Common use of Confidentiality of State Information Clause in Contracts

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party Contractor acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq seq. (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all State Data. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E], if and only to the extent such terms are expressly made applicable to a specific SOW Agreement. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. E. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this ContractMaster Agreement and any SOW Agreement entered into hereunder, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below)data , to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq seq. (“State Data”). [In addition to the provisions of this Section, the Contractor Party shall comply with execute the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment EF]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all State Data received and collected by Contractor in connection with this Master Agreement and any SOW Agreement entered into hereunder . The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care not to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing authorize or permit others to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entitydo so. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall use State Data only for the purposes of and in accordance with this Master Agreement any SOW Agreement. The Contractor shall provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consentan SOW Agreement. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party Contractor acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq seq. (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto to this Contract as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. E. State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all State Data. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”)law. [In addition to the provisions of this Section, the Contractor Party shall comply with execute the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. E. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all information received and collected by Contractor in connection with this Contract (“State Data”). The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care not to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing authorize or permit others to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entitydo so. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any use State Data except to only for the extent required to perform the services under purposes of and in accordance with this Contract. The Contractor shall not access State user accounts provide at a minimum the same care to avoid disclosure or State Data, except in the course unauthorized use of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with as it provides to protect its parent company or other affiliate without State’s express written consentown similar confidential and proprietary information. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”)law. [In addition to the provisions of this Section, the Contractor Party shall comply with execute the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all information received and collected by Contractor in connection with this Contract (“State Data”). The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care not to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing authorize or permit others to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entitydo so. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any use State Data except to only for the extent required to perform the services under purposes of and in accordance with this Contract. The Contractor shall not access State user accounts provide at a minimum the same care to avoid disclosure or State Data, except in the course unauthorized use of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with as it provides to protect its parent company or other affiliate without State’s express written consentown similar confidential and proprietary information. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit Attachment or schedule Exhibit hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”)law. [In addition to the provisions of this Section, the Contractor Party shall comply with execute the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. E. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data Data, governed by privacy law and regulations, shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all information received and collected by Contractor in connection with this Contract (“State Data”). The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care not to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing authorize or permit others to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entitydo so. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any use State Data except to only for the extent required to perform the services under purposes of and in accordance with this ContractAgreement. The Contractor shall not access State user accounts provide at a minimum the same care to avoid disclosure or State Data, except in the course unauthorized use of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with as it provides to protect its parent company or other affiliate without State’s express written consentown similar confidential and proprietary information. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.. Solely with respect to the Contractor’s scope of services expressly set forth under this Contract, and any applicable Task Order agreed to and executed by the parties, the Contractor shall follow the existing Vermont Health Connect (VHC) control framework during the term of this Agreement including industry standard administrative technical, and physical safeguards and controls consistent with NIST (National Institute of Standard and Technology) Special Publication 800-53 (Rev.3 or higher), Federal Information Processing Standards Publication 200 and Internal Revenue Service Publication 1075 which are designed to (i) ensure the security and confidentiality of State Confidential Information; (ii) protect against any anticipated security threats or hazards to the security or integrity of the State Data and; (iii) protect against unauthorized access to or use of State Data. The Contractor will utilize VHC technical measures to include at a minimum: (1) access controls on information systems, including multiple levels of authentication controls to permit access to State Data only to authorized individuals and controls to prevent the Contractor employees from providing State Data to unauthorized individuals who may seek to obtain this information (whether through fraudulent means or otherwise); (2) industry-standard firewall protection; (3) access VHC information systems through a secure encrypted network connection to State networks where provided by VHC; (4) measures to store in a secure fashion all State Data which shall include reasonable encryption where indicated and multiple levels of authentication; 5) follow VHC dual control procedures, segregation of duties, and pre-employment criminal background checks for employees with responsibilities for or access to State Confidential Information; (6) measures to ensure that the State Confidential Information shall not be altered or corrupted without the prior written consent of the State; and

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. STATE OF VERMONT Contract #46012 Page 19 of 24 The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party Contractor acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq seq. (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all State Data. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliates that are under the ownership or control of its parent company if and only to the extent such sharing may be necessary in performance of this Contract, and provided that Contractor shall be fully responsible for such parent’s or affiliate’s compliance with the requirements of this Contract pertaining State Data. As of the Effective Date, Xxxxxx LLC is the only affiliate without State’s express written consentof Contractor that Contractor intends to share State Data with in accordance with the preceding requirements. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party Contractor acknowledges that certain State Data to also include SU/SD data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq seq. (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United StatesStates without the prior written approval of the State. Unless otherwise instructed by the State, Contractor agrees to keep confidential all State Data. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. F. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit Attachment or schedule Exhibit hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”)law. [In addition to the provisions of this Section, the Contractor Party shall comply with execute the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. E. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all information received and collected by Contractor in connection with this Contract (“State Data”). The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care not to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing authorize or permit others to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entitydo so. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any use State Data except to only for the extent required to perform the services under purposes of and in accordance with this ContractAgreement. The Contractor shall not access State user accounts provide at a minimum the same care to avoid disclosure or State Data, except in the course unauthorized use of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with as it provides to protect its parent company or other affiliate without State’s express written consentown similar confidential and proprietary information. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order. The Contractor shall follow the existing Vermont Health Connect (VHC) control framework during the term of this Agreement including industry standard administrative technical, and physical safeguards and controls consistent with NIST (National Institute of Standard and Technology) Special Publication 800-53 (Rev.3 or higher) and Federal Information Processing Standards Publication 200 which are designed to (i) ensure the security and confidentiality of State Confidential Information; (ii) protect against any anticipated security threats or hazards to the security or integrity of the State Data and; (iii) protect against unauthorized access to or use of State Data. The Contractor will utilize VHC technical measures to include at a minimum: (1) access controls on information systems, including multiple levels of authentication controls to permit access to State Data only to authorized individuals and controls to prevent the Contractor employees from providing State Data to unauthorized individuals who may seek to obtain this information (whether through fraudulent means or otherwise); (2) industry-standard firewall protection; (3) access VHC information systems through a secure encrypted network connection to State networks where provided by VHC; (4) follow technical controls prohibiting the ability to save or to store State Data ; (5) follow VHC dual control procedures, segregation of duties, and pre- employment criminal background checks for employees with responsibilities for or access to State Confidential Information; (6) measures to ensure that the State Confidential Information shall not be altered or corrupted without the prior written consent of the State; and (7) completion of VHC staff training to implement the information security measures. In the event the Contractor builds systems according to the Specifications of Work in Attachment A, Contractor shall follow the existing Vermont Health Connect (VHC) control framework during the term of this Agreement including industry standard administrative technical, and physical safeguards and controls consistent with NIST (National Institute of Standard and Technology) Special Publication 800- 53 (Rev.3 or higher) and Federal Information Processing Standards Publication 200 in accordance with federal regulations governing the use of data on state based insurance exchanges.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party Contractor acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq seq. (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all State Data. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliates that are under the ownership or control of its parent company if and only to the extent such sharing may be necessary in performance of this Contract, and provided that Contractor shall be fully responsible for such parent’s or affiliate’s compliance with the requirements of this Contract pertaining State Data. As of the Effective Date, Hyland LLC is the only affiliate without State’s express written consentof Contractor that Contractor intends to share State Data with in accordance with the preceding requirements. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”)law. [In addition to the provisions of this Section, the Contractor Party shall comply with execute the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. F. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all information received and collected by Contractor in connection with this Contract (“State Data”). The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care not to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing authorize or permit others to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entitydo so. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any use State Data except to only for the extent required to perform the services under purposes of and in accordance with this Contract. The Contractor shall not access State user accounts provide at a minimum the same care to avoid disclosure or State Data, except in the course unauthorized use of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with as it provides to protect its parent company or other affiliate without State’s express written consentown similar confidential and proprietary information. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to below),to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”)law. [In addition to the provisions of this Section, the Contractor Party shall comply with execute the requirements set forth in the State’s HIPAA Business Associate Partner Agreement attached hereto as Attachment E]. F. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all information received and collected by Contractor in connection with this Contract, including, but not limited to, State Information and Customer Data (“State Data”). The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care not to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing authorize or permit others to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entitydo so. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any use State Data except to only for the extent required to perform the services under purposes of and in accordance with this Contract. The Contractor shall not access provide at a minimum the same care to avoid disclosure or unauthorized use of State user accounts or State Data, except Data as it provides to protect its own similar confidential and proprietary information. Contractor shall cause all Contractor Personnel charged with performing Services in the course of data center operations, response to service or technical issues, as required by the express terms of connection with this Contract, or at who are otherwise in a position to obtain or be granted access to State Information, to execute a non-disclosure agreement in a form acceptable to the State’s written request. Contractor may not share shall require that all Contractor Personnel comply with the provisions of the non-disclosure agreement and Contractor is responsible for any failure of any Contractor Personnel to comply with all such provisions; provided, however, that the State Data with its parent company shall have the right to enforce the non-disclosure agreements, at Contractor’s cost and expense, if and/or to the extent Contractor is unwilling or other affiliate without State’s express written consentunable or fails to do so for any reason. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party Contractor acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq seq. (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto to this Contract as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. E State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all State Data. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party Contractor acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq seq. (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto to this Contract as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all State Data. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party Contractor acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq seq. (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto to this Contract as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. E. State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all State Data. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent; provided, however, Contractor may share State Data with Contractor’s wholly owned affiliate Medi-Connect Global, solely for purposes of processing State Data in intellectual property assets owned by such affiliates. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third third-party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party Contractor acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq seq. (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto to this Contract as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. E. State Data shall not be stored, accessed from, or transferred to any location outside the United States, without the express written approval of the State. Unless otherwise instructed by the State, Contractor agrees to keep confidential all State Data. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not STATE OF VERMONT CONTRACT # 43142 DEPARTMENT OF VERMONT HEALTH ACCESS PAGE 42 OF 71 Vermont Information Technology Leaders, Inc. publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”)law. [In addition to the provisions of this Section, the Contractor Party shall comply with execute the requirements set forth in the State’s HIPAA Business Associate Partner Agreement attached hereto as Attachment E]. F. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy an executive summary of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all information received and collected by Contractor in connection with this Contract (“State Data”). The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care not to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing authorize or permit others to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entitydo so. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any use State Data except to only for the extent required to perform the services under purposes of and in accordance with this Contract. The Contractor shall not access State user accounts provide at a minimum the same care to avoid disclosure or State Data, except in the course unauthorized use of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with as it provides to protect its parent company or other affiliate without State’s express written consentown similar confidential and proprietary information. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment EE.]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party The Contractor acknowledges that certain State Data (as defined below), to which the Contractor Provider may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]law. Before receiving or controlling State Data, the Contractor Provider will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. The Contractor Unless otherwise instructed by the State, Provider agrees that (a) it will use to keep confidential all unemployment information received from the State (“State Data”). Contractor Information and State Data shall be referred to herein as “Confidential Information.” Each party agrees to use Confidential Information received from the other party only as may be necessary for the purposes of and in the course of performing duties accordance with this Agreement. All proprietary rights and interests in and to a party’s Confidential Information will remain such party’s property. No rights, licenses, trademarks, inventions, copyrights, or exercising rights patents are implied or granted under this Contract; (b) it will Agreement. The receiving party shall provide at a minimum the same care to avoid disclosure or unauthorized use of State Data Confidential Information as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data . It is agreed that all Confidential Information shall be retained by the receiving party in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict secure place with access to State Data in the Contractor’s possession limited to only those such of the receiving party’s employees on its staff or agents who must have the information on a “need to know” basissuch Confidential Information in pursuance of this Agreement. All Confidential Information, unless otherwise specified in writing by additional agreement, shall remain the property of the disclosing party and shall be used by the receiving party only for the purpose intended. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor receiving party shall promptly notify the State disclosing party of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service Confidential Information of the Contractor may have accessdisclosing party supplied pursuant to this Agreement, so that the State disclosing party may seek an appropriate protective orderorder or otherwise defend any right it may have to maintain the confidentiality of its Confidential Information under applicable State law; provided, however, PROVIDER shall have only three business days from the date of the State’s receipt of any such request in order to seek a protective order or otherwise defend its Confidential Information. PROVIDER acknowledges that State is subject to the terms of the Vermont Access to Public Records Law, 1 VSA 315 et seq. PROVIDER agrees that it will not make any claim against State if the State makes available to the public any information it receives from PROVIDER in accordance with the Access to Public Records Act or in response to a binding order from a court or governmental body or agency compelling its production. This Agreement shall remain in full force and effect for a period of two (2) years, unless earlier terminated or extended as agreed by PROVIDER and State or protected for a longer period of time by law. This Agreement may be terminated at any time during the term of the Agreement upon sixty (60) days written notice to the other party; provided that termination or expiration of this Agreement shall not relieve the recipient party of its obligations under this Agreement with respect to confidential and proprietary information exchanged prior to the effective date of the termination or expiration. This Agreement may be executed in one or more counterparts (which may be originals, photocopies or copies sent by facsimile transmission), each of which counterparts shall be an original, but all of which shall constitute one and the same document. This Agreement may not be amended except in writing by the parties’ authorized representatives. There are no agreements, understandings, or representations, express or implied, not specified herein.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party Contractor acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq seq. (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto to this Contract as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. E. State Data shall not be stored, accessed from, or transferred to any location outside the United States. Unless otherwise instructed by the State, Contractor agrees to keep confidential all State Data. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.

Confidentiality of State Information. In performance of this Contract, and any exhibit or schedule hereunder, the Party acknowledges that certain State Data (as defined below), to which the Contractor may have access may contain individual federal tax information, personal protected health information and other individually identifiable information protected by State or federal law or otherwise exempt from disclosure under the State of Vermont Access to Public Records Act, 1 V.S.A. § 315 et seq (“State Data”). [In addition to the provisions of this Section, the Contractor shall comply with the requirements set forth in the State’s HIPAA Business Associate Agreement attached hereto as Attachment E]. Before receiving or controlling State Data, the Contractor will have an information security policy that protects its systems and processes and media that may contain State Data from internal and external security threats and State Data from unauthorized disclosure, and will have provided a copy of such policy to the State. State Data shall not be stored, accessed from, or transferred to any location outside the United States. The Contractor agrees that (a) it will use the State Data only as may be necessary in the course of performing duties or exercising rights under this Contract; (b) it will provide at a minimum the same care to avoid disclosure or unauthorized use of State Data as it provides to protect its own similar confidential and proprietary information; (c) it will not publish, reproduce, or otherwise divulge any State Data in whole or in part, in any manner or form orally or in writing to any third party unless it has received written approval from the State and that third party is subject to a written confidentiality agreement that contains restrictions and safeguards at least as restrictive as those contained in this Contract; (d) it will take all reasonable precautions to protect the State’s information; and (e) it will not otherwise appropriate such information to its own use or to the use of any other person or entity. Contractor will take reasonable measures as are necessary to restrict access to State Data in the Contractor’s possession to only those employees on its staff who ho must have the information on a “need to know” basis. The Contractor shall not retain any State Data except to the extent required to perform the services under this Contract. Contractor shall not access State user accounts or State Data, except in the course of data center operations, response to service or technical issues, as required by the express terms of this Contract, or at State’s written request. Contractor may not share State Data with its parent company or other affiliate without State’s Contract express written consent. The Contractor shall promptly notify the State of any request or demand by any court, governmental agency or other person asserting a demand or request for State Data to which the Contractor or any third party hosting service of the Contractor may have access, so that the State may seek an appropriate protective order.