forum non conveniens with respect to such venue) and to the non-exclusive jurisdiction of competent Minnesota state courts in Hennepin County or federal courts in the District of Minnesota for all litigation which may be brought with respect to the terms of, and the transactions and relationships contemplated by, this Agreement. The parties further consent to the jurisdiction of any state court located within a district that encompasses assets of a party against which a judgment has been rendered for the enforcement of such judgment against the assets of such party.

Section 16. Use of Name and Publicity

Vendor will not have any right to use the names, logos, trademarks, trade names, or other marks of Customer or any of its Affiliates (collectively, the “Customer Marks”), including in connection with any advertising, sales promotions, press releases and other publicity matters, unless and until each use is approved in advance and in writing by the UnitedHealth Group Chief Communications Officer. Customer may withdraw its permission for Vendor to use any of the Customer Marks at any time at its sole discretion by giving written notice to Vendor.

Customer Confidential Page 14 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Section 17. Severability

If any provision of this Agreement is held to be invalid or unenforceable by a court of competent jurisdiction, then the remaining portions of this Agreement shall be construed as if not containing such provision, and all other rights and obligations of the parties shall be construed and enforced accordingly.

Section 18. Notices

All notices, approvals, waivers, and other communications under this Agreement (other than routine operational communications), will be in writing and will be deemed duly given (A) when delivered by hand, (B) one business day after being given to an express courier with a reliable system for tracking delivery, or (C) four business days after the date of mailing, when mailed by United States mail, registered or certified mail, return receipt requested, postage prepaid, and addressed as follows:

Notices to Customer:	Notices to Vendor:
Attn: Legal Department	Attn: Xxxxx Xxxxxx
UnitedHealth Group	Innovation Specialists, LLC d/b/a 2nd.MD
0000 Xxxx Xxxx Xxxx	0000 Xxxx Xxx Xxxx., Xxxxx 000
XX000-X000	Houston, TX 77056
Xxxxxxxxxx, XX 00000
With a copy to:	With a copy to:
Attn: Enterprise Sourcing & Procurement	Attn: Legal
UnitedHealth Group	Innovation Specialists, LLC d/b/a 2nd.MD
0000 Xxxx Xxxx Xxxx	0000 Xxxx Xxx Xxxx., Xxxxx 000
MN008-W240	Houston, TX 77056
Xxxxxxxxxx, XX 00000

Section 19. Non-Solicitation

During the term of this Agreement and for a period of [***] thereafter, neither Customer nor Vendor will directly or indirectly solicit or seek to procure (other than by general advertising) the employment of: (A) in the case of Customer, any Vendor employee engaged in the provision of the Services; and (B) in the case of Vendor, any Customer personnel.

Section 20. No Waiver

No waiver or failure to exercise any option, right, or privilege under the terms of this Agreement on any occasion or occasions shall be construed to be a waiver of the same or any other option, right or privilege on any other occasion.

Section 21. Third Party Beneficiaries.

This Agreement is entered into solely between, and may be enforced only by, Customer and Vendor. This Agreement will not be deemed to create any rights in third parties or to create any obligations of a party to any third parties, other than in and to Customer’s Affiliates receiving Services hereunder.

(SIGNATURE PAGE TO FOLLOW)

Customer Confidential Page 15 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

ACCEPTED AND AGREED:
UNITED HEALTHCARE SERVICES, INC.			INNOVATION SPECIALISTS, LLC D/B/A 2ND.MD
By:	/s/ Xxxx X Xxxxx		By:	/s/ Xxxxx Xxxxxx
	(Authorized Signature)			(Authorized Signature)
Name:	Xxxx X Xxxxx		Name:	Xxxxx Xxxxxx
	(Print or Type)			(Print or Type)
Title:	Sr. Director		Title:	Chief Executive Officer
Date:	12/20/2016		Date:	12/20/2016

Customer Confidential Page 16 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

EXHIBIT A

ORM OF STATEMENT OF WORK

STATEMENT OF WORK NO.       

This is Statement of Work (“SOW”) No. to the MASTER SERVICES AGREEMENT dated etween: [***] (the “Agreement”),

United HealthCare Services, Inc., (“Customer”) on behalf of itself and its Affiliates; and

Innovation Specialists, LLC d/b/a 2nd.MD (“Vendor”). All capitalized terms not otherwise defined in this SOW will have the meanings assigned to them in the Agreement. Unless modified herein, all terms in the Agreement shall remain unchanged and in full force and effect.

1. CUSTOMER SEGMENT(S) RECEIVING SERVICES:

2. PURPOSE AND HIGH-LEVEL SCOPE OF SERVICES:

3. DETAILED DESCRIPTION OF SERVICES:

4. PERSONNEL:

5. WORK PRODUCT/DELIVERABLES:

6. MILESTONES/DEADLINES:

7. FEES: [Select from Fixed-Bid or Time & Materials options below, delete both Option headings, text of non- choice and this note]

Option1: Fixed-Bid

Based on the above tasks and assumptions, Vendor will perform the Services and provide the Work Product for a fixed price of [insert $] which will be invoiced [insert payment schedule].

If Customer terminates this SOW prior to delivery of all Work Product, the charges will be prorated at the time of termination and Customer agrees to pay for Services through the termination date. Applicable federal, state and local taxes are not included in the estimated charges.

Option 2: Time & Materials

Vendor will perform the Services and provide the Work Product at an hourly rate of [insert rate $]. Customer will be charged only for the actual hours provided by Vendor in performing the Services and providing the Work Product. Vendor estimates the total number of hours to complete the Services to be [insert # hours] for an estimated funding requirement of [insert $]. The total fees incurred by Customer under this SOW shall not exceed [insert same $ as estimated funding requirement] without Customer’s prior written consent.

If Customer terminates this SOW, Customer agrees to pay Vendor for actual hours worked by Vendor in performing the Services prior to the date of termination.

The terms and conditions contained in this SOW constitute the parties’ complete understanding and agreement relating to the subject matter hereof. Notwithstanding anything to the contrary in the Agreement or elsewhere, in the event of a conflict between this SOW and the Agreement, the Agreement will control. No other terms and conditions, beyond those contained herein, will be valid unless mutually agreed to by Customer and Vendor in a writing signed by authorized representatives of each party.

Customer Confidential Page 17 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

ACCEPTED AND AGREED:
UNITED HEALTHCARE SERVICES, INC.			INNOVATION SPECIALISTS, LLC D/B/A 2ND.MD
By:			By:
	(Authorized Signature)			(Authorized Signature)
Name:			Name:
	(Print or Type)			(Print or Type)
Title:			Title:
Date:			Date:

Customer Confidential Page 18 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

EXHIBIT B

CERTIFICATE OF COMPLIANCE FOR CONTRACTORS AND SUPPLIERS

Vendor certifies and represents that it is, as of the Effective Date, and shall remain throughout the term of the Agreement in compliance with the following federal laws, to the extent applicable to Vendor and the Services:

1. General.

FAR Clause	Date	Title
52.204-9	Jan 2011	Personal Identify Verification of Contractor Personnel
52.222-21	Feb 1999	Prohibition of Segregated Facilities
52.222-26	Mar 2007	Equal Opportunity
52.222-35	Sep 2010	Equal Opportunity for Veterans
52.222-36	Oct 2010	Affirmative Action for Workers with Disabilities
52.222-37	Sep 2010	Employment Reports on Veterans
52.222-40	Dec 2010	Notification of Employee Rights Under the National Labor Relations Act
52.222-50	Feb 2009	Combating Trafficking in Persons
52.223-18	Aug 2011	Encouraging Contractor Policies to Ban Text Messaging While Driving
52.244-6	Dec 2010	Subcontracts for Commercial Items

DFARS Clause	Date	Title
252.204-7000	Dec 1991	Disclosure of Information

2. Contract Value > $150,000.

If the total fees under the Agreement, including all SOWs executed pursuant to the Agreement, exceed an aggregate total of $150,000, then Vendor shall comply with the Laws listed in Section 1 above and the following:

FAR Clause	Date	Title
52.219-8	Jan 2011	Utilization of Small Business Concerns

3. Contract Value > $5 Million.

If the total fees under the Agreement, including all SOWs executed pursuant to the Agreement, exceed an aggregate total of $5,000,000, then Vendor shall comply with the Laws listed in Section 1 above and the following:

FAR Clause	Date	Title
52.203-13	Apr 2010	Contractor Code of Business Ethics and Conduct

4. Equal Opportunity.

This contractor and subcontractor shall abide by the requirements of 41 CFR 60- 1.4(a), 60-300.5(a) and 60-741.5(a). These regulations prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities, and prohibit discrimination against all individuals based on their race, color, religion, sex, or national origin. Moreover, these regulations require that covered prime contractors and subcontractors take affirmative action to employ and advance in employment individuals without regard to race, color, religion, sex, national origin, protected veteran status or disability.

To the extent applicable, the employee notice requirements set forth in 29 C.F.R. Part 471, Appendix A to Subpart A, are hereby incorporated by reference into this contract.

Customer Confidential Page 19 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

EXHIBIT C
PRICE LIST

Consulting Services      Hourly Rate/Discount off List

	a.	Training
	b.	Implementation/Installation
	c.	Configuration
	d.	Customization
	e.	Other consulting

Customer Confidential Page 20 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

EXHIBIT D
HIPAA and GLBA

(BUSINESS ASSOCIATE AGREEMENT)

The parties hereby agree as follows:

1. DEFINITIONS

1.1            All capitalized terms used in this Exhibit not otherwise defined in this Exhibit have the meanings established in either the Agreement or for purposes of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended and supplemented by HITECH, as each is amended from time to time (collectively, “HIPAA”). To the extent a term is defined in both the Agreement and in this Exhibit or in HIPAA, the definition in this Exhibit or in HIPAA, shall govern.

1.2            “Affiliate” shall have the meaning ascribed to it in the Agreement. If the term “Affiliate” is not defined in the Agreement, then “Affiliate” shall mean, for purposes of this Exhibit, any subsidiary of UnitedHealth Group Inc.

1.3            “Breach” means the acquisition, access, use or disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the PHI as defined, and subject to the exclusions set forth, in 45 C.F.R. § 164.402.

1.4            “Breach Rule” means the federal breach regulations, as amended from time to time, issued pursuant to HIPAA and codified at 45 C.F.R. Part 164 (Subpart D).

1.5            “Compliance Date” means the later of September 23, 2013 or the effective date of the Agreement.

1.6            “Electronic Protected Health Information” or “ePHI” means PHI that is transmitted or maintained in Electronic Media.

1.7            “HITECH” means Subtitle D of the Health Information Technology for Economic and Clinical Health Act provisions of the American Recovery and Reinvestment Act of 2009, 42 U.S.C. §§ 17921-17954, and all associated existing and future implementing regulations, when and as each is effective.

1.8            “PHI” means Protected Health Information, as defined in 45 C.F.R. § 160.103, and is limited to the Protected Health Information received from, or received, maintained, created or transmitted on behalf of, Customer (for itself and/or applicable Covered Entity customers) by Vendor in performance of the Services.

1.9            “Privacy Rule” means the federal privacy regulations, as amended from time to time, issued pursuant to HIPAA and codified at 45 C.F.R. Parts 160 and 164 (Subparts A & E).

1.10          “Security Rule” means the federal security regulations, as amended from time to time, issued pursuant to HIPAA and codified at 45 C.F.R. Parts 160 and 164 (Subparts A & C).

1.11          “Services” as used in this Exhibit, means, to the extent and only to the extent they involve the receipt, creation, maintenance, transmission, use or disclosure of PHI, the services provided by Vendor to Customer as set forth in the Agreement.

Customer Confidential Page 21 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

2. RESPONSIBILITIES OF VENDOR

With regard to its use and/or disclosure of PHI, Vendor agrees to:

2.1            not use and/or further disclose PHI except as necessary to provide the Services, as permitted or required by this Exhibit, and in compliance with each applicable requirement of 45 C.F.R. § 164.504(e), or as otherwise Required by Law; provided that, to the extent Vendor is to carry out a Covered Entity’s obligations under the Privacy Rule, Vendor will comply with the requirements of the Privacy Rule that apply to that Covered Entity in the performance of those obligations.

2.2            implement and use appropriate administrative, physical and technical safeguards and, as of the Compliance Date, comply with applicable Security Rule requirements with respect to ePHI, to prevent use or disclosure of PHI other than as provided for by this Exhibit, including at a minimum, but in any event not limited to, any safeguards set forth in the Agreement or other applicable contracts or agreements between the parties. For the avoidance of doubt, the requirements set forth in the Agreement or other applicable contracts or agreements between the parties do not limit in any way whatsoever Vendor’s obligations under this Section 2.2 to comply with applicable Security Rule requirements.

2.3            without unreasonable delay, and in any event on or before [***] after its discovery by Vendor, report to Customer in writing: (i) any use or disclosure of PHI not provided for by this Exhibit of which it becomes aware in accordance with 45 C.F.R. § 164.504(e)(2)(ii)(C); and/or (ii) any Security Incident of which Vendor becomes aware in accordance with 45 C.F.R. § 164.314(a)(2)(i)(C).

2.4            without unreasonable delay, and in any event on or before [***] after its Discovery by Vendor, notify Customer of any incident that involves an unauthorized acquisition, access, use or disclosure of PHI, even if Vendor believes the incident will not rise to the level of a Breach. The notification shall include, to the extent possible, and shall be supplemented on an ongoing basis with: (i) the identification of all individuals whose Unsecured PHI was or is believed to have been involved; (ii) all other information required for or requested by Customer (or the applicable Covered Entity) to perform a risk assessment in accordance with 45 C.F.R. § 164.402 with respect to the incident to determine whether a Breach of Unsecured PHI occurred; and (iii) all other information reasonably necessary to provide notice to the applicable Covered Entities individuals, HHS and/or the media, all in accordance with the Breach Rule. Notwithstanding the foregoing, in Customer’s sole discretion and in accordance with its directions, and without limiting in any way any other remedy available to Customer at law, equity or contract, including but not limited to any rights or remedies the Customer may have under the Agreement, Vendor [***].

2.5            in accordance with 45 C.F.R. § 164.502(e)(1)(ii) and 45 C.F.R. § 164.308(b)(2), ensure that any subcontractors of Vendor that create, receive, maintain or transmit PHI on behalf of Vendor agree, in writing, to the same restrictions and conditions on the use and/or disclosure of PHI that apply to Vendor with respect to that PHI, including complying with the applicable Security Rule requirements with respect to ePHI; provided that, in any event Vendor shall require its subcontractors (and shall require those subcontractors to require their subcontractors) to report to Vendor any use or disclosure of PHI or Security Incident required to be reported under Sections 2.3 and 2.4 on or before [***] after its discovery by any of those subcontractors.

2.6            make available its internal practices, books and records relating to the use and disclosure of PHI to the Secretary for purposes of determining the applicable Covered Entity’s compliance with the Privacy Rule.

Customer Confidential Page 22 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

2.7            document, and within [***] after receiving a written request from Customer, make available to Customer information necessary for Customer or its applicable Covered Entity customer to make an accounting of disclosures of PHI about an Individual or, when and as requested by Customer, make that information available directly to an Individual, all in accordance with 45 C.F.R. § 164.528 and, as of the later of the date compliance is required by final regulations or the effective date of the Agreement, 42 U.S.C. § 17935(c).

2.8            provide access to Customer, within [***] after receiving a written request from Customer, to PHI in a Designated Record Set about an Individual, or when and as requested by Customer, provide that access directly to an Individual, all in accordance with the requirements of 45 C.F.R. § 164.524, including as of the Compliance Date, providing or sending a copy to a designated third party and providing or sending a copy in electronic format in accordance with 45 C.F.R. § 164.524.

2.9            to the extent that the PHI in Vendor’s possession constitutes a Designated Record Set, make available, within [***] after a written request by Customer, PHI for amendment and incorporate any amendments to the PHI as requested by Customer, all in accordance with 45 C.F.R. § 164.526.

2.10            accommodate reasonable requests for confidential communications in accordance with 45 C.F.R. § 164.522(b), as requested by Customer or as directed by the Individual to whom the PHI relates.

2.11            notify Customer in writing within [***] after Vendor’s receipt directly from an Individual of any request for an accounting of disclosures, access to or amendment of PHI or for confidential communications as contemplated in Sections 2.7-2.10.

2.12            request, use and/or disclose only the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure; provided, that Vendor shall comply with 45 C.F.R. §§ 164.502(b) and 164.514(d) as of the Compliance Date.

2.13            not directly or indirectly receive remuneration in exchange for any PHI as prohibited by 45 C.F.R. § 164.502(a)(5)(ii) as of the Compliance Date.

2.14            not make or cause to be made any communication about a product or service that is prohibited by 45 C.F.R. §§ 164.501 and 164.508(a)(3) as of the Compliance Date.

2.15            not make or cause to be made any written fundraising communication that is prohibited by 45 C.F.R. § 164.514(f) as of the Compliance Date.

2.16            mitigate, to the extent practicable, any harmful effect that is known to Vendor of a use or disclosure of PHI by Vendor that is not permitted by the requirements of this Exhibit.

2.17            comply with all applicable federal, state and local laws and regulations.

2.18            not use, transfer, transmit or otherwise send or make available, any PHI outside of the geographic confines of the United States of America without Customer’s advance written consent.

2.19            Government Program Requirements. To the extent that Vendor receives, uses or discloses PHI pertaining to Individuals enrolled in managed care plans through which Customer or one or more of its affiliates participate in government funded health care programs, receipt, use and disclosure of the PHI pertaining to those individuals shall comply with the applicable program requirements.

Customer Confidential Page 23 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

2.20            Privacy and Safeguards for NPI. Vendor understands and acknowledges that to the extent it is a nonaffiliated third party under GLBA that creates or receives NPI from or on behalf of Customer or an Affiliate, Vendor and its authorized representatives: (i) shall not use or disclose NPI for any purpose other than to perform its obligations under the Agreement; (ii) shall implement appropriate administrative, technical, and physical safeguards designed to ensure the security and confidentiality of the NPI, protect against any anticipated threats or hazards to the security or integrity of the NPI and protect against unauthorized access to or use of the NPI that could result in substantial harm or inconvenience to any consumer; and (iii) shall, for as long as Vendor has NPI, provide and maintain appropriate safeguards for the NPI in compliance with this Exhibit and the GLBA.

3. OTHER PERMITTED USES AND DISCLOSURES OF PHI

Unless otherwise limited in this Exhibit, in addition to any other uses and/or disclosures permitted or required by this Exhibit, Vendor may:

3.1            use and disclose PHI, if necessary, for proper management and administration of Vendor or to carry out the legal responsibilities of Vendor, provided that the disclosures are Required by Law or any third party to which Vendor discloses PHI for those purposes provides written assurances in advance that: (i) the information will be held confidentially and used or further disclosed only for the purpose for which it was disclosed to the third party or as Required by Law; and (ii) the third party promptly will notify Vendor of any instances of which it becomes aware in which the confidentiality of the information has been breached.

4. TERMINATION AND COOPERATION

4.1            Termination. If Customer knows of a pattern or practice of Vendor that constitutes a material breach or violation of this Exhibit then Customer may provide written notice of the breach or violation to Vendor and Vendor must cure the breach or end the violation on or before [***] after receipt of the written notice. If Vendor fails to cure the breach or end the violation within the specified timeframe, Customer may terminate this Exhibit and the Agreement. Customer also may terminate this Exhibit and the Agreement to the extent that any of Customer’s applicable Covered Entity customers terminates its agreement with Customer.

4.2            Effect of Termination or Expiration. Within [***] after the expiration or termination for any reason (or to any extent) of the Agreement and/or this Exhibit, Vendor shall return or destroy all applicable PHI, if feasible to do so, including all applicable PHI in possession of Vendor’s subcontractors. To the extent return or destruction of the PHI is not feasible, Vendor shall notify Customer in writing of the reasons return or destruction is not feasible and, if Customer agrees, may retain the PHI subject to this Section 4.2. Under any circumstances, Vendor shall extend any and all protections, limitations and restrictions contained in this Exhibit to Vendor’s use and/or disclosure of any applicable PHI retained after the expiration or termination (to any extent) of the Agreement and/or this Exhibit, and shall limit any further uses and/or disclosures solely to the purposes that make return or destruction of the PHI infeasible.

4.3            Cooperation. Each party shall cooperate in good faith in all respects with the other party in connection with any request by a federal or state governmental authority for additional information and documents or any governmental investigation, complaint, action or other inquiry.

5. MISCELLANEOUS

5.1            Construction of Terms. The terms of this Exhibit to the extent they are unclear, shall be construed to allow for compliance by the applicable Covered Entity and Customer with HIPAA.

5.2            Survival. Sections 4.2, 4.3, 5.1, 5.2, and 5.3 shall survive the expiration or termination for any reason of the Agreement and/or of this Exhibit.

5.3            No Third Party Beneficiaries. Nothing in this Exhibit shall confer upon any person other than the parties and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.

Customer Confidential Page 24 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

EXHIBIT E
STANDARD CONTRACTUAL CLAUSES

Data Processing Agreement Supplemental Terms and Conditions (Standard Contractual Clauses (processors))

For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, these terms and conditions are entered into between

(i)            United HealthCare Services, Inc., a Minnesota corporation with offices at 0000 Xxxx Xxxx Xxxx, Xxxxxxxxxx, XX 00000, on behalf of itself and its subsidiaries ("UHS") ("Data Exporter"), and

(ii)            Innovation Specialists, LLC d/b/a 2nd.MD, with offices at 0000 Xxxx Xxx Xxxx., Xxxxx 000, Xxxxxxx, Xxxxx 00000 (the "Data Importer").

each a "Party", and together the "Parties"

Recitals

A Data Importer provides services to UHS and or various of its subsidiaries outside the European Economic Area (EEA) (the "Services"). For the purpose of these Clauses, Data Importer is receiving Personal Data, as defined in Attachment 1, as part of the performance of services as a Data Importer, and UHS shall transfer Personal Data to Data Importer as Data Exporter.

B The Parties agree that all processing and movement of Personal Data, performed as part of or otherwise in connection with the Services shall be governed by these Clauses which are hereby incorporated into all agreements between the Data Importer and UHS or its subsidiaries and governing the Services, if any.

C The Parties have therefore agreed on the following Contractual Clauses (the "Clauses") in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the Data Exporter to the Data Importer of the Personal Data specified in Attachment 1.

Customer Confidential Page 25 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Attachment 1

Processing of Personal Data

1. DEFINITIONS

For the purposes of this Attachment 1:

(a) 'applicable data protection law' means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the Processing of Personal Data applicable to a Controller in the Member State in which the Data Exporter is established;

(b) 'Controller' means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of Personal Data;

(c) 'Data Exporter' means United HealthCare Services, Inc. (“data exporter”), on behalf of itself and its Affiliates;

(d) 'Data Importer' means Innovation Specialists, LLC d/b/a 2nd.MD;

(e) 'Directive' means Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the Processing of Personal Data and on the free movement of such data

(f) 'Personal Data' means any information relating to an identified or identifiable natural person ('Data Subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;

(g) 'Process/Processing', means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

(h) 'Processor' means a natural or legal person, public authority, agency or any other body which processes Personal Data on behalf of the Controller;

(i) 'Special Categories of data' means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health, sex life, criminal convictions, and actual or alleged criminal offences;

(j) 'Subprocessor' means any Processor engaged by the Data Importer or by any other Subprocessor of the Data Importer who agrees to receive from the Data Importer or from any other Subprocessor of the Data Importer Personal Data exclusively intended for Processing activities to be carried out on behalf of the Data Exporter after the transfer in accordance with his instructions, the terms of this Exhibit and the terms of the relevant written subcontract;

(k) 'Supervisory Authority' means a public authority responsible for monitoring the application within its territory of the provisions adopted by a Member State pursuant to the Directive;

Customer Confidential Page 26 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

(l) 'technical and organisational security measures' means those measures aimed at protecting Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the Processing involves the transmission of data over a network, and against all other unlawful forms of Processing.

2. DETAILS OF THE TRANSFERS

The details of the transfers of Personal Data are specified in Appendix 1 which forms an integral part of this Exhibit.

3. THIRD-PARTY BENEFICIARY CLAUSE

3.1 The Data Subject can enforce against the Data Exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6.1 and 6.2, Clause 7, Clause 8.2, and Clauses 9 to 12 as third-party beneficiary.

3.2 The Data Subject can enforce against the Data Importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8.2, and Clauses 9 to 12, in cases where the Data Exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the Data Exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the Data Exporter, in which case the Data Subject can enforce them against such entity.

3.3 The Data Subject can enforce against the Subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8.2, and Clauses 9 to 12, in cases where both the Data Exporter and the Data Importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the Data Exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the Data Exporter, in which case the Data Subject can enforce them against such entity. Such third-party liability of the Subprocessor shall be limited to its own Processing operations under this Exhibit.

3.4 The parties do not object to a Data Subject being represented by an association or other body if the Data Subject so expressly wishes and if permitted by national law.

4. OBLIGATIONS OF THE DATA EXPORTER

The Data Exporter agrees and warrants:

(a) that the Processing, including the transfer itself, of the Personal Data has been carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the Data Exporter is established) and does not violate the relevant provisions of that State;

(b) that it has instructed and throughout the duration of the Personal Data Processing services will instruct the Data Importer to Process the Personal Data transferred only on the Data Exporter's behalf and in accordance with the applicable data protection law and this Exhibit;

(c) that the Data Importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;

(d) that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the Processing involves the transmission of data over a network, and against all other unlawful forms of Processing, and that these measures ensure a level of security appropriate to the risks presented by the Processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;

Customer Confidential Page 27 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

(e) that it will ensure compliance with the security measures;

(f) that, if the transfer involves Special Categories of data, the Data Subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of the Directive;

(g) to forward any notification received from the Data Importer or any Subprocessor pursuant to Clause 5(b) and Clause 8.3 to the Supervisory Authority if the Data Exporter decides to continue the transfer or to lift the suspension;

(h) to make available to the Data Subjects upon request a copy of this Exhibit, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with this Exhibit, unless this Appendix 1 or the Agreement contain commercial information, in which case it may remove such commercial information;

(i) that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a Subprocessor providing at least the same level of protection for the Personal Data and the rights of the Data Subject as the Data Importer under this Exhibit; and

(j) that it will ensure compliance with Clause 4(a) to (i).

5. OBLIGATIONS OF THE DATA IMPORTER

The Data Importer agrees and warrants:

(a) to Process the Personal Data only on behalf of the Data Exporter and in compliance with its instructions and this Exhibit; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the Data Exporter of its inability to comply, in which case the Data Exporter is entitled to suspend the transfer of data and/or terminate the Agreement;

(b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the Data Exporter and its obligations under the Agreement and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by this Exhibit, it will promptly notify the change to the Data Exporter as soon as it is aware, in which case the Data Exporter is entitled to suspend the transfer of data and/or terminate the Agreement;

(c) that it has implemented the technical and organisational security measures specified in Appendix 2 before Processing the Personal Data transferred;

(d) that it will promptly notify the Data Exporter about:

(i) any legally binding request for disclosure of the Personal Data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation;

(ii) any accidental or unauthorised access; and

(iii) any request received directly from a Data Subject without responding to that request, unless it has been otherwise authorised to do so;

Customer Confidential Page 28 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

(e) to deal promptly and properly with all inquiries from the Data Exporter relating to its Processing of the Personal Data subject to the transfer and to abide by the advice of the Supervisory Authority with regard to the Processing of the data transferred;

(f) at the request of the Data Exporter to submit its data Processing facilities for audit of the Processing activities covered by this Exhibit which shall be carried out by the Data Exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the Data Exporter, where applicable, in agreement with the Supervisory Authority;

(g) to make available to the Data Subject upon request a copy of this Exhibit, or any existing contract for subprocessing, unless this Exhibit or the contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the Data Subject is unable to obtain a copy from the Data Exporter;

(h) that, in the event of subprocessing, it has previously informed the Data Exporter and obtained its prior written consent;

(i) that the Processing services by the Subprocessor will be carried out in accordance with Clause 11; and

(j) to send promptly a copy of any Subprocessor agreement it concludes under this Exhibit to the Data Exporter.

6. Liability

6.1 The parties agree that any Data Subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or Subprocessor is entitled to receive compensation from the Data Exporter for the damage suffered.

6.2 If a Data Subject is not able to bring a claim for compensation in accordance with paragraph 6.1 against the Data Exporter, arising out of a breach by the Data Importer or its Subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the Data Exporter has factually disappeared or ceased to exist in law or has become insolvent, the Data Importer agrees that the Data Subject may issue a claim against the Data Importer as if it were the Data Exporter, unless any successor entity has assumed the entire legal obligations of the Data Exporter by contract or by operation of law, in which case the Data Subject can enforce its rights against such entity.

6.3 The Data Importer may not rely on a breach by a Subprocessor of its obligations in order to avoid its own liabilities.

6.4 If a Data Subject is not able to bring a claim against the Data Exporter or the Data Importer referred to in paragraphs 6.1 and 6.2, arising out of a breach by the Subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the Data Exporter and the Data Importer have factually disappeared or ceased to exist in law or have become insolvent, the Subprocessor agrees that the Data Subject may issue a claim against the Subprocessor with regard to its own processing operations under this Exhibit as if it were the Data Exporter or the Data Importer, unless any successor entity has assumed the entire legal obligations of the Data Exporter or Data Importer by contract or by operation of law, in which case the Data Subject can enforce its rights against such entity. The liability of the Subprocessor shall be limited to its own processing operations under this Exhibit.

Customer Confidential Page 29 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

the Data Subject can enforce its rights against such entity. The liability of the Subprocessor shall be limited to its own processing operations under this Exhibit.

7. Mediation and jurisdiction

7.1 The Data Importer agrees that if the Data Subject invokes against it third-party beneficiary rights and/or claims compensation for damages under this Exhibit, the Data Importer will accept the decision of the Data Subject:

(a) to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;

(b) to refer the dispute to the courts in the Member State in which the Data Exporter is established.

7.2 The parties agree that the choice made by the Data Subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

8. CO-OPERATION WITH SUPERVISORY AUTHORITIES

8.1 The Data Exporter agrees to deposit a copy of this contract with the Supervisory Authority if it so requests or if such deposit is required under the applicable data protection law.

8.2 The parties agree that the Supervisory Authority has the right to conduct an audit of the Data Importer and of any Subprocessor which has the same scope and is subject to the same conditions as would apply to an audit of the Data Exporter under the applicable data protection law.

8.3 The Data Importer shall promptly inform the Data Exporter about the existence of legislation applicable to it or any Subprocessor preventing the conduct of an audit of the Data Importer, or any Subprocessor, pursuant to paragraph 8.2. In such a case the Data Exporter shall be entitled to take the measures foreseen in Clause 5(b).

9. GOVERNING LAW

This Exhibit shall be governed by English law.

10. VARIATION OF CONTRACT

The parties undertake not to vary or modify this Exhibit. This does not preclude the parties from adding clauses on business-related issues where required as long as they do not contradict the Exhibit.

11. SUBPROCESSING

11.1 The Data Importer shall not subcontract any of its Processing operations performed on behalf of the Data Exporter under this Exhibit without the prior written consent of the Data Exporter. Where the Data Importer subcontracts its obligations under this Exhibit, with the consent of the Data Exporter, it shall do so only by way of a written agreement with the Subprocessor which imposes the same obligations on the Subprocessor as are imposed on the Data Importer under this Exhibit. Where the Subprocessor fails to fulfil its data protection obligations under such written agreement the Data Importer shall remain fully liable to the Data Exporter for the performance of the Subprocessor's obligations under such agreement.

11.2 The prior written contract between the Data Importer and the Subprocessor shall also provide for a third- party beneficiary clause as laid down in Clause 3 for cases where the Data Subject is not able to bring the claim for compensation referred to in paragraph 6.1 against the Data Exporter or the Data Importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the Data Exporter or Data Importer by contract or by operation of law. Such third-party liability of the Subprocessor shall be limited to its own processing operations under this Exhibit.

Customer Confidential Page 30 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

11.3 The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 11.1 shall be governed by English law.

11.4 The Data Exporter shall keep a list of subprocessing agreements concluded under this Exhibit and notified by the Data Importer pursuant to Clause 5(j), which shall be updated at least once a year. The list shall be available to the Data Exporter's Supervisory Authority.

12. OBLIGATION AFTER THE TERMINATION OF PERSONAL DATA PROCESSING SERVICES

12.1 The parties agree that on the termination of the provision of data Processing services, the Data Importer shall, at the choice of the relevant Data Exporter, return all the Personal Data transferred and the copies thereof to the Data Exporter or shall destroy all the Personal Data and certify to the Data Exporter that it has done so, unless legislation imposed upon the Data Importer prevents it from returning or destroying all or part of the Personal Data transferred. In that case, the Data Importer warrants that it will guarantee the confidentiality of the Personal Data transferred and will not actively Process the Personal Data transferred any more.

12.2 The Data Importer warrants that upon request of the Data Exporter and/or of the Supervisory Authority, it will submit its data Processing facilities for an audit of the measures referred to in paragraph 12.1.

Customer Confidential Page 31 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

APPENDIX 1

Data Exporters

The Data Exporter is a healthcare services and information technology company.

Data Importer

The Data Importer is a company undertaking data processing activities.

Data Subjects

The Personal Data transferred may concern the following categories of Data Subjects:

1. Customers of the Data Exporter and personnel employed by or working on behalf of such customers.

2. Persons whose data are relevant to contracts for health care entered into by customers with the Data Exporter.

Categories of data

The Personal Data transferred may concern the following categories of data:

(a) [***]

(b) [***]

(c) [***]

(d) [***]

(e) [***]

(f) [***]

(g) [***]

(h) [***]

(i) [***]

(j) [***]

(k) [***]

(l) [***]

(m) [***]

Customer Confidential Page 32 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Special Categories of data

The Personal Data transferred concern the following special categories of data:

· [***]

Processing operations

Members book and attend a virtual consultation with a specialist using the 2nd.MD application which is downloadable through their Apple or Android phone or tablet device (the “App”). During the consultation, the specialist will capture information relating to the Member’s condition and the outcome of the consultation. This will be recorded securely in the App and will not be shared with the data exporter without the Member’s consent.

Customer Confidential Page 33 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

APPENDIX 2

Technical and Organisational Security Measures

The Data Importer has implemented a suitable set of information security controls including policies, practices, procedures and organizational structures to protect the confidentiality, integrity and availability of personal data entrusted to it and to protect against unauthorised or accidental access, change, loss or destruction, unauthorised transmission or other unauthorised processing as well as other misuse. Furthermore, the Data Importer has a security assessment program where periodic independent assessments are undertaken with an aim to ensure continual effectiveness.

The technical/ organizational security measures implemented by the Data Importer in accordance with Clause 4(c) of this Exhibit are as set out below (as amended and updated from time to time by the Data Importer):

Organizational Measures

With regard to organizational protection the Data Importer undertakes to apply at least the following measures:

Security Management

· The security measures set forth in Exhibit F (Security) and Exhibit D (HIPAA and GLBA – Business Associate Agreement) to the Agreement to which these Standard Contractual Clauses are attached.

Personnel Security (Human Resources Security)

· The security measures set forth in Exhibit F (Security) and Exhibit G (Background Investigations) D.

Business Continuity Planning

· The measures set forth in Exhibit F (Security) and Section 9 of the Agreement to which these Standard Contractual Clauses are attached.

Physical & Environmental Security

· The security measures set forth in Exhibit F (Security) to the Agreement to which these Standard Contractual Clauses are attached.

Technical Measures

With regard to technical protection the Data Importer undertakes to apply at least the following measures:

Workstation Security

· Access rights will be granted based on job role, terminated upon transfer or termination. Maintain a strong password policy requiring a minimum length, complexity, password expiration and account lockout upon multiple failed logon attempts. Workstations will be protected with boot passwords, hard drive encryption and antivirus, as well as other applicable security measures set forth in Exhibit F (Security) to the Agreement to which these Standard Contractual Clauses are attached.

Customer Confidential Page 34 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Server Security

· In addition to the other applicable security measures set forth in Exhibit F (Security) to the Agreement to which these Standard Contractual Clauses are attached, access rights will be granted based on job role, terminated upon transfer or termination. Maintain a strong password policy requiring a minimum length, complexity, password expiration and account lockout upon multiple failed logon attempts. [***].

Network Security

· In addition to the other applicable security measures set forth in Exhibit F (Security) to the Agreement to which these Standard Contractual Clauses are attached, the production network will be protected by firewalls. Strict ingress / egress rules will be configured to restrict communications between servers to only those the application requires. The production network will be monitored by an intrusion detection system and administrators will receive security alerts. All network access will be logged. [***].

Customer Confidential Page 35 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

EXHIBIT F
SECURITY

The requirements of this Exhibit are applicable if and to the extent that: (1) Vendor accesses Customer Information Systems (as defined below); or (2) Vendor creates, has access to, or receives from or on behalf of Customer any Customer Information (as defined below) in electronic format. The requirements set forth in this Exhibit are in addition to, and do not substitute for: (i) any of Vendor’s other obligations under the Agreement, including any Exhibits or applicable Statements of Work; and (ii) any requirements imposed upon Vendor by applicable law. To the extent that any requirements set forth in this Exhibit conflict with other requirements under the Agreement (including any Exhibits or applicable Statements of Work), then the requirement most protective of Customer, in Customer’s reasonable determination, shall apply.

1.            Definitions. The following terms shall have the meanings as set forth below:

1.1            “Confidential Information” has the meaning set forth in the Agreement.

1.2            “Customer” means United Healthcare Services, Inc.

1.3            “Customer Information” means any Confidential Information of Customer that includes or is comprised of any of the following:

(a)            Protected health information (i.e., any information that would be termed “protected health information” under the provisions of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations);

(b)            Non-public personal information (i.e., any information that would be termed “non-public personal information” under the Federal Xxxxx-Xxxxx-Xxxxxx Act, any related state statutes, and any related federal or state regulations);

(c)            Personal data (i.e., any information relating to an identified or identifiable natural person, as further defined under the European Union Directive 95/46/EC and each EU member state's implementing laws, including any regulations and codes of conduct issued under such laws);

(d)            Cardholder data, as that term is defined in the most current version of the Payment Card Industry (PCI) Data Security Standard; or

(e)            Other personal information (i.e., other personally identifiable information about individuals, or information that can be used to identify individuals, the disclosure and/or use of which is restricted by applicable federal or state law, including social security numbers).

1.4            “Customer Information Systems” means information systems resources supplied or operated by Customer or its contractors, including without limitation, network infrastructure, computer systems, workstations, laptops, hardware, software, databases, storage media, proprietary applications, printers, and internet connectivity that are owned, controlled or administered by or on behalf of Customer.

1.5            “HITRUST” means the Health Information Trust Alliance.

1.6            “HITRUST CSF” or “CSF” means the HITRUST common security framework against which Vendor’s security program will be assessed, validated and certified. The common security framework is comprised of a common set of information security requirements with standardized assessment and reporting processes accepted and adopted by healthcare organizations.

Customer Confidential Page 36 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

1.7            “HITRUST CSF Certification” means a CSF third-party validated report with certification, which certification has been issued by HITRUST based on testing performed by an independent CSF assessor and reviewed, approved and certified by HITRUST.

1.8            “HITRUST CSF Self-Assessment Report” means the report issued by HITRUST upon its validation of the self-assessment conducted by Vendor using the standard methodology, requirements, and tools provided under HITRUST’s CSF Assurance Program.

1.9            “HITRUST CSF Validated Report” means a CSF third-party validated report, issued by an authorized CSF assessor based on on-location testing.

1.10            “Independent Certification/Attestation” means: (a) a HITRUST CSF Certification; or (b) an alternative certification (e.g., EHNAC, SOC 2 Type 2, or ISO27001) designed to document and measure performance against control objectives that map to applicable HITRUST CSF requirements, controls, and control specifications and/or other relevant standards (“Alternative Certification”), as approved by Customer pursuant to Section 3.4 and described in Attachment 2.

1.11            “Mitigate” means Vendor has deployed security controls as necessary to reduce the adverse effects of threats and reduce risk exposure to a level reasonably acceptable by Customer.

1.12            “Remediation” or “Remediate”, as applicable, means that Vendor has completely resolved a security exposure or Security Incident, such that the vulnerability no longer poses a risk to Customer Information Systems or Vendor Processing Resources, as applicable.

1.13            “Security Incident” means the unauthorized access, use, disclosure, modification, or destruction of Customer Information or access to or interference with the operations of any Customer Information Systems or Vendor Processing Resources. Security Incidents are classified as follows:

(a)            “High Severity” or severity 1 (severe impact) means [***].

(b)            “Medium Severity” or severity 2 (major impact) means [***].

(c)            “Low Severity” or severity 3 (moderate impact) means [***].

1.14            “Services” has the meaning set forth in the Agreement. If the term “Services” is not defined in the Agreement, then Services means any services or functions provided by Vendor to Customer under the Agreement.

1.15            “Vendor Processing” means any information collection, storage or processing performed by Vendor or its subcontractors that: (i) directly or indirectly supports the Services or functions now or hereafter furnished to Customer; and (ii) involves the storage, processing, use or creation of, or access to, any Customer Information.

1.16            “Vendor Processing Resources” means information processing resources supplied or operated by Vendor, including without limitation, network infrastructure, computer systems, workstations, laptops, hardware, software, databases, storage media, printers, proprietary applications, Internet connectivity, printers and hard copies which are used, either directly or indirectly, in support of Vendor Processing.

Customer Confidential Page 37 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

2. General Requirements.

2.1            Security Program. Vendor shall maintain a comprehensive security program under which Vendor documents, implements and maintains the physical, administrative, and technical safeguards necessary to: (a) comply with applicable law; and (b) protect the confidentiality, integrity, availability, and security of Vendor Processing Resources and Customer Information. Vendor’s security program shall be consistent with the requirements of this Exhibit and shall be designed to ensure compliance with the provisions of applicable law, including without limitation the Health Information Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH), the Payment Card Industry Data Security Standards (PCI DSS), and Xxxxxxxx-Xxxxx (SOX).

2.2            Vendor Security Contact. Vendor shall designate [***] to serve as Vendor’s points of contact for Customer on all security issues. Vendor’s Security Representatives shall be responsible for overseeing compliance with this Exhibit. Vendor shall maintain [***] for the Security representatives’ roles, and will replace a Security Representative within [***] should an individual serving as one of the Security Representatives change roles or no longer be employed by Vendor. Within [***] of the Effective Date and within [***] of identifying a new individual to serve in such role, Vendor will provide Customer with the name and title of, and the [***] contact information (including email and phone number) for the Security Representatives.

2.3            Policies and Procedures. Vendor shall maintain written security management policies and procedures to identify, prevent, detect, contain, and correct violations of measures taken to protect the confidentiality, integrity, availability, or security of Vendor Processing Resources and/or Customer Information. Such policies and procedures shall: (a) assign specific data security responsibilities and accountabilities to specific role(s); (b) include a formal risk management program which includes periodic risk assessments; and (c) provide an adequate framework of controls that safeguard Vendor Processing Resources, Customer Information Systems and Customer Information. Vendor shall provide such policies and procedures to Customer for review upon Customer’s request at any time during the Term.

2.4            Subcontractors. To the extent that any Vendor subcontractor accesses Customer Information Systems or creates, has access to, or receives from or on behalf of Customer any Customer Information in electronic format, Vendor shall enter into a written agreement with such subcontractor [***].

2.5            IT Change and Configuration Management. In addition to any specific requirements set forth in the applicable Statement of Work, Vendor shall employ reasonable processes, consistent with industry best practices, for change management, code inspection, repeatable builds, separation of development and production environments, and testing plans. Code inspections must include a comprehensive process to identify vulnerabilities and malicious code, including but not limited to logic-bombs, sniffers, and backdoors. In addition, Vendor shall ensure that processes are documented and implemented for vulnerability management, patching, and verification of system security controls prior to their connection to production networks.

2.6            Change Notifications. In addition to any specific requirements and subject to any specific conditions set forth in the Agreement or the applicable Statement of Work, Vendor shall provide Customer with at least [***] prior written notice of any relevant material changes that will negatively impact security, to Vendor’s information technology infrastructure, facilities, or resources associated with information security governance and oversight, security, network, and infrastructure operations and any key personnel responsible for ensuring a secure environment spanning Vendor, any of its subcontractors, and Customer.

2.7            Data Retention. Vendor shall not retain any Customer data following completion of the applicable Services, except to the extent: (a) required by law; (b) required pursuant to Exhibit H (Medicare Advantage Regulatory Requirements Appendix); or (c) expressly required by Customer in writing. At Customer’s request, Vendor shall certify to Customer in writing that all Customer data has been returned or destroyed, as required under this Agreement.

Customer Confidential Page 38 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

3. Security Assessment and Independent Certification Requirements

3.1            Applicability. Vendor is required to demonstrate to Customer, through an Independent Certification / Attestation as further set forth in this Section 3, that Vendor has in place appropriate controls to protect Customer Information.

3.2            Security Assessment. [***] Vendor shall have completed a security assessment conducted by Customer’s Information Risk Management department (“Security Assessment”). The Security Assessment may: (a) rely on the Independent Certification/Attestation Vendor provided to Customer; or (b) be in addition to the Independent Certification/Attestation, in Customer’s sole discretion. In addition, Customer may require additional Security Assessments in connection with Statements of Work for new or additional Services. Any remediation requirements identified during a Security Assessment will be documented and tracked using a tool provided by Customer (e.g., a vendor portal or spreadsheet). Vendor will complete such remediation requirements within the agreed upon timeframes. Material remediation requirements may also be set forth in Attachment 1 or the applicable Statement of Work. [***].

3.3            Independent Certification / Attestation – HITRUST CSF Certification. Vendor shall have, as of the Effective Date, and shall maintain through the period described in Section 3.6, a HITRUST CSF Certification. To the extent that Vendor does not have a HITRUST CSF Certification as of the Effective Date, or is the process of obtaining a HITRUST CSF Certification, the requirements of Section 3.4 or Section 3.5, as applicable, shall apply. In order to meet the requirements of this Exhibit, the scope of all assessment, review, testing, validation and certification activities under Vendor’s HITRUST CSF Certification must include all Vendor Processing Resources and Vendor Processing, as well as applicable Vendor facilities used in connection with the provision of the Services.

3.4            Independent Certification / Attestation – Other. Subject to Customer’s prior written consent, which may be withheld or conditioned in Customer’s sole discretion, Vendor may meet the requirements of this Section 3 by obtaining and maintaining an Alternative Certification. To the extent that Customer approves the use of an Alternative Certification, the approved Alternative Certification and a description of the relevant control objectives or similar requirements shall be set forth in Attachment 2.

3.5            HITRUST CSF Implementation Requirements. To the extent that Vendor has not obtained a HITRUST CSF Certification (and Customer has not approved the use of an Alternative Certification), then: (a) the requirements of Section 3.7 shall apply; and (b) Vendor shall (i) complete and provide to Customer a HITRUST CSF Self-Assessment Report, (ii) obtain and provide to Customer a HITRUST CSF Validated Report, and (iii) obtain and provide to Customer a HITRUST CSF Certification by the respective deadlines set forth in Attachment 3. Vendor’s failure to meet the foregoing requirements shall be deemed to be a material breach of the Agreement. If Vendor has begun the process of obtaining a HITRUST CSF Certification before the Effective Date, then Vendor represents and warrants to Customer that all corrective action plans that are necessary to obtain a HITRUST CSF Validated Report and/or HITRUST CSF Certification and that have been identified to Vendor prior to the Effective Date are included in Attachment 3.

3.6            Independent Certification / Attestation Timing Requirements. To the extent that an Independent Certification/Attestation is required under this Exhibit, Vendor shall maintain such Independent Certification/Attestation (and continue to meet the applicable requirements of this Exhibit regarding such Independent Certification/Attestation) until the later of: (a) the expiration or earlier termination of the Agreement; or (b) Vendor no longer maintains (including in archived or secure storage) or has access to, any Customer Information.

3.7            Interim Requirements. Until such time as Vendor obtains either a HITRUST CSF Certification or an Alternative Certification approved by Customer, the requirements of Attachment 4 shall apply.

Customer Confidential Page 39 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

3.8            Reporting of Findings. Upon Customer’s request, Vendor shall report to Customer any findings and associated corrective action plans identified during a self-assessment or any third party assessment, including any assessment related to Vendor’s Independent Certification / Attestation. Vendor will provide Customer with any further information associated with such findings, as reasonably requested by Customer.

4. Security Monitoring and Response

4.1            Mitigation and Remediation of Security Exposures. Vendor will Mitigate or Remediate any High Severity security exposure or finding discovered by Customer or Vendor within [***] from the time Vendor becomes aware of the exposure or finding. Vendor will Mitigate or Remediate any Medium Severity or Low Severity security exposure or finding discovered by Customer or Vendor within [***] from the time Vendor becomes aware of the exposure or finding. With respect to security exposures that are Mitigated (but not Remediated), Vendor must Remediate such security exposures within [***] after being Mitigated (in the case of High Severity exposures) and [***] after being Mitigated (in the case of Medium Severity exposures), and [***] after being Mitigated (in the case of Low Severity exposures). If Vendor fails to Mitigate or Remediate any security exposure or finding within the required timeframe: [***].

4.2            Incident Response. Vendor shall maintain formal processes to detect, identify, report, respond to, Mitigate, and Remediate Security Incidents in a timely manner.

4.3            Incident Notification. Vendor shall notify Customer in writing within [***] of any Security Incident(s) which result in, or which Vendor reasonably believes may result in, unauthorized access to, modification of, or disclosure of Customer Information, Customer Information Systems or other Customer applications. Vendor shall provide Customer with a written Remediation plan within [***] of the Security Incident. Notwithstanding the notice provisions of the Agreement, Vendor shall send all notifications and written communications required under this Section to Customer at XXX@xxx.xxx.

4.4            Incident Remediation. Upon becoming aware of a Security Incident, Vendor will assign a severity level (i.e., High Severity, Medium Severity or Low Severity) based on the definitions set forth in this Exhibit. Vendor will reclassify the Severity Level of any Security Incident upon Customer’s reasonable request. Vendor will Mitigate or Remediate any High Severity Security Incident within [***] from the time Vendor becomes aware of the incident. Vendor will Mitigate or Remediate any Medium Severity or Low Severity Security Incident within [***] from the time Vendor becomes aware of the incident. With respect to Security Incidents that are Mitigated (but not Remediated), Vendor must Remediate such Security Incidents within [***] after being Mitigated (in the case of High Severity incidents) and [***] after being Mitigated (in the case of Medium Severity incidents), and [***] after being Mitigated (in the case of Low Severity incidents). If Vendor fails to Mitigate or Remediate any Security Incident within the required timeframe: [***].

4.5            Site Outage. Vendor shall promptly report to Customer any Vendor site outages where such outage may impact Customer or Vendor’s ability to fulfill its obligations to Customer.

Customer Confidential Page 40 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

5. Hosting, Virtualization Services, and Data Aggregation

5.1            Limits on Shared Hosting and Virtualization. Vendor shall not utilize (nor permit any subcontractor to utilize) any shared hosting or virtualized “cloud” hosting arrangements in support of Customer without Customer’s prior written approval.

5.2            Co-Mingled or Aggregated Data. Vendor shall not [***] Customer Information or any Confidential Information of Customer (including, for example, program code, database scripts, data extracts, process flows, calculations, macros, and business logic) [***] without Customer’s prior written approval. Vendor will obtain Customer’s prior written approval of each Vendor (or subcontractor) data center in which Customer Information is stored or processed.

5.3            Logical and Physical Segregation. Vendor shall physically and/or logically segregate Customer data from data of other Vendor customers.

6. Licenses; Software Development

6.1            No License Granted. Nothing in this Exhibit grants to Vendor, either expressly or by implication, any right or license to access or use for any purpose any Customer Information, Customer Information Systems, or any software in Customer’s computing environments. This Exhibit does not transfer to Vendor title of any ownership rights or rights in patents, copyrights, trademarks and trade secrets included in Customer Information Systems.

6.2            Software Usage. Vendor shall not attempt to copy, alter, decompile, reverse engineer, or disassemble any of the software programs contained in Customer Information Systems.

6.3            Software Development. If the Services include the development of software product(s), including web applications, for Customer, such software shall be developed and maintained in accordance with the development methodology specified by Customer. Such software shall satisfy the appropriate Customer information security policies and guidelines that are furnished by Customer to Vendor (which are incorporated herein by reference). Vendor shall comply with any instructions, guidelines or minimum compliance controls that are furnished by Customer to Vendor (which are incorporated herein by reference) to enable Customer to comply with SOX and/or other applicable laws and regulations. To the extent that Vendor uses internally-developed software or web applications to provide the Services, even if such items are not developed exclusively for Customer, then (a) Vendor shall insure that such items comply with any instructions, guidelines or minimum compliance controls that are furnished by Customer to Vendor (which are incorporated herein by reference) to enable Customer to comply with applicable laws and regulations, and (b) Vendor will provide Customer with such information as is reasonably necessary for Customer to confirm that applicable compliance controls are in place.

7.             Audit. Notwithstanding anything to the contrary in the Agreement, Vendor will provide to Customer, its auditors (including internal audit staff and external auditors), inspectors, regulators and other representatives as Customer may from time to time designate in writing, access [***] to any facility or part of a facility at which either Vendor or any of its subcontractors is performing Vendor Processing or which contains Vendor Processing Resources, and to data and records relating to Vendor Processing, Vendor Processing Resources, and information security for the purpose of performing audits and inspections of Vendor and any of its subcontractors to (a) verify the integrity of Customer Information and examine the systems that process, store, secure, support and transmit Customer Information; (b) verify Vendor’s and its subcontractors’ compliance with the requirements of this Exhibit, and (c) review general controls and security practices and procedures. Vendor will cooperate fully with Customer or its designees in connection with audit functions and with regard to examinations by regulatory authorities. Customer’s auditors and other representatives will comply with Vendor’s reasonable security requirements in the performance of such audit.

8.             Amendments. Notwithstanding anything to the contrary set forth in the Agreement, Customer may amend this Exhibit by providing at least [***] prior written notice to Vendor if Customer reasonably determines that such amendment is necessary for Customer to comply with the Standards for Privacy of Individually Identifiable Health Information or the Security Standards for the Protection of Electronic Protected Health Information (both of which are set forth at 45 CFR Parts 160 and 164) or any other federal, state or local law, regulation, ordinance, or requirement relating to the confidentiality, integrity, availability, or security of Customer Information.

Customer Confidential Page 41 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Attachment 1

Security Assessment Remediation Requirements

¨           Not applicable.

x          Applicable.

#	Remediation Requirement	Completion Criteria	Implementation Date
Independent	[***]	[***]	No later than [***]
Review of		be performed [***] in order to	from the Effective Date of
Information		provide reasonable assurance	of this MSA
Security		that security practices and
		operations are effective.

(add rows as necessary)

Customer Confidential Page 42 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Attachment 2

Alternative Certification Requirements

¨            Not applicable.

x            Applicable.

Customer approves and consents to the SOC 2 Type II submitted by Vendor as an Alternative Certification in compliance with Section 3.3 of this Exhibit E (Security), until such time that Vendor obtains the SOC 2 Type 2 report mapped with HITRUST CSF. Vendor shall maintain such Alternative Certification in compliance with this Agreement at all times.

Furthermore, Vendor is in the process of obtaining SOC 2 Type 2 report mapped with HITRUST CSF. The controls tested during this process, as well as in future assessments, as part of the SOC 2 Type II shall cover all of the HITRUST controls in the then current mapping principles to HITRUST CSF or as otherwise communicated to Vendor in writing during the term of this Agreement. The current version can be found at: xxxxx://xxxxxxxxxxxxxxx.xxx/xxx-xxx-xxxxxxx-xxxxxxxxx/ OR xxxxx://xxxxxxxxxxxxxxx.xxx/xxx0/]. Vendor will obtain the SOC 2 Type 2 report mapped with HITRUST CSF no later than [***] from the Effective Date of this MSA. Vendor will provide Customer with a copy of the SOC 2 Type 2 report mapped with HITRUST CSF documentation, along with any supporting documentation requested of Vendor, within [***] of receipt from the certifying authority. Vendor shall maintain its certification in compliance with this Agreement at all times.

Customer Confidential Page 43 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Attachment 3

HITRUST CSF Implementation Plan

x            Not applicable.

¨            Applicable.

1. Implementation Deadlines.

Requirement	Deadline
HITRUST CSF Self-Assessment Report	[[***] after the Effective Date]
HITRUST CSF Validated Report	[[***] after the Effective Date]
HITRUST CSF Certification	[[***] after the Effective Date]

2. Corrective Action Plans.

Customer Confidential Page 44 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

Attachment 4
Interim Requirements

x           Not applicable.

¨           Applicable.

1. Definitions. The following terms shall have the meanings as set forth below:

1.1            “Device” means equipment or electronic media on which Customer Information is accessed, stored or processed, including without limitation storage drives or tapes, removable drives or media (to the extent permitted by Customer), desktop and laptop computers, tablets, and mobile devices.

1.2            “Vendor Personnel” will mean employees, contractors or agents of Vendor, or of its subcontractors, who provide Services (or any component thereof) to Customer.

2. Security Management (Infrastructure Protection)

Vendor shall maintain industry standard procedures to protect Vendor Processing Resources, including, at a minimum:

(a) Formal security programs (e.g., policies, standards, processes);

(b) Content aware solutions (i.e., data loss prevention) to discover, monitor, and protect data during transit/at rest across network, storage, and endpoint systems;

(c) Processes for becoming aware of and maintaining security patches and fixes;

(d) Router filters, firewalls, and other mechanisms to restrict access to the Vendor Processing Resources, including without limitation, all local site networks that may be accessed via the Internet (whether or not such sites transmit information);

(e) Resources used for mobile access to Customer Information Systems shall be protected against attack and penetration through the use of firewalls, malware detection/prevention, and encryption; and

(f) Processes to prevent, detect, and eradicate malicious code (e.g., viruses) and to notify Customer of instances of malicious code detected on Vendor Processing Resources that may affect Customer Information or Customer Information Systems. Notwithstanding the notice provisions of the Agreement, Vendor shall send all notifications and written communications required under this Section to Customer at XXX@xxx.xxx.

3. Risk Management

3.1            General Requirements. Vendor shall maintain appropriate safeguards and controls and exercise due diligence to protect Customer Information and Vendor Processing Resources against unauthorized access, use, and/or disclosure, considering all of the factors and/or requirements listed below. In the event of any conflict or inconsistency between relevant requirements, Vendor shall protect the Customer Information and Vendor Processing Resources in accordance with [***]:

(a) Federal and state legal and regulatory requirements;

(b) Information technology and healthcare industry best practices (e.g., HITRUST Common Security Framework);

(c) Sensitivity of the data;

(d) Relative level and severity of risk of harm should the integrity, confidentiality, availability or security of the data be compromised, as determined by Vendor as part of an overall risk management program;

(e) Customer’s data security requirements, as set forth in this Exhibit, the due diligence process and/or in the Agreement; and

(f) Any further information security requirements which are included in a Statement of Work or equivalent document which is attached to or relates to the Agreement.

Customer Confidential Page 45 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

3.2            Internal Risk Assessment. Vendor shall periodically [***] evaluate its processes and systems to ensure continued compliance with obligations imposed by law, regulation or contract with respect to the confidentiality, integrity, availability, and security of Customer Information and Vendor Processing Resources. Vendor shall document the results of these evaluations and any remediation activities taken in response to such evaluations, and provide a copy to Customer, upon Customer’s request.

3.3            Internal Records. Vendor shall maintain mechanisms to capture, record, and examine information relevant to Security Incidents and other security-related events. In response to such events, Vendor shall take appropriate action to address and remediate identified vulnerabilities to Customer Information and Vendor Processing Resources, including as set forth in this Exhibit.

3.4            Vulnerability Assessment and Patch Management. Vendor shall provide Customer with the results of external vulnerability testing, internal infrastructure vulnerability testing, and application vulnerability testing. Vendor will perform (and, at Customer’s request, allow Customer to perform) penetration tests of applicable Vendor environments, including perimeter vulnerability testing, internal infrastructure vulnerability testing, and application testing. Vendor shall also ensure that appropriate patches and security updates are applied in accordance with OEM recommendations or (subject to Customer’s prior written approval) industry standards and best practices. Vendor shall provide process documentation and assessment results to Customer upon Customer’s request.

3.5            Audit and Attestation Practices. Vendor shall provide to Customer [***] information on its audit processes, procedures and controls, including a report on any findings and remediation efforts. If Vendor has not, as of the Effective Date, obtained a HITRUST CSF Certification or an Alternative Certification approved by Customer to permanently substitute for the HITRUST CSF Certification, then Vendor shall provide Customer an interim Alternative Certification. Vendor shall provide such Alternative Certification as of the Effective Date and [***] thereafter until (a) Vendor obtains a HITRUST CSF Certification approved by Customer, or (b) the Agreement expires or is terminated.

3.6            Vendor Locations. Unless previously authorized by Customer in writing, all work performed by Vendor related to the Agreement shall be performed from the Vendor location(s) designated in the Agreement and/or relevant Statement of Work(s).

4. Personnel Security

4.1            Access to Customer Information. Vendor shall require that Vendor Personnel who have, or may be expected to have, access to Customer Information or Customer Information Systems comply with the provisions of the Agreement, including this Exhibit and any confidentiality agreement(s) or Business Associate Agreement(s) binding upon Vendor. Vendor will remain responsible for any breach of this Exhibit by Vendor Personnel.

4.2            Security Awareness. Vendor shall ensure that Vendor Personnel remain aware of industry standard security practices, and their responsibilities for protecting the Customer Information. Vendor shall provide information security awareness training and education to all Vendor Personnel upon hire, during the on-boarding process, and annually thereafter. Such information security awareness education and training shall address the responsibilities related to the Services provided to Customer. Customer may, at its option, review the content of, and request modifications to, the training curriculum. Vendor shall accommodate all of Customer’s reasonable requests in this regard. Participation in such training by Vendor Personnel shall be mandatory and Vendor shall track attendance and, at Customer’s request, provide a confirmation that all Vendor Personnel have completed such training. Vendor’s information security awareness training shall include, but not be limited to:

(a) Protection against malicious software (such as viruses);

(b) Appropriate password protection and password management practices;

(c) Appropriate use of workstations and computer system accounts;

(d) HIPAA and HITECH requirements, including the Privacy Rule and Security Rule;

(e) Vendor’s information security policies;

(f) Any applicable acceptable use policies;

Customer Confidential Page 46 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

(g) Relevant obligations set forth in the Agreement; and

(h) Procedures for reporting Security Incidents.

4.3            Sanction Policy. Vendor shall maintain a sanction policy to address violations of Vendor’s internal security requirements or security requirements which are imposed on Vendor by law, regulation, or contract.

4.4            Supervision of Workforce. Vendor shall maintain processes for authorizing and supervising Vendor Personnel and for monitoring access to Customer Information, Customer Information Systems and/or Vendor Processing Resources.

5. Physical Security.

Vendor shall maintain appropriate physical security controls (including facility and environmental controls) to prevent unauthorized physical access to Vendor Processing Resources and areas in which Customer Information is stored or processed. Where practicable, this obligation shall include controls to physically protect hardware (e.g., lockdown devices). Vendor shall adopt and implement a written facility security plan which documents such controls and the policies and procedures through which such controls will be maintained. Vendor shall maintain appropriate records of maintenance performed on Vendor Processing Resources and on the physical control mechanisms used to secure Vendor Processing Resources. Vendor shall obtain Customer’s prior written approval before moving storage or processing of Customer Information, or Vendor Personnel who have access to Customer Information or Customer Information Systems, to any location not previously authorized by Customer. Vendor agrees and acknowledges that any such relocation may require updates to any applicable Independent Attestation/Certification, and Vendor will not complete any such relocation until such updates have been completed.

6. Security Monitoring and Response

6.1            Incident Response. Vendor shall maintain formal processes to detect, identify, report, respond to, Mitigate, and Remediate Security Incidents in a timely manner.

6.2            Incident Notification. Vendor shall notify Customer in writing within [***] of any Security Incident(s) which result in, or which Vendor reasonably believes may result in, unauthorized access to, modification of, or disclosure of Customer Information, Customer Information Systems or other Customer applications. Vendor shall provide Customer with a written Remediation plan within [***] of the Security Incident. Notwithstanding the notice provisions of the Agreement, Vendor shall send all notifications and written communications required under this Section to Customer at XXX@xxx.xxx.

6.3            Incident Remediation. Upon becoming aware of a Security Incident, Vendor will assign a severity level (i.e., High Severity, Medium Severity or Low Severity) based on the definitions set forth in this Exhibit. Vendor will reclassify the Severity Level of any Security Incident upon Customer’s reasonable request. Vendor will Mitigate or Remediate any High Severity Security Incident within [***] from the time Vendor becomes aware of the incident. Vendor will Mitigate or Remediate any Medium Severity or Low Severity Security Incident within [***] from the time Vendor becomes aware of the incident. With respect to Security Incidents that are Mitigated (but not Remediated), Vendor must Remediate such Security Incidents within [***] after being Mitigated (in the case of High Severity incidents) and [***] after being Mitigated (in the case of Medium Severity incidents), and [***] after being Mitigated (in the case of Low Severity incidents). If Vendor fails to Mitigate or Remediate any Security Incident within the required timeframe: [***].

Customer Confidential Page 47 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

6.4            Site Outage. Vendor shall promptly report to Customer any Vendor site outages where such outage may impact Customer or Vendor’s ability to fulfill its obligations to Customer.

7. Data and Communications Security

7.1            Exchange of Customer Information. Vendor shall utilize a method of transmitting Customer Information electronically that limits the unauthorized access to and/or modification of such information.

7.2            Data Retention. Vendor shall not retain any Customer data following completion of the applicable Services, except to the extent (a) required by law, (b) required pursuant to Exhibit H (Medicare Advantage Regulatory Requirements Appendix), or (c) expressly required by Customer in writing. Subject to the foregoing, Vendor shall ensure that following the completion of the applicable Services, the Customer data used in connection with such Services is Securely Deleted in accordance with Vendor’s records retention policy, which shall be developed by Vendor and reviewed by Customer. At Customer’s request, Vendor shall certify to Customer in writing that all Customer data has been destroyed as required hereunder. As used herein, “Securely Deleted” (or “Securely Delete”) means that (i) hard copy materials are destroyed and cannot be reconstructed (e.g., shredded);

(ii) electronic files are deleted and overwritten to a level sufficient to ensure that they cannot be retrieved or reconstructed and that any Customer data contained in the files is rendered unreadable, unusable and indecipherable; and (iii) Devices are physically destroyed, degaussed or overwritten in accordance with NIST Special Publication 800-88. Vendor shall Securely Delete any Customer data provided by Customer but not required by Vendor for performance of the applicable Services promptly after Vendor discovers that such data is not needed, provided, however, that if such prompt deletion would require Vendor to reallocate resources and impact Vendor’s ability to meet Service Level requirements or deadlines established by Customer, then Customer and Vendor will work together to establish a schedule for such deletion.

7.3            Encryption. Vendor shall ensure that all Customer data containing Customer Information whether stored (i.e., “data at rest”) or that Vendor transmitted (i.e., “data in motion”) over the public internet is encrypted using valid encryption processes. Full disk encryption must be implemented on any desktop or laptop computer on which Customer data is stored or processed. Valid encryption processes for data at rest are consistent with NIST Special Publication 800-111, Guide to Storage Encryption Technologies for End User Devices. Valid encryption processes for data in motion are those which comply, as appropriate [***]: (a) NIST Special Publications 800-52, Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations; 800- 77, Guide to IPsec VPNs, or (b) the requirements of applicable data security and/or privacy laws in the country from which the Customer Information originates, or (c) other which are Federal Information Processing Standards (FIPS) 140-2 validated. Vendor shall maintain such encryption for all transmissions by Vendor of Customer data via public networks (e.g., the Internet). Such transmissions include, but are not limited to:

(i) Sessions between web browsers and web servers;

(ii) Email containing Customer Information (including passwords);

(iii) Transfer of files via the Internet (e.g., FTP);

(iv) Laptop / desktop encryption;

(v) Mobile Device encryption; and

(vi) Removable storage media encryption (e.g., thumb drive, external hard drives, writable CD drives, backup tapes).

7.4            Protection of Systems, Devices and Storage Media. With respect to all Vendor systems or Devices containing Customer data, Vendor shall ensure all reasonable, industry-standard measures are taken to physically secure such Devices to prevent any unauthorized disclosure while in transit and while at rest. Vendor shall ensure that all Devices on which Customer data was stored or processed are Securely Deleted before such Devices are used for any other purpose. No Device on which Customer data was stored or processed may be sold, donated, discarded, or otherwise disposed of or used by any organization unless such Device has been Securely Deleted. All media on which Customer data is stored shall be protected against unauthorized access or modification. Vendor shall maintain reasonable and appropriate processes and mechanisms to maintain accountability and tracking of the receipt, removal and transfer of Devices, including certification of the Device being Securely Deleted.

Customer Confidential Page 48 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

7.5            Data Integrity. Vendor shall maintain processes to prevent unauthorized or inappropriate modification of Customer Information, for both data in transit and data at rest.

8. Access Control

8.1            Identification and Authentication. All access to any Customer Information or any Vendor Processing Resources shall be Identified and Authenticated as defined in this Section. “Identification” (or “Identify,” as the context requires) refers to processes which establish the identity of the person or entity requesting access to Customer Information and/or Vendor Processing Resources. “Authentication” (or “Authenticate,” as the context requires) refers to processes which validate the purported identity of the requestor. For access to Customer Information or Vendor Processing Resources, Vendor shall require Authentication by the use of an individual, unique user ID and an individual password or other appropriate Authentication technique approved by Customer in writing. Vendor shall obtain written approval from Customer prior to using digital certificates as part of Vendor’s Identification or Authorization processes. Vendor shall maintain procedures to ensure the protection, integrity, and soundness of all passwords created by Vendor and/or used by Vendor in connection with the Agreement.

8.2            Account Administration. Vendor shall maintain appropriate processes for requesting, approving, and administering accounts and access privileges for Vendor Processing Resources and Customer Information. These processes shall be required for both Customer-related accounts and Vendor’s internal accounts for Vendor Processing Resources, and shall include procedures for granting and revoking emergency access to Vendor Processing Resources and Customer Information. All access by Vendor Personnel to Customer Information Systems shall be subject to prior approval by Customer and shall follow Customer standard policies and procedures.

8.3            Access Control. Vendor shall maintain appropriate access control mechanisms to prevent all access to Customer Information and/or Vendor Processing Resources, except by (a) specified users expressly authorized by Customer and (b) Vendor Personnel who have a “need to access” to perform a particular function in support of Vendor Processing. The access and privileges granted shall be limited to the minimum necessary to perform the assigned functions. Vendor shall maintain processes to ensure that Vendor Personnel access to Customer Information is revoked no later than [***] upon termination and [***] in the case of involuntary termination. Vendor shall maintain appropriate mechanisms and processes for detecting, recording, analyzing, and resolving unauthorized attempts to access Customer Information or Vendor Processing Resources. If Vendor Personnel change roles or for any other reason no longer require access to Customer Information Systems, Vendor will notify Customer within [***]. In the case of involuntary termination, Vendor will notify Customer within [***]. Notwithstanding the notice provisions of the Agreement, Vendor shall send all notifications and written communications required under this Section to Customer at [***].

8.4            Personal Devices and Removable Media. Vendor shall ensure the Vendor Personnel will not be permitted to, and will not, utilize personal computing equipment for accessing Customer Information Systems or processing Customer Information. Vendor shall monitor and prevent Customer data from being sent via social media or personal email accounts. Vendor shall restrict access to, and the use of removable media, such as USB ports, writable optical media, portable hard drives, and other removable media. Vendor may not (and shall cause Vendor Personnel to not) use any such removable media to store or transfer Customer Information without Customer’s prior written approval.

9. Network Security

Vendor shall only have access to Customer Information Systems authorized by Customer and shall use such access solely for providing Services to Customer. Vendor shall not attempt to access any applications, systems or data which Customer has not authorized Vendor to access or which Vendor does not need to access in order to perform Services for Customer. Vendor further agrees to access such applications, data and systems solely to the extent minimally necessary to provide Services to Customer. Vendor's attempt to access any applications, data or systems in violation of the terms in this Section shall be a material breach of the Agreement.

Customer Confidential Page 49 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

EXHIBIT G
BACKGROUND INVESTIGATIONS

Vendor shall, at its own expense, perform a background investigation on each individual assigned to perform Services under the Agreement which will involve: (i) unescorted access to any Customer facility, (ii) direct access or connectivity to any Customer Information Systems (as defined in Exhibit F), (iii) access to protected health information or non-public personal information, or (iv) driving on behalf of Customer (collectively, “High Access Services”).

Prior to the assignment of any individual to perform High Access Services, Vendor shall provide Customer with written confirmation that a background investigation have been successfully completed and passed in accordance with the requirements set forth below. Vendor shall be responsible for obtaining any necessary consent from such individuals to permit Customer full access to the background investigation reports. Vendor agrees to keep all such reports for a period of at least [***] past the last date the individual was assigned to Customer.

Vendor shall not permit any former employee of Customer, UnitedHealth Group, or any of their Affiliates to perform High Access Services without the prior written approval of the UnitedHealth Group Employee Relations department.

Should Vendor become aware, at any time during an individual’s assignment for Customer, that the individual is disqualified from performing High Access Services, Vendor shall immediately remove such individual from his or her assignment with Customer and shall notify Customer in writing within [***] of gaining such knowledge.

Customer reserves the right to regularly audit Vendor to determine whether the terms set forth herein are being completed to the satisfaction of Customer. Should Vendor fail to comply with any term of this Exhibit, Vendor shall, upon written request from Customer, pay to Customer a penalty of [***] per occurrence (i.e., per individual), which amounts Customer, at its sole discretion, may offset against sums otherwise owed to Vendor. Notwithstanding anything to the contrary in the Agreement or otherwise, this remedy is cumulative and in addition to any remedies available at law or in equity.

Nothing contained in this Agreement shall be construed to create any obligation on the part of Customer to disclose to Vendor, or to any individual, the reasons for its determination to terminate, or to decline, the assignment of an individual, or share any information obtained through a background investigation, except to the extent required by law.

Vendor shall meet the requirements of the Fair Credit Reporting Act, any regulations issued thereunder, and any other applicable state and federal laws.

Background Investigation Requirements:

1. Background investigations shall include:

• Social Security Number (SSN) trace verification (including disclosure of all other names by which the individual has been known and a check for validity, a suspicious issuance date or a deceased person result);

• System for Award Management (XXX) database for debarment from federal programs;

• Office of Foreign Assets Control Specially Designated Nationals (SDN) List;

• Felony and misdemeanor convictions filed at federal, state, and county government levels for the individual’s home, school and work addresses for the previous seven year period, including participation in court-ordered programs, deferred adjudication, probation and parole;

• the US Department of Justice National Sex Offender Public Website (NSOPW); and

• The following investigations, as applicable:

Customer Confidential Page 50 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

In the event the assignment requires:	…the background investigation must include:
Driving on behalf of Customer	Motor Vehicle history in state of current licensure, state of residence, and state of assignment, if different.
Licensed health professional	FACIS Level 3 search
Educational degrees, licenses, or professional certifications required for the position	Verifications of such degrees / licenses / certifications

2. Vendor Assignment Screening Matrix

Vendor shall make an initial determination as to whether an individual to be assigned to perform High Access Services has passed or failed the background investigation, or requires further review, in accordance with the following screening matrix:

If the background investigations results in a discrepancy or a positive hit, as applicable, consult this matrix and the legend below:
SSN	R
XXX Database	F
SDN List	F
NSOPW	R
Educational Degree*	R
License(s) *	F
Certification(s) *	F
	Year 1	Year 2	Year 3	Year 4	Year 5	Year 6	Year 7
Felony	F	F	F	F	F	F	F
Misdemeanor Involving Theft, Fraud, Drugs or Violence	F	F	F	R	R	R	R
DMV – Major Violation(s)*	F	F	F	R	R	R	R
DMV – Minor Violation(s)*	R	R	P	P	P	P	P
FACIS Level 3 *	R	R	R	R	R	R	R

^* = If applicable to the position

LEGEND

F = FAIL

P = PASS 

R = Requires evaluation and approval by Customer’s Employee Relations Department (HRdirect).

DMV – Minor Violation(s) = Any moving violation other than a Major Violation, as defined below.

DMV – Major Violation(s) = Hit and run, negligent homicide, reckless driving, careless driving, driving while license is suspended or revoked, driving while intoxicated, driving under the influence, and/or possession of open container of alcoholic beverage.

3. Drug Free Workplace Policy

Vendor is committed to protecting the safety, health, and well-being of its employees and all people who come into contact with its workplace(s) and property, and/or use its products and services. Recognizing that drug abuse poses a direct and significant threat to this goal, Vendor is committed to ensuring a drug-free working environment for all of its employees. Vendor will implement and enforce a policy that prohibits the illicit use, possession, sale, conveyance, distribution, or manufacture of illegal drugs, intoxicants, or controlled substances in any amount or in any manner.

Customer Confidential Page 51 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

EXHIBIT H

MEDICARE ADVANTAGE REGULATORY REQUIREMENTS APPENDIX
VENDOR – DELEGATED ENTITY

THIS MEDICARE ADVANTAGE REGULATORY REQUIREMENTS APPENDIX (this “Exhibit”) supplements and is made part of the Agreement.

SECTION 1
APPLICABILITY

This Exhibit applies to the administrative services performed and products provided by Vendor pursuant to the Agreement as such services and products relate to Medicare Advantage Benefit Plans. In the event of a conflict between this Exhibit and other appendices or any provision of the Agreement, the provisions of this Exhibit shall control except: (1) with regard to Benefit Plans outside the scope of this Exhibit; or (2) as required by applicable law.

SECTION 2
DEFINITIONS

For purposes of this Exhibit, the following terms shall have the meanings set forth below.

2.1           Benefit Plan: A certificate of coverage, summary plan description, or other document or agreement, whether delivered in paper, electronic, or other format, under which a Payer is obligated to provide coverage of Covered Services for a Customer.

2.2           CMS Contract: A contract between the Centers for Medicare & Medicaid Services (“CMS”) and a Medicare Advantage Organization for the provision of Medicare benefits pursuant to the Medicare Advantage Program under Title XVIII, Part C of the Social Security Act.

2.3           Covered Service: A health care service or product for which a Customer is entitled to receive coverage from a Payer, pursuant to the terms of the Customer’s Benefit Plan with that Payer.

2.4           Customer: For the purposes of this Exhibit, Customer means a person eligible and enrolled to receive coverage from a Payer for Covered Services.

2.5           Medicare Advantage Benefit Plans: Benefit Plans sponsored, issued or administered by a Medicare Advantage Organization as part of the Medicare Advantage program or as part of the Medicare Advantage program together with the Prescription Drug program under Title XVIII, Part C and Part D, respectively, of the Social Security Act (as those program names may change from time to time).

2.6           Medicare Advantage Customer or MA Customer: A Customer eligible for and enrolled in a Medicare Advantage Benefit Plan that is covered under the Agreement.

2.7 Medicare Advantage Organization or MA Organization: For purposes of this Exhibit, MA Organization is:

(a) UnitedHealthcare Insurance Company or one of its affiliates that has entered into a contract with CMS for the purpose of offering a Benefit Plan to MA Customers; or (b) Payer.

2.8           Payer: An entity obligated to a Customer to provide reimbursement for Covered Services under the Customer’s Benefit Plan.

Customer Confidential Page 52 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

SECTION 3
DELEGATED ACTIVITIES

3.1           MA Organization Accountability; Delegated Activities. Vendor acknowledges and agrees that MA Organization oversees and is accountable to CMS for any functions and responsibilities described in the CMS Contract and applicable Medicare Advantage regulations, including those that MA Organization has delegated to Vendor under the Agreement. In addition to the other provisions of this Exhibit, the following shall apply with respect to any functions and responsibilities under the CMS Contract that MA Organization has delegated to Vendor pursuant to the Agreement:

(a)            Vendor shall perform or arrange for the provision of those delegated activities set forth in the Agreement.

(b) Vendor shall comply with any reporting responsibilities as set forth in the Agreement.

(c)            If MA Organization has delegated to Vendor any activities related to the credentialing of health care providers, Vendor must comply with all applicable CMS requirements for credentialing, including but not limited to the requirement that the credentials of medical professionals must either be reviewed by MA Organization, or the credentialing process must be reviewed, preapproved, and audited on an ongoing basis by MA Organization.

(d)            If MA Organization has delegated to Vendor the selection of health care providers to be participating providers in MA Organization’s Medicare Advantage network, or the selection of contractors or subcontractors to perform services under the CMS Contract, MA Organization retains the right to approve, suspend or terminate the participation status of such health care providers and the agreements with such contractors or subcontractors.

(e)            Vendor acknowledges that MA Organization shall monitor Vendor’s performance of delegated activities on an ongoing basis. Such monitoring activities may include site visits and periodic audits. If CMS or MA Organization determines that Vendor has not performed satisfactorily, or has failed to meet all reporting and disclosure requirements in a timely manner, MA Organization may revoke any or all of the delegated activities and reporting requirements. Vendor shall cooperate with MA Organization regarding the transition of any delegated activities or reporting requirements that have been revoked by MA Organization.

SECTION 4
VENDOR REQUIREMENTS

4.1           Data. Vendor shall submit to MA Organization risk adjustment data as defined in 42 CFR 422.310(a) if applicable. By submitting data to MA Organization, Vendor represents to MA Organization, and upon MA Organization’s request, shall certify in writing, that the data is accurate, complete, and truthful, based on Vendor’s best knowledge, information and belief.

4.2           Customer Protection. Vendor agrees that in no event, including but not limited to, non-payment by Vendor or MA Organization, insolvency of Vendor or MA Organization, or breach of the Agreement, shall Vendor xxxx, charge, collect a deposit from, seek compensation, remuneration or reimbursement from, or have any recourse against any MA Customer or person (other than MA Organization) acting on behalf of the MA Customer for any fees that are the legal obligation of MA Organization under the CMS Contract.

4.3           Eligibility. Vendor agrees to immediately notify MA Organization in the event Vendor is or becomes excluded from participation in any federal or state health care program under Section 1128 or 1128A of the Social Security Act. Vendor shall not employ or contract for the provision of health care services, utilization review, medical social work or administrative services and products, (collectively “Eligibility Services”), with or without compensation, with any individual or entity that is or becomes excluded from participation in any federal or state health care program under Section 1128 or 1128A of the Social Security Act. Vendor shall review the (1) Department of Health and Human Services Officer of Inspector General List of Excluded Individuals and Entities and (2) the System for Award Management (XXX), a portal for the Federal Procurement System, (and any successor lists) prior to the hiring or contracting of any new employee, temporary employee, volunteer, consultant, governing body member or subcontractor for the provision of Eligibility Services. Vendor must continue to review these lists on a monthly basis thereafter to ensure that none of these persons or entities are excluded or become excluded from participation in federal programs.

Customer Confidential Page 53 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

4.4           Laws. Vendor shall comply with all applicable federal and Medicare laws, regulations, and CMS instructions, including but not limited to: (a) federal laws and regulations designed to prevent or ameliorate fraud, waste, and abuse, including but not limited to, applicable provisions of federal criminal law, the False Claims Act (31 X.X.X. §0000 et seq.), and the anti-kickback statute (§1128B of the Social Security Act); and (b) HIPAA administrative simplification rules at 45 CFR Parts 160, 162, and 164.

4.5           Federal Funds. Vendor acknowledges that MA Organization receives federal payments under the CMS Contract and that payments Vendor receives from or on behalf of MA Organization are, in whole or in part, from federal funds. Vendor is therefore subject to certain laws that are applicable to individuals and entities receiving federal funds.

4.6           CMS Contract. Vendor shall perform the services and provide the products set forth in the Agreement in a manner consistent with and in compliance with MA Organization’s contractual obligations under the CMS Contract.

4.7 Records.

(a)            Maintenance; Privacy and Confidentiality; Customer Access. Vendor shall maintain records and information related to services performed and products provided by Vendor under the Agreement, in an accurate and timely manner. Vendor shall maintain such records for the longer of the following periods:

(i)      in the case of records containing information related to the medical loss ratio information reported to CMS by the MA Organization, including, for example, information related to incurred claims and quality improvement activities, at least [***] from the date such medical loss ratio information is reported to CMS by the MA Organization, or

(ii)     in the case of all records, at least [***] from the final date of the CMS Contract period in effect at the time the records were created, or such longer period as required by law.

Vendor shall safeguard MA Customer privacy and confidentiality, including but not limited to the privacy and confidentiality of any information that identifies a particular MA Customer, and shall comply with all federal and state laws regarding confidentiality and disclosure of medical records or other health and enrollment information, including the requirements established by MA Organization and the Medicare Advantage program, as applicable.

(b)           Government Access to Records. Vendor acknowledges and agrees that the Secretary of Health and Human Services, the Comptroller General, or their designees shall have the right to audit, evaluate and inspect any pertinent books, contracts, computer or other electronic systems (including medical records), patient care documentation and other records and information belonging to Vendor that involve transactions related to the CMS Contract. This right shall extend through the longer of the following periods:

(i)      in the case of records containing information related to the medical loss ratio information reported to CMS by the MA Organization, including, for example, information related to incurred claims and quality improvement activities, at least [***] from the date such medical loss ratio information is reported to CMS by the MA Organization, or

(ii)     in the case of all records, at least [***] from the later of the final date of the CMS Contract period in effect at the time the records were created or the date of completion of any audit, or longer in certain instances described in the applicable Medicare Advantage regulations.

For the purpose of conducting the above activities, Vendor shall make available its premises, physical facilities and equipment, records relating to the services performed and the products provided under the Agreement, and any additional relevant information CMS may require.

Customer Confidential Page 54 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

(c)            MA Organization Access to Records. Vendor shall grant MA Organization or its designees such audit, evaluation, and inspection rights identified in subsection 4.7(b) as are necessary for MA Organization to comply with its obligations under the CMS Contract. Whenever possible, MA Organization will give Vendor reasonable notice of the need for such audit, evaluation or inspection, and will conduct such audit, evaluation or inspection at a reasonable time and place.

4.8           Subcontracts. If Vendor has any arrangements, in accordance with the terms of the Agreement, with affiliates, subsidiaries or any other subcontractors, directly or through another person or entity, to perform any of the services or provide any products Vendor is obligated to perform or provide under the Agreement that are the subject of this Exhibit, Vendor shall ensure that all such arrangements are in writing, duly executed, and include all the terms contained in this Exhibit. Vendor shall provide proof of such to MA Organization upon request. In addition, Vendor agrees to oversee and monitor, on an ongoing basis, the services Vendor has subcontracted to another person or entity. Vendor further agrees to promptly amend its agreements with such subcontractors, in a manner consistent with the changes made to this Exhibit by MA Organization, to meet any additional CMS requirements that may apply to the performance of the services or the provision of the products.

4.9           Offshoring. Unless previously authorized by MA Organization in writing, all services provided by Vendor pursuant to the Agreement that are subject to this Exhibit must be performed within the United States, the District of Columbia, or the United States territories.

If MA Organization authorizes Vendor in writing to perform Medicare-related services that involve Medicare beneficiary protected health information (“PHI”) pursuant to the Agreement at locations outside of one of the fifty United Sates, the District of Columbia, or one of the United States Territories (American Samoa, Guam, Northern Marianas, Puerto Rico and Virgin Islands), the following provisions apply:

(a)            Vendor represents and warrants to MA Organization that Vendor has in place and will comply with policies and procedures to ensure that all PHI and other personal information remains secure. Vendor will provide written evidence of the policies and procedures upon MA Organization’s request.

(b)            Vendor will provide prior written notice to MA Organization of (a) any material change in the Medicare-related services that involve PHI that Vendor performs offshore, (b) any material change in Vendor’s policies and procedures to ensure that all PHI and other personal information remains secure, and

(c)            any material change in the tools and systems used by Vendor to ensure that all PHI and other personal information remains secure.

(c)            Vendor is prohibited from receiving access to any PHI or other personal information that is not associated with its contractual relationship with MA Organization. If Vendor receives access to PHI or other personal information of MA Organization’s members that is not associated with Vendor’s contractual relationship with MA Organization, Vendor will immediately notify MA Organization that it has received such access, return all PHI or personal information accessed by Vendor, and destroy any such PHI or personal information that remains in Vendor’s possession after doing so (i.e. copies, electronic records, back-ups or temporary files).

(d)           Vendor’s services under the Agreement may be terminated [***] upon discovery of a significant security breach.

(e) Vendor authorizes MA Organization or its designee to conduct an audit of Vendor [***].

(f)            Vendor acknowledges and agrees that MA Organization will use the results of its audit of Vendor to evaluate the continuation of MA Organization’s relationship with Vendor.

(g)            Vendor authorizes MA Organization or its designee to share the results of audits of Vendor with CMS.

Customer Confidential Page 55 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

SECTION 5
OTHER

5.1 Regulatory Amendment. MA Organization may unilaterally amend this Exhibit to comply with applicable laws and regulations and the requirements of applicable regulatory authorities, including but not limited to CMS. MA Organization shall provide written notice to Vendor of such amendment and its effective date. Unless such laws, regulations or regulatory authority(ies) direct otherwise, the signature of Vendor will not be required in order for the amendment to take effect.

rev. 08-13

Customer Confidential Page 56 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

EXHIBIT I

MASTER COMMUNITY & STATE APPENDIX

THIS MASTER COMMUNITY & STATE APPENDIX (this “Exhibit”) supplements and is made part of the Agreement. This Exhibit applies with respect to the provision of services Vendor provides for any Customer health plan Affiliate administering a Medicaid or other state-specific (“State”) government funded and regulated program (“State Program”). In the event of a conflict between this Exhibit and other appendices or any provision of the Agreement, the provisions of this Exhibit shall control except with regard to benefit plans outside the scope of this Exhibit or unless otherwise required by law or applicable State regulatory agency. Vendor will comply with the following requirements to the extent applicable to Vendor’s performance of services under the Agreement.

Capitalized terms used but not defined in this Exhibit shall have the meaning assigned to them in the Agreement or other applicable appendix.

1.             Regulatory Approval and Filing. In the event Customer is required to file the Agreement with federal, state or local governmental authorities, Customer shall be responsible for filing the Agreement with such authorities as required by any applicable law or regulation. If following any such filing, the governmental authority requests changes to the Agreement, Vendor agrees to cooperate with Customer in preparing the response to the governmental authority.

2.             Compliance with Law and Government Contracts. Vendor and Customer agree to comply with all applicable federal, State, and local laws, rules, and regulations in connection with the performance of their obligations under the Agreement. All tasks under the Agreement also must be performed in accordance with the requirements of applicable contracts between any Customer Affiliate and State and/or federal regulatory agencies. Customer will provide or otherwise communicate such requirements to Vendor. Vendor shall ensure all agents, employees, assigns and subcontractors, if any, that are involved in providing services under the Agreement also comply with this Section.

3.             Delegation and Oversight. In compliance with the delegation and oversight obligations imposed on Customer Affiliates under their contracts with State and/or federal regulatory agencies, Customer reserves the right to revoke any functions or activities delegated to Vendor under the Agreement, if in the reasonable judgment of Customer or an applicable Customer Affiliate, Vendor’s performance under the Agreement does not comply with obligations under applicable government contracts. This right shall be in addition to Customer’s termination rights under the Agreement.

4.             Press Release; Marketing; Advertising; Use of Name and Trademarks. Except as otherwise set forth in the Agreement, Vendor shall not publicly use the name, logo, trademark, trade name, or other marks of Customer without Customer’s prior written consent. The parties mutually agree to provide, at a minimum, at least [***] and opportunity to comment on all press releases, advertisements or other media statements and communications regarding the Agreement, the services or the business relationship between the parties. A party shall obtain the other party’s written consent prior to any publication or use of such materials or communications. Nothing herein shall be construed to create a right or license to make copies of any copyrighted materials.

5.             Offshoring. Unless previously authorized in writing by the appropriate Customer health plan Affiliate and State governing agency, if required, all work performed under the Agreement shall be performed from location(s) in the 00 Xxxxxx Xxxxxx. If Vendor receives authorization pursuant to this Section 5 to offshore certain obligations under the Agreement, Customer will provide, and Vendor shall comply with, all applicable offshoring regulations, requirements or restrictions, including any applicable security controls. The parties agree that any offshoring restrictions or requirements may be updated at any time to comply with applicable law and any other requirements.

6.             Subcontracts. To the extent required by any regulatory agency governing any Medicare or Medicaid or other governmental benefit plans (or as may be set forth in an appendix) or any accrediting agency, Vendor shall provide advance notice to Customer and obtain Customer’s consent prior to any subcontracting of any of its responsibilities under the Agreement.

Customer Confidential Page 57 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

7.             Regulatory Amendment. Customer may unilaterally amend this Exhibit to comply with applicable regulatory requirements required under law. Upon Customer’s notification of such changes, Customer will provide notice to Vendor. If such regulatory amendment materially affects the position of either party or renders it illegal for a party to continue to perform under the Agreement in a manner consistent with the parties’ intent, then the parties shall negotiate further amendments to this Exhibit or the Agreement as necessary to correct any inequities, to the greatest extent possible.

8.             Effect of Termination or Expiration. Within [***] after the expiration or termination for any reason (or to any extent) of the Agreement and/or this Exhibit, Vendor shall return or destroy all applicable PHI, if feasible to do so, including all applicable PHI in possession of Vendor’s agents or subcontractors. To the extent return or destruction of the PHI is not feasible, Vendor shall notify Customer in writing of the reasons return or destruction is not feasible and, if Customer agrees, may retain the PHI subject to this section. Under any circumstances, Vendor shall extend any and all protections, limitations and restrictions contained in this Exhibit to Vendor’s use and/or disclosure of any applicable PHI retained after the expiration or termination (to any extent) of the Agreement and/or this Exhibit, and shall limit any further uses and/or disclosures solely to the purposes that make return or destruction of the PHI infeasible.

Customer Confidential Page 58 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

EXHIBIT J

EXCHANGE REGULATORY APPENDIX

THIS EXCHANGE REGULATORY APPENDIX (this “Exhibit”) supplements and is made part of the Agreement and shall survive termination of the Agreement to the extent it or applicable law imposes continuing obligations.

SECTION 1
APPLICABILITY

Customer is operating as a certified Qualified Health Plan Issuer (“QHP Issuer”) in one or more public Health Care Exchanges (“Exchange”) created under the terms of the Federal Patient Protection and Affordable Care Act (“PPACA”) and any implementing State law. Customer may be delegating certain of its QHP Issuer's activities, reporting responsibilities, and/or other obligations, to Vendor.

This Exhibit applies solely to the services performed and provided with respect to any Exchange business delegated by United to Vendor pursuant to the Agreement. In the event of a conflict between this Exhibit and other appendices or any provision of the Agreement, the provisions of this Exhibit shall control, except as required by applicable law. Terms in this Agreement shall be as defined in PPACA, as supplemented by any applicable State Exchange law.

SECTION 2
PROVISIONS

This Exhibit is intended to comply with Exchange laws and substantive requirements.

1.             The delegated activities and reporting responsibilities are set forth in the Agreement to which this Exhibit is attached. To the extent such delegated activities and reporting responsibilities serve Exchange business, they are designated as “QHP Services”.

2.             Vendor acknowledges and agrees that Customer may revoke the delegated activities and reporting standards of Vendor or specify other remedies, for the respective Exchange, in instances where the U.S. Department of Health and Human Services (“HHS”), a State Exchange regulator, or Customer determines that such parties have not performed satisfactorily. To the extent that HHS or a State Exchange regulator directs the revocation, Customer shall provide immediate written notice of such to Vendor, and such revocation shall become effective as directed by HHS or the State Exchange regulator. Vendor shall cooperate with Customer regarding the transition of any QHP Services that have been revoked by United.

3.             Vendor must comply with all applicable laws and regulations relating to the standards specified in 45 CFR § 156.340, as it may be amended from time to time, and all other Federal and/or State laws relevant to Customer’s Exchange business being serviced.

4.             Vendor must permit access by the Secretary of HHS and the Office of Inspector General or their designees, in the case of Federally Facilitated Exchange (“FFE”) business, or comparable State regulators, in the case of State Exchange business, in connection with their right to evaluate through audit, inspection, or other means, to Vendor's books, contracts, computers, or other electronic systems, including medical records and documentation, relating to the Customer’s obligations as a QHP Issuer in accordance with Federal standards under 45 CFR §156.340, as it may be amended from time to time, with all records retained for at least [***] from the final date of the Agreement period or such lesser period which may be specified in State law for State Exchanges.

5.             If submitting FFE data is involved, Vendor is bound by the terms of Customer’s agreement between Qualified Health Plan Issuer and The Centers for Medicare and Medicaid Services or any applicable trading partners or comparable State Exchange agreement, to test its software, and receive Customer’s approval of software as being in the proper format and compatible with the FFE or the applicable State system.

Customer Confidential Page 59 of 60 Rev 3.16.16

CERTAIN CONFIDENTIAL INFORMATION CONTAINED IN THIS DOCUMENTS, MARKED BY [***], HAS BEEN OMITTED BECAUSE ACCOLADE, INC. HAS DETERMINED THE INFORMATION IS NOT MATERIAL.

6.             If any State Exchange or HHS for FFEs requires additional specific provisions to be in Customer’s agreement with any delegated or downstream entity, they will be provided to Vendor by Customer and are incorporated herein by reference or by attaching a copy of such provisions to this Exchange Regulatory Exhibit.

7.             If Vendor delegates any QHP Services to a downstream entity (as such term is defined in 45 C.F.R. § 156.20), Vendor shall provide written advance notification to Customer of such delegated activities and reporting responsibilities before the applicable effective date of the delegation under federal regulations, Vendor shall bind the downstream entity to all the terms of this Exhibit, including providing for revocation of the delegated activities.

Customer Confidential Page 60 of 60 Rev 3.16.16