Page1

CliniSync Participant Agreement BH Attribution Project v1 May 2025
This Participant Agreement (“Agreement”) is entered into as of the Effective Date below by and between Ohio Health Information Partnership, Inc., an Ohio nonprofit corporation (“Company”), and the entity (“Participant”) listed below.
Effective Date:

Participant
Organization Name:
Is your Organization owned by another entity (Hospital, Franchise, etc.)? Name of Parent Entity (if applicable):
Specialty:

Primary Address:

City:

State:

Zip:

County:

Country:

Organization NPI:

Primary Contact Name:

Primary Contact Title:

Primary Contact Phone:

Primary Contact Email:

Site Administrator Name (if different from Primary Contact): Site Administrator Title (if different from Primary Contact): Site Administrator Phone (if different from Primary Contact):
Site Administrator Email (if different from Primary Contact):

Is the Organization Tax Exempt?

No

Yes, please provide tax exempt form

Privacy Officer (PO) Name:

PO Email:

PO Phone:

Primary Hospital:

EHR Vendor:

Phone: 614-664-2600
Fax: 888-390-7274
Website: www.clinisync.org

Ohio Health Information Partnership, Inc. 3455 Mill Run Drive, Suite 315
Hilliard, Ohio 43026

Company

Company is a statewide health information organization that provides a health information exchange serving health care providers and other participants in the State of Ohio (“CliniSync”). Participant has indicated its interest in obtaining access to CliniSync. Company and Participant wish to enter into this Agreement to provide Participant with access to CliniSync.
This Agreement establishes the terms under which Company will provide Participant with access to CliniSync and the other services incorporated herein as follows:

Section	Description	
1	CliniSync Physician Services	
2	CliniSync Additional Services	
3	CliniSync Participant Agreement Terms and Conditions	
4	Defined Terms	
5	Business Associate Agreement	
6	The following reference documents are available at www.clinisync.org and upon request can be delivered to the Participant by email prior to signing this contract.
–	CliniSync Policies and Procedures
The following reference documents upon request can be delivered to the Participant by email prior to signing this contract.
–	Project Scope Document	

This Agreement supersedes and replaces any other agreements or understandings, whether oral or written, entered into between the parties with respect to the subject matter of this Agreement or CliniSync. This Agreement may be executed in one or more counterparts, duplicate originals, or facsimile versions, each of which will be deemed an original, but all of which together will constitute one and the same instrument. THE PARTIES HAVE READ AND AGREE TO BE BOUND BY THIS AGREEMENT, INCLUDING THOSE TERMS CONTAINED ON THE FOLLOWING PAGES HEREOF, AS OF THE EFFECTIVE DATE.
FOR PARTICIPANT:	FOR COMPANY:
Organization: 		Ohio Health Information Partnership, Inc.
Signed: 		Signed:   	
To electronically sign this contract, please type “/s/” before your name or insert photo of your signature.

Page2

Name: 	Name:	 Title: 	Title:	 Date: 	Date:   	

Exhibit A  Additional Facilities
Additional facilities shall include the following as wholly owned subsidiaries of Participant:

Entity Name:		
Primary Address:		
County:		
EIN/NPI:		
		
Entity Name:		
Primary Address:		
County:		
EIN/NPI:		
		
Entity Name:		
Primary Address:		
County:		
EIN/NPI:		
		
Entity Name:		
Primary Address:		
County:		
EIN/NPI:		
		
Entity Name:		
Primary Address:		
County		
EIN/NPI:		
		
Entity Name:		
Primary Address:		
County:		
EIN/NPI:		
		
Entity Name:		
Primary Address:		
County:		
EIN/NPI:		
		
Entity Name:		
Primary Address:		
County:		
EIN/NPI:		
		
Entity Name:		
Primary Address:		
County:		
EIN/NPI:		

Page3

Additional facilities can be provided in a separate document if the number exceeds the space on this page.

Page4

Section 1 CliniSync Physician Services
Please select the CliniSync Services you are interested in implementing.

Service	
Description	
Fee	Service Selected (Y/N)	

Direct Messaging and Provider Directory	Ability to send Direct Messages using the CliniSync DirectTrust.org certified Health Information Service Provider (HISP) or HISP provided by Participating Organization’s EHR. Access to a secure Provider Directory that includes DirectTrust or secure email addresses of other physicians, hospitals and other providers to improve transitions of care.	

No Charge		

Community Health Record	Ability for authorized and authenticated users to search and retrieve patient information exchanged through the CliniSync HIE to create a longitudinal health record. This can be done using a web portal or the Participating Organization’s EHR with standard interface protocols.	

No Charge		

Clinical Results and Reports Delivery	Receive patients’ lab results, radiology and transcribed reports directly into your EHR, such as care summaries, history & physicals, and progress notes. Results and Reports can be delivered to physician EHR or for paper-based or those who are not able to handle structured, inbound HL7 interface feeds, via PDF document.	

No Charge1		
1 Physician EHR vendor costs may apply.

Participant’s specific Services and related integration requirements will be defined in the Project Scope Document mutually agreed to by Company and Participant. Such Project Scope Document will be subject to the terms of and incorporated into this Participant Agreement.
Integrated Electronic Health Record (EHR) connectivity with CliniSync will require implementation and support on the part of the Participant’s EHR vendor. The terms of that agreement are between the EHR vendor and the Participant but must be negotiated prior to the submission of the Participant’s Project Scope Document. To facilitate discussion, EHR vendors who have participated with CliniSync have a consistent implementation approach for Participant consideration. CliniSync Vendor Partner information is documented by vendor and available upon request. The parties acknowledge and agree that the Company is not a party to any agreement entered into between the Participant and an EHR vendor.

Page5

Section 1 Pricing
There will be no charge for use of the services in Section 1. If Participant chooses to integrate Results/Reports Delivery into their EHR, there may be a charge accessed from Participant’s EHR vendor, VAR and/or Hosting company.
CliniSync Implementation Services

Service	
Description	
Fee	

Project Planning	Project Planning will include, but not be limited to Introductory Call, Scheduling, Pre-Visit Call, Installation (if required), Build and Training, Post Visit Call, 30-Day Follow-Up and Annual Site Visit or Call.	
No Charge	

Project Management	Co-project management services including project structure, work plan, milestone and progress reports, issue resolution and change control.	
No Charge	

Vendor Relationship Management	Management and oversight of Technology Vendor resources assigned to implementation. Includes coordination and guidance in working with practice’s EHR system.	
No Charge	

Training	Train-the-trainer support prior to production and additional support after the Live Date.	
No Charge	

Implementation Resources Required from Participant

Resource	
Description / Role	
Estimated Time	

Site Administrator*	Serves as primary point of contact for the implementation project. Coordinates all Participant involvement during implementation including ensuring Participant Agreement, Business Associate Agreement, and the Project Scope Document are completed and returned to the Company, software deployment, training, testing, physician coordination, user access administration and roll-out.	
2-5 Hours (Adjusted to practice need)	

Primary Contact*	Has the authority to act on contracting including the Participant Agreement and Business Associate Agreement, and all other aspects of the organization’s services. The Primary Contact is responsible for ensuring the Site Administrator’s understanding of their responsibilities and will coordinate participant participation and ensure timely management decisions are made.	
1 Hour Per Month	
*Site Administrator and Primary Contact may be the same resource.

Ongoing Support Resources required from the Participant

Resource	
Description	
Estimated Time	

Site Administrator	Responsible for first tier end-user support for CliniSync services including managing staff access to CliniSync, validating users and related credentials, ongoing training, timely notification to CliniSync regarding change management, adherence to CliniSync policies and procedures including notification and investigation of potential breach of CliniSync.	
2 Hours Per Month	

Primary Contact	The Primary Contact is responsible for ensuring the Site Administrator’s understanding of their responsibilities and compliance with all CliniSync Policies and Procedures.	
1 Hour Per Month	

Page6

Section 2
CliniSync Additional Services
1.	CliniSync Additional Service Options
The following Additional Services are available from CliniSync. If the Additional Service is selected by Participant, it shall be incorporated into this Agreement and the Project Scope Document and subject to the terms of this Agreement.

Please select the CliniSync Services you are interested in implementing.

Chart 2.1.1 Fees

Service	
Description	Implementation Fee	Annual Subscription Fee	Service Selected (Y/N)	
CCD
Publishing / Contribute Data to CliniSync

(PnR)	Ability to contribute data to CliniSync for the purposes of updating patient identification, consent, and/or other clinical information (e.g., CCD) within the Community Health Record.	

N/A	

Annual Subscription Fee Waived	

NO	

Notify	Allows Providers to receive notifications on patients who are included in a Patient Panel and uploaded to the Notify application (Either Admit or Discharge). These notifications can be sent by Direct message, regular email or SMS (text message).				
(Stand Alone Solution)	Providers can also receive notification on patients when they are the provider of record as reported by the patient on admission or discharge at a Participating Organization. These notifications can also be sent by Direct messages, regular email or SMS (text message).	N/A	Annual Subscription Fee Waived		
Behavioral	Contribution of the Behavioral Health				
Health	Attribution File (BHAPL) as described in the				
Attribution File   Contribution	BHAPPL File specification as set forth in Exhibit B.	NA	Annual Subscription Fee Waived	
Yes	

Section 3
CliniSync Participant Agreement Terms and Conditions

1.	IMPLEMENTATION.

1.1.	Timeline. Participant and CliniSync staff will identify a mutually agreeable timeline that includes but is not limited to the following:

a.	After the Participant signs the Physician Participant Agreement, Participant will be required to complete a Project Scope Document.

1.	This Project Scope Document will include a filtering statement and an integration statement as an attachment that also must be completed.

2.	The Project Scope Document is only required for Participants who select Results/Report Delivery.

3.	Upon submission of the Project Scope Document, the participant will schedule the Live Date
within 30 days after Data is available to Participant.

b.	Any changes to the Project Scope Document will be reviewed by CliniSync staff and acceptable changes will be made within 30 days. CliniSync will only accept changes from the person identified in the Project Scope Document as the Site Administrator.

c.	Participant will review the CliniSync Policy Manual and privacy documents and discuss any questions with a representative from CliniSync.

d.	All of the above will be completed prior to the Live Date.

1.2.	Training. Subject to the terms of this Agreement and the services selected in Sections 1 and 2, Company will provide Participant and the Authorized Users with training regarding the use of CliniSync and the Services. Company shall not be responsible for providing training on health information technology generally (e.g., HL7 issues).

1.3.	Maintenance and Support. Subject to the terms of this Agreement, Company will maintain and service the functionality of CliniSync.

2.	CLINISYNC ACCESS AND USE.

2.1.	CliniSync Services. Company will provide Participant access to CliniSync and the Services. Participant acknowledges that Company will provide Services through its Technology Vendor. Participant will comply with all policies contained in the CliniSync Policy Manual.

2.2.	
Page7

Access and Use. Following the Live Date and during the term of this Agreement, Company will provide Participant with a nonexclusive, nontransferable, and non-sublicensable right to access and use CliniSync and the Services provided through CliniSync solely as expressly set forth in this Agreement. Participant understands and acknowledges that each Authorized User who intends to access and use a particular CliniSync product or service will be required to agree to a User Acknowledgement prior to such initial access and use. Participant and Authorized Users shall have no rights to use the Licensed Software outside the terms of this Agreement.
1.1.	
2.3.	Permitted and Prohibited Uses.

a.	Permitted Uses. Participant will use CliniSync and the Licensed Software exclusively for authorized purposes, which are limited to access and use of Data for Participant’s treatment of its patients, and for payment for Participant’s health care services and for the limited health care operations as described in paragraphs 1 and 2 of the definition of health care operations in 45 CFR 164.501, as permitted by Laws. All such permitted uses shall be consistent with this Agreement, all applicable Laws, regulations and rights of others, and the Policies and Procedures.

b.	Duty to Keep Confidential CliniSync Technical Information. Except as required by Laws, Participant will keep confidential and not disclose to any third parties, and will ensure that its Authorized Users keep confidential and do not disclose to any third parties, user identifications, account numbers, account profiles, used in connection with or gathered or processed by CliniSync or the Licensed Software.

c.	Prohibition on Use of CliniSync for Marketing or Other Promotional Purposes. Participant shall not use CliniSync, the Licensed Software, or any Data received through CliniSync, for marketing, advertising, or other promotion of Participant’s business.

2.4.	Additional Restrictions.

a.	Participant will not, and will not permit any Authorized User or third party to: (1) copy, alter, modify, reverse engineer, decompile, disassemble, lend or rent CliniSync or the Licensed Software, or otherwise attempt to derive the method of operation of CliniSync or the Licensed Software; (2) interfere in any manner with the hosting of CliniSync or the Licensed Software; (3) use CliniSync or the Licensed Software for other than Participant’s own business purposes; (4) use CliniSync or the Licensed Software for purposes of providing outsourcing, service bureau, time sharing, rental, hosting, application service provider or online services to third-parties, or otherwise make access to CliniSync or the Licensed Software available to any third-party not related to or affiliated with Participant; or (5) use CliniSync or the Licensed Software for any purpose that is illegal in any way, or that advocates illegal activity.

b.	Participant will keep intact and will not alter, obscure or remove any notices or legends provided on or in connection with CliniSync or the Licensed Software.

c.	Participant shall not provision universal access to CliniSync to all of its affiliated locations absent written consent from Company. Participant may provision access to those locations wholly owned by Participant. Participant shall provide Company with a list of all locations which are provisioned access to CliniSync. As necessitated by additions and deletions of locations, Participant shall provide updates to such list to Company.

2.5.	Service Levels. If CliniSync or any Services provided through CliniSync fail to meet Company’s then-current Service Levels, Company will re-perform the affected Services or refund to Participant any Fees paid by Participant for those Services. The foregoing will be Participant’s sole remedy, and Company’s sole obligation, for any failure to meet Company’s then-current Service Levels.

3.	ADDITIONAL SERVICES.

3.1.	
Page8

Additional Services. Any Additional Services requested by Participant with respect to CliniSync or otherwise under this Agreement will be provided subject to mutually agreed to Project Scope Document entered into by the parties under this Agreement and incorporated into this Agreement.
1.1.	
3.2.	Additional Service Training. Subject to the terms of this Agreement, Company will provide Participant and the Authorized Users with training regarding the use of CliniSync and the Services selected in Section 1 and Section 2. Company shall not be responsible for providing training on health information technology generally (e.g., HL7 issues).

3.3.	Other Services. Any other additional services not described in the Project Scope Document and requested by Participant with respect to CliniSync or otherwise under this Agreement will be provided subject to mutually agreed to future statements of work entered into by the parties under this Agreement.

4.	PARTICIPANT OBLIGATIONS. Participant will provide the resources and perform the obligations set forth in Section 1 and Section 2 to assist Company in performing the Implementation and providing the Services under this Agreement, in compliance with all Laws, the Policies and Procedures and requirements of any federal or state grants received by Company applicable to Participant, all of which are available on Company’s website. Company will not be responsible for any delay in performing or failure to perform any Services or other obligations due to any failure by Participant to provide the resources or perform the obligations set forth in Section 1 and Section 2, or to otherwise provide reasonable cooperation and assistance to Company. Participant will execute such further agreements or documents as may reasonably be required for Company to exchange Data through the eHealth Exchange or other regional or national electronic health information exchanges.

4.1.	Additional Participant Obligations.

a.	Participant will take responsibility for its own and affiliated third party’s roles, responsibilities and tasks necessary to complete this project.

b.	Participant will provide the implementation and support resources for the duration of the project.

c.	Participant will review the CliniSync Project Timeline mutually developed by the parties and approved by Company and provide an acceptable response within a timeframe of five (5) business days and prior to commencement of any task identified in that phase.

d.	In the event changes in scope are requested by Participant, which results in either delay in acceptance or, in Company’s estimated work or software/hardware requirements, Participant and Company shall negotiate in good faith to establish an alternate budget or deliverables or an alternate schedule.

e.	Participant will provide access to all implementation and support resources identified above as necessary.

f.	Primary Contact. Participant will designate a person (“Primary Contact”) to whom all CliniSync communications may be addressed and who has the authority to act on all aspects of the services. The Primary Contact is responsible for ensuring understanding of their responsibilities. The Primary Contact will also coordinate participant participation and ensure timely management decisions are made.

g.	Site Administrator. Participant will designate a person (“Site Administrator”) who shall have the following responsibilities:

1.	The Site Administrator is responsible for ensuring understanding of his or her responsibilities.

2.	
Page9

The Site Administrator shall perform duties related to authentication, determine appropriate access requirements, and notify CliniSync in instances of improper use as defined by CliniSync policy.
1.	
3.	The Site Administrator’s identity must be verified in accordance with the Company’s Identity Proofing Procedure. The Site Administrator will then be authorized to provision access to those within their organization in accordance to the minimum necessary requirement as defined by HIPAA in the same HIPAA-compliant manner used when issuing other credentials to conduct their organization’s business.

5.	AUTHORIZED USERS AND ACCOUNTS.

5.1.	Authorized Users. All access to and use of CliniSync will be restricted to Authorized Users of Participant as permitted under this Agreement and applicable Policies and Procedures and Laws. Participant is solely responsible for all use of CliniSync by each Authorized User and for compliance by each Authorized User with the applicable terms of this Agreement, the Policies and Procedures, and any additional terms of use applicable to CliniSync or other Services.

5.2.	User Accounts. Access to CliniSync by Participant will be provided through Authorized User Accounts established on CliniSync. Participant will provide all information requested by Company in connection with the establishment of each Account and will be responsible for validating and assuring the accuracy and completeness of this information. Each Account will be assigned to a single Authorized User. Each Authorized User will complete all training regarding the use of CliniSync required by Company and Participant will certify that each Authorized User has completed all such training. Company will establish a process to enable Participant’s Authorized Users to create a unique Account ID and password for each Account. Each Account ID may be used only by the Authorized User of the applicable Account. Participant is fully responsible for liabilities and damages incurred through use of each Account ID (whether lawful or unlawful) and any activity completed through any Account will be deemed to have been completed by Participant. Participant will ensure the security and confidentiality of each Account ID and will notify Company immediately if any Account ID is lost, stolen, or otherwise compromised. Participant is responsible for initiating, updating, removing or suspending access of its Authorized Users to CliniSync as set forth in the applicable Policies and Procedures and in this Agreement. Participant will notify Company of any changes in access to CliniSync by Authorized Users as set forth in the applicable Policies and Procedures. Company will not be liable for any failure by Participant to fulfill these obligations.

5.3.	Participant Responsibilities.

a.	Participant will immediately notify Company upon becoming aware of any failure by any Authorized User to comply with this Agreement, the Policies and Procedures, or any additional terms of use applicable to CliniSync or other Services, and will assist Company in ensuring this Agreement, the Policies and Procedures, and any additional terms of use are followed by each Authorized User.

b.	Participant will be solely responsible, at Participant’s own expense, for acquiring, installing and maintaining all hardware, software and other equipment as may be necessary for Participant and each Authorized User to connect to, access, or use CliniSync or any other Services. Participant will be solely liable for any failure in its hardware, software, and other equipment, including any such failure resulting in Participant’s breach of this Agreement or violation of Laws, except where that failure was due to a qualifying event under the terms of Force Majeure as defined in Section 18.1 below. Participant will be solely liable for any failure in its hardware, software and other equipment, resulting in Participant’s violation of Laws.

6.	DATA.

6.1.	
Page10

Data from Other Participants. The Data does not originate from Company. CliniSync will deliver, make available, and enable Participant’s access to Data as described further in the Services. Participant acknowledges and agrees that such Data is “as-is” and “as-available” and Company does not monitor the specific content or nature of any Data and is under no obligation to review any Data. Company’s sole obligation with respect to Data is to deliver, make available, or otherwise process Data, as further described in the Services, using Data provided to it by participants. Without limiting any other provision of this Agreement, except as expressly stated in Section 13, Company will have no responsibility
1.1.	
for or liability related to the accuracy, currency, completeness, content, or delivery of any Data provided, accessed, or made available through CliniSync.

6.2.	Participant Data. As between Company and Participant, Participant is solely responsible for Participant Data. Participant will not knowingly provide or make available any Participant Data in violation of any Laws, or the Policies and Procedures, or that: (a) is an infringement, misappropriation or violation of any intellectual property rights, publicity/privacy rights, or other rights of any third party; (b) is illegal in any way or that advocates illegal activity; (c) contains any viruses or is intended to damage, surreptitiously intercept, or expropriate CliniSync or any other system, data, or information; or (d) is false, misleading, inaccurate, untruthful, incomplete, or not current, or is not an accurate representation of the information available by or on behalf of Participant. Participant has sufficient rights to grant Company the rights necessary for Company to provide and make available the Participant Data through CliniSync or the other Services and to otherwise utilize the Participant Data as contemplated by this Agreement. By providing or uploading any Participant Data through CliniSync or other Services, subject to the terms of this Agreement and solely for purposes of establishing, operating, and managing CliniSync and other Services and complying with and exercising rights under applicable Laws, the Policies and Procedures and this Agreement, Participant grants Company a nonexclusive, royalty-free, fully-paid, perpetual, and fully sublicensable right and license to use, copy, store, reproduce, standardize, normalize, update, analyze, display, and provide the Participant Data, and all other data or information generated or derived from the Participant Data through the operation of CliniSync, eHealth Exchange or any other Services, in any form or format in accordance with the terms and conditions of this Agreement. Participant expressly consents to the use and disclosure of the Participant Data by Company as necessary for Company to operate CliniSync and provide the Services and/or otherwise permit participants to access Participant Data through CliniSync or the eHealth Exchange and to use such Participant Data under this Agreement and in accordance with the applicable Policies and Procedures, which shall include Participant’s access of Participant Data for the treatment of Participant’s own patients and payment for Participant’s health care services and other purposes permitted or required by Laws. Any disclosure by Company of any Participant Data outside of the operation of CliniSync or performance of the Services will be limited to aggregated Data, de-identified in compliance with HIPAA, except where required by applicable Laws. With respect to any such aggregated Data generated from Participant Data, Company shall not, without the express prior written consent of Participant, disclose to any third party, Participant as the source of the Participant Data contained in the aggregated Data, or include such identities within such aggregated Data. Each party agrees to notify the other party upon becoming aware of any failure or alleged failure by a party to comply with this Section 6. Company agrees to provide Participant with an audit report of other participants in CliniSync who accessed Participant Data for purposes other than as permitted by this Agreement which was reported to Company by other participants so that Participant can make notifications required under any applicable Laws.

7.	OWNERSHIP.

7.1.	Participant Data. As between Company and Participant, Participant will retain all ownership, right, title, and interest in and to all Participant Data. Participant grants Company a royalty-free, perpetual, non-exclusive license to use Participant Data provided to Company in its de-identified form for quality improvement purposes, grant requirements, public health purposes, and other uses required or permitted by Laws.

7.2.	Technology. As between Company and Participant, CliniSync and all Technology are and will remain the property of Company or its vendors, contractors and agents. Company reserves all rights in and to the Technology and CliniSync and other services not expressly granted or provided to Participant under this Agreement.

8.	
Page11

REPORTING AND AUDITS. Company will provide to Participant the standard reports and summaries available through CliniSync regarding the operation of CliniSync by Authorized Users and the Participant Data. Any audit or evaluation of CliniSync or other Services will be solely as provided for and in accordance with the applicable Policies and Procedures or Laws.
1.	
9.	TERM, TERMINATION AND SUSPENSION.

9.1.	Term. This Agreement will commence on the Effective Date. Unless earlier terminated as set forth below, this Agreement will continue for an initial term of two (2) years from the Live Date (“Initial Term”) and will renew automatically thereafter for successive one (1) year additional terms.

9.2.	Termination. This Agreement may be terminated as follows:

a.	By either party if the other party materially breaches any provision of this Agreement and fails to cure the breach within thirty (30) days after receiving notice thereof from the non-breaching party;

b.	By either party following the end of the Initial Term, for any reason or no reason upon written notice to the other party at least ninety (90) days prior to the expiration of the then-current term;

c.	By Participant upon written notice to Company if Participant is unable or unwilling to comply with or implement a change in the Policies and Procedures, or introduction of a new service or upgrade or improvement to CliniSync, as provided in Section 16.2. Such termination shall be effective on the effective date of the change in Policies and Procedures and Participant shall pay all fees incurred through the effective date of the change in Policies and Procedures.

d.	By Company if as a result of an audit performed in accordance with the Policies and Procedures it is discovered that a Participant has used the CliniSync system for uses other than permitted by this Agreement, the Policies and Procedures, or Applicable Laws. Company will follow the Breach Policy as identified in the Policies and Procedures which may result in immediate termination.

e.	Immediately, by Company, if Company’s agreement with Technology Vendor terminates for any reason.

9.3.	Suspension. Effective upon Company's notice to Participant, Company may temporarily suspend Participant's or any Authorized Users' access to CliniSync, or to any portion of CliniSync, for up to fourteen (14) business days for Company to investigate any potential breach of this Agreement; provided, however, that the requirement of notice shall be deemed waived in the case of a potential breach involving security, privacy, or damage or harm to Company, CliniSync or any other CliniSync participant or user. Company shall not temporarily suspend access to all or any portion of CliniSync unless Company has a bona fide, good faith belief that a potential breach of this Agreement has occurred, and Company shall reasonably limit such suspension  to  only  those  portions  of  CliniSync  necessary  to  investigate  the  potential  breach. Company shall exercise commercially reasonable efforts to investigate any such potential breach in a timely manner and to limit the extent and duration of any suspension in a reasonable effort to minimize inconvenience to Participant or any Authorized User arising from the suspension. If Company suspends access to a portion of CliniSync and Participant remains able to access any part of CliniSync, Participant shall remain obligated to pay all Fees set forth in Sections 1 and 2 and any future Addendum entered into by Company and Participant. If Company suspends Participant's access to CliniSync altogether, such that Participant is unable to access or use any portion of CliniSync whatsoever during the suspension period, and any investigation reveals no actual breach of this Agreement, Company will refund Participant any portion of monthly fees paid by Participant for the period of such suspension.

9.4.	Effect of Termination. Termination or expiration of this Agreement will not relieve either party of any rights or obligations accruing prior to such termination under this Agreement. Upon any termination or expiration of this Agreement:
(a)	
Page12

Participant will cease using CliniSync and any other Services; (b) Company will cease providing access to CliniSync and performing any other Services; and (c) all Fees owed to Company under this Agreement for Services rendered through the date of the termination or expiration or due to such termination will be immediately due and payable by Participant to Company (including, at minimum, the Fees due under this Agreement prorated based on Services performed by Company prior to termination). Unless termination is due to Company’s breach, Participant shall not be entitled to a refund of prepaid Fees as the result of termination of this Agreement. Sections 2.4, 6, 7, 9.4, 12, 13, 14, 15, 16, and 18 will survive termination or
(a)	
expiration of this Agreement for any reason. In addition, any applicable obligations under any Business Associate Agreement will survive termination or expiration of this Agreement for any reason.

10.	FEES AND PAYMENT; TAXES. The fee structure for the Services available under this Agreement is as set forth in Section 1 and Section 2 (if Additional Services are selected). Participant will pay Company all Fees when due in advance, as reflected in Section 1 and Section 2. All Fees will be paid in U.S. dollars and are non-refundable once paid, unless otherwise provided for in Section 9. Except if the parties agree otherwise, all payments are due within thirty (30) days after the invoice date. Payments by mail should be addressed to the Ohio Health Information Partnership, L-3462, Columbus Ohio 43260. After the initial term of this Agreement, Company may increase annual fees (if any) by up to three percent (3%) per year. If Participant fails to pay any Fees due within thirty (30) days after the invoice date, any amounts not paid will bear interest from the original due date until paid at the lesser of 1.5% per month or the highest rate allowed by applicable law, together with collection costs, including attorneys’ fees, incurred in enforcing this Agreement. All Fees are exclusive of any taxes, and Participant (unless recognized by the applicable taxing authority as exempt from tax) agrees to pay any taxes, whether federal, state or local, or municipal that may be imposed upon or with respect to the Services or otherwise as a result of this Agreement. Participant will be solely responsible for any other charges or expenses of third-party vendors that Participant may incur to access or use CliniSync or any other Services, including, without limitation, Internet access charges, and fees charged by third-party vendors with which Participant has contracted for products and services.

11.	REPRESENTATIONS AND WARRANTIES. Each party represents and warrants to the other party that: (1) the execution and performance of this Agreement has been duly authorized by such Party; (2) this Agreement is a valid and legally binding obligation enforceable against such party in accordance with its terms; and (3) such party will at all times comply with all applicable Laws, the Policies and Procedures, and Grants in the performance of this Agreement. Company represents and warrants to Participant that Company has the right, title and interest necessary to license the Licensed Software to Participant for use as permitted under this Agreement. In addition to any representations or warranties granted under this Section 11, to the extent any warranties or other remedies provided to Company by a health information exchange vendor in an agreement with Company are by their terms also enforceable by Participant, Company will extend the benefits of those warranties or other remedies to Participant where legally permissible.

12.	DISCLAIMERS. EXCEPT AS EXPRESSLY STATED IN SECTION 11, CLINISYNC AND ALL OTHER SERVICES, INCLUDING, WITHOUT LIMITATION, ANY DATA OR TECHNOLOGY, ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT REPRESENTATIONS OR WARRANTIES OF ANY KIND, AND COMPANY EXPRESSLY DISCLAIMS ALL REPRESENTATIONS, WARRANTIES, OR CONDITIONS REGARDING CLINISYNC AND OTHER SERVICES, INCLUDING, WITHOUT LIMITATION, ALL DATA AND TECHNOLOGY, WHETHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE. IN PARTICULAR, COMPANY DOES NOT WARRANT THAT CLINISYNC OR OTHER SERVICES WILL MEET PARTICIPANT’S EXPECTATIONS OR BE ACCURATE OR ERROR-FREE, UNINTERRUPTED OR OPERATE IN COMBINATION WITH ANY OTHER HARDWARE, SOFTWARE OR SYSTEM. COMPANY WILL NOT BE HELD RESPONSIBLE FOR ANY PROBLEMS WITH CLINISYNC OR OTHER SERVICES ATTRIBUTABLE TO THE INTERNET OR PARTICIPANT’S OR ANY USER’S NETWORK OR ABILITY TO ACCESS THE INTERNET.

13.	ADDITIONAL LIABILITIES.

13.1.	Indemnification. Company agrees to defend, indemnify and hold harmless Participant and its directors, officers, employees, agents, and Authorized Users (collectively, the “Indemnified Parties”), against any third party claims that the Indemnified Parties’ use or possession of the Licensed Software as delivered by Company, infringes any U.S. copyright or

Page13

U.S. patent or misappropriates any trade secret of any third party, and against all damages, awards, and costs (including, but not limited to, legal fees and expenses) awarded against the Indemnified Party in connection with such claims. As a condition of receiving such defense and indemnity, the Indemnified Parties shall promptly notify Company of any claim alleged to be covered by this provision, shall grant Company sole control and authority over the defense and settlement of such claim, and shall provide Company (at Company’s expense) with all requested information and cooperation in such defense and settlement. Company may not settle any claim without Participant’s consent (which shall not be unreasonably withheld or delayed). Participant may retain its own independent counsel to monitor the defense or settlement of the claim,

at Participant’s sole expense. In the event of any claim that is subject to the foregoing indemnity obligations, or if the use of the Licensed Software (or any part thereof) is or in Company’s opinion may be enjoined, Company may either (i) modify or replace the affected software while providing equivalent functionality, performance and operation, or (ii) obtain all necessary licenses and rights for Participant to continue to use the affected software as contemplated under this Agreement. If Company is unable to accomplish any of the foregoing within a reasonable period of time, then Company may require Participant to cease using the Licensed Software and terminate this Agreement upon which Company shall refund to Participant any unamortized annual fees paid to Company in advance, amortized on a monthly basis. THE PROVISIONS OF THIS SECTION ARE THE INDEMNIFIED PARTIES’ SOLE AND EXCLUSIVE REMEDY, AND COMPANY’S SOLE AND EXCLUSIVE OBLIGATION TO THE INDEMNIFIED PARTIES AND ANY OTHER PERSON INDEMNIFIED HEREUNDER, WITH RESPECT TO INFRINGEMENT
OR MISAPPROPRIATION OF THIRD-PARTY INTELLECTUAL PROPERTY RIGHTS. Furthermore, Participant agrees that in no event will Company have any liability under this Section to the extent any infringement claim is based on: (i) the use of any Licensed Software in combination with any hardware, software, systems, or other elements not supplied or approved for use by Company (if the claim would have been avoided but for such combination); (ii) any modifications made to the Licensed Software by anyone other than Company; or (iii) any use of the Licensed Software not in accordance with the terms of this Agreement and the Business Associate Agreement.

13.2.	Data.

a.	Company. Company will be responsible for Losses incurred by Participant due to claims or allegations against Participant by third parties relating to errors knowingly or through gross negligence introduced into any Data by Company through the processing of the Data by CliniSync in breach of this Agreement by Company. Notwithstanding the foregoing, Company will have no responsibility or liability with respect to any portion of any such Losses resulting from or due to any other error in the Data, including, without limitation, any error due to or resulting from any act or omission of Participant (or its employees, agents or subcontractors), any Authorized User, any other participant or user of CliniSync, or any third party to this Agreement.

b.	Participant. Participant will be responsible for all Losses arising out of, or in any way related to, the Participant Data, the use of CliniSync by Participant or any Authorized User, or any actions taken or not taken by Participant or any Authorized User based on the use of CliniSync or any Data obtained through CliniSync, including, without limitation, any actions involving patient care, utilization management or quality management. To the extent permitted by Laws, Participant will indemnify, defend, hold harmless Company and its vendors, grantors, and affiliates, and each of their respective owners, officers, directors, trustees, employees, contractors, agents or representatives, from and against all such Losses. Notwithstanding the foregoing, Participant will have no responsibility or liability with respect to any portion of any such Losses resulting from any act or omission of Company.

c.	Procedures. The party seeking indemnification or defense under Section 13.2 will: (a) give the other party prompt notice of any claim subject to Section 13.2; (b) grant the other party sole control over the defense or settlement of any such claim (provided that the indemnifying or defending party may not enter into any admission of liability or into any settlement without first obtaining the consent of such party), which consent shall not be unreasonably withheld or delayed; and (c) provide the other party with reasonable assistance in the defense or settlement of any claim subject to Section 13.2 at the expense of the other party. This Section 13.2 shall not apply to third party claims against Participant or Participant's Indemnified Parties for infringement arising from Participant's use or possession of CliniSync, which shall be governed by the provisions of Section 13.1 above.

14.	
Page14

LIMITATION OF LIABILITY. IN ADDITION TO ANY OTHER LIMITATIONS OF LIABILITY IN THIS AGREEMENT, EXCEPT FOR ANY LIABILITY ARISING UNDER SECTIONS 6, 13 OR 15, OR UNDER THE BUSINESS ASSOCIATE AGREEMENT, OR OUT OF ANY INFRINGEMENT BY A PARTY OF THE INTELLECTUAL PROPERTY RIGHTS OF THE OTHER PARTY: (1) NEITHER PARTY WILL BE LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT, PUNITIVE OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT UNDER ANY THEORY OF LIABILITY (INCLUDING NEGLIGENCE, ALLEGATIONS OF MEDICAL MALPRACTICE OR
1.	
LIABILITY ARISING OUT OF DELIVERY OF, OR FAILURE TO DELIVER, MEDICAL CARE) AND WHETHER OR NOT SUCH PARTY WAS OR SHOULD HAVE BEEN AWARE OR ADVISED OF THE POSSIBILITY OF SUCH DAMAGE, INCLUDING, WITHOUT LIMITATION, LOST REVENUE OR PROFITS, LOST DATA OR INFORMATION, COSTS OF PROCUREMENT OF SUBSTITUTE SERVICES, OR INJURY TO REPUTATION OR OTHER ECONOMIC ADVANTAGE OR DISADVANTAGE, EVEN IF THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, AND (2) EACH PARTY’S TOTAL CUMULATIVE LIABILITY RELATED TO THIS AGREEMENT WILL NOT EXCEED THE AMOUNTS ACTUALLY PAID TO COMPANY BY PARTICIPANT UNDER THIS AGREEMENT UP TO THE DATE OF THE EVENTS GIVING RISE TO ANY SUCH LIABILITY. THE FOREGOING LIMITATIONS OF LIABILITY ARE INTENDED TO APPLY ONLY TO THE PARTIES TO THIS AGREEMENT AND EACH PARTY EXPRESSLY RETAINS ANY REMEDIES IT MAY HAVE UNDER THIS AGREEMENT OR UNDER APPLICABLE LAW WITH RESPECT TO ANY THIRD PARTY.

15.	CONFIDENTIALITY, PRIVACY, AND SECURITY.

15.1.	Applicable Laws. Company and Participant will comply with the requirements of all applicable Laws relating to the confidentiality, privacy, security, or other access or use of CliniSync or any Data.

15.2.	Additional Requirements. In addition to and without limiting the other requirements of this Section 15:

a.	Patient Information. Regardless of whether Participant or Company is considered a “Covered Entity” under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) or other applicable Laws, Company and Participant will both comply with the requirements under applicable federal Laws for the confidentiality, security, privacy, or other access or use of patient information, including, without limitation, Protected Health Information (“PHI”), as defined in 45 CFR §160.103 as the same may be amended from time to time and including, without limitation, all written or electronic information relating to the diagnosis, treatment, tests, prognosis, admission, discharge, transfer, prescription or claims of any patient, or any other data or information implicitly or explicitly identifying any patient, to whom services are provided by Participant, which information is provided, stored or accessed through CliniSync.

b.	State Laws. Each party will comply with the requirements under the applicable confidentiality and privacy Laws of the State of Ohio, including, without limitation, the following sections of the Laws of the State of Ohio as such may be amended, moved or otherwise enacted to address such matters from time to time: (i) ORC § 3701.17 – concerning the confidentiality of protected health information reported to or obtained by the Ohio Department of Health; (ii) ORC § 3701.243 – concerning the confidentiality of HIV test results or diagnosis; (iii) ORC § 3701.74 – concerning medical records in the care of health care providers; (iv) ORC § 3793.13 – concerning the confidentiality of drug and alcohol abuse records; (v) ORC § 5101.27 – concerning the confidentiality of medical information regarding public assistance recipients; (vi) ORC § 5122.31 – concerning the confidentiality of mental health records; and (vii) OAC 5101:3-26-08.3 – concerning confidentiality of medical information in the custody of a managed care plan.

c.	
Page15

Business Associate Agreement. Regardless of whether Company, Participant or any other participant in CliniSync is a Covered Entity or a Business Associate (as defined under HIPAA, the HITECH Act, or other applicable Laws) for purposes of this Agreement, Company and Participant will comply with the terms of the Business Associate Agreement in the form entered into by Participant and Company as of the date of this Agreement. As necessary to comply with the Laws, the parties agree to enter into amendments of such Business Associate Agreement as necessary to fully comply with such Laws by following the process set forth in Section 16 for amendment of this Agreement. Without limiting any obligation or requirement imposed by the Business Associate Agreement, Company and Participant represent, warrant, and covenant that each party will use and disclose any patient information, including, without limitation, any PHI solely for the purposes of exercising its rights and performing its obligations under this Agreement.
a.	
d.	Confidentiality. Except as and to the extent required by law, neither party will disclose or use, and will direct its representatives not to disclose or use to the detriment of the other party, any Confidential Information (as defined below) furnished, or to be furnished, by a party (the "Disclosing Party") or their respective representatives, to the other party (the "Receiving Party") or its representatives, at any time or in any manner other than in connection with the performance of this Agreement. For purposes of this Section, "Confidential Information" means any information about the Disclosing Party identified in writing or orally as such to the Receiving Party by the Disclosing Party promptly following its disclosure, any proprietary information of the Disclosing Party, or any other information disclosed by a Disclosing Party to the Receiving Party, unless (a) such information is already known to the Receiving Party or its representatives, agents or employees or to others not bound by a duty of confidentiality at the time of its disclosure or such information becomes publicly available through no fault of the Receiving Party or its representatives; (b) the use of such information is necessary or appropriate in making any filing or obtaining any governmental consent or approval required for the performance of this Agreement; or (c) the furnishing or use of such information is required by or necessary or appropriate in connection with legal proceedings. Upon the written request of the Disclosing Party, the Receiving Party will promptly return to the Disclosing Party or destroy any Confidential Information in its possession and certify in writing to the Disclosing Party that it has done so.

16.	AMENDMENTS AND DISPUTE RESOLUTION.

16.1	Amendments to Agreement. Company may amend or change this Agreement as necessary:

a.	To comply with applicable Laws;

b.	To comply with Policies and Procedures; and

c.	In connection with the introduction of a new service or an upgrade or other improvement to CliniSync that affects the Services and/or Participant’s Statement of Work.

Company will exercise commercially reasonable efforts to notify Participant by email of any such changes. Company will generally provide thirty (30) days’ prior notice to Participant of any such amendment or change set forth in this Section 16.1. Company reserves the right to provide notice of fewer than thirty (30) days should circumstances warrant. Changes will be effective thirty (30) days after notice to Participant unless Company and Participant mutually determine otherwise. If Participant is unwilling or unable to comply with or implement any such change, Participant may elect to terminate this Agreement upon written notice to Company as provided in Section 9.2(c). Except as set forth in this Section 16.1, or changes in Fees set forth in Section 10, this Agreement may be amended or changed only by a written amendment signed by the authorized representatives of both parties.

16.2	Policy Changes. Company may change the Policies and Procedures from time to time in its sole discretion. Such changes may reflect the availability of new equipment, technology, systems, functionality, services, changes in Laws, or other circumstances affecting operation of CliniSync. Company may amend or change the Policies and Procedures through a formal policy amendment process determined by Company. Company shall promptly notify Participant of any such changes to the Policies and Procedures.

16.3	
Page16

Dispute Resolution. Any Dispute arising out of or relating to this Agreement will be settled according to the procedure set forth in this Section 16.3. Upon written notice of a Dispute from either party, each party will appoint a senior manager who will meet together for the purpose of resolving the Dispute. If the Dispute continues unresolved after ten (10) business days, then upon the written request of either party, each of the parties will appoint a designated senior business executive who will meet together within ten (10) business days for the purpose of resolving the Dispute. During the thirty (30) day period following such initial meeting (or such other period as the parties may agree in writing), the designated executives will meet as often as the parties reasonably deem necessary in order to negotiate in good faith in an effort to resolve the Dispute without the necessity of any formal proceeding relating thereto. Notwithstanding any other provision of this
16.1	
Agreement, if a Dispute is not resolved by the parties within ninety (90) days after the issuance of written notice under this provision, either party may take any available action in law or in equity. Nothing in this provision will prevent a party from seeking a restraining order, injunction or other equitable relief before commencing or during the foregoing informal dispute resolution processes. Each party will bear its own costs and expenses, and an equal share of the administrative fees of the dispute resolution. Any of the timeframes set forth in this Section 16.3 may be extended by mutual agreement of the parties.

16.4	Changes in Law. If either party determines in good faith that any law, regulation, ordinance or order having the Force of Law is enacted, promulgated, abrogated or changed (which shall be deemed to include any change in interpretation or application by the competent authorities) that subsequently affects a party’s obligations under this Agreement, then such party may notify the other party in writing of the change in law and the parties shall consider modifying this Agreement in good faith to comply with the change in law for a period of up to thirty (30) days. If the parties cannot mutually agree upon a modification to this Agreement to comply with the change within the thirty (30) day period, then either party may terminate this Agreement by providing written notice to the other party.

17.	INSURANCE. The parties acknowledge that it is recommended that Company and Participant will each purchase and maintain technology and information errors and omissions/data breach liability insurance coverage and such professional and general liability insurance coverage or such other insurance coverage or self-insurance as such party deems reasonable to insure itself and its officers, directors, and employees against any third party claim or cause of action arising out of its performance under this Agreement. If such recommended insurance is purchased and this Agreement is terminated for any reason, it is recommended that the party either maintain the insurance coverage recommended under this Section 17 for a period of not less than three (3) years, or provide an equivalent extended reporting endorsement (“tail policy”). Each party will provide proof of recommended insurance coverage to the other party if purchased. The insurance coverage recommended under this Agreement may be provided through one or more commercial insurance policies, through a reasonably acceptable self-insurance program, or through a combination of commercial and self-insurance programs. Notwithstanding the foregoing, if a Participant is the State of Ohio or a political subdivision, which operates a hospital, and is therefore covered under the provisions of Ohio law affecting its liability and immunity for claims by private parties, Participant will be deemed self-insured and exempt from the provisions of this Section 17; provided, however, that if Participant generally carries general or other business liability insurance notwithstanding its operation by the State of Ohio or a political subdivision, Participant should obtain and maintain insurance consistent with the recommendations of this Section 17. The liability, if any, of Participant for damages, losses, or costs arising out of or related to acts performed by Participant pursuant to this Agreement, will be governed by the provisions of Ohio law, as applicable, as now or hereafter amended, and no provision of this Agreement, will be deemed a waiver, express or implied, of any of the immunities, rights, benefits, or protections of any applicable provisions of Ohio law that may apply to Participant.

18.	ADDITIONAL PROVISIONS.

18.1	Force Majeure. Neither Party shall be liable to the other for damages in the event of any loss, damage, claim, delay or default (other than a failure to pay money when due) arising by reason of Acts of God (including storm, fire, flood, earthquake, etc.), labor disturbance (including strikes, boycotts, lockouts, etc.), war, civil commotion, or other cause beyond the reasonable control of the Party sought to be charged i.e., if the failure could not have been prevented by reasonable precautions and cannot reasonably be circumvented by such Party through use of alternate sources, workarounds, plans or other means) (each of the foregoing, a “Force Majeure” event). The Party claiming the Force Majeure event (“Claiming Party”) shall provide prompt written notice to the other Party of such event. In such event, the Claiming Party shall perform its obligations hereunder within a reasonable time after the cause of the failure has been remedied, and the other Party shall be obligated to accept such delayed performance. Notwithstanding any of the foregoing, if the Force Majeure event continues for more than thirty (30) days, then the other Party may, upon written notice to the Claiming Party, terminate this Agreement.

18.2	
Page17

Change of Control or Change in Facilities/Locations. Each party will notify the other party of any change of control of such party’s stock, members, substantial assets, or business (whether by way of merger, sale of substantially all assets, sale of a member or of stock, or otherwise) or change in facilities or locations, occurring at any time during this Agreement. At any time within thirty (30) days following such notice to the other party, if such change of control or change
18.1	
of facilities or locations occurs or any other change affecting the material terms of the Project Scope Document, the parties will develop a new mutually agreed Project Scope Document. The parties mutually acknowledge and agree the Fees due under this Agreement will change accordingly. Subject to the foregoing, either party may assign its rights or delegate its duties hereunder without the consent of the other party, provided that the assignee or transferee assumes all obligations of such party under this Agreement and further provided that such assigning party provides written notice of assignment to the other party. Any assignment or delegation in violation of this Agreement will be null and void.

18.3	Injunctive Relief. Each party acknowledges that any breach of the promises or agreements contained in this Agreement may result in irreparable and continuing damage to the other party for which there may be no adequate remedy at law, and the other party may seek injunctive relief as well as such other and further equitable relief as may be appropriate.

18.4	Choice of Law and Venue. This Agreement will be governed by the Laws of the State of Ohio without regard to the conflicts of law principles thereof. Any action or proceeding arising from or relating to this Agreement must be brought exclusively in a state or federal court in Franklin County, Ohio, and each party irrevocably submits to the exclusive jurisdiction and venue of such courts. Each party agrees that it will only bring any action or proceeding arising from or relating to this Agreement in a federal court in Ohio or in state court in Franklin County, Ohio.

18.5	Independent Contractors. The relationship between Company and Participant is that of independent contractors. This Agreement will not create any agency, joint venture, or partnership relationship between the parties. Company may provide the Services through its own employees or through independent contractors, as determined solely by Company in its reasonable discretion.

18.6	Notices. Any and all notices required or permitted under this Agreement must be in writing and sent by United States mail, electronic mail with written acknowledgement of receipt, overnight delivery service, or facsimile transmission to the addresses for each party provided above or such different addresses as a party may later designate in writing.

18.7	Waiver. No waiver by either party of any breach of this Agreement will be a waiver of any preceding or succeeding breach. No waiver by either party of any right under this Agreement will be construed as a waiver of any other right.

18.8	Severability. If any provision of this Agreement will prove to be invalid, void, or illegal, such provision will in no way affect, impair, or invalidate any other provision of this Agreement, and such other provisions will remain in full force and effect.

18.9	Use of Name. Except as specifically permitted in this Agreement or as required by applicable Law, neither party will use the names or trademarks of the other party in any advertising, publicity, endorsement, or promotion without the prior written consent of the other party, except for purposes of community planning, provider engagement, public notice of HIE participation, advisory committee activities, grant preparation or submission, or as otherwise permitted under applicable Law.

18.10	Compliance with Laws and Policies. The Agreement and the rights and obligations of the parties hereunder are made subject to, and each party will at all times comply with all applicable: (a) Laws and (b) the Policies and Procedures, as amended pursuant to Section 16.2.

18.11	Third-Party Beneficiaries. There shall be no third-party beneficiaries of any Participation Agreement.

18.12	
Page18

Entire Agreement. This Agreement, the Project Scope Document, when executed, and the Policies and Procedures constitute the entire understanding between the parties with respect to the subject matter of this Agreement.

[End of Terms and Conditions]

Section 4
Defined Terms

“Account” is a unique account established by CliniSync to provide each Authorized User with access to CliniSync.

“Account ID” is the unique user identification number for each Account.

“Additional Services” are those services described in Section 2 and requested by Participant with respect to CliniSync under this Agreement.
“Authorized User” includes any employee, contractor or medical staff member of Participant or of any of its affiliates authorized by Participant to access and use CliniSync under this Agreement.
“CliniSync Project Implementation Timeline” is the timeline mutually agreed upon by Participant and Company that establishes timeframes for Implementation and that includes, at a minimum, the Project Scope Document Submission, Training and the Live Date. This is included as part of the Project Scope Document.
“Project Scope Document” includes user and filtering information for the delivery of reports and results to a practice. “Data” is data or information provided, accessed, made available, or otherwise processed through or by CliniSync. “Dispute” is any controversy, dispute, or disagreement arising out of or relating to this Agreement.
“Effective Date” is the date that both Company and Participant sign this Agreement as recorded by Company on page 1.

“Fees” means all monthly charges identified in Section 1 and any additional charges, including any charges identified in Section 2, CliniSync Additional Services.
“Grants” includes all grants under which the Company has received funding, including but not limited to the State Health Information Exchange Cooperative Agreement Program and the Health Information Technology Extension Program funded by the Office of the National Coordinator for Health Information Technology.
“Implementation” means the entire process of Participant preparing for and receiving access to CliniSync.

“Laws” includes federal and state laws, statutes, ordinances, regulations, rules, codes, treaties, directives, standards, or other legal requirements.
“Licensed Software” means the computer programs and software code, which may include: (a) software components, developed, owned, and provided by Technology Vendor, for use of the Participant for the duration of the Agreement; and
(b)	any modifications, revisions, corrections, enhancements, new releases or replacements for all of the foregoing items.

“Live Date” is the date the Participant attests to completion of Implementation.

“Losses” includes all losses, liabilities, damages, claims, allegations, demands, causes of action, costs, or expenses (including reasonable attorneys’ fees).
“Participant Data” includes all Data regarding, provided, or made available by or on behalf of Participant or any Authorized User.
“Policies and Procedures” includes policies and procedures referenced in the Terms and Conditions, including but not limited to, items referenced as being provided by Company to Participant.

Page19

“Service Levels” means service levels for the operation of CliniSync as set forth in the Company Remote Hosting Services Levels available as part of the Project Scope Document.
“Services” are the particular menu of CliniSync services in Section 1 provided under this Agreement.

“Technology” includes all software, hardware and other technology used by or on behalf of Company or any third-party vendor of Company to provide CliniSync or other Services.

Page20

“Technology Vendor” is Company’s contracted health information exchange vendor.

Section 5
Business Associate Agreement
THIS ADDENDUM supplements and is made a part of the Participant Agreement (hereinafter the “Underlying Agreement”) entered into by and between the Ohio Health Information Partnership, Inc. (“Company”), and 	(“the Participant”). The Underlying Agreement establishes the terms of the relationship between Company and the Participant.
Whereas, Company and the Participant are parties to the Underlying Agreement pursuant to which Company provides certain Health Information Exchange (“HIE”) services to the Participant and, in connection with the provision of those services, the Participant discloses to Company certain Protected Health Information (“PHI”, as defined in 45 C.F.R. §160.103) that is subject to protection under the Health Insurance Portability and Accountability Act of 1996 and any subsequent amendments or supplements thereto, including but not limited to the provisions of the Health Information Technology for Economic and Clinical Health (“HITECH”) Act (collectively, “HIPAA”);
Whereas, the Participant is a “Covered Entity” as that term is defined in the HIPAA implementing regulations, 45 C.F.R. Part 160 and Part 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Part 164, Subpart C, the Security Standards for the Protection of Electronic Protected Health Information (“Security Rule”);
Whereas, Company, as a recipient of PHI from the Participant, is a “Business Associate” as that term is defined in the Privacy Rule;
Whereas, pursuant to the Privacy Rule and the Security Rule, all Business Associates of Covered Entities must agree in writing to certain mandatory provisions regarding the Use and Disclosure of PHI; and
Whereas, the purpose of this Addendum is to comply with the requirements of the Privacy Rule and the Security Rule, including, but not limited to, the Business Associate contract requirements at 45 C.F.R.
§§164.314(a), 164.502(e), §164.504(e), and as may be amended.

NOW, THEREFORE in consideration of the mutual promises and covenants contained herein, the parties agree as follows:
1.	Definitions. Unless otherwise provided in this Addendum, capitalized terms have the same meanings as set forth in the Privacy Rule or the Security Rule.
2.	Scope of Use and Disclosure by Company of Protected Health Information
a.	Company shall be permitted to Use and Disclose PHI that is disclosed to it by the Participant as necessary to perform its obligations under the Underlying Agreement. Company may Use or Disclose PHI only as permitted or required by this Addendum or as Required by Law. Company may not Use or Disclose PHI in a manner that would violate the Privacy or Security Rule, if done by Participant, except for the purposes specified under Sections 4(b) or 4(c) below as permitted.
b.	Unless otherwise limited herein, in addition to any other Uses and/or Disclosures permitted or authorized by this Addendum or Required by Law, Company may:
i.	Use the PHI in its possession for its proper management and administration and to fulfill any legal responsibilities of Company; and
ii.	
Page21

Disclose the PHI in its possession to a third party for the purpose of Company’s proper management and administration or to fulfill any legal responsibilities of Company; provided, however, that the Disclosures are Required by Law or Company has received from the third party written assurances that (a) the information will be held confidentially and used or further Disclosed only as Required by Law or for the purposes for which it was Disclosed to the third
i.	
party; and (b) the third party will notify Company of any instances of which it becomes aware in which the confidentiality of the information has been breached.
c.	Except as permitted by Participant in writing including but not limited to the Underlying Agreement, Company shall not use PHI for “data aggregation” as defined in 45 CFR 164.501. Company may combine PHI from Participant with PHI from other CliniSync Participants to provide health information exchange services contemplated in the Underlying Agreement.
d.	Except as permitted by Participant in writing including but not limited to the Underlying Agreement, Company may not de-identify any and all PHI created or received by Company under this Addendum.
e.	Company acknowledges that it may not sell PHI, except if provided an authorization from Participant pursuant to and in compliance with 45 C.F.R. 164.508(a)(4).
f.	Company is required to Disclose PHI:
i.	When required by HHS under the provisions of HIPAA to investigate or determine Company’s compliance with HIPAA.
ii.	To the Participant to allow Participant to meet its requirements to satisfy an individual's request for an electronic copy of PHI, as described in Section 3(f).
g.	When Using or Disclosing PHI or when requesting PHI, Company must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the Use, Disclosure, or request, pursuant to and subject to the exceptions provided in 45 C.F.R. 164.502(b).
3.	Obligations of Company. In connection with its Use and Disclosure of PHI, Company agrees that it will:
a.	Use or further Disclose PHI only as permitted or required by this Addendum or as Required by Law.
b.	Use reasonable and appropriate safeguards to prevent Use or Disclosure of PHI other than as provided for by this Addendum, and comply, where applicable, with the security standards in 45
C.F.R. Part 164, Subpart C, with respect to electronic PHI.
c.	Report to the Participant any Use or Disclosure of PHI not provided for by this Addendum of which Company becomes aware, including breaches of unsecured PHI as described in Section 4(b).
d.	Require subcontractors that create, receive, maintain or transmit PHI on behalf of Company to agree to the same restrictions and conditions that apply to Company pursuant to this Addendum, and document such requirements by entering into a business associate agreement with all subcontractor business associates as provided in 45 C.F.R. 164.504(e)(5).
e.	Within fifteen (15) days of receiving a request from the Participant, make available the information necessary for the Participant to make an accounting of Disclosures of PHI about an individual. In the event an Individual contacts Company directly requesting an accounting of disclosures of PHI, Company will not provide an accounting to the Individual but shall promptly forward such request to Participant.
f.	Within ten (10) days of receiving a written request from the Participant, make available PHI necessary for the Participant to respond to Individuals’ requests for access to PHI about them in the event that the PHI in Company's possession constitutes a Designated Record Set. In the event an Individual contacts Company directly about access to PHI, Company will not provide access to the Individual but shall promptly forward such request to Participant.
g.	Within fifteen (15) days of receiving a written request from the Participant incorporate any amendments or corrections to the PHI in accordance with the Privacy Rule in the event that the PHI in Company’s possession constitutes a Designated Record Set. In the event an Individual contacts Company directly about an amendment to PHI, Company will not make any amendments to the Individual’s PHI but shall promptly forward such request to Participant.
h.	
Page22

To the extent Company is to carry out Participant’s obligations under 45 C.F.R. Part 164, Subpart E, comply with privacy standards in 45 C.F.R. Part 164, Subpart E, that apply to Participant in the performance of such obligation.
a.	
i.	Make available to the Secretary of Health and Human Services Company’s internal practices, books and records relating to the Use and Disclosure of PHI for purposes of determining the Participant’s compliance with the Privacy Rule, subject to any applicable legal privileges.
j.	Comply with the security standards in 45 C.F.R. Part 164, Subpart C.
k.	Ensure that any subcontractor that create, receive, maintain or transmit Electronic PHI on behalf of Company agrees to comply with the applicable requirements of the security standards in 45 C.F.R. Part 164, Subpart C, and document such requirements by entering into a business associate agreement with all subcontractor business associates as provided in 45 C.F.R. 164.314(a)(2)(iii).
l.	Promptly report to the Participant any Security Incident with respect to Electronic PHI of which it becomes aware, including breaches of unsecured PHI as described in Section 4(b).
m.	To the extent practicable, mitigate any harmful effect that is known to Company of a Use or Disclosure of PHI by Company in violation of this Addendum.
4.	HITECH Act Obligations
a.	Company shall comply with all requirements of the HITECH Act that apply to business associates.
b.	Company shall require all employees, officers, subcontractors and agents working for Company to report immediately to Company, no later than five (5) business days after discovery, any occurrence, event or fact that could reasonably be considered an indication that a Breach of an Individual’s Protected Health Information has occurred. Upon receipt of a report, Company shall immediately i) notify Participant of the occurrence, event or fact, including the date and time of the discovery and as much information regarding the suspected Breach as is available; and ii) undertake an investigation of whether a Breach did occur, and apprise Participant of the results of the investigation on an ongoing basis. Company shall require its employees, officers, subcontractors and agents to cooperate fully with Participant in providing any additional information requested by Participant in connection with the breach. If Participant determines that a breach has occurred, Company shall, at Company’s cost, take all action, which is reasonably requested by Participant to mitigate the Breach and to prevent further Breaches.
5.	Obligations of the Participant. The Participant agrees that it:
a.	Has included, and will include, in the Participant’s Notice of Privacy Practices required by the Privacy Rule that the Participant may Disclose PHI for Health Care Operations purposes.
b.	Has obtained, and will obtain, from Individuals’ consents, authorizations and other permissions necessary or Required by Laws applicable to the Participant for Company and the Participant to fulfill their obligations under the Underlying Agreement and this Addendum.
c.	Will promptly notify Company in writing of any restrictions on the Use and Disclosure of PHI about Individuals that the Participant has agreed to that may affect Company’s ability to perform its obligations under the Underlying Agreement or this Addendum.
d.	Will promptly notify Company in writing of any changes in, or revocation of, permission by an Individual to Use or Disclose PHI, if such changes or revocation may affect Company's ability to perform its obligations under the Underlying Agreement or this Addendum.
6.	Termination.
a.	Termination for Breach. The Participant may terminate this Addendum if the Participant determines that Company has breached a material term of this Addendum. Alternatively, the Participant may choose to provide Company with notice of the existence of an alleged material breach and afford Company an opportunity to cure the alleged material breach. In the event Company fails to cure the breach to the satisfaction of the Participant, the Participant may immediately thereafter terminate this Addendum.
b.	
Page23

Automatic Termination. This Addendum will automatically terminate upon the termination of the Underlying Agreement.
c.	Effect of Termination.
i.	Termination of this Addendum will result in termination of the Underlying Agreement.
i.	
ii.	
Page24

Upon termination of this Addendum or the Underlying Agreement, Company will return or destroy all PHI received from the Participant or created or received by Company on behalf of the Participant that Company still maintains and retain no copies of such PHI; provided that if such return or destruction is not feasible, Company will extend the protections of this Addendum to the PHI and limit further Uses and Disclosures to those purposes that make the return or destruction of the information infeasible.
7.	Amendment. Company and the Participant agree to take such action as is necessary to amend this Addendum from time to time as is necessary for the Participant to comply with the requirements of the Privacy Rule and the Security Rule.
8.	Survival. The obligations of Company under Section 6(c)(ii) of this Addendum shall survive any termination of this Addendum.
9.	No Third-Party Beneficiaries. Nothing express or implied in this Addendum is intended to confer, nor shall anything herein confer, upon any person other than the parties and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.
10.	Effective Date. This Addendum shall be effective on the date signed.

FOR PARTICIPANT:	FOR COMPANY:
Organization: 		Ohio Health Information Partnership, Inc.
Signed: 	Signed:   	
To electronically sign this contract, please type “/s/” before your name.

Name: 	Name:	 Title: 	Title:	 Date: 	Date:   	

Exhibit B

Behavioral Health Attribution Population List
Specification Version 1.0
Updated September 2024

Page25

1	Overview
This specification is written to describe the Behavioral Health Attribution Population List (BHAPL) intake file requirements. The batch conversion process reads through the BHAPL intake file looking for updates to care records.

2	Data Fields

Field	Required	Description	Notes	
PracticeID	Required	Unique Identifier
for your organization	Site of Care (OID) – assigned by OHIP/CliniSync. The OID will be assigned and provided at the beginning of the project.	
PracticeName	Required	Unique Name
for your organization	Name of Organization	
BatchDate	Required	The Date/Time
the batch file was created	YYYYMMDDHHMM format required	
MedicalRecordNumber	Required	Internal MRN (This is the patient Identifier)	Medical Record Number assigned by Organization.
•	ID must be unique per patient
•	No special characters or spaces permitted
•	It can be alphanumeric but cannot exceed fifty characters; shorter is better.
Sort file by this value, low to high	
LastName	Required	Patient (Legal) Last Name	Use all uppercase	
FirstName	Required	Patient (Legal) First Name	Use all uppercase	
MiddleName	No	Patient (Legal) Middle Name or
Initial	Use all uppercase	
Suffix	No	Patient Name Suffix	Use all uppercase, e.g., JR or III	
DOB	Required	Date of Birth	YYYYMMDD format	
SSN	Required	Social Security Number	999999999 format - leave blank if no SSN or invalid	
Gender	Required	Administrative Gender (Legal Sex)	Must be one of the following:
•	F = Female
•	M = Male
•	U = Undifferentiated	
Address1	Required	Street Address	•	Use all uppercase
Required if patient is not homeless	
Address2	No	Other designation	•	Not used for matching purposes	
City	Required	City	•	Use all uppercase
Required if patient is not homeless	
State	Required	State	•	Two-character state code
•	Required if patient is not homeless	
Zip	Required	Zip or postal code	•	99999 or 999999999 format
•	Required if patient is not homeless	
HomePhone	Required	Patient’s Home Phone Number	•	9999999999 format
Required if patient has a phone	
CellPhone	Conditionally Required	Patient’s Home Phone Number	•	9999999999 format
Required if patient has a phone	
EmailAddress	Conditionally Required	Patients Primary Email Address	•	
Page 26

Required if patient has an email	
Program Service (Original Source Name)	Required	Source Program Service Name	Source Program Service Name 
•	
Page 27

Field	Required	Description	Notes	
If the patient has more
than one Program service, then add that Program Service and Patient information as another record.				
Program Service (Mapped Category)

If the patient has more than one Program service, then add that Program Service and Patient information as another record.	Required	Mapped Program Service Name		Program abbreviation	Expanded information		
				
101	Behavioral Support/ Case Management
- includes CPST, TBS, Case
Management, and Care Coordination		
				102	Outpatient Therapy		
				103	Intensive Outpatient Therapy, IOP		
				
104	Day treatment/Partial Hospitalization Program		
				105	Medical Management		
				106	Residential - QRTP, ICF		
				
107	Mobile Response and Stabilization Services		

108	Home-based Treatment - Includes Intensive Home-Based Therapy (IHBT), Family-focused therapy (FFT), Multisystemic Therapy (MST), Assertive
Community Treatment (ACT)		
				109	OhioRISE CME		
				110	OhioRISE Aetna care coordination		
				
111	Psychiatric Residential Treatment Facility		
				
112	Mental Health Certified Peer Supporter
- Adult, Family, Youth/Young Adult		
				113	Behavioral health respite		
				
114	Youth receive a DA but are not yet enrolled in long-term treatment.		
				115	
Page 28

ABA – Applied Behavioral Analysis		
				116	
Generic Program or Unknown		
				
ProviderFirstName	Conditionally Required	Provider First Name	•	Use all uppercase	
ProviderLastName	Conditionally Required	Provider Last Name	•	Use all uppercase	
ProviderNPI	Conditionally Required	Provider NPI	•	
Page 29

Required Type 1 NPI	

Field	Required	Description	Notes	
StartDateofService	Required	Date of Intake
or Start of Program
Service		
Most_Recent_Date_of_ Service	Conditionally Required	Last Date Seen
or Appointment Date		

3	Timing
To maintain operational accuracy, BHAPL must be minimally uploaded weekly by 2 pm Friday.

4	File Format & Delivery Requirements
1.	The file must include all active patients in each file as permitted by CliniSync Policy. The file cannot be a “change only” file.

2.	A consistent file naming convention must be used, and the date and time the file was created.
a.	Ex., File_F_MMDDYYHHMMSS.txt.

3.	Column headers are required and must be consistent from file to file.
a.	Do not skip a non-required column even if you do not plan to populate it.

4.	Required delimiters include:
a.	Field Delimiter – Pipe (|) delimiter is preferred, but user defined delimiters are also acceptable.
b.	Record Delimiter – Carriage Return (\r) or Carriage Return & Line Feed (\r\n).
c.	End of file marker is preferred but not required.
d.	The delimited flat file may be type .txt or .csv.

5.	The files must be uploaded using Secure Delivery – SSH File Transfer Protocol (SFTP).
a.	Clients must use CliniSync’s SFTP site.
i.	Two subfolders must exist. One for PROD data and one called CERT for test or other data.
b.	All file uploads must be automated in Production.
i.	Manually produced files have the highest chance of introducing errors.

5	Pre-Validation Requirements
Due to the significant downstream impact erroneous files may be introduced, all BHAPL users are required to build in checks and balances to identify and correct an erroneous Active Population List before uploading to CliniSync. These pre- validation requirements include halting and correcting a file before upload in the following instances:

Page 30

1.	If any record within the BHAPL is missing the following fields:
a.	MRN
b.	Last Name
c.	First Name
d.	DOB
e.	Gender

2.	If the same MRN is used for two or more records in the file (i.e., not unique).
a.	Note: The same patient may have two different MRNs on a file, in this case, the demographic data associated with the patient should be consistent to ensure consistent matching to CliniSync data.
a.	
3.	If any field is non-conformant with required formats, such as:
a.	MRN contains special characters, spaces or is too long.
b.	DOB is not in the expected format.
c.	Gender value is unexpected.

4.	Routine checks are performed to ensure the last name is not switched inadvertently with first name.

5.	No dummy values are inserted in the phone, zip code and SSN fields. If these values are unknown for a record, do not value the field.

6.	Invalid values such as State codes in zip fields, invalid city, invalid phone numbers are identified, scrubbed, and removed or corrected before uploading.

7.	File column headers are present.

8.	The expected total number of patient records are present in the file:
a.	For example, verifying the total number of patient records in the file are no less or greater than an expected percentage change from the last file. If you expect your patient population to shift no more than 30% in either direction file to file, check to make sure this is the case.
b.	“Short-changing” a file is one of the most common errors. Doing so could result in significant loss of downstream data to your users.

6	Change Control Requirements
1.	Prior to implementing any changes to your BHAPL file programs or upload processes in Production, Participants will:
a.	Alert CliniSync of the anticipated change.
b.	Will share sample files with CliniSync for approval before any change is made in Production.
c.	Will coordinate with CliniSync’s Change Control Group on the date to move the change to Production.
a.	Will not proceed with any changes until approved.

7	Part 2 Data Restrictions
1.	Prior to implementing your BHAPL upload processes in Production, Participants will:
a.	Ensure internal organizational legal sign off on the Behavioral Health Attribution Population List and contribution to CliniSync.
b.	Executed a CliniSync Participation and Business Associate Agreement.
c.	Ensure compliance with the OHIO HEALTH INFORMATION PARTNERSHIP CLINISYNC POLICIES and for the Exchange of Restricted Health Information, Participants are responsible for Excluding Restricted Health Information

8	Processing

Page 31

The files will be loaded by 2 pm every Friday, CliniSync will process the files and consolidate them into one file. This file will then be processed as a CliniSync Clinical Dispatcher file and run through the CliniSync network and treated as an Admit, Discharge Transfer HL7 message (ADT) and added to the patient’s longitudinal record.

Messages will also be available to be used through the CliniSync Notify and Clinical Dispatcher notification services. If attribution reports are requested by individual organizations that will be addressed by organization. In the beginning those attribution reports will be limited to health systems. Health Plans and Community Organizations will be able to receive this information through the Notify and Community Health Record applications.