Provider Terms

REFERRING PRACTICE TERMS OF SERVICE

General Terms and Conditions and BAA

The General Terms and Conditions set forth below, including the BAA (as defined below), are a part of the Referring Practice Terms of Service between Glidian and Referring Practice that references and incorporates them.

     

1.Certain Definitions.  

     

  1. BAA” means the Business Associate Addendum attached hereto as Exhibit A, as amended or replaced from time to time, which is incorporated herein and made a part of this Agreement by this reference.

  1. HIPAA” means Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and the regulations promulgated under the foregoing from time to time by the United States Department of Health and Human Services, each as amended from time to time.
  2. Participating Provider” has the meaning ascribed on the Cover Page.
  3. Performing Provider” has the meaning ascribed on the Cover Page.
  4. Referring Practice Data” means all PHI (as defined in the BAA) and other information disclosed or made available to Glidian by or on behalf of Referring Practice in the course of or related to Glidian’s provision of the Services.
  5. Restricted Payor” has the meaning ascribed on the Cover Page.
  6. Services” has the meaning ascribed on the Cover Page.
  7.  
  8.  
  9. Term.  The  term of this Agreement shall commence upon the Effective Date and  shall continue until terminated as provided herein.  Either party  may terminate this Agreement by notice to the other party for  convenience or upon the breach of the other party.
  10.  
  11. Services.   Subject to terms and conditions of this Agreement, including  Referring Practice’s performance of its responsibilities set forth  in this Agreement, Glidian shall perform the Services with regard to  the Participating Providers.
  12.  
  13. No Charges; Taxes.   Referring Practice shall pay no fees, expenses, or other charges  pursuant to this Agreement.  Referring Practice shall be responsible  for and shall pay when due all taxes, levies, or assessments based  on or in any way measured by this Agreement or the Services,  excluding taxes based on Glidian’s net income.
  14.  
  15. Addition  and Removal of Participating Providers.  From time to  time, (i) upon notice to Glidian (which may be in email if  receipt is acknowledged by Glidian), Participating Providers may be  added or removed and (ii) upon request by Glidian that is  accepted by Referring Practice (each of which may be in email),  Participating Providers may be added.  In either case, this  Agreement shall be deemed so amended.
  16.  
  17.  Referring Practice Responsibilities.  Referring  Practice shall assist and cooperate with Glidian in its provision of  the Services by providing or making available such information,  documentation, access to personnel, and other efforts as reasonably  requested by Glidian from time to time.  Subject to Glidian’s  compliance with the BAA and HIPAA, Referring Practice shall be  responsible for obtaining and maintaining all consents and  authorizations of any patients and other individuals necessary for  Glidian’s use and disclosure of information regarding such persons  in the performance of the Services.  To the extent that the Services  necessitate or would be facilitated by Glidian’s access to online  systems made available to Referring Practice by Restricted Payors  for such purpose, Referring Practice shall provide (or cause such  Restricted Payors to provide) Glidian access to such systems subject  to Glidian’s acceptance of such written terms of use as Referring  Practice or such Restricted Payor reasonably may require.  Subject  to Glidian’s compliance with the BAA and HIPAA, Referring Practice  shall be responsible for obtaining and maintaining all consents and  authorizations of any of Referring Practice’s licensors, vendors,  or personnel, or of any other third parties or government agencies,  necessary for Glidian’s access to the such systems and for Glidian  to provide the Services.  Referring Practice represents and warrants  that that it is and will remain compliant in all material respects  with all of its agreements with Restricted Payors and that any act  of Glidian contemplated or authorized under this Agreement will not  violate any such agreement.  Glidian shall not be liable for, and  Referring Practice shall indemnify, defend, and hold harmless  Glidian, its affiliates, and their respective directors, officers,  and employees from and against, any loss, liability, damage, award,  settlement, claim, suit, proceeding, cost, and expense (including  reasonable legal fees and disbursements and costs of investigation,  litigation, expert witness fees, settlement, judgment, interest, and  penalties) arising from or related Referring Practice’s failure to  perform the foregoing responsibilities or Referring Practice’s  breach of the foregoing representation and warranties.  
  18.  
  19. Referring Practice Data.   As between Glidian and Referring Practice, Referring Practice has  and retains exclusive ownership of all Referring Practice Data and  all intellectual property and proprietary rights therein.  Referring  Practice grants to Glidian a non-exclusive, royalty free license  during the term of this Agreement (i) to use and disclose Referring  Practice Data to perform its obligations under this Agreement and  for purposes of monitoring, correcting, and improving the Services,  (ii) to de-identify Referring Practice Data in accordance with HIPAA  and such that it reasonably cannot be used to identify Referring  Practice, or any Referring Practice personnel solely for the  foregoing purposes.  Referring Practice hereby assigns to Glidian  any and all right, title, and interest in and to any such  de-identified data; provided, however, that to the extent that any  portion of the foregoing or proprietary rights in or based upon the  foregoing is not assigned or assignable to Glidian pursuant to this  paragraph, Referring Practice grants to Glidian a perpetual,  irrevocable, worldwide, royalty-free, non-exclusive, transferable  license to use, adapt, translate, create derivative works from,  perform, display, make, have made, import, disclose, exploit,  sublicense, and exercise the foregoing.
  20.  
  21. Disclosure to Performing  Provider.  Referring Practice expressly acknowledges  and agrees that Glidian may disclose to the relevant Performing  Provider the outcome of the Services with regard to a given patient,  including whether the Restricted Payor granted prior approval, the  benefits confirmed with a Restricted Payor, and any conditions  stipulated by a Restricted Payor with regard to the foregoing.
  22.  
  23. No Guarantee of Outcome.   Referring Practice expressly acknowledges and agrees that  Glidian makes no guarantees or assurances regarding the outcomes of  outcomes of the Services and that the determinations as to prior  authorization or medical necessity of health care services are made  solely by the relevant Restricted Payors.
  24.  
  25. Disclaimers.  THE SERVICES ARE PROVIDED “AS IS,” AND GLIDIAN DISCLAIMS ANY AND  ALL WARRANTIES, CONDITIONS, OR REPRESENTATIONS (EXPRESS OR IMPLIED,  ORAL OR WRITTEN) WITH RESPECT TO THE SERVICES, INCLUDING ANY AND ALL  IMPLIED WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,  MERCHANTABILITY, OR FITNESS OR SUITABILITY FOR ANY PURPOSE (WHETHER  OR NOT THE GLIDIAN KNOWS, HAS REASON TO KNOW, HAS BEEN ADVISED, OR  OTHERWISE IS IN FACT AWARE OF ANY SUCH PURPOSE), WHETHER ALLEGED TO  ARISE BY LAW, BY REASON OF CUSTOM OR USAGE IN THE TRADE, BY COURSE  OF DEALING, OR OTHERWISE.
  26.  
  27. Risk  Allocation.
  28.  
  29.    
  30. EXCLUSION OF INDIRECT DAMAGES.     WITHOUT LIMITING A PARTY’S EXPRESS INDEMNIFICATION OBLIGATIONS    UNDER THIS AGREEMENT WITH REGARD TO CLAIMS OF THIRD PARTIES,    NEITHER PARTY WILL BE LIABLE TO THE OTHER PARTY (NOR TO ANY PERSON    CLAIMING RIGHTS DERIVED FROM THE OTHER PARTY’S RIGHTS) FOR    INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES    OF ANY KIND (INCLUDING WITHOUT LIMITATION LOST PROFITS, LOSS OF OR    DAMAGE TO DATA, LOSS OF BUSINESS, OR OTHER ECONOMIC DAMAGE),    WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR    OTHERWISE, AND REGARDLESS OF WHETHER THE PARTY LIABLE OR ALLEGEDLY    LIABLE WAS ADVISED, HAD OTHER REASON TO KNOW, SHOULD HAVE    ANTICIPATED, OR IN FACT KNEW OF THE POSSIBILITY THEREOF.  IN NO    EVENT SHALL EITHER PARTY BE LIABLE FOR COSTS OF PROCUREMENT OF    SUBSTITUTE GOODS BY ANYONE. THE PROVISIONS OF THIS PARAGRAPH ARE    INDEPENDENT OF, SEVERABLE FROM, AND TO BE ENFORCED INDEPENDENTLY OF    ANY OTHER ENFORCEABLE OR UNENFORCEABLE PROVISION OF THIS AGREEMENT.
  31.    
  32. MAXIMUM AGGREGATE LIABILITY.     EXCEPT WITH REGARD TO A PARTY’S EXPRESS INDEMNIFICATION    OBLIGATIONS UNDER THIS AGREEMENT, IN NO EVENT SHALL A PARTY’S    AGGREGATE LIABILITY TO THE OTHER PARTY (INCLUDING LIABILITY TO ANY    PERSON OR PERSONS WHOSE CLAIM OR CLAIMS ARE BASED ON OR DERIVED    FROM A RIGHT OR RIGHTS CLAIMED BY OR THROUGH SUCH PARTY), WITH    RESPECT TO ANY AND ALL CLAIMS AT ANY AND ALL TIMES ARISING FROM OR    RELATED TO THE SUBJECT MATTER OF THIS AGREEMENT, IN CONTRACT, TORT    (INCLUDING NEGLIGENCE), OR OTHERWISE, EXCEED $250.  THE PROVISIONS    OF THIS PARAGRAPH ARE INDEPENDENT OF, SEVERABLE FROM, AND TO BE    ENFORCED INDEPENDENTLY OF ANY OTHER ENFORCEABLE OR UNENFORCEABLE    PROVISION OF THIS AGREEMENT.    
  33.    
  34. Intentional Risk Allocation.     Referring Practice acknowledges and agrees that the Services are    provided free of charge and that Glidian would be unwilling to    enter this Agreement on such basis without the exclusions and    limitations set forth herein.  Each party acknowledges that the    provisions of this Agreement were negotiated, as a material part of    the agreement memorialized herein, to reflect an informed,    voluntary allocation between them of all risks (both known and    unknown) associated with the transactions involved with this    Agreement.  The warranty disclaimers and limitations in this    Agreement are intended, and have as their essential purpose, to    limit the circumstances of liability.  The remedy limitations and    the limitations of liability are separately intended, and have as    their essential purpose, to limit the forms of relief available to    the parties.
  35.  
  36.  
  37. Other  Provisions.
  38.  
  39.    
  40. Nature of Relationship.    Glidian shall provide all Services hereunder as an independent    contractor to Referring Practice.  Nothing contained herein shall    be deemed to create any agency, partnership, joint venture, or    other relationship between the parties or any of their affiliates,    and neither party shall have the right, power, or authority under    this Agreement to create any duty or obligation on behalf of the    other party.
  41.    
  42. Force Majeure.  Neither    party shall be liable for any failure to perform its obligations    under this Agreement if such failure (i) arises, directly or    indirectly, out of causes reasonably beyond the direct control of    such party and not due to such party’s own fault or negligence or    that of its contractors or representatives or other persons acting    on its behalf and (ii) cannot be overcome by the exercise of due    diligence and reasonably could not have been prevented through    commercially reasonable measures, including acts of God, acts of    terrorists or criminals, acts of domestic or foreign governments,    change in any law or regulation, fires, floods, explosions,    epidemics, disruptions in communications, power, or other    utilities, strikes or other labor problems, riots, or    unavailability of supplies.
  43.    
  44. Notice.  Except as    otherwise expressly provided herein, notices shall be given under    this Agreement in writing, in the English language, (i) by    personal delivery, provided that if the applicable person is an    entity, such delivery shall be to an officer of such entity or, if    none, to an individual serving in a similar capacity (in which case    such notices shall be deemed given upon such personal delivery),    (ii) by certified or registered U.S. mail, postage pre-paid,    from within the United States (in which case such notices shall be    deemed given on the third business day after deposit), (iii) with    next-business-day instruction by a recognized overnight courier,    pre-paid, with next-business-day delivery instruction (in which    case such notices shall be deemed given on the next business day    after deposit), or (iv) to Referring Practice, by e-mail (in    which case such notice shall be deemed given upon transmission    unless Glidian receives a non-delivery email message within a    reasonable time thereafter).  Notices shall be sent to Glidian at    Attn: Legal Department, Glidian, Inc., 224    Sequoia Ave., South San Francisco, CA 94080, with copy    to Steve F. Wood, Esq., Baker Donelson, 211 Commerce Street, Suite    800, Nashville, Tennessee 37201, and to Referring Practice at the    address set forth on the Cover Page.  Either party may change its    address for purposes of notice by written notice thereof to the    other party.
  45.    
  46. Governing Law; Venue.  This    Agreement shall be construed and enforced in accordance with the    laws of the state of California (other than its conflicts of law    provisions) and venue shall be exclusive in the federal or state    courts in San Francisco, California.    
  47.    
  48. Severability.  If any one    or more of the provisions of this Agreement should be ruled wholly    or partly invalid or unenforceable by a court or other government    body of competent jurisdiction, then (i) the validity and    enforceability of all provisions of this Agreement not ruled to be    invalid or unenforceable will be unaffected; (ii) the effect    of the ruling will be limited to the jurisdiction of the court or    other government body making the ruling; (iii) the    provision(s) held wholly or partly invalid or unenforceable would    be deemed amended, and the court or other government body is    authorized to reform the provision(s), to the minimum extent    necessary to render them valid and enforceable in conformity with    the parties’ intent as manifested herein; and (iv) if the    ruling, and/or the controlling principle of law or equity leading    to the ruling, subsequently is overruled, modified, or amended by    legislative, judicial or administrative action, then the    provision(s) in question as originally set forth in this Agreement    will be deemed valid and enforceable to the maximum extent    permitted by the new controlling principle of law or equity.    
  49.    
  50. Entire Agreement.  This    Agreement constitutes the entire agreement between the parties    concerning the subject matter hereof.  No prior or contemporaneous    representations, inducements, promises, or agreements, oral or    otherwise, between the parties with reference thereto will be of    any force or effect.  Each party represents and warrants that, in    entering into and performing its obligations under this Agreement,    it does not and will not rely on any promise, inducement, or    representation allegedly made by or on behalf of the other party    with respect to the subject matter hereof, nor on any course of    dealing or custom and usage in the trade, except as such promise,    inducement, or representation may be expressly set forth herein.
  51.    
  52. Amendment and Waiver.  No    modification or amendment to this Agreement will be valid or    binding unless in writing and duly executed by the party or parties    to be bound thereby (which may be accomplished in electronic form    or by electronic means).  The failure of either party at any time    to require performance by the other party of any provision of this    Agreement shall in no way affect the right of such party to require    performance of that provision.  Any waiver by either party of any    breach of this Agreement shall not be construed as a waiver of any    continuing or succeeding breach of such provision, a waiver of the    provision itself or a waiver of any right under this Agreement.
  53.    
  54. No Third Party Beneficiaries.     This Agreement is not intended to confer, nor shall any provision    hereof be interpreted to confer, upon any person other than the    parties and the respective successors or permitted assigns of the    parties, any rights, remedies, obligations, or liabilities    whatsoever.
  55.    
  56. Interpretation.  The    division of this Agreement into articles, sections, and subsections    and the use of captions and headings in connection therewith are    solely for convenience and shall have no legal effect in construing    the provisions of this Agreement.  Unless otherwise indicated,    references to articles, sections, subsections, and paragraphs are    to provisions of this Agreement and references to exhibits and    schedules are to exhibits and schedules appended to this Agreement.    Unless the context otherwise requires, (i) references to any party    to this Agreement include references to such party’s successors    and permitted assigns, (ii) references to “person” include    references to any individual, corporation, limited liability    company, partnership, company, firm, association, joint venture,    trust, governmental body, or other entity, (iii) any of the terms    defined herein may be used in the singular or the plural depending    on the reference, (iv) a masculine, feminine, or neuter pronoun    includes the other genders as appropriate in the context, and (v)    the term “including” means “including without limitation”    unless otherwise expressly indicated in a given instance.
  57.    
  58. Survival.  The covenants    herein concerning indemnification and any other provision that, by    its nature, is intended to survive this Agreement shall survive any    termination or expiration of this Agreement.
  59.    
  60. Successors and Assigns.    This Agreement will be binding upon and inure to the benefit of the    parties and their successors and assigns permitted by this    Agreement.
  61.  



EXHIBITA

BusinessAssociate Addendum

THIS BUSINESSASSOCIATE ADDENDUM (the “Addendum”) supplements andis made a part of the Referring Practice Terms of Service betweenGlidian and Referring Practice (the “Agreement”).

Referring Practiceis a Covered Entity (or is a Business Associate to one or moreCovered Entities) pursuant to HIPAA.  Referring Practice has engagedGlidian to perform the Services pursuant to the Agreement.  In thecourse of providing the Services, Referring Practice may makeavailable to Glidian or have Glidian obtain or create on its behalfinformation that may be deemed Protected Health Information subjectto the provisions of HIPAA and information subject to protectionunder other federal or state laws.

In order to complywith the applicable provisions of HIPAA and other federal or statelaws as applicable, the parties agree as follows:

     
  1. Definitions.
  2.  
  3.    
  4. Capitalized terms used but not    otherwise defined in this Addendum shall have the meanings ascribed    in HIPAA (whether or not such terms are capitalized therein) or in    the Agreement, as the case may be.    
  5.    
  6. Electronic PHI” means    PHI that is Electronic Protected Health Information.
  7.    
  8. PHI” means Protected    Health Information received or accessed by Glidian from or on    behalf of Referring Practice or created, transmitted, or maintained    by Glidian for or on behalf of Referring Practice.
  9.  
  10.  
  11. Permitted  Uses.  Glidian may use PHI only as permitted or  required by this Addendum and only for the following purposes:  (i) as necessary to perform the Services; (ii) to  provide Data Aggregation services relating to the Health Care  Operations of Referring Practice, but only incident to the  performance of the Services; (iii) to de-identify PHI in  accordance with the standards set forth under HIPAA, but only  incident to the performance of the Services; (iv) to carry out  its legal responsibilities; (v) for the proper business  management and administration of Glidian; and (v) as Required  By Law.
  12.  
  13. Permitted Disclosures.   Glidian may disclose PHI only as permitted or required by this  Addendum for the following purposes: (i) as necessary to  perform the Services; (ii) for the proper business management  and administration of Glidian or to carry out its legal  responsibilities, if Required By Law or if Glidian has obtained  reasonable assurances that the recipient will (A) hold such PHI  in confidence, (B) use or further disclose it only for the  purpose for which it was received or as Required By Law, and  (C) notify Glidian of any instance of which the recipient  becomes aware in which the confidentiality of such PHI has been  breached; and (iii) as otherwise Required By Law.
  14.  
  15. Prohibited  Uses and Disclosures.
  16.  
  17.    
  18. Subject to Referring Practice’s    compliance with its obligations set forth in Section 16    as applicable, Glidian shall not use or further disclose PHI in a    manner that would violate HIPAA if done by Referring Practice.
  19.    
  20. If Referring Practice notifies    Glidian that Referring Practice has agreed to be bound by    additional restrictions on the uses or disclosures of PHI pursuant    to Section 16, Glidian shall be bound by such    additional restrictions and shall not use or disclose PHI in    violation of such additional restrictions.
  21.    
  22. Glidian shall not sell PHI or    otherwise receive remuneration, directly or indirectly, in exchange    for PHI.
  23.    
  24. Glidian shall not use or disclose    PHI for purposes of marketing or fundraising.
  25.  
  26.  
  27. Subcontractors  and Agents.  Any disclosure to a Subcontractor of  Glidian shall be pursuant to a written agreement between Glidian and  such Subcontractor containing substantially the same restrictions  and conditions on the use, disclosure, and safeguarding of PHI as  are set forth in this Addendum.
  28.  
  29. Minimum Necessary.   Glidian shall request, access, use, and disclose only the minimum  amount of PHI necessary, in accordance with HIPAA, to perform the  Services.
  30.  
  31. Certain Privacy Rule  Compliance.  To the extent that Glidian is to carry  out one or more of Referring Practice's obligations under Subpart E  of Part 164 of HIPAA (generally known as the HIPAA Privacy  Rule), Glidian shall comply with such requirements that apply to  Referring Practice in the performance of such obligations.
  32.  
  33. Safeguards.  Glidian at all times shall maintain administrative, physical,  and technical safeguards that reasonably and appropriately protect  the confidentiality, availability, and integrity of Electronic PHI  that it creates, receives, maintains, or transmits in accordance  with the regulations set forth at 45 CFR § 164.308, 45 CFR  § 164.310, and 45 CFR § 164.312 and shall maintain  policies and procedures and other documentation in accordance the  regulations set forth at 45 CFR § 164.316.  Glidian  acknowledges that such provisions apply to Glidian in the same  manner that they apply to Covered Entities.
  34.  
  35.  Breach Investigation and Reporting.
  36.  
  37.    
  38. As soon    as practicable following any actual or reasonably suspected    impermissible use or disclosure of PHI, Glidian shall assess    whether such actual or suspected impermissible use or disclosure    was of PHI that is Unsecured Protected Health Information and, if    so (or if Glidian cannot determine reasonably conclusively to the    contrary), Glidian shall make an evaluation of whether there is a    low probability that the PHI has been compromised.  In making such    evaluation, Glidian shall conduct a risk assessment that considers,    at a minimum, (i) the nature and extent of the protected health    information involved, including the types of identifiers and the    likelihood of re identification, (ii) the unauthorized person who    used the protected health information or to whom the disclosure was    made, (iii) whether the protected health information was actually    acquired or viewed, and (iv) the extent to which the risk to the    protected health information has been mitigated, and Glidian shall    evaluate the overall possibility that the PHI has been compromised    by considering all of the above, and any other relevant factors, in    combination.
  39.    
  40. If pursuant to the evaluation    described in Section 9.1 Glidian determines that such    impermissible use or disclosure constitutes a Breach of PHI that is    Unsecured Protected Health Information, Glidian shall provide    Referring Practice in writing, without unreasonable delay but in no    case later than 10 days following such determination, written    notice setting forth the date of discovery thereof, the identities    of affected individuals (or, if such identities are unknown at that    time, the classes of such individuals), a general description of    the nature of the incident, and such other information as is    required pursuant to HIPAA or reasonably requested by Referring    Practice.  Glidian shall supplement such notice with information    not available at the time of the initial notification as promptly    thereafter as the information becomes available to Glidian.
  41.    
  42. If pursuant to the evaluation    described in Section 9.1 Glidian determines that such    impermissible use or disclosure does not constitute a Breach of PHI    that is Unsecured Protected Health Information, Glidian shall    notify Referring Practice in writing of such impermissible use or    disclosure of PHI and of such determination promptly following such    determination.
  43.    
  44. For purposes hereof, an actual or    suspected use or disclosure shall be deemed impermissible if it is    not or would not be permitted by this Agreement or if it is or    would be in violation of HIPAA.
  45.    
  46. For purposes hereof, an    impermissible use or disclosure shall be deemed discovered by    Glidian as of the first day on which such impermissible use or    disclosure is known to Glidian or, by exercising reasonable    diligence, would have been known to Glidian, and Glidian shall be    deemed to have knowledge of an impermissible use or disclosure if    such impermissible use or disclosure is known, or by exercising    reasonable diligence would have been known, to any person, other    than the person committing the impermissible use or disclosure, who    is a workforce member of Glidian or an agent of Glidian (determined    in accordance with the federal common law of agency).
  47.  
  48.  
  49. Security  Incident Reporting.  Glidian shall report to  Referring Practice in writing any Security Incident involving  Electronic PHI, other than a Security Incident that involves an  actual or suspected impermissible use or disclosure of PHI, within  30 days of Glidian’s discovery thereof.  The parties acknowledge  and agree that this section constitutes notice by Glidian to  Referring Practice of the ongoing occurrence of events that may  constitute Security Incidents but that are trivial, routine, do not  constitute a material threat to the security of PHI, and do not  result in unauthorized access to or use or disclosure of PHI (such  as typical pings and port scans), for which no additional notice to  Referring Practice shall be required.
  50.  
  51. Mitigation.  Glidian shall take all actions reasonably necessary and shall  cooperate with Referring Practice as reasonably requested to  mitigate, to the extent practicable, any harmful effect of any use  or disclosure of PHI in violation of the terms and conditions of  this Addendum or of any applicable law.
  52.  
  53. Access and Amendment.   With respect to an Individual as to whom Glidian maintains PHI,  Glidian shall notify Referring Practice promptly upon receipt of a  request from such an Individual for access to or a copy of such  Individual’s PHI or to amend such Individual’s PHI.  To the  extent permitted under HIPAA, and except as otherwise required upon  the order of a court of competent jurisdiction, (i) Glidian  shall direct such Individual to make such request of Referring  Practice and (ii) Glidian shall not consent to such access,  deliver such copy, or comply with such request except as directed by  Referring Practice.  With respect to PHI maintained by Glidian in a  Designated Record Set, to the extent required by HIPAA, Glidian  shall (i) make available PHI to Individuals or Referring  Practice, as reasonably requested by Referring Practice and in  accordance with HIPAA and (ii) upon receipt of notice from  Referring Practice, promptly amend any portion of the PHI so that  Referring Practice may meet its amendment obligations under HIPAA.
  54.  
  55. Accounting for Disclosures.   Glidian shall document all disclosures of PHI by Glidian and  information related to such disclosures as would be required for  Referring Practice to respond to a request by an Individual for an  accounting of disclosures of PHI in accordance with HIPAA.  Glidian  shall maintain such information for the applicable period set forth  in HIPAA.  Glidian shall deliver such information to Referring  Practice or, upon Referring Practice’s request, to the Individual,  in the time and manner reasonably designated by Referring Practice,  in order for Referring Practice to respond to a request by an  Individual for an accounting of disclosures of PHI in accordance  with HIPAA.  The obligations set forth in this section shall survive  the expiration or any termination of this Agreement and shall  continue, as to a given instance of a disclosure, until the earlier  of (i) the passing of the time required for such information to  be maintained pursuant to HIPAA or (ii) the delivery to  Referring Practice of all such information in a form and medium  reasonably satisfactory to Referring Practice and the return or  destruction of all PHI as provided in this Agreement.
  56.  
  57. Audit.  If  Glidian receives a request, made on behalf of the Secretary of the  Department of Health and Human Services, that Glidian make its  internal practices, books, and records relating to the use or  disclosure of PHI available to the Secretary of the Department of  Health and Human Services for the purposes of determining Referring  Practice’s or Glidian’s compliance with HIPAA, Glidian promptly  shall notify Referring Practice of such request and, unless enjoined  from doing so by order of a court of competent jurisdiction in  response to a challenge raised by Referring Practice or Glidian  (which challenge Glidian shall not be obligated to raise), Glidian  shall comply with such request to the extent required of it by  applicable law. Nothing in this Agreement shall waive any  attorney-client privilege or other privilege applicable to either  party.
  58.  
  59. Compliance  with Law.  Glidian shall comply with all applicable  federal and state laws regarding individually identifiable  information contained in or associated with PHI, including without  limitation any state data breach laws or other state laws regarding  the protection of such information.  Nothing in this Agreement shall  be construed to require Glidian to use or disclose PHI without a  written authorization from an Individual who is the subject thereof,  or written authorization from any other person, where such  authorization would be required under federal or state law for such  use or disclosure.
  60.  
  61. Obligations  of Referring Practice.  Referring Practice shall  (i) notify Glidian of any limitation in Referring Practice’s  Notice of Privacy Practices to the extent that such limitation may  affect Glidian's use or disclosure of PHI, (ii) notify Glidian  of any changes in, or revocation of, permission by an Individual to  use or disclose PHI, to the extent that such change may affect  Glidian’s use or disclosure of PHI, (iii) notify Glidian of  any restriction on the use or disclosure of PHI to which Referring  Practice has agreed in accordance with HIPAA, to the extent that  such restriction may affect Glidian's use or disclosure of PHI, and  (iv) obtain any authorization or consents as may be Required by  Law for any of the uses or disclosures of PHI necessary for Glidian  to provide to the Services.
  62.  
  63. Term and Termination.   This Addendum shall become effective on the Effective Date and  shall continue in effect until the earlier to occur of (i) the  expiration or termination of all Agreements or (ii) termination  pursuant to this section.  Either party may terminate this Addendum  effective immediately if the other party has breached a material  provision of this Addendum and failed to cure such breach within 30  days of being notified by the other party of the breach.  If the  non-breaching party reasonably determines that cure is not possible,  such party may terminate this Addendum effective immediately upon  written notice to other party.
  64.  
  65. Effect of Termination.   Upon termination of this Addendum, subject to any applicable  provisions of the Agreement, Glidian shall return to Referring  Practice or destroy all PHI that Glidian maintains in any form and  retain no copies of such PHI or, if return or destruction is not  feasible (including without limitation if Glidian is required by  applicable law to retain any such PHI for a time following  termination), notify Referring Practice thereof and extend the  protections of this Addendum to the PHI and limit its further use or  disclosure to those purposes that make the return or destruction of  the PHI infeasible.  The requirements of this section shall survive  termination or expiration of this Addendum and shall be in force as  long as any PHI remains in the custody or control of Glidian.
  66.  
  67. Miscellaneous.
  68.  
  69.    
  70. Amendments.  Any provision    of the Agreement to the contrary notwithstanding, upon the    enactment of any law or regulation affecting the use or disclosure    of PHI, or on the publication of any decision of a court of    competent jurisdiction relating to any such law, or the publication    of any interpretive policy or opinion of any governmental agency    charged with the enforcement of any such law or regulation,    Referring Practice may, by written notice to Glidian, propose to    amend this Addendum in such a manner as Referring Practice    reasonably determines necessary to comply therewith, and such    proposed amendment shall become operative unless Glidian rejects    such amendment by written notice to Referring Practice within 30    days thereafter, in which case, unless the parties agree on an    amendment within 30 days after Glidian’s notice, either party may    terminate this Addendum by written notice to the other.    
  71.    
  72. Notice.  Written notice    pursuant to Section 9 or Section 10 sent    with next-business-day instruction by recognized overnight document    delivery service to the address provided herein shall be deemed    given upon deposit with such overnight delivery service.
  73.    
  74. Interpretation.  In the    event of a conflict between the provisions of this Addendum and any    other provisions of the Agreement, the provisions of this Addendum    shall control.  In the event of an inconsistency between the    provisions of this Addendum and mandatory provisions of HIPAA, as    amended, or its interpretation by any court or regulatory agency    with authority over either party hereto, HIPAA (interpreted by such    court or agency, if applicable) shall control.  Where provisions of    this Addendum are different from those mandated under HIPAA, but    are nonetheless permitted by such rules as interpreted by relevant    courts or agencies, the provisions of this Addendum shall control.
  75.  



REFERRING PRACTICE TERMS OF SERVICE

General Terms and Conditions and BAA

The General Terms and Conditions set forth below, including the BAA (as defined below), are a part of the Referring Practice Terms of Service between Glidian and Referring Practice that references and incorporates them.

1. Certain Definitions.

BAA” means the Business Associate Addendum attached hereto as Exhibit A, as amended or replaced from time to time, which is incorporated herein and made a part of this Agreement by this reference.

HIPAA” means Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act, and the regulations promulgated under the foregoing from time to time by the United States Department of Health and Human Services, each as amended from time to time.

Participating Provider” has the meaning ascribed on the Cover Page.

Performing Provider” has the meaning ascribed on the Cover Page.

Referring Practice Data” means all PHI (as defined in the BAA) and other information disclosed or made available to Glidian by or on behalf of Referring Practice in the course of or related to Glidian’s provision of the Services.

Restricted Payor” has the meaning ascribed on the Cover Page.

Services” has the meaning ascribed on the Cover Page.    

2. Term.
The  term of this Agreement shall commence upon the Effective Date and  shall continue until terminated as provided herein.  Either party  may terminate this Agreement by notice to the other party for  convenience or upon the breach of the other party.

3. Services.  Subject to terms and conditions of this Agreement, including  Referring Practice’s performance of its responsibilities set forth  in this Agreement, Glidian shall perform the Services with regard to  the Participating Providers.  

4. No Charges; Taxes.  Referring Practice shall pay no fees, expenses, or other charges  pursuant to this Agreement.  Referring Practice shall be responsible  for and shall pay when due all taxes, levies, or assessments based  on or in any way measured by this Agreement or the Services,  excluding taxes based on Glidian’s net income.

5. Addition and Removal of Participating Providers. From time to  time, (i) upon notice to Glidian (which may be in email if  receipt is acknowledged by Glidian), Participating Providers may be  added or removed and (ii) upon request by Glidian that is  accepted by Referring Practice (each of which may be in email),  Participating Providers may be added.  In either case, this  Agreement shall be deemed so amended.

6. Referring Practice Responsibilities. Referring  Practice shall assist and cooperate with Glidian in its provision of  the Services by providing or making available such information,  documentation, access to personnel, and other efforts as reasonably  requested by Glidian from time to time.  Subject to Glidian’s  compliance with the BAA and HIPAA, Referring Practice shall be  responsible for obtaining and maintaining all consents and  authorizations of any patients and other individuals necessary for  Glidian’s use and disclosure of information regarding such persons  in the performance of the Services.  To the extent that the Services  necessitate or would be facilitated by Glidian’s access to online  systems made available to Referring Practice by Restricted Payors  for such purpose, Referring Practice shall provide (or cause such  Restricted Payors to provide) Glidian access to such systems subject  to Glidian’s acceptance of such written terms of use as Referring  Practice or such Restricted Payor reasonably may require.  Subject  to Glidian’s compliance with the BAA and HIPAA, Referring Practice  shall be responsible for obtaining and maintaining all consents and  authorizations of any of Referring Practice’s licensors, vendors,  or personnel, or of any other third parties or government agencies,  necessary for Glidian’s access to the such systems and for Glidian  to provide the Services.  Referring Practice represents and warrants  that that it is and will remain compliant in all material respects  with all of its agreements with Restricted Payors and that any act  of Glidian contemplated or authorized under this Agreement will not  violate any such agreement.  Glidian shall not be liable for, and  Referring Practice shall indemnify, defend, and hold harmless  Glidian, its affiliates, and their respective directors, officers,  and employees from and against, any loss, liability, damage, award,  settlement, claim, suit, proceeding, cost, and expense (including  reasonable legal fees and disbursements and costs of investigation,  litigation, expert witness fees, settlement, judgment, interest, and  penalties) arising from or related Referring Practice’s failure to  perform the foregoing responsibilities or Referring Practice’s  breach of the foregoing representation and warranties.  

7. Referring Practice Data. As between Glidian and Referring Practice, Referring Practice has and retains exclusive ownership of all Referring Practice Data and all intellectual property and proprietary rights therein. Referring  Practice grants to Glidian a non-exclusive, royalty free license during the term of this Agreement (i) to use and disclose Referring Practice Data to perform its obligations under this Agreement and  for purposes of monitoring, correcting, and improving the Services, (ii) to de-identify Referring Practice Data in accordance with HIPAA and such that it reasonably cannot be used to identify Referring Practice, or any Referring Practice personnel solely for the foregoing purposes. Referring Practice hereby assigns to Glidian any and all right, title, and interest in and to any such de-identified data; provided, however, that to the extent that any  portion of the foregoing or proprietary rights in or based upon the foregoing is not assigned or assignable to Glidian pursuant to this paragraph, Referring Practice grants to Glidian a perpetual, irrevocable, worldwide, royalty-free, non-exclusive, transferable license to use, adapt, translate, create derivative works from, perform, display, make, have made, import, disclose, exploit, sublicense, and exercise the foregoing.

8. Disclosure to Performing  Provider. Referring Practice expressly acknowledges and agrees that Glidian may disclose to the relevant Performing Provider the outcome of the Services with regard to a given patient, including whether the Restricted Payor granted prior approval, the benefits confirmed with a Restricted Payor, and any conditions stipulated by a Restricted Payor with regard to the foregoing.

9. No Guarantee of Outcome. Referring Practice expressly acknowledges and agrees that Glidian makes no guarantees or assurances regarding the outcomes of outcomes of the Services and that the determinations as to prior authorization or medical necessity of health care services are made solely by the relevant Restricted Payors.

10. Disclaimers. THE SERVICES ARE PROVIDED “AS IS,” AND GLIDIAN DISCLAIMS ANY AND ALL WARRANTIES, CONDITIONS, OR REPRESENTATIONS (EXPRESS OR IMPLIED,  ORAL OR WRITTEN) WITH RESPECT TO THE SERVICES, INCLUDING ANY AND ALL IMPLIED WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, OR FITNESS OR SUITABILITY FOR ANY PURPOSE (WHETHER OR NOT THE GLIDIAN KNOWS, HAS REASON TO KNOW, HAS BEEN ADVISED, OR  OTHERWISE IS IN FACT AWARE OF ANY SUCH PURPOSE), WHETHER ALLEGED TO ARISE BY LAW, BY REASON OF CUSTOM OR USAGE IN THE TRADE, BY COURSE OF DEALING, OR OTHERWISE.

11. Risk  Allocation.

a. EXCLUSION OF INDIRECT DAMAGES. WITHOUT LIMITING A PARTY’S EXPRESS INDEMNIFICATION OBLIGATIONS UNDER THIS AGREEMENT WITH REGARD TO CLAIMS OF THIRD PARTIES, NEITHER PARTY WILL BE LIABLE TO THE OTHER PARTY (NOR TO ANY PERSONCLAIMING RIGHTS DERIVED FROM THE OTHER PARTY’S RIGHTS) FOR INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES OF ANY KIND (INCLUDING WITHOUT LIMITATION LOST PROFITS, LOSS OF OR DAMAGE TO DATA, LOSS OF BUSINESS, OR OTHER ECONOMIC DAMAGE), WHETHER ARISING IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND REGARDLESS OF WHETHER THE PARTY LIABLE OR ALLEGEDLY LIABLE WAS ADVISED, HAD OTHER REASON TO KNOW, SHOULD HAVE ANTICIPATED, OR IN FACT KNEW OF THE POSSIBILITY THEREOF.  IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR COSTS OF PROCUREMENT OF SUBSTITUTE GOODS BY ANYONE. THE PROVISIONS OF THIS PARAGRAPH ARE INDEPENDENT OF, SEVERABLE FROM, AND TO BE ENFORCED INDEPENDENTLY OF ANY OTHER ENFORCEABLE OR UNENFORCEABLE PROVISION OF THIS AGREEMENT.

b. MAXIMUM AGGREGATE LIABILITY. EXCEPT WITH REGARD TO A PARTY’S EXPRESS INDEMNIFICATION OBLIGATIONS UNDER THIS AGREEMENT, IN NO EVENT SHALL A PARTY’S AGGREGATE LIABILITY TO THE OTHER PARTY (INCLUDING LIABILITY TO ANY PERSON OR PERSONS WHOSE CLAIM OR CLAIMS ARE BASED ON OR DERIVED FROM A RIGHT OR RIGHTS CLAIMED BY OR THROUGH SUCH PARTY), WITH RESPECT TO ANY AND ALL CLAIMS AT ANY AND ALL TIMES ARISING FROM OR RELATED TO THE SUBJECT MATTER OF THIS AGREEMENT, IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, EXCEED $250. THE PROVISIONS OF THIS PARAGRAPH ARE INDEPENDENT OF, SEVERABLE FROM, AND TO BE ENFORCED INDEPENDENTLY OF ANY OTHER ENFORCEABLE OR UNENFORCEABLE PROVISION OF THIS AGREEMENT.

c. Intentional Risk Allocation. Referring Practice acknowledges and agrees that the Services are    provided free of charge and that Glidian would be unwilling to    enter this Agreement on such basis without the exclusions and    limitations set forth herein.  Each party acknowledges that the    provisions of this Agreement were negotiated, as a material part of    the agreement memorialized herein, to reflect an informed,    voluntary allocation between them of all risks (both known and    unknown) associated with the transactions involved with this    Agreement.  The warranty disclaimers and limitations in this    Agreement are intended, and have as their essential purpose, to    limit the circumstances of liability.  The remedy limitations and    the limitations of liability are separately intended, and have as    their essential purpose, to limit the forms of relief available to    the parties.

12. Other  Provisions.

a. Nature of Relationship. Glidian shall provide all Services hereunder as an independent contractor to Referring Practice.  Nothing contained herein shall be deemed to create any agency, partnership, joint venture, or other relationship between the parties or any of their affiliates, and neither party shall have the right, power, or authority under this Agreement to create any duty or obligation on behalf of the    other party.

b. Force Majeure. Neither party shall be liable for any failure to perform its obligations under this Agreement if such failure (i) arises, directly or indirectly, out of causes reasonably beyond the direct control of such party and not due to such party’s own fault or negligence or    that of its contractors or representatives or other persons acting    on its behalf and (ii) cannot be overcome by the exercise of due diligence and reasonably could not have been prevented through commercially reasonable measures, including acts of God, acts of terrorists or criminals, acts of domestic or foreign governments, change in any law or regulation, fires, floods, explosions,    epidemics, disruptions in communications, power, or other    utilities, strikes or other labor problems, riots, or    unavailability of supplies.

c. Notice.  Except as otherwise expressly provided herein, notices shall be given under    this Agreement in writing, in the English language, (i) by    personal delivery, provided that if the applicable person is an    entity, such delivery shall be to an officer of such entity or, if    none, to an individual serving in a similar capacity (in which case    such notices shall be deemed given upon such personal delivery),    (ii) by certified or registered U.S. mail, postage pre-paid,    from within the United States (in which case such notices shall be deemed given on the third business day after deposit), (iii) with    next-business-day instruction by a recognized overnight courier,    pre-paid, with next-business-day delivery instruction (in which case such notices shall be deemed given on the next business day    after deposit), or (iv) to Referring Practice, by e-mail (in which case such notice shall be deemed given upon transmission    unless Glidian receives a non-delivery email message within a    reasonable time thereafter).  Notices shall be sent to Glidian at    Attn: Legal Department, Glidian, Inc., 224    Sequoia Ave., South San Francisco, CA 94080, with copy    to Steve F. Wood, Esq., Baker Donelson, 211 Commerce Street, Suite    800, Nashville, Tennessee 37201, and to Referring Practice at the    address set forth on the Cover Page.  Either party may change its    address for purposes of notice by written notice thereof to the    other party.  
d. Governing Law; Venue.  This    Agreement shall be construed and enforced in accordance with the    laws of the state of California (other than its conflicts of law    provisions) and venue shall be exclusive in the federal or state    courts in San Francisco, California.

e. Severability.  If any one    or more of the provisions of this Agreement should be ruled wholly    or partly invalid or unenforceable by a court or other government    body of competent jurisdiction, then (i) the validity and    enforceability of all provisions of this Agreement not ruled to be    invalid or unenforceable will be unaffected; (ii) the effect    of the ruling will be limited to the jurisdiction of the court or    other government body making the ruling; (iii) the    provision(s) held wholly or partly invalid or unenforceable would    be deemed amended, and the court or other government body is    authorized to reform the provision(s), to the minimum extent    necessary to render them valid and enforceable in conformity with    the parties’ intent as manifested herein; and (iv) if the    ruling, and/or the controlling principle of law or equity leading    to the ruling, subsequently is overruled, modified, or amended by    legislative, judicial or administrative action, then the    provision(s) in question as originally set forth in this Agreement    will be deemed valid and enforceable to the maximum extent    permitted by the new controlling principle of law or equity.

f. Entire Agreement.  This    Agreement constitutes the entire agreement between the parties    concerning the subject matter hereof.  No prior or contemporaneous    representations, inducements, promises, or agreements, oral or    otherwise, between the parties with reference thereto will be of    any force or effect.  Each party represents and warrants that, in    entering into and performing its obligations under this Agreement,    it does not and will not rely on any promise, inducement, or    representation allegedly made by or on behalf of the other party    with respect to the subject matter hereof, nor on any course of    dealing or custom and usage in the trade, except as such promise,    inducement, or representation may be expressly set forth herein.

g. Amendment and Waiver.  No modification or amendment to this Agreement will be valid or    binding unless in writing and duly executed by the party or parties    to be bound thereby (which may be accomplished in electronic form    or by electronic means).  The failure of either party at any time    to require performance by the other party of any provision of this    Agreement shall in no way affect the right of such party to require    performance of that provision.  Any waiver by either party of any    breach of this Agreement shall not be construed as a waiver of any    continuing or succeeding breach of such provision, a waiver of the    provision itself or a waiver of any right under this Agreement.

h. No Third Party Beneficiaries. This Agreement is not intended to confer, nor shall any provision    hereof be interpreted to confer, upon any person other than the    parties and the respective successors or permitted assigns of the    parties, any rights, remedies, obligations, or liabilities    whatsoever.  

i. Interpretation.  The    division of this Agreement into articles, sections, and subsections    and the use of captions and headings in connection therewith are    solely for convenience and shall have no legal effect in construing    the provisions of this Agreement.  Unless otherwise indicated,    references to articles, sections, subsections, and paragraphs are    to provisions of this Agreement and references to exhibits and    schedules are to exhibits and schedules appended to this Agreement.    Unless the context otherwise requires, (i) references to any party    to this Agreement include references to such party’s successors    and permitted assigns, (ii) references to “person” include    references to any individual, corporation, limited liability    company, partnership, company, firm, association, joint venture,    trust, governmental body, or other entity, (iii) any of the terms    defined herein may be used in the singular or the plural depending    on the reference, (iv) a masculine, feminine, or neuter pronoun    includes the other genders as appropriate in the context, and (v)    the term “including” means “including without limitation”    unless otherwise expressly indicated in a given instance.

j. Survival.  The covenants    herein concerning indemnification and any other provision that, by    its nature, is intended to survive this Agreement shall survive any    termination or expiration of this Agreement.  

k. Successors and Assigns.    This Agreement will be binding upon and inure to the benefit of the    parties and their successors and assigns permitted by this    Agreement.  

EXHIBIT A

Business Associate Addendum

THIS BUSINESS ASSOCIATE ADDENDUM (the “Addendum”) supplements and is made a part of the Referring Practice Terms of Service between Glidian and Referring Practice (the “Agreement”).

Referring Practice is a Covered Entity (or is a Business Associate to one or more Covered Entities) pursuant to HIPAA.  Referring Practice has engaged Glidian to perform the Services pursuant to the Agreement.  In the course of providing the Services, Referring Practice may make available to Glidian or have Glidian obtain or create on its behalf information that may be deemed Protected Health Information subject to the provisions of HIPAA and information subject to protection under other federal or state laws.

In order to comply with the applicable provisions of HIPAA and other federal or state laws as applicable, the parties agree as follows:

1. Definitions.

1. Capitalized terms used but not otherwise defined in this Addendum shall have the meanings ascribed in HIPAA (whether or not such terms are capitalized therein) or in    the Agreement, as the case may be.

2. “Electronic PHI” means PHI that is Electronic Protected Health Information.

3. “PHI” means Protected Health Information received or accessed by Glidian from or on    behalf of Referring Practice or created, transmitted, or maintained    by Glidian for or on behalf of Referring Practice.  
2. Permitted  Uses.  Glidian may use PHI only as permitted or  required by this Addendum and only for the following purposes:  (i) as necessary to perform the Services; (ii) to  provide Data Aggregation services relating to the Health Care  Operations of Referring Practice, but only incident to the  performance of the Services; (iii) to de-identify PHI in  accordance with the standards set forth under HIPAA, but only  incident to the performance of the Services; (iv) to carry out  its legal responsibilities; (v) for the proper business  management and administration of Glidian; and (v) as Required  By Law.

3. Permitted Disclosures.   Glidian may disclose PHI only as permitted or required by this  Addendum for the following purposes: (i) as necessary to  perform the Services; (ii) for the proper business management  and administration of Glidian or to carry out its legal  responsibilities, if Required By Law or if Glidian has obtained  reasonable assurances that the recipient will (A) hold such PHI  in confidence, (B) use or further disclose it only for the  purpose for which it was received or as Required By Law, and  (C) notify Glidian of any instance of which the recipient  becomes aware in which the confidentiality of such PHI has been  breached; and (iii) as otherwise Required By Law.

4. Prohibited  Uses and Disclosures.      Subject to Referring Practice’s    compliance with its obligations set forth in Section 16    as applicable, Glidian shall not use or further disclose PHI in a    manner that would violate HIPAA if done by Referring Practice.    If Referring Practice notifies    Glidian that Referring Practice has agreed to be bound by    additional restrictions on the uses or disclosures of PHI pursuant    to Section 16, Glidian shall be bound by such    additional restrictions and shall not use or disclose PHI in    violation of such additional restrictions.    Glidian shall not sell PHI or    otherwise receive remuneration, directly or indirectly, in exchange    for PHI.    Glidian shall not use or disclose    PHI for purposes of marketing or fundraising.

5. Subcontractors and Agents.  Any disclosure to a Subcontractor of  Glidian shall be pursuant to a written agreement between Glidian and  such Subcontractor containing substantially the same restrictions  and conditions on the use, disclosure, and safeguarding of PHI as  are set forth in this Addendum.

6. Minimum Necessary.   Glidian shall request, access, use, and disclose only the minimum  amount of PHI necessary, in accordance with HIPAA, to perform the  Services.

7. Certain Privacy Rule Compliance.  To the extent that Glidian is to carry  out one or more of Referring Practice's obligations under Subpart E  of Part 164 of HIPAA (generally known as the HIPAA Privacy  Rule), Glidian shall comply with such requirements that apply to  Referring Practice in the performance of such obligations.

8. Safeguards.  Glidian at all times shall maintain administrative, physical,  and technical safeguards that reasonably and appropriately protect  the confidentiality, availability, and integrity of Electronic PHI  that it creates, receives, maintains, or transmits in accordance  with the regulations set forth at 45 CFR § 164.308, 45 CFR  § 164.310, and 45 CFR § 164.312 and shall maintain  policies and procedures and other documentation in accordance the  regulations set forth at 45 CFR § 164.316.  Glidian  acknowledges that such provisions apply to Glidian in the same  manner that they apply to Covered Entities.

9. Breach Investigation and Reporting.

1. As soon as practicable following any actual or reasonably suspected    impermissible use or disclosure of PHI, Glidian shall assess    whether such actual or suspected impermissible use or disclosure    was of PHI that is Unsecured Protected Health Information and, if    so (or if Glidian cannot determine reasonably conclusively to the    contrary), Glidian shall make an evaluation of whether there is a    low probability that the PHI has been compromised.  In making such evaluation, Glidian shall conduct a risk assessment that considers,    at a minimum, (i) the nature and extent of the protected health    information involved, including the types of identifiers and the    likelihood of re identification, (ii) the unauthorized person who    used the protected health information or to whom the disclosure was    made, (iii) whether the protected health information was actually    acquired or viewed, and (iv) the extent to which the risk to the    protected health information has been mitigated, and Glidian shall    evaluate the overall possibility that the PHI has been compromised    by considering all of the above, and any other relevant factors, in    combination.

2. If pursuant to the evaluation    described in Section 9.1 Glidian determines that such    impermissible use or disclosure constitutes a Breach of PHI that is    Unsecured Protected Health Information, Glidian shall provide    Referring Practice in writing, without unreasonable delay but in no    case later than 10 days following such determination, written    notice setting forth the date of discovery thereof, the identities    of affected individuals (or, if such identities are unknown at that    time, the classes of such individuals), a general description of    the nature of the incident, and such other information as is    required pursuant to HIPAA or reasonably requested by Referring    Practice.  Glidian shall supplement such notice with information    not available at the time of the initial notification as promptly    thereafter as the information becomes available to Glidian.

3. If pursuant to the evaluation    described in Section 9.1 Glidian determines that such    impermissible use or disclosure does not constitute a Breach of PHI    that is Unsecured Protected Health Information, Glidian shall    notify Referring Practice in writing of such impermissible use or    disclosure of PHI and of such determination promptly following such    determination.

4. For purposes hereof, an actual or    suspected use or disclosure shall be deemed impermissible if it is not or would not be permitted by this Agreement or if it is or    would be in violation of HIPAA.

5. For purposes hereof, an impermissible use or disclosure shall be deemed discovered by    Glidian as of the first day on which such impermissible use or    disclosure is known to Glidian or, by exercising reasonable    diligence, would have been known to Glidian, and Glidian shall be    deemed to have knowledge of an impermissible use or disclosure if    such impermissible use or disclosure is known, or by exercising    reasonable diligence would have been known, to any person, other    than the person committing the impermissible use or disclosure, who    is a workforce member of Glidian or an agent of Glidian (determined    in accordance with the federal common law of agency).

10. Security  Incident Reporting.  Glidian shall report to  Referring Practice in writing any Security Incident involving  Electronic PHI, other than a Security Incident that involves an  actual or suspected impermissible use or disclosure of PHI, within  30 days of Glidian’s discovery thereof.  The parties acknowledge  and agree that this section constitutes notice by Glidian to  Referring Practice of the ongoing occurrence of events that may  constitute Security Incidents but that are trivial, routine, do not  constitute a material threat to the security of PHI, and do not  result in unauthorized access to or use or disclosure of PHI (such  as typical pings and port scans), for which no additional notice to  Referring Practice shall be required.

11. Mitigation.  Glidian shall take all actions reasonably necessary and shall  cooperate with Referring Practice as reasonably requested to  mitigate, to the extent practicable, any harmful effect of any use  or disclosure of PHI in violation of the terms and conditions of  this Addendum or of any applicable law.  

12. Access and Amendment.
  With respect to an Individual as to whom Glidian maintains PHI,  Glidian shall notify Referring Practice promptly upon receipt of a  request from such an Individual for access to or a copy of such  Individual’s PHI or to amend such Individual’s PHI.  To the  extent permitted under HIPAA, and except as otherwise required upon  the order of a court of competent jurisdiction, (i) Glidian  shall direct such Individual to make such request of Referring  Practice and (ii) Glidian shall not consent to such access,  deliver such copy, or comply with such request except as directed by  Referring Practice.  With respect to PHI maintained by Glidian in a  Designated Record Set, to the extent required by HIPAA, Glidian  shall (i) make available PHI to Individuals or Referring  Practice, as reasonably requested by Referring Practice and in  accordance with HIPAA and (ii) upon receipt of notice from  Referring Practice, promptly amend any portion of the PHI so that  Referring Practice may meet its amendment obligations under HIPAA.

13. Accounting for Disclosures.   Glidian shall document all disclosures of PHI by Glidian and  information related to such disclosures as would be required for  Referring Practice to respond to a request by an Individual for an  accounting of disclosures of PHI in accordance with HIPAA.  Glidian  shall maintain such information for the applicable period set forth  in HIPAA.  Glidian shall deliver such information to Referring  Practice or, upon Referring Practice’s request, to the Individual,  in the time and manner reasonably designated by Referring Practice,  in order for Referring Practice to respond to a request by an  Individual for an accounting of disclosures of PHI in accordance  with HIPAA.  The obligations set forth in this section shall survive  the expiration or any termination of this Agreement and shall  continue, as to a given instance of a disclosure, until the earlier  of (i) the passing of the time required for such information to  be maintained pursuant to HIPAA or (ii) the delivery to  Referring Practice of all such information in a form and medium  reasonably satisfactory to Referring Practice and the return or  destruction of all PHI as provided in this Agreement.

14. Audit.  If  Glidian receives a request, made on behalf of the Secretary of the  Department of Health and Human Services, that Glidian make its  internal practices, books, and records relating to the use or  disclosure of PHI available to the Secretary of the Department of  Health and Human Services for the purposes of determining Referring  Practice’s or Glidian’s compliance with HIPAA, Glidian promptly  shall notify Referring Practice of such request and, unless enjoined  from doing so by order of a court of competent jurisdiction in  response to a challenge raised by Referring Practice or Glidian  (which challenge Glidian shall not be obligated to raise), Glidian  shall comply with such request to the extent required of it by  applicable law. Nothing in this Agreement shall waive any  attorney-client privilege or other privilege applicable to either  party.

15. Compliance  with Law.  Glidian shall comply with all applicable  federal and state laws regarding individually identifiable  information contained in or associated with PHI, including without  limitation any state data breach laws or other state laws regarding  the protection of such information.  Nothing in this Agreement shall  be construed to require Glidian to use or disclose PHI without a  written authorization from an Individual who is the subject thereof,  or written authorization from any other person, where such  authorization would be required under federal or state law for such  use or disclosure.  

16. Obligations  of Referring Practice.
 Referring Practice shall  (i) notify Glidian of any limitation in Referring Practice’s  Notice of Privacy Practices to the extent that such limitation may  affect Glidian's use or disclosure of PHI, (ii) notify Glidian  of any changes in, or revocation of, permission by an Individual to  use or disclose PHI, to the extent that such change may affect  Glidian’s use or disclosure of PHI, (iii) notify Glidian of  any restriction on the use or disclosure of PHI to which Referring  Practice has agreed in accordance with HIPAA, to the extent that  such restriction may affect Glidian's use or disclosure of PHI, and  (iv) obtain any authorization or consents as may be Required by  Law for any of the uses or disclosures of PHI necessary for Glidian  to provide to the Services.  

17. Term and Termination.
  This Addendum shall become effective on the Effective Date and  shall continue in effect until the earlier to occur of (i) the  expiration or termination of all Agreements or (ii) termination  pursuant to this section.  Either party may terminate this Addendum  effective immediately if the other party has breached a material  provision of this Addendum and failed to cure such breach within 30  days of being notified by the other party of the breach.  If the  non-breaching party reasonably determines that cure is not possible,  such party may terminate this Addendum effective immediately upon  written notice to other party.  

18. Effect of Termination.   Upon termination of this Addendum, subject to any applicable  provisions of the Agreement, Glidian shall return to Referring  Practice or destroy all PHI that Glidian maintains in any form and  retain no copies of such PHI or, if return or destruction is not  feasible (including without limitation if Glidian is required by  applicable law to retain any such PHI for a time following  termination), notify Referring Practice thereof and extend the  protections of this Addendum to the PHI and limit its further use or  disclosure to those purposes that make the return or destruction of  the PHI infeasible.  The requirements of this section shall survive  termination or expiration of this Addendum and shall be in force as  long as any PHI remains in the custody or control of Glidian.

19. Miscellaneous.

1. Amendments.  Any provision    of the Agreement to the contrary notwithstanding, upon the    enactment of any law or regulation affecting the use or disclosure    of PHI, or on the publication of any decision of a court of    competent jurisdiction relating to any such law, or the publication    of any interpretive policy or opinion of any governmental agency    charged with the enforcement of any such law or regulation,    Referring Practice may, by written notice to Glidian, propose to    amend this Addendum in such a manner as Referring Practice    reasonably determines necessary to comply therewith, and such    proposed amendment shall become operative unless Glidian rejects    such amendment by written notice to Referring Practice within 30    days thereafter, in which case, unless the parties agree on an    amendment within 30 days after Glidian’s notice, either party may    terminate this Addendum by written notice to the other.        

2. Notice.  Written notice    pursuant to Section 9 or Section 10 sent    with next-business-day instruction by recognized overnight document    delivery service to the address provided herein shall be deemed    given upon deposit with such overnight delivery service.    

3. Interpretation.  In the    event of a conflict between the provisions of this Addendum and any    other provisions of the Agreement, the provisions of this Addendum    shall control.  In the event of an inconsistency between the    provisions of this Addendum and mandatory provisions of HIPAA, as    amended, or its interpretation by any court or regulatory agency    with authority over either party hereto, HIPAA (interpreted by such    court or agency, if applicable) shall control.  Where provisions of    this Addendum are different from those mandated under HIPAA, but    are nonetheless permitted by such rules as interpreted by relevant    courts or agencies, the provisions of this Addendum shall control.  
© Glidian, Inc. 2024