Exhibit 10.1
No. 0002204-QUO

EXECUTION FINAL
VeriCenter
Master Services Agreement
(VERICENTER LOGO) [d29193d2919305.gif]
This Master Services Agreement No. 0002204-QUO (the “MSA”) between VeriCenter,
Inc. (“VeriCenter”) and Quovadx, Inc (“Customer”) is made effective as of
September 30, 2005 (the “Effective Date”).
Article 1 – Introduction
     1.1 General. This MSA sets forth the terms and conditions of VeriCenter’s
delivery and Customer’s receipt of any or all of the services provided by
VeriCenter, including Professional Services. The specific Services to be
provided under this MSA are identified in the Order Forms submitted by Customer
and accepted by VeriCenter and described in detail in the Order Forms and/or
Statements of Work attached to each Order Form. The service levels VeriCenter
will provide to Customer for each Service ordered, other than Professional
Services, are defined in detail in the Service Level Agreements. Each Service
Level Agreement and Order Form submitted, accepted and executed by both parties
is hereby incorporated by reference into this MSA. This MSA is intended to cover
any and all Services ordered by Customer and provided by VeriCenter.
     1.2 Definitions. Capitalized terms used and not elsewhere defined in this
MSA, have the meanings given them in Schedule 1.2 to this MSA.
Article 2 – Delivery of Services and Term
     2.1 Delivery of Services.
          (a) General. By submitting an Order Form, Customer agrees to receive
and pay for in accordance with the terms hereof, and, by accepting the Order
Form, VeriCenter agrees to provide, the Services specified on the Order Form
during the Initial Term and for any Renewal Term, as specified in
Section 2.2(b).
          (b) Delivery of Supplemental Services. The purpose of this provision
is to enable VeriCenter to provide Customer with certain limited services and
equipment needed by Customer on a “one-off” or emergency basis (“Supplemental
Services”) where such services are not included within the scope of the Services
as described in the Order Form and/or Statements of Work. Supplemental Services
may include, as an example, a request from Customer to VeriCenter via telephone
that VeriCenter immediately replace a problem Customer server with a VeriCenter
server for a temporary period of time. VeriCenter shall notify Customer of the
fees for any Supplemental Services requested by Customer and obtain Customer’s
written approval prior to providing such services. Customer agrees to pay
VeriCenter the approved fees charged by VeriCenter for Supplemental Services.
VeriCenter will use commercially reasonable efforts to provide Supplemental
Services, which shall be subject to the terms hereof., including applicable
express warranties. Vericenter shall have no obligation to determine the need
for or to provide Supplemental Services.
          (c) Delivery of Supplemental Services on an Emergency Basis. In the
event VeriCenter reasonably determines that Supplemental Services are required
on an emergency basis, VeriCenter may provide such services without the consent
of Customer, thereafter provide notice of the services to Customer and bill
Customer at its then standard hourly rates, as provided to Customer from time to
time (“Standard Hourly Rates”) for such services. VeriCenter’s standard hourly
rates as of the date of this Agreement are set forth in Schedule 2.1. Customer
agrees to pay VeriCenter the reasonable fees charged by VeriCenter for
Supplemental Services required on an emergency basis, not to exceed [*]on any
one occasion.
          (d) Billing for Supplemental Services. Customer will be charged for
Supplemental Services in the invoice issued the month following delivery of the
Supplemental Services.
     2.2 Term of Services.
          (a) Commencement of Initial Term. The term of this MSA shall commence
on the Effective Date and end on the date on which there are no longer any
Services being provided hereunder. The term of this MSA and any Services being
performed hereunder may be terminated earlier as set forth below in Section 10.
The term for each Service will commence on the Service Commencement Date
indicated in the Notice of Service Commencement delivered by VeriCenter to
Customer and signed by Customer. VeriCenter will begin providing each Service to
Customer on the applicable Service Commencement Date and each Service will
continue for an Initial Term of three years.
          (b) Renewal Terms. Each Service will continue automatically for
additional terms equal to the Initial Term (“Renewal Term”) unless either Party
notifies the other Party in writing at least thirty (30) days prior to the end
of the Initial Term or a Renewal Term, as applicable, that it has elected to
terminate such Service, in which case such Service shall terminate at the end of
such term, provided however that in the event of a termination by VeriCenter,
the Services shall continue for a period of up to 120 days after the end of the
term to allow Customer to make an orderly transition to another facility. The
termination of any Service will not affect Customer’s obligations to pay for
other Services. Except as otherwise expressly provided in this MSA, VeriCenter
is obligated to provide and Customer is obligated to pay for each Service
through its Initial Term and any Renewal Term.
Article 3 – Payment Terms for Fees and Expenses
     3.1 Fees and Expenses. Customer will pay all fees and expenses due
according to the prices and terms listed in the Order Forms. The prices listed
in the Order Forms will remain in effect during the Initial Term indicated in
the Order Forms and will continue thereafter, unless modified in accordance with
Section 2.2(b).

     
MASTER SERVICES AGREEMENT
  Page 1 of 10
VERICENTER CONFIDENTIAL AND PROPRIETARY
   

[*] We are seeking confidential treatment of these terms which have been
omitted. The confidential portions have been filed separately with the
Securities and Exchange Commission.

 

--------------------------------------------------------------------------------

 

No. 0002204-QUO
EXECUTION FINAL
     3.2 Payment Terms. On the Service Commencement Date for each Service,
Customer will be billed an amount equal to all non-recurring charges indicated
in the Order Form and the monthly recurring charges for the first month of the
term. Monthly recurring charges for all other months will be billed in advance
of the provision of Services. All other charges for Services received and
expenses incurred during a month (e.g., time and materials billing fees, travel
expenses, etc.) will be billed at the end of the month in which the Services
were provided. Charges stated in the Order Forms shall be all inclusive for the
Services specified in the Order Forms, and Customer shall not be invoiced for
pass-through or other expenses except as expressly agreed in an Order Form. Time
and materials based charges shall, unless otherwise agreed in an Order Form, be
based upon the Standard Hourly Rates. Payment for all fees and expenses is due
30 days after receipt of each VeriCenter invoice. All payments will be made in
the United States in U.S. dollars.
     3.3 Late Payments. Any payment (other than amounts disputed in good faith
by Customer) not received within sixty (60) days of the due date will accrue
interest at a rate of one percent (1 %) per month, or the highest rate allowed
by applicable law, whichever is lower. VeriCenter reserves the right to shut
down any service for undisputed payments greater than 90 days past due.
     3.4 Taxes. All fees charged by VeriCenter for Services are exclusive of all
taxes and similar fees now in force or enacted in the future imposed on the
transaction or the delivery of Services, all of which Customer will be
responsible for and will pay in full, except for franchise taxes and taxes based
on VeriCenter’s net income.
Article 4 – Confidential Information; Intellectual Property Ownership; License
Grants
     4.1 Confidential Information.
          (a) Nondisclosure of Confidential Information. Each party acknowledges
that it will have access to certain confidential information of the other party
concerning the other party’s business, plans, customers, technology, and
products, and other information held in confidence by the other party
(“Confidential Information”). Confidential Information will include all
information in tangible or intangible form that is marked or designated as
confidential, and all information that includes any business or technical
nonpublic information of Customer or VeriCenter, including but not limited to
any information relating to either party’s products, services, marketing plans,
business opportunities or personnel, any third-party customer or protected
health information of Customer or that, under the circumstances of its
disclosure, should be considered confidential. Confidential Information will
also include, but not be limited to, VeriCenter Technology, Customer Technology,
and the terms and conditions of this MSA and all documents incorporated by
reference into this MSA. Each party agrees that it will maintain the
Confidential Information of the other party in strict confidence and that it
will not use in any way, for its own account or the account of any third party,
except as expressly permitted by, or required to achieve the purposes of, this
MSA, nor disclose to any third party (except as required by law or to that
party’s attorneys, accountants and other advisors as reasonably necessary), any
of the other party’s Confidential Information (and in each such case only
subject to binding use and disclosure restrictions at least as protective as
those set forth herein). Each party also agrees that it will take reasonable
precautions to protect the confidentiality of the other party’s Confidential
Information, at least as stringent as it takes to protect its own Confidential
Information.
          (b) Exceptions. Information will not be deemed Confidential
Information under this MSA if such information: (i) is known to the receiving
party prior to receipt from the disclosing party directly or indirectly from a
source other than one having an obligation of confidentiality to the disclosing
party; (ii) becomes known (independently of disclosure by the disclosing party)
to the receiving party directly or indirectly from a source other than one
having an obligation of confidentiality to the disclosing party; (iii) becomes
publicly known or otherwise ceases to be secret or confidential, except through
a breach of this MSA by the receiving party; or (iv) is demonstrated by the
receiving party to have been independently developed by the receiving party. The
receiving party may disclose Confidential Information pursuant to the valid
order or requirements of a court or governmental agency, provided that it gives
the disclosing party reasonable prior written notice sufficient to permit the
disclosing party to contest such disclosure.
     4.2 Intellectual Property.
          (a) Ownership. Except for the rights expressly granted in this MSA,
this MSA does not transfer from VeriCenter to Customer any VeriCenter
Technology, and all right, title and interest in and to VeriCenter Technology
will remain solely with VeriCenter. Except for the rights expressly granted in
this MSA, this MSA does not transfer from Customer to VeriCenter any Customer
Technology, and all right, title and interest in and to Customer Technology will
remain solely with Customer. VeriCenter and Customer each agrees that it will
not, directly or indirectly, reverse engineer, decompile, disassemble or
otherwise attempt to derive source code or other trade secrets from the other
party. VeriCenter Technology shall in no event include Customer’s data,
including patient third-party customer or protected health information, or other
content provided by Customer.
          (b) General Skills and Knowledge. Notwithstanding anything to the
contrary in this MSA, either party may use at any time any skills or knowledge
of a general nature acquired during the course of providing or receiving the
Services, including, without limitation, in the case of VeriCenter, information
publicly known or available or that could reasonably be acquired in similar work
performed for another customer of VeriCenter.
     4.3 License Grants.
          (a) By VeriCenter. VeriCenter hereby grants to Client a nonexclusive,
royalty-free license, during the term of this MSA, to use the VeriCenter
Technology solely for purposes of using the Services. Customer shall have no
right to use the VeriCenter Technology for any purpose other than using the
Services.
          (b) By Customer. Customer agrees that if, in the course of performing
the Services, it is necessary for VeriCenter to use Customer Technology,
VeriCenter is hereby granted and shall have a nonexclusive, royalty-free
license, during the term of this MSA, to use the Customer Technology solely for
the purposes of delivering the Services to Customer. VeriCenter shall have no
right to use the Customer Technology for any purpose other than providing the
Services.
Article 5 – VeriCenter Representations and Warranties and Covenants
     5.1 General.
          (a) Authority and Performance of VeriCenter. VeriCenter represents and
warrants that (i) it has the legal right and authority to enter into this MSA
and perform its obligations under this MSA, (ii) the performance of its
obligations and delivery of the Services to Customer will not violate any
applicable U.S., state or local laws or

     
MASTER SERVICES AGREEMENT
  Page 2 of 10
VERICENTER CONFIDENTIAL AND PROPRIETARY
   

 

--------------------------------------------------------------------------------

 

No. 0002204-QUO

EXECUTION FINAL
regulations, including OSHA and HIPAA requirements, or cause a breach of any
agreements with any third parties and (iii) VeriCenter and each of its officers,
directors, employees, representatives, or agents are not barred, suspended or
prohibited from participation in any Medicare/Medicaid program. In the event of
a breach of the warranties set forth in this Section 5.1(a), Customer’s sole
remedy is termination pursuant to Article 10.
          (b) Date Compliance. VeriCenter warrants that none of the computer
hardware and software systems and equipment incorporated into or utilized in the
delivery of the Services contains any date dependent routines or logic which
will fail to operate correctly by reason of such date dependence; provided,
however, that no representation or warranty is made as to the adequacy of any
Customer or third party service provider hardware or software used in connection
with the Services except for third party hardware and software provided by
VeriCenter. In the event of any breach of the warranties under this
Section 5.1(b), Customer’s sole remedy is termination pursuant to Article 10 of
this MSA.
          (c) HIPAA Compliance. VeriCenter will comply with all applicable
provisions of the federal privacy regulations as set forth at 45 C.F.R. Parts
160 through 164 (the “Federal Privacy Regulations”) and the federal security
regulations set forth in proposed form at 45 C.F.R. Part 142 (the “Federal
Security Regulations”), and as they may be amended or changed from time to time
in the future (collectively, “HIPPA Requirements”). The parties shall execute
the Business Associate Addendum.
     5.2 Service Level Warranties.
          (a) Service Level Warranty. Subject to the exceptions set forth in the
Service Level Agreement applicable to a specific Service, VeriCenter warrants
that it will provide each Service at or above the service levels defined in the
applicable Service Level Agreement (the “Service Level Warranty”).
          (b) Remedies. In the event that VeriCenter fails to provide a Service
at the level required by the Service Level Warranty, Customer’s only remedies
are those set forth in the Service Level Agreement applicable to that Service
(the “Remedies”).
          (c) Remedies Shall Be Cumulative; Maximum Remedy. The Remedies set
forth in each Service Level Agreement are cumulative. The aggregate maximum
Remedy for any and all failures to provide Services at the level required by a
particular Service Level Agreement that occur in a single calendar month shall
not exceed the maximum set forth in such Service Level Agreement.
          (d) Termination Option for Chronic Problems. Customer may terminate a
specific Service if the Customer experiences Chronic Problems (as defined in the
applicable Service Level Agreement) with such Service. If the Service Level
Agreement for a specific Service so provides, or if Customer experiences Chronic
Problems in more than one Service Level Agreement during any twelve (12) month
period, Customer may terminate this MSA if Customer experiences Chronic Problems
with such Service. Customer must provide VeriCenter written notice of
termination for Chronic Problems as specified in the Service Level Agreement and
such termination will be effective as provided in the Service Level Agreement.
          (e) The service level warranty set forth in this section 5.2 does not
apply to (i) any Professional Services except as expressly provided in any
applicable service level agreement; (ii) any Supplemental Services; or (iii) any
Services that expressly exclude this service level warranty (as stated in the
Service Level Agreements for such Services).
     5.3 Service Performance Warranty. VeriCenter warrants that it will perform
the Services in a timely, professional and workmanlike manner consistent with
the highest industry standards reasonably applicable to the performance thereof.
     5.4 SECURITY SERVICES. VERICENTER WILL USE COMMERCIALLY REASONABLE MEASURES
TO PROVIDE SECURITY IN CONNECTION WITH THE PROVISION OF THE SERVICES, INCLUDING
BUT NOT LIMITED TO, AS APPLICABLE (I) OPERATING CUSTOMER’S SYSTEMS ON SECURE
EQUIPMENT LOCATED IN A PHYSICALLY SECURE DATA CENTER, (II) EMPLOYING TECHNOLOGY
THAT IS CONSISTENT WITH INDUSTRY STANDARDS FOR FIREWALLS AND OTHER SECURITY
TECHNOLOGY TO HELP PREVENT CUSTOMER’S SYSTEMS HOSTED BY VERICENTER FROM BEING
ACCESSED BY UNAUTHORIZED PERSONS, (III) HAVING, MAINTAINING AND IMPLEMENTING
INDUSTRY STANDARD PHYSICAL SECURITY MEASURES AND POLICIES, (IV) EMPLOYING
TECHNOLOGY THAT IS CONSISTENT WITH INDUSTRY STANDARDS FOR BACKUP AND RECOVERY OF
CUSTOMER’S DATA AND SYSTEMS, (V) UTILIZING COMMERCIALLY ACCEPTABLE PRACTICES TO
VALIDATE THE DATA ON THE TAPE MATCHES DATA ON THE DISKS BEING BACKED UP, AND
(VI) PROVIDING COPIES OF THE MOST CURRENT SAS 70 AUDIT REPORT, WHICH SHALL BE
TREATED AS CONFIDENTIAL INFORMATION OF VERICENTER. VERICENTER AGREES TO USE
COMMERCIALLY REASONABLE EFFORTS TO SAFEGUARD CUSTOMER’S SYSTEMS FROM VIRUSES,
WORMS, TROJAN HORSES, OTHER MALICIOUS CODE OR SECURITY FLAWS. VERICENTER’S
SECURITY SHALL COMPLY WITH ALL APPLICABLE LAWS AND REGULATIONS AND THE
REQUIREMENTS SET FORTH IN THE BUSINESS ASSOCIATE ADDENDUM .
     5.5 No Other Warranty. Except for the express warranties in this MSA or any
Service Level Agreement, VeriCenter does not make, and hereby disclaims, any and
all other Express or implied warranties, including, but not limited to,
warranties of merchantability, fitness for a particular purpose, noninfringement
and title, and any warranties arising from a course of dealing, usage, or trade
practice. VeriCenter does not warrant that the Services will be uninterrupted,
error-free, or completely secure.
     5.6 Disclaimer of Actions Caused by or Under the Control of Third Parties.
VeriCenter does not and cannot control the flow of data to or from VeriCenter’s
network and other portions of the internet. Such flow depends in large part on
the performance of internet services provided or controlled by third parties. At
times, actions or inactions of such third parties can impair or disrupt
customer’s connections to the Internet (or portions thereof). Although
VeriCenter will use commercially reasonable efforts to take all actions it deems
appropriate to remedy and avoid such events, VeriCenter cannot guarantee that
such events will not occur. Accordingly, VeriCenter disclaims any and all
liability resulting from or related to such events.
Article 6 – Customer Representations, Warranties and Obligations

     
MASTER SERVICES AGREEMENT
  Page 3 of 10
VERICENTER CONFIDENTIAL AND PROPRIETARY
   

 

--------------------------------------------------------------------------------

 

No. 0002204-QUO

EXECUTION FINAL
     6.1 Representations and Warranties of Customer.
          (a) Authority and Performance. Customer represents and warrants that
(i) it has the legal right and authority to enter into this MSA and perform its
obligations under this MSA, and (ii) the performance of its obligations and use
of the Services (by Customer, its customers and users) will not violate any
applicable laws, regulations or the Acceptable Use Policy or cause a breach of
any agreements with any third parties or unreasonably interfere with other
VeriCenter customers’ use of VeriCenter services.
          (b) Breach of Warranties. In the event of any breach of any of the
foregoing warranties, VeriCenter will not have the right to suspend Services,
but will have any other remedies available at law or in equity. VeriCenter will
provide notice and opportunity to cure if practicable depending on the nature of
the breach. Once cured, VeriCenter will promptly restore the Services.
     6.2 Compliance with Law and Acceptable Use Policy. Customer agrees that it
will use the Services only for lawful purposes and in accordance with this MSA.
Customer will comply at all times with all applicable laws and regulations and
the Acceptable Use Policy, as updated by VeriCenter from time to time. The
Acceptable Use Policy are incorporated into this MSA and made a part of this MSA
by this reference. VeriCenter may change the Acceptable Use Policy upon fifteen
(15) days’ notice to Customer. Customer agrees that it has received, read and
understands the current version of the Acceptable Use Policy. The Acceptable Use
Policy contains restrictions on Customers and Customer’s users’ online conduct
(including prohibitions against unsolicited commercial email) and contains
penalties for violations of such restrictions. Customer agrees to comply with
such restrictions and, in the event of a failure to comply, Customer agrees to
be subject to the penalties in accordance with the Acceptable Use Policy.
Customer acknowledges that VeriCenter exercises no control whatsoever over the
content of the information passing through Customer’s sites and that it is the
sole responsibility of Customer to ensure that the information it and its users
transmit and receive complies with all applicable laws and regulations and the
Acceptable Use Policy.
     6.3 Accesses and Security. Except with the advanced written consent of
VeriCenter, Customer’s access to the VeriCenter Data Centers will be limited
solely to the Representatives as set forth in the Customer Registration Form
which is hereby incorporated by reference into this MSA. Representatives may
only access the VeriCenter Data Centers when accompanied by an authorized
VeriCenter representative or with a properly issued VeriCenter access badge.
     6.4 Restrictions on Use of Services. Customer shall not, without the prior
written consent of VeriCenter (which may be withheld in its sole discretion),
resell the Services to any third parties.
Article 7 – Insurance
     7.1 VeriCenter Minimum Levels. During the term of this Agreement and prior
to the performance of any service hereunder by VeriCenter, VeriCenter shall, at
its own expense, procure and maintain the following insurance coverage of the
type and amounts specified below for the benefit and protection of Customer and
VeriCenter, which insurance coverage shall be maintained in full force and
effect through out the entire term of this Agreement and until all of the
Services are completed and accepted for final payment:
          (a) A Commercial General Liability Insurance Policy with a limit of
not less than [*] per occurrence and [*] in the aggregate providing coverage for
bodily injury, personal injury and property damage for the mutual interest of
both Customer and VERICENTER, with respect to all operations. Any general
liability policy provided by VeriCenter hereunder shall include, but not be
limited to, the following coverage: (i) premises and operations; (ii)
products/completed operations; (iii) contractual liability; (iv) personal injury
and advertising injury liability; (v) independent provider’s liability;
(vi) severability of interest clause; and (vii) broad form property damage. Any
general liability policy provided by VeriCenter shall apply as primary
insurance, and any other insurance maintained by Customer or its Affiliates, or
any of their directors, officers, agents or employees, or any Customer
self-funded program, shall be excess only and not contributing with such
coverage;
          (b) Professional Liability Insurance including Internet professional
and security liability coverage that contains limits, including umbrella
coverage, of not less than [*] per claim, with an aggregate limit of not less
than [*] providing coverage for wrongful acts in the rendering of, or failure to
render, professional services with regards to electronic data losses or damage
or breaches of electronic data security, employee dishonesty and computer fraud
coverage, and shall include but not be limited to, VeriCenter’s obligations
under HIPAA; as of the Effective Date, the coverage will not contain specific,
express exclusions for design errors, destruction of data (other than casualty
exclusions) or failure to design an adequate system arising out of VeriCenter’s
wrongful acts in the rendering of, or failure to render, professional services
to Customer and/or its Affiliates and VeriCenter will make commercially
reasonable efforts to provide that such specific, express exclusions will not be
contained in the professional liability insurance during the Term of this
Agreement;
          (c) Workers’ Compensation Insurance with statutory limits to include
Employer’s Liability with a limit of not less than [*].
          (d) Property Insurance. VeriCenter shall provide insurance on all
property owned by VeriCenter and provided under this Agreement. Such policy
shall provide “all risk” perils, and shall be written on a basis of one hundred
percent (100%) replacement value of the property. Coverage shall include
business personal property, electronic data processing, tenant improvements,
business interruption (including mechanical breakdown), business income and
extra expense, property of others in the care, custody, and control of the
insured, and transit.
Any deductible or self-insured retention must be declared to Customer along with
any changes thereto and shall be the responsibility of VeriCenter. No insurance
of VeriCenter shall be co-insurance, contributing insurance or primary insurance
with Customer’s insurance. VeriCenter shall maintain such insurance in effect
during the term of this MSA, except the professional liability insurance which
shall be maintained for a minimum of two (2) years following termination or
completion of VeriCenter’s performance of its obligations under this Agreement.
VeriCenter’s insurance companies shall be licensed to do business in the State
of Colorado (with the exception of the professional liability coverage) and will
have an A.M. Best Guide Rating of at least A:VII or better. Any insurance
company of the VeriCenter with a rating of less than A:VII will not be
acceptable to the Customer. VeriCenter is solely responsible for all deductibles
and/or self insured retentions under their policies.
     7.2 Customer Minimum Levels. In order to provide customers with physical
access to facilities operated by VeriCenter and equipment owned by third
parties, VeriCenter is required by its insurers to ensure that each VeriCenter
customer maintains adequate insurance coverage. Customer agrees to keep in full
force and effect during the term of this

     
MASTER SERVICES AGREEMENT
  Page 4 of 10
VERICENTER CONFIDENTIAL AND PROPRIETARY
   

[*] We are seeking confidential treatment of these terms which have been
omitted. The confidential portions have been filed separately with the
Securities and Exchange Commission.

 

--------------------------------------------------------------------------------

 

No. 0002204-QUO

EXECUTION FINAL
MSA: (i) comprehensive general liability insurance in an amount not less than
[*] per occurrence for bodily injury and property damage and (ii) workers
compensation insurance in an amount not less than that required by applicable
law. Customer agrees that it will ensure and be solely responsible for ensuring
that its agents (including contractors and subcontractors) maintain insurance
coverage at levels no less than those required by applicable law and customary
in Customer’s and its agents’ industries.
     7.3 Certificates of Insurance. Promptly following execution of this MSA,
each of the parties will (i) deliver to the other party certificates of
insurance which evidence the minimum levels of insurance set forth above;
(ii) cause its insurance providers to name the other party as an additional
insured on the general liability policy and notify the other party in writing of
the effective date thereof, and (iii) cause its general liability and worker’s
compensation policies to contain a waiver of subrogation in favor of the other
party.
Article 8 – Limitations of Liability
     8.1 Personal Injury. Each Representative and any other person visiting a
VeriCenter Data Center does so at its own risk. VeriCenter assumes no liability
whatsoever for any harm to such persons resulting from any cause other than the
negligence or willful misconduct of VeriCenter.
     8.2 Consequential Damages Waiver. Except for a breach of Section 4.1
(“Confidential Information”), Section 4.2 (“Intellectual Property”) or
Section 9.1 (“Indemnification”) of this agreement, in no event will either party
be liable or responsible to the other for any type of exemplary, special,
punitive, indirect or consequential damages, including, but not limited to, lost
revenue, lost profits, or interruption or loss of use of service or equipment,
even if advised of the possibility of such damages, whether arising under theory
of contract, tort (including negligence), strict liability or otherwise. Except
for a breach of Section 4.1, Section 4.2 or Section 9.1 of this agreement, or in
the case of gross negligence, reckless, illegal or fraudulent acts or omissions
, [*]
     8.3 Basis of the Bargain; Failure of Essential Purpose. The parties agree
that the limitations and exclusions of liability and disclaimers specified in
this MSA represent the parties’ agreement as to the allocation of risk between
the parties in connection with VeriCenter’s obligations under this MSA and that
such limitations, exclusions and disclaimers will survive and apply even if
found to have failed of their essential purpose. The parties acknowledge that
VeriCenter has set its prices and entered into this MSA in reliance upon the
limitations of liability and the disclaimers of warranties and damages set forth
in this MSA, and that the same form an essential basis of the bargain between
the parties.
Article 9 – Indemnification
     9.1 Indemnification. Each party will indemnify, defend and hold the other
harmless from and against any and all costs, liabilities, losses, and expenses
(including, but not limited to, reasonable attorneys’ fees) (collectively,
“Losses”) resulting from any claim, suit, action, or proceeding (each, an
“Action”) brought by any third party against the other or its affiliates
alleging (i) the infringement or misappropriation of any intellectual property
right relating to the delivery or use of the Services (but excluding any
infringement caused by the other party); (ii) personal injury caused by the
negligence or willful misconduct of the other party; (iii) any violation of or
failure to comply with the Acceptable Use Policy and (iv) violation of any
applicable statute or regulation regarding the confidentiality, privacy or
security of information. Customer will indemnify, defend and hold VeriCenter,
its affiliates and customers harmless from and against any and all Losses
resulting from or arising out of any Action brought against VeriCenter, its
affiliates or customers alleging any damage or destruction to the VeriCenter
Data Centers, VeriCenter equipment or other customers’ equipment caused by the
negligence or willful misconduct of Customer, its Representatives or designees
     9.2 Notice. Each party’s indemnification obligations under this MSA shall
be subject to (i) receiving prompt written notice of the existence of any
Action; (ii) being able to, at its option, control the defense of such Action;
(iii) permitting the indemnified party to participate in the defense of any
Action; and (iv) receiving reasonable cooperation of the indemnified party in
the defense thereof.
Article 10 – Termination
     10.1 Termination For Cause. Either party may terminate this MSA, effective
as of the date specified in written notice of termination provided to the other
party, if: (i) the other party breaches any material term or condition of this
MSA and fails to cure such breach within thirty (30) days after receipt of
written notice of the same, except in the case of failure to pay fees, which
must be cured within thirty (30) days after receipt of written notice from
VeriCenter, it being acknowledged and agreed that any material breach of
Section 4.1, 4.2 or Section 5.1 shall be deemed a material breach of this MSA;
(ii) the other party becomes the subject of a voluntary petition in bankruptcy
or any voluntary proceeding relating to insolvency, receivership, liquidation,
or composition for the benefit of creditors; or (iii) the other party becomes
the subject of an involuntary petition in bankruptcy or any involuntary
proceeding relating to insolvency, receivership, liquidation, or composition for
the benefit of creditors, if such petition or proceeding is not dismissed within
sixty (60) days of filing. Notwithstanding the foregoing, if VeriCenter elects
to terminate this MSA for cause by reason of non-payment by Customer, Customer
may, by written notice to VeriCenter, elect to continue Services hereunder for
an additional period of up to 30 days, if Customer cures the payment default
promptly after notice of termination and stays current in its payment
obligations.
     10.2 Termination on Expiration of all Services. Either party may terminate
this MSA, effective as of the date specified in written notice of termination
provided to the other party, if all Services have been terminated in accordance
with the procedures in Section 2.2(b) or if no Order Forms are in effect.
     10.3 No Liability for Termination. Except in the case of termination for
cause pursuant to Section10.1, neither party will be liable to the other for any
termination or expiration of any Service or this MSA in accordance with its
terms.
     10.4 Effect of Termination. Upon the effective date of termination of this
MSA:
          (a) VeriCenter will immediately cease providing the Services;

     
MASTER SERVICES AGREEMENT
  Page 5 of 10
VERICENTER CONFIDENTIAL AND PROPRIETARY
   

[*] We are seeking confidential treatment of these terms which have been
omitted. The confidential portions have been filed separately with the
Securities and Exchange Commission.

 

--------------------------------------------------------------------------------

 

No. 0002204-QUO

EXECUTION FINAL
          (b) any and all payment obligations of Customer under this MSA for
Services provided through the date of termination will remain due in accordance
with the above payment terms;
          (c) within ten (10) days of such termination, each party will return
all Confidential Information of the other party in its possession and will not
make or retain any copies of such Confidential Information except as required to
comply with any applicable legal or accounting record keeping requirement; and
          (d) Except in the case of termination for cause pursuant to
Section 10.1, Customer will pay to VeriCenter all expenses incurred by
VeriCenter to return Customers’ Confidential Information, including, but not
limited to, labor costs and the cost of storage media.
     10.5 Termination Assistance. Notwithstanding the provisions of
Section 10.4, upon the termination of this MSA for any reason except termination
by Customer for cause, and except as extended by the invocation of the extension
under Section 10.6, VeriCenter will provide to Customer such termination
assistance relating to the Services, at VeriCenter’s then current standard
rates, as may be reasonably requested in writing by Customer. VeriCenter’s
obligation to provide assistance pursuant to this Section 10.5 is limited to a
period of thirty (30) days (the “Assistance Period”). Customer will pay
VeriCenter, on the first day of the Assistance Period and as a condition to
VeriCenter’s obligation to provide termination assistance to Customer during the
Assistance Period, an amount equal to VeriCenter’s reasonable estimate of the
total amount payable to VeriCenter for such termination assistance for the
Assistance Period. In the event this MSA is terminated by Customer for cause, or
is terminated By VeriCenter pursuant in connection with a lease termination
described in Section 11.2, VeriCenter shall provide reasonable assistance to
Customer, with no charge to Customer, to assist Customer with an orderly
transition to another service provider.
     10.6 Continuation of Services. Notwithstanding the provisions of
Section 10.4, Customer shall have the option, exercisable upon termination, by
delivery of written notice to VeriCenter, to continue the Services and this MSA
on a month-to-month basis after the termination date or the expiration date, as
applicable, for the then applicable fees set forth in the Order Forms. Customer
shall have the right to have this MSA continue on a monthly basis pursuant to
this Section 10.6 for up to three months. If this MSA is terminated by
VeriCenter, the Customer will pay VeriCenter, on the first day of each month and
as a condition to VeriCenter’s obligation to continue to provide the Services to
Customer during that month, an amount equal to VeriCenter’s reasonable estimate
of the total amount payable to VeriCenter for such Services for that month.
     10.7 Survival. The following provisions will survive any expiration or
termination of this MSA: Articles 3, 8, 9, 10 and 11 (excluding Section 11.2)
and Sections 4.1, 4.2, and 5.4.
Article 11 – Miscellaneous Provisions
     11.1 Force Majeure. Except for the obligation to make payments, neither
party will be liable for any failure or delay in its performance under this MSA
due to any cause beyond its reasonable control, including, but not limited to,
acts of war, acts of God, earthquake, flood, embargo, riot, sabotage, labor
shortage or dispute, governmental act or failure of the Internet (not resulting
from the actions or inactions of VeriCenter, including the inadequacy of
infrastructure architecture or physical security) (each a “Force Majeure
Event”), provided that the delayed party: (a) gives the other party prompt
notice of such cause, and (b) uses its reasonable commercial efforts to promptly
correct such failure or delay in performance. If VeriCenter is unable to provide
Services for a period of seven (7) consecutive days as a result of a continuing
Force Majeure Event, Customer may cancel the Services and this MSA on written
notice to VeriCenter. Such termination will be effective on the date specified
in the written notice, and Customer shall have no liability to VeriCenter beyond
unpaid charges up to the date of interruption of service.
     11.2 No Lease; Agreement Subordinate to Master Lease. This MSA is a
services agreement and is not intended to and will not constitute a lease of any
real property. Customer acknowledges and agrees that (i) it has been granted
only a license to use the VeriCenter Data Centers in accordance with this MSA;
(ii) Customer has not been granted any real property interest in the VeriCenter
Data Centers; and (iii) Customer has no rights as a tenant or otherwise under
any real property or landlord/tenant laws, regulations, or ordinances; and
(iv) this MSA, to the extent it involves the use of space leased by VeriCenter,
shall be subordinate to any lease between VeriCenter and its landlords; and
(v) the expiration or termination of any such lease shall terminate this MSA as
to such property subject to Customer retaining any rights or claims it may have
against VeriCenter arising from the expiration or termination of such lease.
     11.3 Marketing. Customer agrees that during the term of this MSA VeriCenter
may publicly refer to Customer, orally and in writing, as a Customer of
VeriCenter. Any other reference to Customer by VeriCenter requires the written
consent of Customer.
     11.4 Government Regulations. Neither party will export, re-export,
transfer, or make available, whether directly or indirectly, any regulated item
or information to anyone outside the U.S. in connection with this MSA without
first complying with all export control laws and regulations which may be
imposed by the U.S. Government and any country or organization of nations within
whose jurisdiction Customer operates or does business.
     11.5 Non-Solicitation. During the Term of this MSA and continuing through
the first anniversary of the termination of this MSA, each party agrees that it
will not, and will ensure that its affiliates do not, directly or indirectly,
solicit or attempt to solicit for employment any persons employed by the other
party . The foregoing notwithstanding, neither party will be deemed to have
breached this Section 11.5 by (a) hiring personnel responding to generally
placed help-wanted advertisements or job postings or (b) hiring personnel of the
other party that have been terminated or notified of pending termination by the
other party. In the event a party violates this Section 11.5, the breaching
party agrees to pay the other party the equivalent of six (6) months wages of
the individual hired to serve as liquidated damages and as a placement fee for
acquisition of staff.
     11.6 No Third Party Beneficiaries. VeriCenter and Customer agree that,
except as otherwise expressly provided in this MSA, there shall be no third
party beneficiaries to this MSA, including but not limited to the insurance
providers for either party or the customers of Customer.
     11.7 Governing Law; Dispute Resolution. This MSA and the rights and
obligations of the parties created hereby will be governed by and construed in
accordance with the internal laws of the State of New York without regard to its
conflict of law rules and specifically excluding from application to this MSA
that law known as the United Nations Convention on the International Sale of
Goods. The parties will endeavor to settle amicably by mutual discussions any
disputes, differences, or claims whatsoever related to this MSA. Failing such
amicable settlement, any controversy, claim, or dispute arising under or
relating to this MSA, including the existence, validity, interpretation,

     
MASTER SERVICES AGREEMENT
  Page 6 of 10
VERICENTER CONFIDENTIAL AND PROPRIETARY
   

 

--------------------------------------------------------------------------------

 

No. 0002204-QUO

EXECUTION FINAL
performance, termination or breach thereof, shall finally be settled by
arbitration in accordance with the Arbitration Rules (and if Customer is a
non-U.S. entity, the International Arbitration Rules) of the American
Arbitration Association (“AAA”). There will be one (1) arbitrator (the
“Arbitration Tribunal”), who will be appointed by the AAA in accordance with its
rules. The language of the arbitration shall be English. The Arbitration
Tribunal will not have the authority to award punitive damages to either party.
Each party shall bear its own expenses, but the parties will share equally the
expenses of the Arbitration Tribunal and the AAA. This MSA will be enforceable,
and any arbitration award will be final, and judgment thereon may be entered in
any court of competent jurisdiction. The arbitration will be held in New York,
New York, USA. Notwithstanding the foregoing, claims for preliminary injunctive
relief and other pre-judgment remedies may be brought in a state or federal
court in the United States with jurisdiction over the subject matter and
parties.
     11.8 Severability. In the event any provision of this MSA is held by a
tribunal of competent jurisdiction to be contrary to the law, the remaining
provisions of this MSA will remain in full force and effect.
     11.9 Waiver. The waiver of any breach or default of this MSA, or the
failure to exercise any right provided for in this MSA, will not constitute a
waiver of any subsequent breach, default or right, and will not act to amend or
negate the rights of the waiving or non-exercising party.
     11.10 Assignment. Customer may assign this MSA in whole as part of a
corporate reorganization, consolidation, merger, sale of all or substantially
all of its assets, or transaction or series of related transactions that results
in the transfer of fifty percent (50%) or more of the outstanding voting power
of Customer. Customer may not otherwise assign its rights or delegate its duties
under this MSA either in whole or in part without the prior written consent of
VeriCenter, and any attempted assignment or delegation without such consent will
be void. VeriCenter may not assign this MSA in whole or part. VeriCenter may
delegate or subcontract the performance of certain Services to third parties,
including VeriCenter’s wholly owned subsidiaries, only with Customer’s prior
written consent and provided VeriCenter controls the delivery of such Services
to Customer and remains responsible to Customer for the delivery of such
Services. This MSA will bind and inure to the benefit of each party’s successors
and permitted assigns.
     11.11 Notice. Any notice or communication required or permitted to be given
under this MSA may be delivered by hand, deposited with an overnight courier,
confirmed facsimile, or mailed by registered or certified mail, return receipt
requested, postage prepaid, in each case to the address of the receiving party
as listed on the Order Form or at such other address as may hereafter be
furnished in writing by either party to the other party. Such notice will be
deemed to have been given as of the date it is delivered, mailed, faxed or sent,
whichever is earlier.
     11.12 Relationship of Parties. VeriCenter and Customer are independent
contractors and this MSA will not establish any relationship of partnership,
joint venture, employment, franchise or agency between VeriCenter and Customer.
Neither VeriCenter nor Customer will have the power to bind the other or incur
obligations on the other’s behalf without the other’s prior written consent,
except as otherwise expressly provided in this MSA.
     11.13 Article and Section Headings; Pronouns; Plural and Singular. The
article and section headings in this MSA are for reference purposes only and
shall not affect the meaning or interpretation of this MSA. References in this
MSA to a designated “Article” or “Section” refer to an Article or Section of
this MSA unless otherwise specifically indicated. All pronouns used in this MSA
shall be construed as including both genders and the neuter. All capitalized
defined terms used in this MSA are equally applicable to their singular and
plural forms.
     11.14 Entire Agreement.. This MSA, including schedules and all documents
incorporated into this MSA by reference, constitute the entire agreement between
the parties with respect to the subject matter hereof, and supersede all of the
prior agreements and undertakings, both written and oral, among the parties, or
any of them, with respect to the subject matter of this MSA, except for the
Business Associate Agreement executed by the parties concurrently with this MSA.
     11.15 Counterparts and Originals. This MSA may be executed in counterparts,
which together shall constitute a single agreement. Delivery by telephonic
facsimile transmission of a signed counterpart of this MSA shall be effective as
delivery of a manually signed counterpart. Once signed, any reproduction of this
MSA made by reliable means (e.g., photocopy, facsimile) is considered an
original.
     11.16 Amendments. This MSA may be amended or changed only by a written
document signed by authorized representatives of VeriCenter and Customer in
accordance with this Section 11.16.
     11.17 Omnibus Reconciliation Act of 1980 Compliance. Each party will comply
with all applicable provisions of Section 952 of Pub. L. 96-499 of the Omnibus
Reconciliation Act of 1980, and as such law may be amended or changed from time
to time in the future, pertaining to contractors of services to Medicare
providers.
     11.18 Interpretation of Conflicting Terms. In the event of a conflict
between or among the terms in this MSA, the Service Level Agreements, the Order
Forms, Statements of Work and any other document made a part hereof, the
documents shall control in the following order: this MSA, the Order Form with
the latest date, Statements of Work, the Service Level Agreements, and other
documents.

     
MASTER SERVICES AGREEMENT
  Page 7 of 10
VERICENTER CONFIDENTIAL AND PROPRIETARY
   

 

--------------------------------------------------------------------------------

 

No. 0002204-QUO

EXECUTION FINAL
Authorized representatives of Customer and VeriCenter have read the foregoing
Master Services Agreement and all documents incorporated into the Master
Services Agreement and agree and accept such terms effective as of the date
first referenced above.

              CUSTOMER: QUOVADX, INC.   VERICENTER, INC.
 
           
Signature:
  /s/ Mark Rangell   Signature:   /s/ Michael Sullivan
 
           
Print Name:
  Mark Rangell   Print Name:   Michael Sullivan
 
           
Title:
  Executive Vice President   Title:   SVP Sales
 
           
Date:
  9/30/2005   Date:   10/3/05

This Master Services Agreement incorporates the following documents:

•   All Schedules   •   Order Forms [*]   •   Network SLA   •   Facility
Availability SLA   •   Availability SLA   •   Performance SLA   •   VeriCenter
Roles and Responsibilities [*]   •   Operational Roles and Responsibilities [*]
  •   Acceptable Use Policy   •   Business Associate Addendum

     
MASTER SERVICES AGREEMENT
  Page 8 of 10
VERICENTER CONFIDENTIAL AND PROPRIETARY
   

[*] We are seeking confidential treatment of these terms which have been
omitted. The confidential portions have been filed separately with the
Securities and Exchange Commission.

 

--------------------------------------------------------------------------------

 

No. 0002204-QUO

EXECUTION FINAL
VeriCenter
Master Services Agreement Schedule 1.2—Definitions
     The following defined terms are equally applicable in their singular and
plural forms:
          (a) “Customer Registration Form” means the list that contains the
names and contact information (e.g. pager, email and telephone numbers) of
Customer and the individuals authorized by Customer to enter the VeriCenter Data
Centers, as delivered by Customer to VeriCenter and amended in writing from time
to time by Customer.
          (b) “Customer Technology” means Customer’s proprietary technology,
including Customer’s Internet operations design, content, software tools,
hardware designs, algorithms, software (in source and object forms), user
interface designs, architecture, class libraries, objects and documentation
(both printed and electronic), know-how, trade secrets and any related
intellectual property rights throughout the world (whether owned by Customer or
licensed to Customer from a third party) and also including any derivatives,
improvements, enhancements or extensions of Customer Technology conceived,
reduced to practice, or developed during the term of this MSA by Customer or
jointly by Customer and VeriCenter.
          (c) “Initial Term” means the minimum term for which VeriCenter will
provide the Services to Customer, as indicated on the Order Forms.
          (d) “Notice of Service Commencement” means the written notice
delivered by VeriCenter to Customer indicating the Service Commencement Date.
          (e) “Order Form” means any of the forms specifying the Services, and
the term and prices of such Services, to be provided by VeriCenter to Customer
that are submitted by Customer and accepted by VeriCenter.
          (f) “Professional Services” means any non-standard professional or
consulting service provided by VeriCenter to Customer as more fully described in
a Statement of Work.
          (g) “Renewal Term” means any service term following the Initial Term,
as specified in Section 2.2 of the MSA.
          (h) “Representatives” mean the individuals identified in writing on
the Customer Registration Form and authorized by Customer to enter the
VeriCenter Data Centers.
          (i) “Acceptable Use Policy” means the VeriCenter general Acceptable
Use Policy governing Customer’s use of Services, including, but not limited to,
online conduct, and the obligations of Customer and its Representatives in the
VeriCenter Data Centers.
          (j) “Services” means the specific services provided by VeriCenter as
described on the Order Forms.
          (k) “Service Commencement Date” means the date VeriCenter will begin
providing the Services to Customer, as indicated in a Notice of Service
Commencement delivered by VeriCenter to Customer.
          (l) “Service Level Agreement” is the detailed definition of service
levels that VeriCenter will provide to Customer for a specific Service.
          (m) “Service Level Warranty” is described and defined in Section 5.2
of the MSA.
          (n) “Statement of Work” means the detailed descriptions of the
Professional Services attached to Order Forms.
          (o) “VeriCenter Data Center” means any of the facilities used by
VeriCenter to provide the Services.
          (p) “VeriCenter Technology” means VeriCenter’s proprietary technology,
including VeriCenter Services, software tools, hardware designs, algorithms,
software (in source and object forms), user interface designs, architecture,
class libraries, objects and documentation (both printed and electronic),
network designs, know-how, trade secrets and any related intellectual property
rights throughout the world (whether owned by VeriCenter or licensed to
VeriCenter from a third party) and also including any derivatives, improvements,
enhancements or extensions of VeriCenter Technology conceived, reduced to
practice, or developed during the term of this MSA by either party that are not
uniquely applicable to Customer or that have general applicability in the art.
          (q) The terms “written” and “in writing” mean anything reduced to a
tangible form by a party, including a printed, photocopy, facsimile or hand
written document but excluding email or other electronic formats.

     
MASTER SERVICES AGREEMENT
  Page 9 of 10
VERICENTER CONFIDENTIAL AND PROPRIETARY
   

 

--------------------------------------------------------------------------------

 

No. 0002204-QUO

EXECUTION FINAL
VeriCenter
Master Services Agreement Schedule 2.1—Standard Hourly Rates
[*]

     
MASTER SERVICES AGREEMENT
  Page 10 of 10
VERICENTER CONFIDENTIAL AND PROPRIETARY
   

[*] We are seeking confidential treatment of these terms which have been
omitted. The confidential portions have been filed separately with the
Securities and Exchange Commission.

 

--------------------------------------------------------------------------------

 

SLA # 0002204-QUO
EXECUTION FINAL
Network SLA
(VERICENTER LOGO) [d29193d2919306.gif]
This Service Level Agreement (the “SLA”) between VeriCenter, Inc. (“VeriCenter”)
and Quovadx, Inc (“Customer”) is entered into pursuant to Master Services
Agreement No. 0002204-QUO (“MSA”) between VeriCenter and the Customer.
Capitalized terms used in this SLA and not otherwise defined below shall have
the meanings given to them in the MSA.
A. Purpose and Scope
The purpose of this SLA is to define Managed Network service levels and
operational specifications that VeriCenter will provide to Customer. Specifics
as to the Service(s) (the “Services”) to be provided to the Customer are set
forth in the Order Form, which is incorporated into and made a part hereof.
Section 2.0 of the VeriCenter Roles and Responsibilities document is
incorporated herein by reference.
B. Service Levels
B.1 Managed Network
VeriCenter Managed Network environments consist of LAN and WAN infrastructures.
VeriCenter Managed Network environments will be available on a 7 (day) x 24
(hour) x 52 (week) basis, except for Scheduled Outages. VeriCenter Managed
Network environments are designed with robust architectures and production
system disciplines to ensure maximum performance and availability. VeriCenter
will continuously employ network monitoring techniques to track performance
levels of network components and systems. Network latency will be measured by
averaging sample measurements taken every five (5) minutes during a calendar
month between WAN nodes for Internet Availability. Availability will be
calculated monthly using total actual minutes available divided by total
possible minutes available. Availability calculations will exclude Scheduled
Outages for maintenance and similar scheduled downtime. Performance measurements
will exclude Customer’s collocated network equipment and Customer Premise
Equipment (CPE). VeriCenter will, at VeriCenter expense, upgrade or improve
capacity and performance levels within VeriCenter Managed Network environments
as VeriCenter, through reasonable commercial judgment, determines improvements
are warranted and necessary for availability and performance attainment. All
Managed Network modifications will follow the established change management
practices described in this SLA.
[*]
C. Remedy
C.1 Remedies
In the event that, as a direct result of VeriCenter’s actions or inactions, the
Service levels provided by VeriCenter fail to meet the specified performance
levels stated above, [*]
C.2 Exceptions
VeriCenter will have no liability for any failure to provide Services (a) during
any Scheduled Outage, (b) resulting from a Force Majeure Event, or (c) caused,
directly or indirectly, by the acts or omissions of Customer or its employees,
agents, contractors or representatives or by Customer’s or its employees’,
agents’, contractors’ or representatives’ equipment.
Without limiting the foregoing, VeriCenter is not responsible for acts or
omissions of Customer or its employees, agents, contractors or representatives
that result in failure of, or disruption to, the Services. Customer agrees that
neither Customer nor its employees, agents, contractors or representatives shall
attempt in any way to circumvent or otherwise interfere with any security
precautions or measures of VeriCenter relating to the VeriCenter Data Centers or
any other VeriCenter equipment. Any such attempts may, among other things, cause
disruption to the Services. Any disruption to the Services resulting from a
violation of these provisions shall not be an Unscheduled Outage and Customer
will have no right to any Service credit or other remedy under this SLA or
otherwise with respect to such disruption. Customer will be responsible for, and
will indemnify VeriCenter for, any damage or service interruptions caused by
Customer or its employees, agents, contractors or representatives in violation
of these provisions, including, without limitation, any damage to any VeriCenter
provided equipment. Further, the Customer will pay VeriCenter, at VeriCenter’s
then current rates, for all remedial services resulting from the Customer’s
actions.
C.3 Termination for Chronic Problems
The conditions warranting termination of Services applicable to this SLA, as
specified on the Order Form, are as follows:
[*]
D. Service Level Change Request Procedures
Either party may request changes to this SLA at any time. Since a change could
affect the fees, schedules or other terms related to this SLA or the MSA, both
the Customer and VeriCenter must approve each change, and this SLA and/or the
MSA must be appropriately amended before implementation of any change. The
change request procedure is as follows:

  NETWORK SLA   Page 1 of 2 VERICENTER CONFIDENTIAL AND PROPRIETARY    

[*] We are seeking confidential treatment of these terms which have been
omitted. The confidential portions have been filed separately with the
Securities and Exchange Commission.

 

--------------------------------------------------------------------------------

 

SLA # 0002204-QUO
EXECUTION FINAL

a)   The project manager for the requesting party will submit a change request
(“CR”) in writing. It will describe the change and include whatever rationale
and/or estimated effect the change will have on the SLA and/or the MSA.

b)   The other party’s project manager will review each CR. The project manager
will weigh the merits of the proposed change and approve it for investigation or
reject it. If rejected, the project manager will return the CR to the requesting
party, together with the reason(s) for rejection.

c)   Approval of a CR for investigation by both parties constitutes
authorization by the Customer of any fee proposed by VeriCenter to investigate
the CR for investigations taking less than 3 hours. Investigations longer than 3
hours must be estimated by VeriCenter and approved by customers authorized
representatives. During such investigation, the effect on the Monthly Fee,
Service Term or other terms of this SLA will be determined. Following completion
of such investigation, the requested change will then be approved or disapproved
for implementation.

d)   Approved changes will be incorporated into this SLA or the MSA through
written modifications, which shall be signed by duly authorized representatives
of both parties

E. Change Management
The Customer will be provided at least twenty-one (21) days prior written notice
of any changes to be made by VeriCenter that affect the Services. However, if a
shorter notification period is required, changes will be made with the agreement
of the Customer. VeriCenter will strive to minimize outages that may be caused
by a change; however, in the event that an outage is required, VeriCenter will
use best reasonable efforts to minimize the impact of the change and schedule
the outage based upon the Customer’s and VeriCenter’s requirements. If an outage
is required, such outage will be considered a Scheduled Outage. VeriCenter
intends to work with the Customer on all change management issues in order to
ensure that the Services are not affected beyond the levels set forth in this
SLA. VeriCenter reserves the right, however, to proceed with any change if it is
determined, by VeriCenter, that the change will not cause harm to the Customer’s
specific environment and/or is otherwise necessary. Customer is required to
provide prior notification to VeriCenter of any changes to its configurations
that interface with the provided Services. If necessary, VeriCenter will provide
a representative to work with the Customer to address any issues that arise
during the Customer’s configuration changes.
F. Event Notification
VeriCenter shall provide initial notice to a designated Customer’s
representative by telephone, e-mail, pager or comparable notification service
within one (1) hour of VeriCenter becoming aware of an event that has caused or
may cause an Unscheduled Outage. In the event Customer first becomes aware of
such event, Customer shall promptly provide initial notice to VeriCenter via the
Toll-Free Customer Support Number (877) 209-4572. Status reports about the event
will continue on the hour until either the event has been resolved or both
VeriCenter and the Customer have determined a course of action that does not
require continued notification.
G. Definitions
LAN (Local Area Network): Those network components and facilities that are
installed within VeriCenter Data Centers providing local connectivity to
installed equipment, and that are owned and managed by the VeriCenter Operations
Group and made available to subscribers of VeriCenter services.
Managed Network: The system of LAN and WAN environments utilized by VeriCenter
Data Centers.
Monthly Fee: The monthly fee for a Service as set forth in the Order Form for
that Service.
Scheduled Outages: The six-hour period of time between 0:00 (AM Mountain Time)
each Sunday until 6:00 (AM Mountain Time) that Sunday, during the Service Term,
during which VeriCenter temporarily interrupts any Services for upgrades,
maintenance, or for any other agreed upon reason or purpose, including an
established framework for scheduling and managing such outages.
Service Term: The minimum term for which VeriCenter will provide the Service to
Customer as set forth in the Order Form for that Service.
Unscheduled Outages: Interruptions in Services outside of the agreed-upon
Scheduled Outage, for any reason, including arising from failures associated
with Services provided by VeriCenter or a Force Majeure Event. Unscheduled
Outage shall not include any outage primarily caused by Customer or its
employees or agents.
VeriCenter Operations Group: The VeriCenter Operations Group, responsible for
the daily delivery and management of Services provided to the Customer.
WAN (Wide Area Network): Those network components and facilities that are
installed at the boundaries of VeriCenter Data Centers providing connectivity to
external or remote networks and equipment and made available to subscribers of
VeriCenter services.

By the signatures of their duly authorized representatives below, VeriCenter and
Customer, intending to be legally bound, agree to all of the provisions of this
SLA.

              CUSTOMER: QUOVADX, INC.   VERICENTER, INC.
 
           
Signature:
  /s/ Mark Rangell   Signature:   /s/ Michael Sullivan
 
           
Print Name:
  Mark Rangell   Print Name:   Michael Sullivan
 
           
Title:
  Executive Vice President   Title:   SVP Sales
 
           
Date:
  9/30/2005   Date:   10/3/05

This Service Level Agreement incorporates the following documents

•   Order Form [*]   •   VeriCenter Roles and Responsibilities, Section 2.0 [*]

     
NETWORK SLA
  Page 2 of 2
VERICENTER CONFIDENTIAL AND PROPRIETARY
   

[*] We are seeking confidential treatment of these terms which have been
omitted. The confidential portions have been filed separately with the
Securities and Exchange Commission.

 

--------------------------------------------------------------------------------

 

SLA # 0002204-QUO
EXECUTION FINAL
Facility Availability SLA
(VERICENTER LOGO) [d29193d2919306.gif]
This Service Level Agreement (the “SLA”) between VeriCenter, Inc. (“VeriCenter”)
and Quovadx, Inc (“Customer”) is entered into pursuant to Master Services
Agreement No. 0002204-QUO (“MSA”) between VeriCenter and the Customer.
Capitalized terms used in this SLA and not otherwise defined below shall have
the meanings given to them in the MSA.
A. Purpose and Scope
The purpose of this SLA is to define Facility Availability service levels and
operational specifications that VeriCenter will provide to Customer. Specifics
as to the Service(s) (the “Services”) to be provided to the Customer are set
forth in the Order Form, which is incorporated into and made a part hereof.
Section 1.0 of the VeriCenter Roles and Responsibilities document is
incorporated herein by reference.
B. Service Levels
B.1 Facility Availability
VeriCenter Data Centers will be available on a 7 (day) x 24 (hour) x 52
(week) basis, except for Scheduled Outages. VeriCenter Data Centers are designed
with environmental support system redundancy and managed environmental system
infrastructures that provide for un-interruptible power and cooling for all
components within such VeriCenter Data Center. VeriCenter will continuously
monitor capacity levels for power generation, cooling, and un-interruptible
power supply systems at VeriCenter Data Centers. VeriCenter will, at VeriCenter
expense, upgrade or improve capacity levels within VeriCenter Data Centers as
necessary. Capacity upgrades will follow the established change management
practices described in this SLA. VeriCenter’s performance level for Facility
Availability is set as 99.99% available. Availability will be calculated monthly
using total actual minutes available divided by total possible minutes
available. Availability calculations will exclude Scheduled Outages for
maintenance and similar scheduled downtime.
C. Remedy
C.1 Remedies
In the event that, as a direct result of VeriCenter’s actions or inactions, the
Service Levels provided by VeriCenter fail to meet the specified performance
levels,
[*]
C.2 Exceptions
VeriCenter will have no liability for any failure to provide Services (a) during
any Scheduled Outage, (b) resulting from a Force Majeure Event, or (c) caused,
directly or indirectly, by the acts or omissions of Customer or its employees,
agents, contractors or representatives or by Customer’s or its agents’,
contractors’ or representatives’ equipment.
Without limiting the foregoing, VeriCenter is not responsible for acts or
omissions of Customer or its employees, agents, contractors or representatives
that result in failure of, or disruption to, the Services. Customer agrees that
neither Customer nor its employees, agents, contractors or representatives shall
attempt in any way to circumvent or otherwise interfere with any security
precautions or measures of VeriCenter relating to the VeriCenter Data Centers or
any other VeriCenter equipment. Any such attempts may, among other things, cause
disruption to the Services. Any disruption to the Services resulting from a
violation of these provisions shall not be an Unscheduled Outage and Customer
will have no right to any Service credit or other remedy under this SLA or
otherwise with respect to such disruption. Customer will be responsible for, and
will indemnify VeriCenter for, any damage or service interruptions caused by
Customer or its employees, agents, contractors or representatives in violation
of these provisions, including, without limitation, any damage to any VeriCenter
provided equipment. Further, the Customer will pay VeriCenter, at VeriCenter’s
then current rates, for all remedial services resulting from the Customer’s
actions.
C.3 Termination for Chronic Problems
The conditions warranting termination of Services applicable to this SLA, as
specified on the Order Form, are as follows:
[*]
D. Service Level Change Request Procedures
Either party may request changes to this SLA at any time. Since a change could
affect the fees, schedules or other terms related to this SLA or the MSA, both
the Customer and VeriCenter must approve each change, and this SLA and/or the
MSA must be appropriately amended before implementation of any change. The
change request procedure is as follows:

a)   The project manager for the requesting party will submit a change request
(“CR”) in writing. It will describe the change and include

  FACILITY AVAILABILITY SLA   Page 1 of 2 VERICENTER CONFIDENTIAL AND
PROPRIETARY    

[*] We are seeking confidential treatment of these terms which have been
omitted. The confidential portions have been filed separately with the
Securities and Exchange Commission.

 

--------------------------------------------------------------------------------

 

SLA # 0002204-QUO
EXECUTION FINAL
whatever rationale and/or estimated effect the change will have on the SLA
and/or the MSA.

b)   The other party’s project manager will review each CR. The project manager
will weigh the merits of the proposed change and approve it for investigation or
reject it. If rejected, the project manager will return the CR to the requesting
party, together with the reason(s) for rejection.

c)   Approval of a CR for investigation by both parties constitutes
authorization by the Customer of any fee proposed by VeriCenter to investigate
the CR. During such investigation, the effect on the Monthly Fee, Service Term
or other terms of this SLA will be determined. Following completion of such
investigation, the requested change will then be approved or disapproved for
implementation.

d)   Approved changes will be incorporated into this SLA or the MSA through
written modifications, which shall be signed by duly authorized representatives
of both parties.

E. Change Management
The Customer will be provided at least twenty-one (21) days prior written notice
of any changes to be made by VeriCenter that affect the Services. However, if a
shorter notification period is required, changes will be made with the agreement
of the Customer. VeriCenter will strive to minimize outages that may be caused
by a change; however, in the event that an outage is required, VeriCenter will
use best reasonable efforts to minimize the impact of the change and schedule
the outage based upon the Customer’s and VeriCenter’s requirements. If an outage
is required, such outage will be considered a Scheduled Outage. VeriCenter
intends to work with the Customer on all change management issues in order to
ensure that the Services are not affected beyond the levels set forth in this
SLA. VeriCenter reserves the right, however, to proceed with any change if it is
determined, by VeriCenter, that the change will not cause harm to the Customer’s
specific environment and/or is otherwise necessary. Customer is required to
provide prior notification to VeriCenter of any changes to its configurations
that interface with the provided Services. If necessary, VeriCenter will provide
a representative to work with the Customer to address any issues that arise
during the Customer’s configuration changes.
F. Event Notification
VeriCenter shall provide initial notice to a designated Customer’s
representative by telephone, e-mail, pager or comparable notification service
within one (1) hour of VeriCenter becoming aware of an event that has caused or
may cause an Unscheduled Outage. In the event Customer first becomes aware of
such event, Customer shall promptly provide initial notice to VeriCenter via the
Toll-Free Customer Support Number (877) 209-4572. Status reports about the event
will continue on the hour until either the event has been resolved or both
VeriCenter and the Customer have determined a course of action that does not
require continued notification.
G. Definitions
Facility Availability: The availability of VeriCenter Data Centers.
Monthly Fee The monthly fee for a Service as set forth in the Order Form for
that Service.
Scheduled Outages: The six-hour period of time between 0:00 (AM Mountain Time)
each Sunday until 6:00 (AM Mountain Time) that Sunday, during the Service Term,
during which VeriCenter temporarily interrupts any Services for upgrades,
maintenance, or for any other agreed upon reason or purpose, including an
established framework for scheduling and managing such outages.
Service Term The minimum term for which VeriCenter will provide the Service to
Customer as set forth in the Order Form for that Service.
Unscheduled Outages: Any interruptions in Services outside of the agreed-upon
Scheduled Outage, for any reason, including arising from failures associated
with Services provided by VeriCenter or a Force Majeure Event. Unscheduled
Outage shall not include any outage primarily caused by Customer or its
employees or agents.
By the signatures of their duly authorized representatives below, VeriCenter and
Customer, intending to be legally bound, agree to all of the provisions of this
SLA.

              CUSTOMER: QUOVADX, INC.   VERICENTER, INC.
 
           
Signature:
  /s/ Mark Rangell   Signature:   /s/ Michael Sullivan
 
           
Print Name:
  Mark Rangell   Print Name:   Michael Sullivan
 
           
Title:
  Executive Vice President   Title:   SVP Sales
 
           
Date:
  9/30/2005   Date:   10/3/05

This Service Level Agreement incorporates the following documents:

•   Order Form [*]   •   VeriCenter Roles and Responsibilities [*]

     
FACILITY AVAILABILITY SLA
  Page 2 of 2
VERICENTER CONFIDENTIAL AND PROPRIETARY
   

[*] We are seeking confidential treatment of these terms which have been
omitted. The confidential portions have been filed separately with the
Securities and Exchange Commission.

 

--------------------------------------------------------------------------------

 

SLA 00002139-xxx
EXECUTION FINAL
Application Availability SLA
(VERICENTER LOGO) [d29193d2919307.gif]
This Service Level Agreement (the “SLA”) between VeriCenter, Inc. (“VeriCenter”)
and (“Customer”) is entered into pursuant to Master Services Agreement (MSA) NO.
000. Capitalized terms used in this SLA and not otherwise defined below shall
have the meanings given to them in the MSA.
A. Purpose and Scope
The purpose of this SLA is to: (1) provide an overview of VeriCenter’s
operational services in support of Application Availability, (2) define target
Application Availability service levels, and (3) define appropriate remedies.
The VeriCenter Roles and Responsibilities document is incorporated herein by
reference.
B. Overview of Operational Services
B.1.5 Summary of Operational Services:

      Rapid Secure Operating System Servers Storage Networking Facilities

This section summarizes VeriCenter’s operational services in support of
Application Availability. ACTUAL SERVICES TO BE PROVIDED ARE DETAILED IN THE
ROLES AND RESPONSIBILITIES (“R&R”) ADDENDUM AND ARE HEREAFTER REFERRED TO AS THE
“Services.”
B.1 General Services
VeriCenter Managed Services environments will be available on a 7 (day) x 24
(hour) x 52 (week) basis, except for Scheduled Outages. VeriCenter will
administer changes, microcode upgrades and/or other hardware/software
improvements/upgrades on behalf of Customer in accordance with the Change
Management and Change Request procedures set forth herein.
B.1.1 Facilities Service
VeriCenter Data Centers are designed with environmental support system
redundancy and managed environmental system infrastructures that provide for
un-interruptible power and cooling for all components within such VeriCenter
Data Center. VeriCenter will continuously monitor capacity levels for power
generation, cooling, and un-interruptible power supply systems at VeriCenter
Data Centers. VeriCenter will, at VeriCenter expense, upgrade or improve
capacity levels within VeriCenter Data Centers as necessary.
B.1.2 Network Services
VeriCenter Managed Network environments consist of LAN and WAN infrastructures.
VeriCenter Managed Network environments are designed with robust architectures
and production system disciplines to ensure maximum performance and
availability. VeriCenter will provide monitoring services of the network
hardware at the VeriCenter Data Centers. These monitoring services include the
monitoring of routers, switches and other networking equipment required to
deliver network services.
B.1.3 Storage Services
VeriCenter will provide monitoring services of the storage hardware at the
VeriCenter Data Centers. These monitoring services include periodic monitoring
of disk performance, cache memory usage and related performance metrics
available through vendor tools. VeriCenter will advise the Customer when
appropriate of any issues with the performance of communications or storage
hardware required for the delivery of these services such as signal quality
loss, error retransmissions, disk failures, and power or microcode failures.
B.1.4 Managed Server Services
VeriCenter Managed Servers will be available on a 7 (day) x 24 (hour) x 52
(week) basis, except for Scheduled Outages. VeriCenter Managed Server
environments are designed with robust architectures and production system
disciplines to ensure maximum performance and availability. VeriCenter will
continuously employ production system disciplines and monitor capacity and
performance levels for Managed Server environments.
C. Services (Check the Applicable Operational Services Option)
C.1.1 þ Rapid Secure Services
VeriCenter Rapid Secure services provide firewall and intrusion detection
protection while allowing remote access to the Customer’s Environment over the
Internet. The Rapid Secure option includes operating system responsibility.
D. Application Availability and Remedies
D.1 Target Application Availability Level
VeriCenter’s Target Application Availability level is 99.5%
D.2 Remedies
In the event that, as a direct result of VeriCenter’s actions or inactions with
respect to its performance of the Services (as detailed in the R&R addendum),
VeriCenter fails to meet the target Application Availability level, [*]
Such service credit shall be deemed to be liquidated damages, and in no event
will the total Managed Service Credit exceed [*] This credit will be in the form
of a credit memo or a cash payment if this service has been discontinued /
expired or if it has otherwise been terminated in accordance with the provisions
of the MSA.
D.2 Exceptions
VeriCenter will have no liability for any failure to provide Services (a) during
any Scheduled Outage, (b) resulting from a Force Majeure Event, or (c) caused,
directly or indirectly, by the acts or omissions of
[*] We are seeking confidential treatment of these terms which have been
omitted. The confidential portions have been filed separately with the
Securities and Exchange Commission.

 

--------------------------------------------------------------------------------

 

EXECUTION FINAL
Customer or its employees, agents, contractors or representatives or by
Customer’s or its employees’, agents’, contractors’ or representatives’
equipment.
Without limiting the foregoing, VeriCenter is not responsible for acts or
omissions of Customer’s employees, agents, contractors or representatives that
result in failure of, or disruption to, the Services. Customer agrees that
neither Customer nor its employees, agents, contractors or representatives shall
attempt in any way to circumvent or otherwise interfere with any security
precautions, procedural controls, Acceptable Use Policy, Change Request
Management, Problem Management or other measures of VeriCenter relating to the
VeriCenter offered services. Any such actions may, among other things, cause
disruption to the Services. Any disruption to the Services resulting from a
violation of these provisions shall not be an Unscheduled Outage and Customer
will have no right to any Service credit or other remedy under this SLA or
otherwise with respect to such disruption. Customer will be responsible for, and
will indemnify VeriCenter for, any damage or service interruptions caused by
Customer or its employees, agents, contractors or representatives in violation
of these provisions, including, without limitation, any damage to any VeriCenter
provided equipment or other affected customers. Further, the Customer will pay
VeriCenter, at VeriCenter’s then current rates, for all remedial services
resulting from the Customer’s actions.
D.3 Termination for Chronic Problems
The conditions warranting termination of Services applicable to this SLA, as
specified on the Order Form and Roles & Responsibilities documents are as
follows:
[*]
E. Service Level Change Request Procedures
Either party may request changes to this SLA at any time. Since a change could
affect the fees, schedules or other terms related to this SLA or the MSA, both
the Customer and VeriCenter must approve each change, and this SLA and/or the
MSA must be appropriately amended before implementation of any change. The
change request procedure is as follows:

a)   The project manager for the requesting party will submit a change request
(“CR”) in writing. It will describe the change and include whatever rationale
and/or estimated effect the change will have on the SLA and/or the MSA.

b)   The other party’s project manager will review each CR. The project manager
will weigh the merits of the proposed change and approve it for investigation or
reject it. If rejected, the project manager will return the CR to the requesting
party, together with the reason(s) for rejection.

c)   Approval of a CR for investigation by both parties constitutes
authorization by the Customer of any fee proposed by VeriCenter to investigate
the CR for investigations taking less than 3 hours. Investigations longer than 3
hours must be estimated by VeriCenter and approved by customers authorized
representatives. During such investigation, the effect on the Monthly Fee,
Service Term or other terms of this SLA will be determined. Following completion
of such investigation, the requested change will then be approved or disapproved
for implementation.

d)   Approved changes will be incorporated into this SLA or the MSA through
written modifications, which shall be signed by duly authorized representatives
of both parties

F. Change Management
The Customer will be provided at least Twenty-one (21) days prior written notice
of any changes to be made by VeriCenter that affect the Services. However, if a
shorter notification period is required, changes will be made with the agreement
of the Customer. VeriCenter will strive to minimize outages that may be caused
by a change; however, in the event that an outage is required, VeriCenter will
use best reasonable efforts to minimize the impact of the change and schedule
the outage based upon the Customer’s and VeriCenter requirements. If an outage
is required, such outage will be considered a Scheduled Outage. VeriCenter
intends to work with the Customer on all change management issues in order to
ensure that the Services are not affected beyond the levels set forth in this
SLA. VeriCenter reserves the right, however, to proceed with any change if it is
determined, by VeriCenter, that the change will not cause harm to the Customer’s
specific environment and/or is otherwise necessary. Customer is required to
provide prior notification to VeriCenter of any changes to its configurations
that interface with the provided Services. If necessary, VeriCenter will provide
a representative to work with the Customer to address any issues that arise
during the Customer’s configuration changes.
G. Event Notification
VeriCenter shall provide initial notice to a designated Customer’s
representative by telephone, e-mail, pager or comparable notification service
within one (1) hour of VeriCenter becoming aware of an event that has caused or
may cause an Unscheduled Outage that effects service. In the event Customer
first becomes aware of such event, Customer shall promptly provide initial
notice to VeriCenter via the Toll-Free Customer Support Number (877) 209-4572.
Status reports about the event will continue on the hour until either the event
has been resolved or both VeriCenter and the Customer have determined a course
of action that does not require continued notification.
H. Reporting
VeriCenter shall provide monthly reports to Customer covering the performance of
the following:
Application Availability: Through VeriCenter’s Monitoring and Customer Service
tools, any outage is reported to determine the availability of your
subscription. We take the total number of unavailable minutes (if any), subtract
them from the total minutes within the month, and finally divide the total
available minutes by the month’s total minutes to determine your subscription’s
availability. The report will cover Total Application Availability, VeriCenter
Environment Availability, and Customer Application Availability.
Bandwidth Utilization: Bandwidth samples are taken every 5 minutes, resulting in
288 daily samples and totaling approximately 8640 samples per month. Those
samples are then added / averaged to derive total measured bandwidth, average,
incoming, and outgoing utilization rates.
Customer Service Performance: By tracking all calls/emails that come in to the
Support Center, and the tickets that are generated from those calls – we are
able to provide you with information regarding the number of tickets opened,
closed on first contact, closed, and still open. In addition we provide you with
a breakdown of the types of calls/emails received, and who generated the
requests.

     
APPLICATION AVAILABILITY SLA
  Page 2 of 3
VERICENTER CONFIDENTIAL AND PROPRIETARY
   

[*] We are seeking confidential treatment of these terms which have been
omitted. The confidential portions have been filed separately with the
Securities and Exchange Commission.

 

--------------------------------------------------------------------------------

 

EXECUTION FINAL
Incident Detail: Each month data is extracted from the Customer Support Centers
Incident reporting system to provide you the detail of each incident that was
called or emailed to the Customer Support Center. You will find all details of
when the incident ticket was opened, closed, and all activities that occurred
between the opening and closing of the ticket.
I. Definitions
Application Availability: Calculated by dividing the total number of minutes in
a month by the number of minutes that the application was available. VeriCenter
will track all incidents that affect the Application Availability but is only
responsible for the elements outlined in the R&R. This is to say that problems
with the application that result in an outage will be recorded for tracking
purposes but will not be used in the calculation of the Environment Availability
uptime percentage which is used to pay remedies.
Environment: The infrastructure components defined in the Order Form that run
Customer’s application(s).
LAN (Local Area Network): Those network components and facilities that are
installed within VeriCenter Data Centers providing local connectivity to
installed equipment, and that are owned and managed by the VeriCenter Operations
Group and made available to subscribers of VeriCenter services.
Managed Network: The management and support of the infrastructure used to
provide the Local Area Network (LAN) and Wide Area Network (WAN) services.
Managed Services: The service, provided by VeriCenter to the Customer that is
required to deliver the contracted service as outlined in the Order Form and
Roles & Responsibilities documents.
Monthly Fee: The monthly fee for a Service as set forth in the Order Form for
that Service.
Rapid Secure: The security model, designed by VeriCenter to allow customers the
benefits of firewall and intrusion detection services as well as enabling the
customer remote access into the systems. This product offering requires that
VeriCenter allow remote access to the customers systems therefore limits the
level of SLA that VeriCenter is able to provide. The limited SLA is dues to the
fact that the customer has both access and control of the systems. This SLA
includes all base services components and hardware but does not include any
application software that is being used.
Scheduled Outages: The six-hour period of time between 0:00 (AM Mountain Time)
each Sunday until 6:00 (AM Mountain Time) that Sunday, during the Service Term,
during which VeriCenter temporarily interrupts any Services for upgrades,
maintenance, or for any other agreed upon reason or purpose, including an
established framework for scheduling and managing such outages.Service Term: The
minimum term for which VeriCenter will provide the Service to Customer as set
forth in the Order Form for that Service.
Site Vault: The security model designed by VeriCenter to provide customers with
the benefits of firewall and intrusion detection services but restricts the
customers’ access to administer the systems. This product offering requires that
the customer allow only VeriCenter to have access to the systems. This limited
access to the servers by the customer allows VeriCenter to provide a more
comprehensive SLA that includes the availability of the operating system.
Managed Service Credit: A credit, which the Customer can apply for if a service
is temporarily unavailable and the outage is outside of the stated SLA
availability percentage.
Unscheduled Outages: Any interruptions in Services outside of the agreed-upon
Scheduled Outage, for any reason, including arising from failures associated
with Services provided by VeriCenter or a Force Majeure Event. Unscheduled
Outage shall not include any outage primarily caused by Customer or its
employees or agents.
VeriCenter Operations Group: The VeriCenter Operations Group, responsible for
the daily delivery and management of Services provided to the Customer.
WAN (Wide Area Network): Those network components and facilities that are
installed at the boundaries of VeriCenter Data Centers providing connectivity to
external or remote networks and equipment and made available to subscribers of
VeriCenter services.
By the signatures of their duly authorized representatives below, VeriCenter and
Customer, intending to be legally bound, agree to all of the provisions of this
SLA.

              CUSTOMER: QUOVADX, INC.   VERICENTER, INC.
 
           
Signature:
  /s/ Mark Rangell   Signature:   /s/ Michael Sullivan
 
           
Print Name:
  Mark Rangell   Print Name:   Michael Sullivan
 
           
Title:
  Executive Vice President   Title:   SVP Sales
 
           
Date:
  9/30/2005   Date:   10/3/05

This Service Level Agreement incorporates the following documents:

  •   Order Form [*]     •   VeriCenter Roles & Responsibilities [*]     •  
Outage Flow Chart     •   Check Out Procedures (COP’s) – To Be Provided by
Customer Upon Implementation

     
APPLICATION AVAILABILITY SLA
  Page 3 of 3
VERICENTER CONFIDENTIAL AND PROPRIETARY
   

[*] We are seeking confidential treatment of these terms which have been
omitted. The confidential portions have been filed separately with the
Securities and Exchange Commission.

 

--------------------------------------------------------------------------------

 

SLA # 0002204-QUO
EXECUTION FINAL
Operational Performance SLA
(VERICENTER LOGO) [d29193d2919306.gif]
This Service Level Agreement (the “SLA”) between VeriCenter, Inc. (“VeriCenter”)
and Quovadx, Inc (“Customer”) is entered into pursuant to Master Services
Agreement (MSA) No.0002204-QUO between VeriCenter and the Customer. Capitalized
terms used in this SLA and not otherwise defined below shall have the meanings
given to them in the MSA.
A. Purpose and Scope
The purpose of this SLA is to: (1) provide an overview of VeriCenter’s
operational services that support Customer’s application Environment, (2) define
target performance service levels for those services, and (3) define appropriate
remedies. The VeriCenter Roles and Responsibilities document is incorporated
herein by reference.
B. Overview of Operational Services
This section summarizes VeriCenter’s operational services that support Customer
application Environment. The services described in this section and the
Monitoring Section of the Roles and Responsibilities (“R&R”) Addendum are
hereafter referred to as the “Services.”
B.1 Monitoring Services
VeriCenter Monitoring systems are defined as hardware and software probes,
sniffers, agents, applications and utilities that are owned and managed by the
VeriCenter Operations Group and installed within VeriCenter Data Centers, that
monitor, collect, process and report on information associated with the
characteristics of VeriCenter Data Center computer system environments.
VeriCenter Monitoring systems are designed to provide early warning notification
and alerts, as well as initiate pre-defined corrective actions or trouble
avoidance procedures and processes, when thresholds are reached or triggers are
activated. VeriCenter Monitoring systems will be available on a 7 (day) x 24
(hour) x 52 (week) basis, except for Scheduled Outages. VeriCenter will, at
VeriCenter’s expense, upgrade or improve capabilities of VeriCenter Monitoring
system environments as VeriCenter, through reasonable commercial judgment,
determines improvements are warranted and necessary to maintain Monitoring
systems integrity and performance. All Monitoring systems modifications will
follow the established change management practices described in this SLA.
VeriCenter’s Monitoring services will be delivered in two (2) Tiers or
categories of service, with different performance objectives as follows:
B.1.1 Tier 1 Monitoring – Base level monitoring of major components and systems
within the subscribed services configuration including component and system
condition assessment (up or down) and basic network connectivity (responds or
does not respond). Recognition of abnormal conditions will be made within five
(5) minutes and abnormal conditions will be reported to the Customer by phone or
e-mail within 60 minutes of the recognition. Recovery procedures will be
initiated immediately, were applicable. Status reports will be hourly until
normal conditions are restored.
B.1.2 Tier 2 Monitoring – Intelligent monitoring of major components and systems
within the subscribed services configuration including component and system
condition assessment (up or down) and basic network connectivity (responds or
does not respond), as well as supported operating system, supported operating
system services and supported data base conditions. Recognition of abnormal
conditions will be made within five (5) minutes and abnormal conditions will be
reported to the Customer by phone or e-mail within 60 minutes of the
recognition.
Recovery procedures will be initiated immediately, where applicable. Status
reports will be hourly until normal conditions are restored. Historical event
logging and trending reports will be provided to Customers monthly.
B.2 Facility Services
VeriCenter shall provide initial notice to a designated Customer’s
representative by telephone, e-mail, pager or comparable notification service
within one (1) hour of VeriCenter becoming aware of an event that has caused or
may cause an Unscheduled Outage. In the event Customer first becomes aware of
such event, Customer shall promptly provide initial notice to VeriCenter via the
Toll-Free Customer Support Number (877) 209-4572. Status reports about the event
will continue on the hour until either the event has been resolved or both
VeriCenter and the Customer have determined a course of action that does not
require continued notification.
B.3 Backup Services
Backup services will be measured on an exception basis. The table below
summarizes the standard policy for handling common exceptions and events.

      Exception/Event   VeriCenter Policy
Backup Exceeds Window (due to capacity growth or Backup Client Server processing
constraints)
  Default Action. VeriCenter will reschedule job start time within the policy
window, and/or split the job into multiple parallel streams, to rectify problem.

Alternative: If above is not successful, VeriCenter will contact the Customer to
arrange for an acceptable policy exception for the Backup Client involved.
 
   
File Open/Not backed up
  No action.
File will be picked up on the next scheduled backup. Files which are never
closed will never be backed up without the purchase of additional services when
an alterative exists. Reasonable efforts will be made to backup open files or
work with Customer to find a solution.
 
   
Backup Client Not Accessible
  Notify Customer.
Backup will automatically pick up the next day’s schedule except if a Full
Backup is missed. The next day a Full Backup will be completed subject to
Customer limitations.
 
   
Tape or drive Failure
  Restart Job.
VeriCenter will reallocate a different drive and restart the job unless previous
restrictions are defined for that Backup Client Server by the Customer.
 
   
Unable to restore from tape
  Attempt Alternate Restore, Contact Customer
VeriCenter will attempt to restore the file from a different/previous backup
job. The Customer will be notified of the failure and will verify which
alternate file should be used, if any. Notice will be provided within the
restore initiation window defined for the particular file.

VeriCenter warrants that it will routinely back-up all Customer data and systems
and that it will use reasonable and industry standard backup technology and
procedures in performing all routine back-ups for Customer. VeriCenter warrants
that it will use industry standard technology and procedures to verify all
back-ups mirror accurately the files on each operational disk.

  VERICENTER CONFIDENTIAL AND PROPRIETARY   Page 1

 

--------------------------------------------------------------------------------

 

SLA # 0002204-QUO
EXECUTION FINAL
VeriCenter does not warrant the validity of the data that is being backed up.
B.4 Support Performance
Following are the baseline services offered by the VeriCenter Customer Service
Center.
B.4.1 Easy Access to Support — Described below are several tools that have been
put in place to allow a Caller easy access to a Customer Support Representative
(CSR).
B.4.1.i VeriCenter Customer Service Center Help Line - Callers need easy access
to a CSR. The VeriCenter Customer Service Center Help Line allows a Caller to
access the VeriCenter Customer Service Center team through an automated
attendant. The number for the VeriCenter Customer Service Center Help Line is:
Toll Free Number: 877-209-4572
B.4.1.ii Voice Mailbox – If all CSR’s are busy, and a Caller has been holding
for 30 seconds, the Caller is given an option to continue holding or to be
routed to a voice mailbox. This mailbox is checked every 15 minutes 24 hours per
day, 7 days per week, and the CSR’s will return calls promptly, as appropriate.
B.4.1.iii E-Mail Mailbox – For customers desiring to contact VeriCenter Customer
Service Center through electronic mail, Service Requests will be accepted that
are prioritized as MED or LOW. This mailbox is checked regularly, 24 hours per
day, 7 days per week and calls returned within an hour as appropriate. It is
recommended that Severity Level 1 and 2 requests not rely on this service due to
slower response times. customerservice@vericenter.com
B.4.1.iv Service Request Ownership/Resolution — Once a CSR receives a call and
entitlement has been established the representative is responsible for its
resolution or its escalation. Thus the representative is responsible for logging
the call, providing the customer with the corresponding Service Request Number,
trouble-shooting the Service Request, and escalating the call if necessary. The
CSR will maintain the responsibility for determining the resolution,
communicating the resolution back to the Caller, and recording the resolution in
the VeriCenter Customer Service Center tracking database. If a CSR receives a
call that is not supported by the team, the representative is responsible for
helping the individual get to the right place for support.
B.4.1.v Knowledge Management — As noted above, the CSR is responsible for
logging the Service Request. It is each team’s responsibility to keep a current
and accurate base of knowledge that will assist in future Service Request
resolutions.
B.4.2 Service Elements
Below are the service elements between the Customer and the VeriCenter Customer
Service Center.
B.4.2.i Hours of Operation – The VeriCenter Customer Service Center’s hours of
operation are:
Regular Business Hours:
Monday – Friday:
7:00AM – 7:00PM CST
After Business Hours:

     
 
  Monday – Friday:
 
  7:00PM – 7:00AM CST
 
  Saturday – Sunday:
 
  All Day

B.4.2.ii Priority Definitions — The prioritization of a Service request is very
important and is the foundation of VeriCenter escalation process. A call’s
priority determines how quickly a call is resolved and/or escalated. During the
initial call, the CSR will inquire into the nature and urgency of the Service
Request in order to assign the appropriate priority. Afterwards, the CSR and
Caller will agree upon what priority the call is to be given. Call priorities
are:

              Severity       First Level   Second Level Levels   Description of
Severity   Escalation   Escalation
1
  An outage of a defined customer environment. This is treated with the highest
level of support and service.   5 Min.   1 Hr.
 
           
2
  An outage that affects functionality but does not leave the customer defined
environment non-functional. This type of outage is treated with a high level of
support and service.   1 Hr.   4 Hrs.
 
           
3
  A request by the customer to perform a task or operation, which is important
but not critical to ongoing operations   3 Hrs.   8 Hrs.
 
           
4
  A request by the customer to perform a task or operation, of convenience   8
Hrs.   48 Hrs.

B.4.3 Internal Escalation Procedures — When a CSR determines that a call needs
to be escalated; the call is marked as such in the tracking database. If a call
is severity 1 priority, every attempt will be made to perform ‘live’ escalation
via phone or direct contact. For severity 2 — 4 priority calls, escalations are
made through the call-tracking system.
B.4.4 External Escalation Procedures – When it is necessary for a CSR to
escalate a Service Request to an escalation partner outside of VeriCenter, then
the service level priority expectations for problem resolution will vary. The
CSR will inform the customer of such proceedings and will keep the customer
updated continually until the Service Request has been resolved.
B.4.5 Caller’s Responsibilities — It is the Caller’s responsibility to provide
as much detail as possible on the Service Request. In addition, the Caller needs
to be open to the CSR’s suggestions as they work together toward problem
resolution. In most instances, the customer is part of the escalation process.
The customer must commit resources to helping resolve escalated Service Requests
to meet the agreed-upon service levels. Finally, the Caller is responsible for
returning the representative’s phone call or e-mail message if additional
information or documentation is needed

  VERICENTER CONFIDENTIAL AND PROPRIETARY   Page 2

 

--------------------------------------------------------------------------------

 

SLA # 0002204-QUO
EXECUTION FINAL
B.4.6 Communication - Support is a team effort. It is imperative that continuous
communication and feedback exist between parties to provide quick resolution to
Service Requests.
B.5 Security Services:
B.5.1 Physical Access: Physical access to VeriCenter Data Centers is controlled
by the VeriCenter Operations Group and is restricted to authorized VeriCenter
employees and those individuals specifically approved and authorized by
VeriCenter who are accompanied by VeriCenter’s personnel or who have properly
issued access badges. Access by the Customer will be limited to Representatives
of the Customer designated in the Customer Registration Form, which is hereby
incorporated by reference. If the Customer wishes to gain access to a VeriCenter
Data Center, arrangements must be made in advance with VeriCenter (typically a
phone call on the day requested). At all times a VeriCenter employee must escort
Customer’s Representatives unless other arrangements have been made and an
access badge properly issued. All changes to the Customer’s Representatives
designated in the Customer Registration Form must be confirmed with VeriCenter
in writing at least one (1) day prior to access to the facility for any new
Representative.
B.5.2 Electronic Access: Electronic access to VeriCenter’s data center
environments will be secured through the deployment and utilization of best of
breed redundant firewall borders, network intrusion monitors, Operating System
security parameters, anti-virus software and security policy administration.
VeriCenter will continually monitor and track intrusion attempts, virus threats
and other security breaches, both internal and external, and take appropriate
actions should vulnerabilities be identified. Formal logging and reporting of
all security breaches will be performed.
B.5.3 Access to Customer’s Facilities: VeriCenter may require security clearance
and access to the Customer’s facility to install and maintain VeriCenter’s
equipment. VeriCenter will comply with all requirements deemed necessary by the
Customer for VeriCenter’s personnel and contractors to gain access to the
Customer’s facility. VeriCenter will be responsible for all work performed by
VeriCenter’s personnel and contractors while on Customer’s premises.
B.6 Summary of Services:

                  Initial Problem             Notification /   Initial Customer
    Service Type   Recognition   Contact   Status Updates
Facility
  5 Min.   1 Hr   Hourly
Monitoring
  5 Min.   1 Hr   Hourly
Backup
  N/A   Exception Based   Exception Based
Security
  Best Efforts   Best Efforts   Best Efforts
Support
  N/A   N/A   N/A

C. Remedy
C.1 Responsiveness
[*]
C.2 Exceptions
VeriCenter will have no liability for any failure to provide Services (a) during
any Scheduled Outage, (b) resulting from a Force Majeure Event, or (c) caused,
directly or indirectly, by the acts or omissions of Customer or its employees,
agents, contractors or representatives or by Customer’s or its employees’,
agents’, contractors’ or representatives’ equipment.
Without limiting the foregoing, VeriCenter is not responsible for acts or
omissions of Customer’s employees, agents, contractors or representatives that
result in failure of, or disruption to, the Services. Customer agrees that
neither Customer nor its employees, agents, contractors or representatives shall
attempt in any way to circumvent or otherwise interfere with any security
precautions, procedural controls, Acceptable Use Policy, Change Request
Management, Problem Management or other measures of VeriCenter relating to the
VeriCenter offered services. Any such actions may, among other things, cause
disruption to the Services. Any disruption to the Services resulting from a
violation of these provisions shall not be an Unscheduled Outage and Customer
will have no right to any Service credit or other remedy under this SLA or
otherwise with respect to such disruption. Customer will be responsible for, and
will indemnify VeriCenter for, any damage or service interruptions caused by
Customer or its employees, agents, contractors or representatives in violation
of these provisions, including, without limitation, any damage to any VeriCenter
provided equipment or other affected customers. Further, the Customer will pay
VeriCenter, at VeriCenter’s then current rates, for all remedial services
resulting from the Customer’s actions.
C.3 Termination for Chronic Problems
The conditions warranting termination of Services applicable to this SLA, as
specified on the Order Form, are as follows:
[*]
D. Service Level Change Request Procedures
Either party may request changes to this SLA at any time. Since a change could
affect the fees, schedules or other terms related to this SLA or the MSA, both
the Customer and VeriCenter must approve each change, and this SLA and/or the
MSA must be appropriately amended before implementation of any change. The
change request procedure is as follows:

a)   The project manager for the requesting party will submit a change request
(“CR”) in writing. It will describe the change and include whatever rationale
and/or estimated effect the change will have on the SLA and/or the MSA.

b)   The other party’s project manager will review each CR. The project manager
will weigh the merits of the proposed change and approve it for investigation or
reject it. If rejected, the project

  VERICENTER CONFIDENTIAL AND PROPRIETARY   Page 3

[*] We are seeking confidential treatment of these terms which have been
omitted. The confidential portions have been filed separately with the
Securities and Exchange Commission.

 

--------------------------------------------------------------------------------

 

SLA # 0002204-QUO
EXECUTION FINAL
manager will return the CR to the requesting party, together with the reason(s)
for rejection.

c)   Approval of a CR for investigation by both parties constitutes
authorization by the Customer of any fee proposed by VeriCenter to investigate
the CR for investigations taking less than 3 hours. Investigations longer than 3
hours must be estimated by VeriCenter and approved by customers authorized
representatives. During such investigation, the effect on the Monthly Fee,
Service Term or other terms of this SLA will be determined. Following completion
of such investigation, the requested change will then be approved or disapproved
for implementation.

d)   Approved changes will be incorporated into this SLA or the MSA through
written modifications, which shall be signed by duly authorized representatives
of both parties

E. Change Management
The Customer will be provided at least twenty-one (21) days prior written notice
of any changes to be made by VeriCenter that affect the Services. However, if a
shorter notification period is required, changes will be made with the agreement
of the Customer. VeriCenter will strive to minimize outages that may be caused
by a change; however, in the event that an outage is required, VeriCenter will
use best reasonable efforts to minimize the impact of the change and schedule
the outage based upon the Customer’s and VeriCenter’s requirements. If an outage
is required, such outage will be considered a Scheduled Outage. VeriCenter
intends to work with the Customer on all change management issues in order to
ensure that the Services are not affected beyond the levels set forth in this
SLA. VeriCenter reserves the right, however, to proceed with any change if it is
determined, by VeriCenter, that the change will not cause harm to the Customer’s
specific environment and/or is otherwise necessary. Customer is required to
provide prior notification to VeriCenter of any changes to its configurations
that interface with the provided Services. If necessary, VeriCenter will provide
a representative to work with the Customer to address any issues that arise
during the Customer’s configuration changes.
F. Event Notification
VeriCenter shall provide initial notice to a designated Customer’s
representative by telephone, e-mail, pager or comparable notification service
within one (1) hour of VeriCenter becoming aware of an event that has caused or
may cause an Unscheduled Outage. In the event Customer first becomes aware of
such event, Customer shall promptly provide initial notice to VeriCenter via the
Toll-Free Customer Support Number (866) VCENTER. Status reports about the event
will continue on the hour until either the event has been resolved or both
VeriCenter and the Customer have determined a course of action that does not
require continued notification.
G. Definitions
Environment: The infrastructure components as defined in the Order Form that run
Customer’s application(s).
Monitoring: The monitoring, collecting, processing and reporting of information
associated with the characteristics of VeriCenter Data Center computer system
environments.
Monthly Fee: The monthly fee for a Service as set forth in the Order Form for
that Service.
Scheduled Outages: The six-hour period of time between 0:00 (AM Mountain Time)
each Sunday until 6:00 (AM Mountain Time) that Sunday, during the Service Term,
during which VeriCenter temporarily interrupts any Services for upgrades,
maintenance, or for any other agreed upon reason or purpose, including an
established framework for scheduling and managing such outages.
Service Term: The minimum term for which VeriCenter will provide the Service to
Customer as set forth in the Order Form for that Service.
Unscheduled Outages: Any interruptions in Services outside of the agreed-upon
Scheduled Outage, for any reason, including arising from failures associated
with Services provided by VeriCenter or a Force Majeure Event. Unscheduled
Outage shall not include any outage primarily caused by Customer or its
employees or agents.
VeriCenter Operations Group: The VeriCenter Operations Group, responsible for
the daily delivery and management of Services provided to the Customer.
By the signatures of their duly authorized representatives below, VeriCenter and
Customer, intending to be legally bound, agree to all of the provisions of this
SLA

              CUSTOMER: QUOVADX, INC.   VERICENTER, INC.
 
           
Signature:
  /s/ Mark Rangell   Signature:   /s/ Michael Sullivan
 
           
Print Name:
  Mark Rangell   Print Name:   Michael Sullivan
 
           
Title:
  Executive Vice President   Title:   SVP Sales
 
           
Date:
  9/30/2005   Date:   10/3/05

This Service Level Agreement incorporates the following documents:

•   Order Form [*]   •   VeriCenter Roles & Responsibilities [*]   •   Problem
Management Flow Chart

VERICENTER CONFIDENTIAL AND PROPRIETARY   Page 4

[*] We are seeking confidential treatment of these terms which have been
omitted. The confidential portions have been filed separately with the
Securities and Exchange Commission.

 

--------------------------------------------------------------------------------

 

EXECUTION FINAL
(QUOVADX LOGO) [d29193d2919304.gif]
QUOVADX BUSINESS ASSOCIATE AGREEMENT
     This Business Associate Agreement (“BA Agreement”) is entered into by and
between Quovadx, Inc. (“Quovadx”) and VeriCenter, Inc. (“Business Associate”)
(each a “Party” and collectively the “Parties”).
     WHEREAS, in the operation of its Cash Accelerator business, Quovadx is a
Covered Entity;
     WHEREAS, Quovadx in connection with the operation of its Cash Accelerator
business receives services from Business Associate under the terms of that
certain Master Services Agreement between the Parties dated September 30, 2005
(the “Underlying Agreement”);
     WHEREAS, in providing services to Quovadx, Business Associate may obtain
access to PHI;
     WHEREAS, the Parties desire to meet their obligations under the Health
Insurance Portability and Accountability Act of 1996, the Privacy Rule (as
defined below) and the Security Rule (as defined below) (collectively, “HIPAA”);
     NOW, THEREFORE, in consideration of the foregoing and for other good and
valuable consideration, the receipt and sufficiency of which are hereby
acknowledged, the Parties agree as follows:
1. DEFINITIONS.
     1.1 Unless otherwise specified in this BA Agreement, all capitalized terms
used in this BA Agreement and not otherwise defined herein have the meaning set
forth in the Underlying Agreement or in 45 CFR parts 160 and 164, each as
amended from time to time.
     1.2 “Electronic PHI” shall mean Electronic Protected Health Information, as
defined in 45 CFR § 160.103.
     1.3 “PHI” shall mean Protected Health Information, as defined in 45 CFR §
160.103.
     1.4 “Privacy Rule” shall mean the privacy regulations at 45 CFR §§ 160 and
164 Subparts A and E.
     1.5 “Security Rule” shall mean the security regulations at 45 CFR §§ 160
and 164 Subparts A and C.
2. RESPONSIBILITIES OF BUSINESS ASSOCIATE.
     2.1 Business Associate agrees to:
          (a) use and/or disclose PHI only as permitted or required by this BA
Agreement, the Underlying Agreement, or as required by law;
          (b) use appropriate safeguards to prevent use or disclosure of PHI
other than as permitted or required by this BA Agreement or the Underlying
Agreement;
          (c) (i) implement administrative, physical, and technical safeguards
that reasonably and appropriately protect the confidentiality, integrity, and
availability of the Electronic PHI that it creates, receives, maintains or
transmits on behalf of Quovadx; and (ii) make its policies and procedures, and
documentation required by the Security Rule relating to such safeguards,
available to the Secretary of the Department of Health and Human Services
(“HHS”) for purposes of determining Quovadx’s compliance with the Security Rule;

 

--------------------------------------------------------------------------------

 

EXECUTION FINAL
          (d) report to Quovadx any use or disclosure of PHI of which it becomes
aware that is not permitted by this BA Agreement or the Underlying Agreement;
          (e) report to Quovadx any Security Incident with respect to Electronic
PHI of which it becomes aware;
          (f) require all its subcontractors and agents that create, receive,
use, disclose or have access to PHI to agree, in writing, to the same
restrictions and conditions on the use and/or disclosure of PHI that apply to
Business Associate;
          (g) ensure that all of its subcontractors and agents to whom it
provides Electronic PHI agree in writing to implement reasonable and appropriate
safeguards to protect such Electronic PHI;
          (h) make available its internal practices, books, and records relating
to the use and disclosure of PHI to the HHS for purposes of determining
Quovadx’s compliance with HIPAA;
          (i) document such disclosures of PHI and information related to such
disclosures as would be required by Quovadx to respond to a request for an
accounting of disclosures of PHI about an individual;
          (j) within 20 days of receiving a written request from Quovadx, make
available information necessary for Quovadx to make an accounting of disclosures
of PHI about an individual; and
          (k) mitigate, to the extent practicable, any harmful effect that is
known to Business Associate of a use or disclosure of PHI by Business Associate
in violation of this BA Agreement.
     2.2 If Business Associate retains PHI in its possession and such PHI
constitutes a Designated Record Set, Business Associate agrees as follows with
regard to such PHI:
          (a) within 20 days of receiving a written request from Quovadx, to
make available the PHI necessary for Quovadx to respond to individuals’ requests
for access to PHI about them; and
          (b) within 20 days of receiving a written request from Quovadx,
incorporate any amendments or corrections to the PHI in accordance with the
Privacy Rule.
3. PERMITTED USES AND DISCLOSURES OF PHI.
     3.1 Unless otherwise limited herein, in addition to any other uses and/or
disclosures permitted or required by this BA Agreement or required by law,
Business Associate may:
          (a) use the PHI in its possession for Business Associate’s proper
management and administration and to fulfill any legal responsibilities of
Business Associate; and
          (b) disclose the PHI in its possession to a third party for the
purpose of Business Associate’s proper management and administration or to
fulfill any legal responsibilities of Business Associate; provided, however,
that the disclosures are required by law or Business Associate has received from
the third party written assurances that (i) the information will be held
confidentially and used or further disclosed only as required by law or for the
purpose for which it was disclosed to the third party; and (ii) the third party
will notify Business Associate of any instances of which it becomes aware in
which the confidentiality of the information has been breached.
4. RESPONSIBILITIES OF QUOVADX.
     4.1 Quovadx agrees to inform Business Associate of any PHI that is subject
to any arrangements permitted or required of Quovadx under the Privacy Rule that
may materially impact in any manner the use and/or disclosure of PHI by Business
Associate under this BA Agreement, including, but not limited to, restrictions
on the use and/or disclosure of PHI as provided for in 45 CFR § 164.522 and
agreed to by Quovadx.
5. EFFECTIVE DATE. This BA Agreement shall be effective as of the effective date
of the Underlying Agreement (the “BA Effective Date”).

2

--------------------------------------------------------------------------------

 

EXECUTION FINAL
6. TERM AND TERMINATION.
     6.1 Term. This BA Agreement shall commence as of the BA Effective Date and
continue in effect until terminated in accordance with the provisions of
Section 6.2.
     6.2 Termination.
          (a) Upon Quovadx’s determination of a breach of a material term of
this BA Agreement by Business Associate, Quovadx shall either terminate the
Underlying Agreement, this BA Agreement and any other agreements requiring the
disclosure of PHI by Quovadx to Business Associate; or provide Business
Associate written notice of that breach in sufficient detail to enable Business
Associate to understand the specific nature of that breach and afford Business
Associate an opportunity to cure the breach; provided, however, that if Business
Associate fails to cure the breach within a reasonable time specified by
Quovadx, Quovadx may terminate this BA Agreement and the Underlying Agreement to
the extent that Business Associate’s continued performance under the Underlying
Agreement requires Business Associate to create or receive PHI. If Quovadx
terminates this BA Agreement, Business Associate shall have no continuing
obligations under the Underlying Agreement.
          (b) This BA Agreement shall terminate immediately upon the termination
of the Underlying Agreement, or in the case of multiple Underlying Agreements,
the last of such agreements.
     6.3 Effect of Termination or Expiration.
          (a) Except as provided in 6.3(b), upon termination of this BA
Agreement for any reason, Business Associate shall return or destroy all PHI
received from Quovadx, or created or received by Business Associate on behalf of
Quovadx. This provision shall apply to PHI that is in the possession of
subcontractors or agents of Business Associate.
          (b) In the event that Business Associate determines that returning or
destroying the PHI is infeasible, Business Associate shall notify Quovadx of the
conditions that make return or destruction infeasible. In that event:
(i) Business Associate shall extend the protections of this BA Agreement to such
PHI and limit further uses and disclosures of such PHI to those purposes that
make the return or destruction infeasible, for so long as Business Associate
maintains such PHI; and (ii) Quovadx shall comply with its obligations under
Section 4.1(b) with respect to any PHI retained by Business Associate after the
termination or expiration of this BA Agreement. This Section 6.3 shall survive
any termination or expiration of this BA Agreement.
7. NOTICES. All notices pursuant to this BA Agreement must be given in
accordance with the requirements set forth in the Underlying Agreement(s).
8. CHANGE IN LAW; AMENDMENT. The Parties agree to negotiate to amend this BA
Agreement as necessary to comply with any amendment to any provision of HIPAA or
its implementing regulations set forth at 45 CFR parts 160 and 164, including,
but not limited to, the Privacy Rule and the Security Rule, which materially
alters either Party’s or both Parties’ obligations under this BA Agreement. This
BA Agreement may not be amended, altered or modified except by written agreement
signed by Quovadx and Business Associate.
9. CONTRADICTORY TERMS; CONSTRUCTION OF TERMS. Any provision of the Underlying
Agreement or any other agreement between the Parties that is directly
contradictory to one or more terms of this BA Agreement (“Contradictory Term”)
shall be superseded by the terms of this BA Agreement as of the BA Effective
Date only to the extent that it is reasonably impossible to comply with both the
Contradictory Term and the terms of this BA Agreement. The terms of this BA
Agreement shall be construed in light of any applicable interpretation or
guidance on HIPAA, the Privacy Rule, and/or the Security Rule issued by HHS, the
Office for Civil Rights, or the Centers for Medicare and Medicaid Services from
time to time.
10. ASSIGNMENT. Neither this BA Agreement nor any right or obligation hereunder
shall be assigned or transferred by either Party without the prior written
consent of the other (which consent shall not be unreasonably withheld or
delayed); provided, however, that each party shall have the right, without such
consent, to assign or transfer this BA Agreement or any right or obligation
hereunder to any of its affiliates or also to any other person that (a) acquires
or otherwise succeeds to all or substantially all of that Party’s business and
assets or the business and assets of said Party that relate to the Underlying
Agreement, (b) assumes all of the Party’s obligations hereunder or obligations
hereunder that arise after such assignment or transfer, and (c) agrees to
perform or cause performance of all such obligations when due. No assignment or
transfer shall relieve a Party of any obligation hereunder. Any purported
assignment or transfer not permitted by this Section shall be void. All of the
terms and provisions of this BA Agreement shall be binding upon and inure to the
benefit of the Parties and their respective successors and permitted assigns and
transferees.

3

--------------------------------------------------------------------------------

 

EXECUTION FINAL
11. MISCELLANEOUS. Nothing in this BA Agreement shall confer upon any person
other than the Parties and
their respective successors or assigns, any rights, remedies, obligations, or
liabilities whatsoever. In the event that any provision of this BA Agreement
violates any applicable statute, ordinance or rule of law in any jurisdiction
that governs this BA Agreement, such provision shall be ineffective to the
extent of such violation without invalidating any other provision of this BA
Agreement. No provision of this BA Agreement may be waived except by an
agreement in writing signed by the waiving Party. A waiver of any term or
provision shall not be construed as a waiver of any other term or provision. The
persons signing below have the right and authority to execute this Agreement for
their respective entities and no further approvals are necessary to create a
binding agreement.
IN WITNESS WHEREOF, the Parties hereto have executed this BA Agreement as of the
BA Effective Date.

              QUOVADX, INC.   VERICENTER, INC.
 
           
 
           
By:
  /s/ Linda Wackwitz   By:   /s/ Michael Sullivan
 
       
 
  (Authorized Signature)       (Authorized Signature)
 
           
 
  Linda Wackwitz       Michael Sullivan      
 
  Printed Name       Printed Name
 
           
 
  EVP       SVP Sales      
 
  Title       Title

4