WHEREAS, SEH has implemented a community-wide health record system utilizing Epic System Corporation's Epic Care software ("Health Record");
WHEREAS, SEH wishes to make the Health Record available to all providers throughout the community to improve overall health in the community;
WHEREAS, SEH has implemented or is implementing the EpicCare Link software
("EpicCare Link") and EpicCare Everywhere software to permit portal access and interfacing with the Health Record by providers in the community;
WHEREAS, Participant wishes to improve the health of the community and improve care for Participant's patients;
and WHEREAS, SEH is providing EpicCare Link access to Participants subject to the terms and conditions of this Agreement.
NOW, THEREFORE, in consideration of the foregoing and the mutual representations and covenants of the Parties, thereby agree as follows:
1. Access.
1.1 EpicCare Link. SEH shall provide Participant access to EpicCare Link in order to permit Participant and its users to electronically access the Health Record pursuant to the terms and conditions of this Agreement. Participant shall provide to SEH and/or Epic all information reasonably requested and necessary for SEH to provide access by Participant to EpicCare Link.
1.2 Participant Technology Obligations. Participant shall obtain and maintain connectivity and network configuration and required hardware and equipment (collectively, the “Configuration”) in accordance with specifications provided by SEH and/or Epic and shall update the Configuration as required in the event of upgrades to EpicCare Link. Participant shall ensure that its Users (as defined in Section 2.1) access EpicCare Link and the Health Record remotely through equipment owned or leased by Participant.
1.3 Use of Health Record. The use of the Health Record by Participants and Users (as defined in Section 2.1) pursuant to this Agreement shall be solely for the purpose of Treatment of and Payment for patients of the Participant. For purposes of this Agreement, the terms "Treatment" and "Payment" shall have the meanings ascribed to them in the Health Insurance and Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"). Participant acknowledges and agrees that it is participating in the Health Record and as such, any records maintained by Participant in the Health Record may be accessible by other participants. Participant further acknowledges and agrees that SEH does not make any guarantee, representation or warranty with respect to Participant’s ability to receive payment or reimbursement based on Participant’s use of any information
contained in the Health Record.
1.4 Access to Data. Subject to the terms and conditions of this Agreement and applicable law, SEH hereby grants to Participant a limited, revocable, nonexclusive, non-transferable license for Users to access and use EpicCare Link and the Health Record (the “Access”).
2. Participant Responsibilities.
2.1 User Management. Participant may request Access for its employees, agents, medical staff, other health care providers, and other support staff employed or otherwise retained by Participant who have a need for Access in providing services for or at Participant (“Users”) and who have accepted the EpicCare Link User Terms and Conditions, as may be amended from time to time by SEH. Participant shall manage such access in accordance with any agreed upon procedures for granting Access to Users. SEH shall retain final authority with respect to the granting of Access to Users. SEH shall retain final authority and sole and complete discretion with respect to the granting of Access to Users and may partially or completely revoke such Access at any time and for any reason. Participant shall require that all User Access is in accordance with written reference manuals, training materials, and procedures relating to Users’ Access (“User Documentation”) provided by SEH (if any).
2.2 Access to Data, Participant, and Users. Upon SEH’s reasonable request, Participant shall permit SEH and Epic access to Participant’s books and records related to this Agreement during reasonable business hours and permit electronic audits, for legitimate purposes, including, without limitation, monitoring Participant’s compliance with the terms of this Agreement and to perform Epic’s or SEH’s obligations hereunder. Specifically, but without limitation, SEH may ask for, and Participant shall provide, copies of Participant’s records verifying treatment relationships and uses and/or disclosures of records for treatment purposes and in accordance with the terms of this Agreement.
2.3 Participation. Participant shall use EpicCare Link and Health Record consistent with EpicCare Link’s capabilities and the requirements of this Agreement. Such use shall include, without limitation, mandatory participation in applicable training programs provided by SEH and/or Epic related to EpicCare Link.
2.4 Restrictions. Participant will not, and will not permit Users to, do any of the following:
2.4.1 Copy or duplicate, by any means, EpicCare Link or any part thereof;
2.4.2 Reverse engineer, de-compile, disassemble or otherwise attempt to learn the source code, structure, algorithms or ideas underlying EpicCare Link or any part thereof;
2.4.3 Modify, adapt, translate or create derivative works based on EpicCare Link or any part thereof;
2.4.4 Remove, obscure or modify any markings or notice of other proprietary rights of Epic, third party vendors or Epic’s respective licensors from any media, user interfaces or documentation provided pursuant to this Agreement. To the extent applicable, Participant shall affix and maintain the copyright notice of Epic on all permitted backup or multiple use copies made of EpicCare Link or any portion thereof and shall not remove any proprietary notice of SEH or Epic from any copy of EpicCare Link;
2.4.5 Cause or permit the use of EpicCare Link by any third party or permit any third party to take any action restricted in this Section 2.4 or otherwise restricted by this Agreement; or
2.4.6 Share or disclose usernames, passwords or any unique identifiers and information needed to access EpicCare Link and the EHR System Data. Each User must request and use unique credentials and maintain them securely.
2.5 Corrective Action. Participant shall take corrective action up to and including termination of employment and/or suspension of any employee who acts in violation of this Agreement, the User Terms & Conditions, and/or applicable regulatory requirements. Participant must promptly report any violation of this Agreement, the User Terms and Conditions and/or applicable regulatory requirement to SEH and such corrective actions taken in response.
3. Additional SEH Responsibilities.
3.1 Users. SEH shall create usernames, passwords, and/or any other authentication necessary to allow Access by Users designated by Participant or shall designate such authentication to Participants subject to this Agreement and the User Terms and Conditions. SEH shall also use its best efforts to promptly comply with requests by Participant to change Users’ access rights and add or delete Users. In the event that SEH has designated authentication to Participant, then Participant shall promptly change User's access rights and promptly add or delete Users.
3.2 Audits and Reports. SEH shall provide Participant audit information to Participant regarding its Users’ Access, use, and disclosure of EHR System Data and EpicCare Link. Participant will collaboratively work with SEH Privacy Officer immediately upon discovery of any unauthorized access, use or disclosure of PHI.
4. Warranty, Indemnity, and Liability Limitation.
4.1 Hold Harmless. Participant agrees to provide liability protection for its officers, employees, and agents while acting within the scope of their employment. Participant further agrees to hold harmless SEH from any and all liability, including but not limited to claims, demands, losses, costs, damages, and expenses of every kind and description, or damages to persons or property arising out of or in connection with or occurring during the course of this Agreement where such liability is founded upon or grows out of the acts or omissions of any of the officers, employees, or agents of Participant.
4.2 Indemnification. : Participant shall indemnify and defend SEH for and against any and all liability, including (but not limited to) claims, demands, penalties, losses, costs, damages, and expenses of every kind and description (including reasonable attorney’s fees and court costs), arising out of (i) any violation of HIPAA or other federal or state confidentiality, privacy, or security laws; (ii) any Breach (as defined under HIPAA) and/or any Security Incident (as defined under HIPAA); or (iii) any breach of this Agreement by Participant, any User, or Participant’s employees, agents or representatives. By way of example only, and without limiting the foregoing, if Participant, any User or any agent, employee or representative of Participant accesses information using the EpicCare Link for reasons other than Treatment or Payment or otherwise accesses information beyond the scope of Access authorized under this Agreement, Participant shall indemnify and defend SEH as described above. Nothing in this Section 4.2 shall be construed to limit the obligation of Participant to pay for the costs of breach notification and mitigation as provided in Section 7.5 or pay for costs incurred by SEH in seeking relief as provided in Section 9.5. The obligations of Participant set forth in this Section 4.2 shall be in addition to the obligations of Participant set forth in Sections 7.5 and 9.5.
4.3 Disclaimer of Warranty. SEH HAS NOT MADE, AND PARTICIPANT HAS NOT
RECEIVED, ANY EXPRESS OR IMPLIED WARRANTIES OR REPRESENTATIONS,
INCLUDING, BUT NOT LIMITED TO, ANY EXPRESS OR IMPLIED WARRANTIES OF MERCHANTABILITY, ACCURACY, FITNESS FOR A PARTICULAR PURPOSE AND TITLE AND ALL SUCH WARRANTIES ARE HEREBY EXCLUDED.
4.4 Limitation of Liability. PARTICIPANT EXPRESSLY UNDERSTANDS AND AGREES THAT SEH SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, INCLUDING
WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, GOODWILL, USE, DATA LOSS, OR OTHER LOSSES (EVEN IF SEH HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES) RESULTING FROM: (i) THE USE OR INABILITY TO USE EPICCARE LINK OR THE HEALTH RECORD; (ii) PARTICIPANT’S OR USERS’ RELIANCE ON THE INFORMATION ON EPICCARE LINK OR THE HEALTH RECORD; (iii) PARTICIPANT’S OR USERS’ FAILURE TO READ OR ACCESS EPICCARE LINK OR THE HEALTH RECORD IN A TIMELY MANNER; (iv) THE INTERRUPTION, SUSPENSION, OR TERMINATION OF EPICCARE LINK OR THE HEALTH RECORD; OR (v) ANY MATTER OTHERWISE RELATED TO PARTICIPANT’S OR USERS’ USE OF EPICCARE LINK OR THE HEALTH RECORD.
5. Term and Termination.
5.1 Term of the Agreement. The initial term of this Agreement shall begin on the Effective Date and continue for a period of one (1) year (“Initial Term”). This Agreement shall renew automatically thereafter for successive one-year terms (each, a “Renewal Term”).
5.2 Termination. Either party may terminate this Agreement upon providing the other party five (5) days prior written notice.
6. Clinical Products.
6.1 Participant and Users will do each of the following:
6.1.1 Participant and Users will verify the accuracy of information obtained from the Health Record, including without limitation, all patient information and critical outputs of EpicCare Link following generally accepted standards of medical practice. The term critical outputs means outputs (including without limitation output in the form of data) that Participant or Users know, or following generally accepted standards of medical practice, should know have potential for negative impact on patient care.
6.1.2 Participant and Users will not rely solely on EpicCare Link for data Participant and Users know or, following generally accepted standards of medical practice, should know has the potential for negative impact on patient care. For example, Participant and Users must verify allergies, current medications, relevant histories, and problems with the patient.
6.1.3 Participant and Users will be vigilant in reporting to each other any program errors or data errors or suspected program errors or suspected data errors discovered in the course of using EpicCare Link. Participant will report to SEH promptly after discovery, any discovered or reported problems with EpicCare Link that have been discovered or reported by any User or which either Participant or any User independently know or, following generally accepted standards of medical practice, should know could adversely affect patient care. If Participant and Users are alerted to a problem that Participant knows or, following generally accepted standards of medical practice, should know, could adversely affect patient care, Participant will immediately alert all Users.
6.1.4 In addition to the foregoing, Participant and Users will use EpicCare Link and access and use EHR System Data only in accordance with applicable standards of good clinical practice.
7. Confidentiality and Patient Information.
7.1 Confidentiality.
7.1.1 For the purposes of this Agreement, “Confidential Information” means any software (including, without limitation, EpicCare Link and all technical information), material, data and business, financial, operational, customer, vendor, Trade Secrets, and other information disclosed by one Party to the other and not generally known by or disclosed to the public, and shall include, without limitation, the terms of this Agreement. As used herein, “Trade Secrets” includes EpicCare Link and any other trade secrets or other confidential information of Epic or SEH protected by operation of law and this Agreement.
7.1.2 Each Party shall keep, and shall require its directors, officers, employees, agents and representatives to keep, in confidence all Confidential Information of the other Party and shall not use or disclose to any third parties any of the other Party’s Confidential Information, except as specifically permitted in the Agreement or as required by law. In addition, Participant, and any of its directors, officers, employees, agents and representatives, may not disclose publicly any results of any testing or benchmarking of EpicCare Link or of SEH’s or Epic’s services without SEH’s written consent, and such results shall be Confidential Information under this Section of the Agreement. Participant shall limit access to Confidential Information to Users who must have access in order to make proper use of EpicCare Link and the EHR System Data in the Participant’s operations. Participant shall store all Confidential Information in a place reasonably believed to be secure. Participant shall inform all Users that Participant and Users are obligated to keep all Trade Secrets confidential and that it is the policy of the Participant to do so. In the event either Party discovers, or suspects, unauthorized use of or access to the Confidential Information (including, without limitation, any EHR System Data), it shall immediately notify the other Party.
7.1.3 Except for individually identifiable health information, which shall always be confidential, Confidential Information excludes Confidential Information which: (i) is or becomes within the public domain through no act of the receiving Party in breach of this Agreement or any other Agreement, (ii) was in the possession of a Party prior to its disclosure or transfer to such Party and such Party can so prove, (iii) is independently developed by a Party and such Party can so prove, or (iv) is received from another source without any restriction on use or disclosure.
7.2 Individually Identifiable Health Information. With respect to any individually identifiable health information, the Parties agree to comply with the privacy and security requirements of HIPAA, the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), and all other federal and state privacy and security laws applicable to the exchange and use of the EHR System Data. Each Party shall report any unauthorized uses or disclosures or security incidents in accordance with applicable regulatory requirements, including HIPAA and the HITECH Act.
7.3 Protected Health Information and Safeguards. Participant’s and Users’ Access to the EHR System Data shall be in accordance with the minimum necessary standard set forth in 45 C.F.R. Sections 164.502(b) and 164.514(d) and only as is appropriate to Users’ responsibilities. If Users gain inappropriate access to information, Participant will notify SEH’s Privacy Officer.
7.4 Reporting of Unauthorized Use or Disclosure of PHI. Participant shall report to SEH without unreasonable delay and in any event not more than one (1) business day thereafter (1) any Breach of Unsecued PHI (as defined under HIPAA) which Participant discovers (as the concept of discovery is defined under HIPAA); (2) suspected or actual Security Incident (as defined under HIPAA) of which Participant becomes aware; (3) any use or disclosure of PHI not authorized by this Agreement of which it becomes aware; or (4) any allegation from any patient or other individual that a User has made an unauthorized use or disclosure of PHI or
breached security of PHI. Participant’s report shall identify: (i) the nature of the Breach of Unsecured PHI, the unauthorized use or disclosure, Security Incident or allegation; (ii) the PHI at issue; (iii) names of workforce involved in the Breach of Unsecured PHI, unauthorized use, disclosure, Security Incident or allegation and the recipient of any unauthorized disclosure; (iv) what Participant has done or shall do to mitigate any harmful effect of the Breach of Unsecured PHI, unauthorized use or disclosure, Security Incident or allegation; and (v) what corrective action Participant has taken or shall take to prevent future similar incidents. Participant shall provide such other information, including a written report, as reasonably requested by SEH’s Privacy Officer. Participant shall impose appropriate sanctions for HIPAA and/or HITECH violations by Users and shall cooperate with SEH in mitigating any harmful effects of such Breach of Unsecured PHI, Security Incident, unauthorized access, use, or violations. Participant shall require its Users, employees and agents to agree in writing to report a Breach of Unsecured PHI, suspected or actual Security Incident, any use or disclosure of PHI not authorized by this Agreement or any allegation from any patient or other individual that a User has made an unauthorized use of disclosure of PHI or breached security of PHI in order to allow Participant to comply with this Section 7.4.
7.5 Notification to Individuals. Participant shall cooperate with SEH in notifying individuals and the media of the occurrence of any Breach of Unsecured PHI, Security Incident or unauthorized uses or disclosures of PHI described in Section 7.4 (the “Breach Event”). Participant shall indemnify and hold SEH harmless from and against all (a) costs and expenses (including, without limitation, attorneys' fees, mailing and notice costs, call center costs, credit monitoring costs (up to two years)) related to any and resulting notifications when the Breach Event arises from Participant’s (or its Users, employees or agents) negligence, willful misconduct, violation of law, breach of this Agreement or Participant’s (or its Users, employees or agents) unauthorized use or disclosure of PHI, and (b) penalties imposed by a federal or state governing agency against SEH to the extent such penalty is imposed upon SEH citing Participant’s (or its Users, employees or agents) acts or omissions as the basis for imposing such penalty against SEH. In the event SEH opts to allow Participant to be responsible for such notifications, Participant must obtain SEH’s approval of the time, manner and content of any such notifications, provide SEH with copies of the notification, and provide the notification within sixty (60) days after discovery of the Breach Event or such shorter timeframe required by SEH. Participant shall have the burden of demonstrating to SEH that all notifications were made as required, including any evidence demonstrating the necessity of any delay beyond the 60 day calendar notification requirement to affected individuals after the discovery of the breach by SEH, Participant or any User. This Section shall survive termination of the Agreement.
8. Ownership Rights.
8.1 Intellectual Property. Except for the rights granted to Participant under this Agreement, all rights, title, and interest to EpicCare Link, the software applications used to provide EpicCare Link, the User Documentation (as defined in Section 2.1) and any other information, software, or materials provided to Participant by SEH under this Agreement, shall at all times remain solely with SEH, Epic, and/or SEH’s other licensors and vendors.
8.2 Epic Ownership. This Agreement does not grant to Participant or any physician or other health care provider any ownership interest in EpicCare Link. Participant and Users are granted access to EpicCare Link as provided in this Agreement. Ownership of EpicCare Link and all intellectual property rights in it shall remain at all times with Epic and, as applicable, SEH.
9. Miscellaneous.
9.1 Compliance with Laws. Each Party represents and warrants that it has complied, and shall comply and cooperate with the other in its efforts to comply with, in all material respects, all applicable laws and regulations and with all professional and ethical requirements in connection with the fulfillment of its obligations under this Agreement, including, without limitation, the privacy and security requirements of HIPAA and the HITECH Act.
9.2 Subpoenas. In the event that SEH or Participant is served with a subpoena or other court order relating to the access to or use of EpicCare Link, the Party receiving the subpoena shall, to the extent legally permissible, immediately notify the other Party, and the Parties shall cooperate regarding the response to such subpoena or court order to the extent permitted by law.
9.3 Third Party Beneficiaries. Except as otherwise expressly stated herein, the Parties do not intend to create any enforceable rights in any third party under this Agreement, and there are no third party beneficiaries to this Agreement; provided, however, that Epic shall be a third party beneficiary to this Agreement solely with respect to enforcing the obligations and covenants of the SEH’s agreement with Epic relating to the Epic Care software.
9.4 Notices. Unless otherwise specified herein, all notices or demands required or permitted to be given or made under this Agreement, shall be in writing and shall be hand-delivered with signed receipt or mailed by first-class mail, or sent by registered or certified mail, postage prepaid, or sent by overnight courier, addressed to the Parties at the addresses set forth on the signature page to this Agreement. Addresses may be changed by either party by giving written notice thereof to the other Party. A concurrent electronic notice (read receipt only) shall also be delivered to the email address of a Party as indicated in this Agreement.
9.5 General. Each Party’s status in all matters pursuant to this Agreement shall be that of an independent contractor and not an agent of the other. This Agreement and all exhibits referenced herein constitute the entire agreement between Participant and SEH with respect to the subject matter of this Agreement, and supersedes all other prior and contemporary agreements, understandings and commitments between Participant and SEH with respect to the subject matter of this Agreement. This Agreement shall not be modified or amended except by a written instrument executed by both Parties. No waiver by by a Party any breach of this Agreement or waiver of any other provision hereunder shall be deemed to be
a waiver of any other breach or provision. No failure or delay by a Party to exercise
any right it may have by reason of the default of the other Party shall operate as a waiver of default or as a modification of this Agreement or shall prevent the exercise of any right of the non-defaulting party under this Agreement. If any provision of this Agreement is found to be invalid or unenforceable by any court, such provision shall be ineffective only to the extent that it is in contravention of applicable laws without invalidating the remaining provisions hereof. This Agreement shall be governed and interpreted in accordance with the laws of the State of Alabama. If SEH prevails in any proceeding to enforce this Agreement or to recover damages for Participant’s violation of this Agreement, Participant will pay all costs incurred by SEH in seeking such relief, including, but not limited to, reasonable attorneys’ fees. SEH shall not be liable for failure to perform under this Agreement if such failure is due to any cause beyond its reasonable control, including, but not limited to, acts of God, governmental authorities, civil disturbances or labor disputes, embargo, riots, acts of war or terrorism, fires, power surges or power failures, malfunctioning communication lines or failures of suppliers. The provisions of Sections 1.3, 2.2, 2.5, 4 (including all subparts), 6 (including all subparts), 7 (including all subparts) and 8 (including all subparts) shall survive expiration or termination of this Agreement.
9.6 Headings. The headings and subheadings in this Agreement are inserted for convenience of reference only and shall not affect the meaning or interpretation of this Agreement.
9.7 Counterparts; Facsimile and pdf Signatures. The Parties agree that this Agreement may be executed in multiple originals, each of which shall be considered an original for all purposes and, collectively, shall be considered to constitute this Agreement. The Parties further agree that signatures transmitted by facsimile or in Portable Document Format (pdf) may be considered an original for all purposes, including, without limitation, the execution of this Agreement and enforcement of this Agreement.