Common use of Data Segregation Clause in Contracts

Data Segregation. i. HCA Data received under this Agreement must be segregated or otherwise distinguishable from non-HCA Data. This is to ensure that when no longer needed by the Contractor, all of HCA’s Data can be identified for return or destruction. It also aids in determining whether HCA’s Data has or may have been compromised in the event of a security breach. ii. HCA’s Data must be kept in one of the following ways: • On media (e.g. hard disk, optical disc, tape, etc.) which contains only HCA Data; • In a logical container on electronic media, such as a partition or folder dedicated to HCA’s Data; • In a database that contains only HCA Data; • Within a database – HCA data must be distinguishable from non- HCA Data by the value of a specific field or fields within database records; • Physically segregated from non-HCA Data in a drawer, folder, or other container when stored as physical paper documents. iii. When it is not feasible or practical to segregate HCA’s Data from non- HCA data, both HCA’s Data and the non-HCA data with which HCA’s Data is commingled must be protected as described in this Exhibit. iv. Contractor must designate and be able to identify all computing equipment on which they store, process, and maintain HCA Data. No Data at any time may be processed on or transferred to any portable storage medium. Laptop/tablet computing devices are not considered portable storage medium devices for purposes of this Contract provided it is installed with end-point encryption.

Data Segregation. i. HCA HCA’s Data received under this Agreement Contract must be segregated or otherwise distinguishable from non-non- HCA Data. This is to ensure that when no longer needed by the Contractor, all of HCA’s Data can be identified for return or destruction. It also aids in determining whether HCA’s Data has or may have been compromised in the event of a security breach. ii. 4.1 HCA’s Data must be kept in one of the following ways: • On : A. on media (e.g. hard disk, optical disc, tape, etc.) which contains will contain only HCA Data; • In or B. in a logical container on electronic media, such as a partition or folder dedicated to HCA’s Data; • In or C. in a database that contains will contain only HCA Data; • Within or D. within a database – HCA data must and will be distinguishable from non- non-HCA Data by the value of a specific field or fields within database records; • Physically or E. when stored as physical paper documents, physically segregated from non-HCA Data in a drawer, folder, or other container when stored as physical paper documentscontainer. iii. 4.2 When it is not feasible or practical to segregate HCA’s Data from non- non-HCA data, then both HCA’s Data and the non-HCA data with which HCA’s Data it is commingled must be protected as described in this ExhibitAttachment. iv. 4.3 Contractor must designate and be able to identify all computing equipment on which they store, process, process and maintain HCA Data. No Data at any time may be processed on or transferred to any portable storage medium. Laptop/tablet computing devices are not considered portable storage medium devices for purposes of this Contract provided it is installed with end-point encryption.

Data Segregation. i. HCA 4.1 HCA’s Data received under this Agreement Contract must be segregated or otherwise distinguishable from non-HCA Data. This is to ensure that when no longer needed by the Contractor, all of HCA’s Data can be identified for return or destruction. It also aids in determining whether HCA’s Data has or may have been compromised in the event of a security breach. ii. HCA’s Data must be kept in one of the following ways: • On : A. on media (e.g. hard disk, optical disc, tape, etc.) which contains will contain only HCA Data; • In or B. in a logical container on electronic media, such as a partition or folder dedicated to HCA’s Data; • In or C. in a database that contains will contain only HCA Data; • Within or D. within a database – HCA data must and will be distinguishable from non- non-HCA Data by the value of a specific field or fields within database records; • Physically or E. when stored as physical paper documents, physically segregated from non-HCA Data in a drawer, folder, or other container when stored as physical paper documentscontainer. iii. 4.2 When it is not feasible or practical to segregate HCA’s Data from non- non-HCA data, then both HCA’s Data and the non-HCA data with which HCA’s Data it is commingled must be protected as described in this ExhibitAttachment. iv. 4.3 Contractor must designate and be able to identify all computing equipment on which they store, process, and maintain HCA Data. No Data at any time may be processed on or transferred to any portable storage medium. Laptop/tablet computing devices are not considered portable storage medium devices for purposes of this Contract provided it is installed with end-point encryption.

Data Segregation. i. HCA HCA’s Data received under this Agreement Contract must be segregated or otherwise distinguishable from non-non- HCA Data. This is to ensure that when no longer needed by the Contractor, all of HCA’s Data can be identified for return or destruction. It also aids in determining whether HCA’s Data has or may have been compromised in the event of a security breach. ii. A. HCA’s Data must be kept in one of the following ways: • On : i. on media (e.g. hard disk, optical disc, tape, etc.) which contains will contain only HCA Data; • In or ii. in a logical container on electronic media, such as a partition or folder dedicated to HCA’s Data; • In or iii. in a database that contains will contain only HCA Data; • Within or iv. within a database – HCA data must and will be distinguishable from non- non-HCA Data by the value of a specific field or fields within database records; • Physically or v. when stored as physical paper documents, physically segregated from non-HCA Data in a drawer, folder, or other container when stored as physical paper documentscontainer. iii. B. When it is not feasible or practical to segregate HCA’s Data from non- non-HCA data, then both HCA’s Data and the non-HCA data with which HCA’s Data it is commingled must be protected as described in this ExhibitAttachment. iv. C. Contractor must designate and be able to identify all computing equipment on which they store, process, process and maintain HCA Data. No Data at any time may be processed on or transferred to any portable storage medium. Laptop/tablet computing devices are not considered portable storage medium devices for purposes of this Contract provided it is installed with end-point encryption.

Data Segregation. i. HCA HCA’s Data received under this Agreement Contract must be segregated or otherwise distinguishable from non-HCA Data. This is to ensure that when no longer needed by the Contractor, all of HCA’s Data can be identified for return or destruction. It also aids in determining whether HCA’s Data has or may have been compromised in the event of a security breach. ii. 4.1 HCA’s Data must be kept in one of the following ways: • On on media (e.g. hard disk, optical disc, tape, etc.) which contains will contain only HCA Data; • In or in a logical container on electronic media, such as a partition or folder dedicated to HCA’s Data; • In or in a database that contains will contain only HCA Data; • Within or within a database – HCA data must and will be distinguishable from non- non-HCA Data by the value of a specific field or fields within database records; • Physically or when stored as physical paper documents, physically segregated from non-HCA Data in a drawer, folder, or other container when stored as physical paper documentscontainer. iii. 4.2 When it is not feasible or practical to segregate HCA’s Data from non- non-HCA data, then both HCA’s Data and the non-HCA data with which HCA’s Data it is commingled must be protected as described in this ExhibitAttachment. iv. 4.3 Contractor must designate and be able to identify all computing equipment on which they store, process, process and maintain HCA Data. No Data at any time may be processed on or transferred to any portable storage medium. Laptop/tablet computing devices are not considered portable storage medium devices for purposes of this Contract provided it is installed with end-point encryption.

Data Segregation. i. HCA HCA’s Data received under this Agreement DSA must be segregated or otherwise distinguishable from non-HCA Data. This is to ensure that when no longer needed by the Contractor, all of HCA’s Data can be identified for return or destruction. It also aids in determining whether HCA’s Data has or may have been compromised in the event of a security breach. ii. a. HCA’s Data must be kept in one of the following ways: • On : i. on media (e.g. hard disk, optical disc, tape, etc.) which contains will contain only HCA Data; • In or i. in a logical container on electronic media, such as a partition or folder dedicated to HCA’s Data; • In or ii. in a database that contains will contain only HCA Data; • Within or iii. within a database – HCA data must and will be distinguishable from non- non-HCA Data by the value of a specific field or fields within database records; • Physically or iv. when stored as physical paper documents, physically segregated from non-HCA Data in a drawer, folder, or other container when stored as physical paper documentscontainer. iii. b. When it is not feasible or practical to segregate HCA’s Data from non- non-HCA data, then both HCA’s Data and the non-HCA data with which HCA’s Data it is commingled must be protected as described in this ExhibitAttachment. iv. c. Contractor must designate and be able to identify all computing equipment on which they store, process, process and maintain HCA Data. No Data at any time may be processed on or transferred to any portable storage medium. Laptop/tablet computing devices are not considered portable storage medium devices for purposes of this Contract DSA provided it is installed with end-point encryption.

Data Segregation. i. HCA HCA’s Data received under this Agreement DSA must be segregated or otherwise distinguishable from non-HCA Data. This is to ensure that when no longer needed by the Contractor, all of HCA’s Data can be identified for return or destruction. It also aids in determining whether HCA’s Data has or may have been compromised in the event of a security breach. ii. a. HCA’s Data must be kept in one of the following ways: • On : i. on media (e.g. hard disk, optical disc, tape, etc.) which contains will contain only HCA Data; • In or ii. in a logical container on electronic media, such as a partition or folder dedicated to HCA’s Data; • In or iii. in a database that contains will contain only HCA Data; • Within or iv. within a database – HCA data must and will be distinguishable from non- non-HCA Data by the value of a specific field or fields within database records; • Physically or v. when stored as physical paper documents, physically segregated from non-HCA Data in a drawer, folder, or other container when stored as physical paper documentscontainer. iii. b. When it is not feasible or practical to segregate HCA’s Data from non- non-HCA data, then both HCA’s Data and the non-HCA data with which HCA’s Data it is commingled must be protected as described in this ExhibitAttachment. iv. c. Contractor must designate and be able to identify all computing equipment on which they store, process, process and maintain HCA Data. No Data at any time may be processed on or transferred to any portable storage medium. Laptop/tablet computing devices are not considered portable storage medium devices for purposes of this Contract DSA provided it is installed with end-point encryption.