Document:

exv10w27

Exhibit 10.27

Professional Services Agreement

     This Professional Services Agreement (this “PSA”) is entered into as of October 2, 2009
(the “Effective Date”), by and between athenahealth, Inc., a Delaware corporation with a primary
business address of 311 Arsenal Street, Watertown, Massachusetts 02472 USA (hereinafter referred to
as “Athena”); International Business Machines Corporation, a New York corporation with a primary
business address of Armonk, New York 10504 USA (“IBM”).

     WHEREAS, Athena and IBM are parties to an IBM International Customer Agreement fully executed
as of October 16, 2000, relating to the provision of services to Athena by IBM (the “Master
Agreement”), as well as to a Pilot Statement of Work dated May 18, 2009, relating to preparation
for the delivery of business process outsourcing services under the Master Agreement (the “Pilot
SOW”);

     WHEREAS, Athena and IBM Daksh Business Process Services Private Limited, a wholly owned
subsidiary of IBM (“IBM Daksh”), are parties to a certain Mutual Non-Disclosure Agreement dated as
of April 28, 2008 (the “Existing NDA”); and

     WHEREAS, the parties hereto now desire to have IBM provide the services set forth in Schedule
A (the “Services”).

     NOW, THEREFORE, in consideration of the mutual covenants contained herein, the parties hereto
agree as follows:

1. Relationship of Agreements

     a. Master Agreement. This PSA is considered a Transaction Document under the Master
Agreement, and the general terms and conditions of the Master Agreement (excluding any and all
Appendices and SOWs) are incorporated by reference into this PSA. For purposes of this PSA,
references to “Customer” in the Master Agreement will be interpreted to mean “Athena.” Unless
otherwise defined herein, capitalized terms used in this PSA shall have the same meanings as set
forth in the Master Agreement. For clarification purposes, no machines or licensed program
products are acquired by Athena under this PSA.

     b. Pilot SOW. This PSA is intended to supersede the Pilot SOW.

     c. Existing NDA. This PSA constitutes a “definitive agreement” for purposes of
Section 2(c) of the Existing NDA and supersedes that agreement, and all information considered
Proprietary Information and Technology of a party under the Existing NDA shall be considered
Confidential Information of that party under this PSA.

     d. Schedules to this PSA. The following Exhibit and Schedules are included as
attachments to this PSA:

          i. Exhibit A — Form of Project Change Request

          ii. Schedule A — Service Descriptions

          iii. Schedule B — Business Associate Terms and Conditions

          iv. Schedule C — Charges

     e. Conflicts. In the case of any conflict between this PSA and the Master Agreement
or any other agreement between the Parties, the terms of this PSA shall control, and, regardless of
any provision hereof to the contrary, the conflicting terms from such agreements shall not be
considered incorporated into this PSA. In the case of a conflict between the terms of this PSA and
any Change Order or Schedule to this PSA, the terms of this PSA shall control unless otherwise
specifically stated in such Change Order or Schedule. There are no other prior or collateral
understandings or agreements between the Parties other than those specifically described herein.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 1 of 17

 

 

2. Definitions

     a. “Athena’s Business Processes” means the business processes executed or supported by IBM on
Athena’s behalf under this PSA.

     b. “Athena’s Data” means any information relating to an identifiable individual that IBM
processes on behalf of Athena in performing the Services. Athena’s Data excludes information: (i)
processed by IBM for any reason other than IBM’s performance of the Services; (ii) processed by IBM
because of its relationship with its customers (including Athena and Athena’s Enterprise)
generally; and (iii) relating to employees of IBM, its Enterprise, and their permitted
subcontractors.

     c. “Facilities” means any location: (i) owned, leased, rented, or used by Athena that IBM may
use in providing the Services; and (ii) that is listed herein.

     d. “Kick Code” means a code attached to a claim to identify its current status and/or the next
step(s) in the claim handling process.

     e. “Party” means either IBM or Athena, which shall be referred to collectively as the
“Parties.”

     f. “Products” collectively means:

          i. “IBM Product(s),” which means any equipment, program, system, product, or business process
developed by IBM and used by IBM in conjunction with the Services provided to Athena under this
PSA, including IBM logoed hardware or software made generally available by IBM or its Enterprise;
and

          ii. “Athena’s Product(s),” which means any equipment, system, program, product, or business
process provided to IBM by Athena under this PSA or used in conjunction with the Services.

     g. “Project Manager” means an individual assigned by a Party to manage the performance of that
Party’s obligations under this PSA, who has the authority to represent and bind that Party for
purposes of this PSA, and who will have a specific operational role as described in this PSA.
Athena and IBM will each provide the other reasonable advance written notice of a change to the
respective Project Manager and will discuss any objections the other has to such change.

     h. “Regulatory Requirements” collectively means:

          i. “IBM Regulatory Requirements,” which means the laws, regulations, and rules applicable to
IBM in its capacity as a provider of information technology enabled services and personnel to
support business process outsourcing; and

          ii. “Athena’s Regulatory Requirements,” which means the laws, regulations, and rules
applicable to Athena, including laws applicable to Athena’s Business Processes and/or use or
receipt of the Services.

3. Additional Terms

     The following terms are applicable to this PSA and are in addition to or modify those of the
Master Agreement.

     a. Changes to the Agreement Terms

     Should the Parties mutually agree upon any addition, modification, or change to any terms of
this PSA, such addition, modification, or change shall be done as per the procedure stated below
and be signed by the Parties’ authorized representatives (such a signed document, a “Change
Order”).

          i. Project Change Control Procedure

          The following process will be followed if a change to this PSA is required.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 2 of 17

 

 

               A. A Project Change Request (a “PCR”) will be the vehicle for communicating change. Each PCR
must describe the change being requested, the rationale for that change, and the effect that change
will have on the Services. The designated Project Manager of the requesting Party will review the
proposed change and determine whether to submit the request to the other Party. A PCR form is
included as Exhibit A to this PSA.

               B. Both Project Managers will review the proposed change and recommend it for further
investigation or reject it. IBM will specify any material charges for such investigation and
present them to Athena for approval. Each PCR must be signed by authorized representatives from
both Parties to authorize further investigation of the recommended changes. The investigation will
determine the effect that the implementation of the PCR will have on price, schedule, and other
terms and conditions of the PSA.

               C. A written change authorization or PCR must be signed by authorized representatives from
both Parties to authorize implementation of the investigated changes. Until a change is agreed to
in writing, both Parties will continue to act in accordance with the latest agreed version of the
PSA.

          ii. Changes Made by IBM on an Emergency Basis

          Except for changes made by IBM on an emergency basis, IBM will schedule change activities in
accordance with the Project Change Control Procedure with the goal of minimizing unreasonable
interruptions to Athena’s business operations. With respect to changes made by IBM on an emergency
basis, IBM will provide Athena with notice of such changes within twenty-four (24) hours and
documentation of such changes within five (5) Business Days (as that term is defined in Schedule A)
after such changes are made.

     b. Required Consents

     Athena is responsible for promptly obtaining and providing to IBM all Required Consents
necessary for IBM to provide the Services described in this PSA. A “Required Consent” means any
consents or approvals required to give IBM, its Enterprise, and any permitted subcontractors the
right or license to access, use and/or modify (including creating derivative works) Athena’s
Products solely as necessary for the performance of the Services without infringing the ownership
or license rights (including patent and copyright) of the providers or owners of such Products. A
Required Consent also includes any consents or approvals required to give IBM, its Enterprise, and
permitted subcontractors the right or license to access or use Athena’s services or facilities
(including the Facilities).

     Failure of Athena to provide any Required Consents to IBM shall be a basis for indemnification
under Section 11 of this PSA.

     c. Service Recipients

     Athena represents to IBM that there will be no Services provided to third parties (e.g.,
health care providers) under this PSA.

     d. Data Protection

          i. General

               A. IBM and Athena are each responsible for complying with its respective obligations under the
applicable data protection laws governing Athena’s Data.

               B. Athena remains solely responsible for determining the purposes and means of IBM’s
processing of Athena’s Data under this PSA, including that such processing will not place IBM in
breach of the applicable data protection laws.

               C. Data protection laws are Athena’s Regulatory Requirements with respect to Athena’s Data,
except and only to the extent that such data protection laws regulate IBM’s processing of Athena’s
Data in IBM’s performance of the Services. IBM and Athena each acknowledge that each Party has the
right to investigate the steps the other is taking to comply with applicable data protection laws
and the Parties agree to

			
	 	 	 
	IBM/Athena Confidential
	 	Page 3 of 17

 

 

reasonably cooperate with such investigation (including, but not limited to, providing copies
of HIPAA security risk analysis and risk management plans, as well as any SAS-70 audits where
reasonable to do so and subject to the terms of the Confidentiality provisions under this PSA).
Nothing in this PSA prevents IBM or Athena from taking the steps it deems necessary to comply with
applicable data protection laws.

               D. If Athena requests additional or materially different services to comply with the
applicable data protection laws, such services will be considered new services.

          ii. Security

               A. Athena acknowledges that Athena is solely responsible for determining that the security
measures specified herein constitute appropriate technical and organizational measures to protect
Athena’s Data as required by the applicable data protection laws. IBM is not required to perform
or adhere to any security measures concerning Athena’s Data other than those specified in this PSA.

               B. By executing this PSA, Athena appoints IBM as a data processor of Athena’s Data. As a
processor of Athena’s Data, IBM will process Athena’s Data as specified herein. Athena agrees that
IBM may perform such processing as IBM reasonably considers necessary or appropriate to perform the
Services. Upon expiration or termination of this PSA and to the extent applicable, Athena will
give the data protection authority prompt notice of the termination of the appointment of IBM as
Athena’s data processor.

          iii. Transborder Data Flows

               A. IBM will not transfer any of Athena’s Data across a country border unless IBM reasonably
considers such transfer appropriate or useful for IBM’s performance of the Services and obtains
Athena’s prior written consent.

               B. Athena is solely responsible for determining that any transfer by IBM or Athena of Athena’s
Data across a country border under this PSA complies with the applicable data protection laws.

               C. Athena shall obtain, with IBM’s reasonable assistance, all necessary consents and
regulatory approvals required for any transfers of Athena’s Data across country borders, all at
Athena’s reasonable expense.

          iv. Information

               A. If, under the applicable law, Athena is required to provide information to a third party
regarding Athena’s Data, IBM will reasonably cooperate with Athena in providing such information.
Athena will reimburse IBM for its reasonable charges for such assistance.

               B. Upon IBM’s or Athena’s reasonable written request, Athena or IBM will provide the other
with such information that it has regarding Athena’s Data and its processing that is necessary to
enable the requester to comply with its obligations under this Section and the applicable data
protection laws.

               C. Nothing in this Section requires IBM to provide Athena access to the premises or systems of
IBM, its Enterprise, or any of their permitted subcontractors or to information relating to the
other customers of IBM, its Enterprise, or their permitted subcontractors, except to the extent
reasonably necessary for Athena’s exercise of its rights under this PSA and upon reasonable notice.

               D. Athena agrees to allow IBM to store the contact information of Athena employees, such as
names, phone numbers, and e-mail addresses, in any country where IBM does business and to use such
information internally and to communicate with Athena for the purposes of Athena’s and IBM’s
business relationship.

     e. Severability and Waiver

     In the event that any provision of this PSA is held to be invalid or unenforceable, the
remaining provisions of the PSA remain in full force and effect. Nothing in this PSA affects any
statutory rights of consumers that

			
	 	 	 
	IBM/Athena Confidential
	 	Page 4 of 17

 

 

cannot be waived or limited by contract. The exercise or waiver, in whole or in part, of any
right, remedy, or duty provided for in this PSA will not constitute the waiver of any prior,
concurrent or subsequent right, remedy, or duty within this PSA.

     f. Audits

          i. Each Party will keep appropriate business records pertaining to (A) its performance of this
PSA; (B) the security measures to be maintained as specified in Section 3(d) and Schedule B; (C)
access to and use of Athena Systems (as that term is defined in Section 12); (D) the compliance
program specified in Section 13(i); and (E) financial records to substantiate the details of
transactions specified in the invoices billed by IBM to Athena, solely as they relate to the
Services.

          ii. Each Party will have the right to audit the other Party’s records to the extent reasonably
necessary to verify any reports provided by such Party, to verify compliance with the security
measures outlined in this PSA, and to verify each Party’s compliance with its other obligations
under this PSA or to verify any charge or payment amount. At Athena’s written request during the
course of any audit under this PSA, IBM will promptly make available to Athena financial records to
substantiate the details of the invoices billed to Athena hereunder; provided, however, that IBM
shall not be required to provide any records pertaining to its costs of providing the Services or
data relating to the provision of services to other customers of IBM. A Party may conduct an audit
not more often than once during any consecutive twelve (12) month period, starting from the
Effective Date. Each audit will take place, upon reasonable written notice to the Party being
audited, during regular business hours, and at any location of that Party or any affiliate thereof
providing any of the Services or at a mutually agreed location. All audits will be scheduled in
such a manner as not to interfere unreasonably with the operations of the Party subject to the
audit. The party conducting an audit shall bear the costs relating to that audit.

          iii. In addition to the rights outlined above in this Section, Athena shall have the right,
from time to time and upon reasonable advance notice no more frequently than quarterly, to request
results of security assessments, reports, and/or audits conducted by IBM of the physical,
administrative, and technical security measures in place at any facility at which Services are
provided.

4. Term and Termination

     a. Term.

     The initial term of this PSA (the “Initial Term”) shall commence as of the Effective Date and
will continue for a period of sixty-three (63) months thereafter, unless earlier terminated in
accordance with the provisions of this PSA, with two (2) year automatic renewals to follow the
Initial Term (collectively, the “Term”). If either Party determines it does not wish to allow an
automatic renewal, then that Party shall provide the other Party with at least twelve (12) months
advance written notice, and no such automatic renewal shall be added. *The provisions of Sections
6 through 11 and Section 14 shall survive the termination of this PSA.

     b. Termination for Convenience.

     Either Party may elect to terminate this PSA for convenience by:

          i. providing the other with at least six (6) months advance written notice of its election to
terminate the convenience including the effective date of such termination, which shall not be
earlier than two (2) contract years from the Effective Date of this PSA; and

          ii. in the case of termination by Athena, paying IBM any Termination Charges for Convenience,
Winddown Charges, and other fees as set forth in Schedule C, Exhibit C-3: Termination for
Convenience and Winddown Charges, for the month in which termination becomes effective, which IBM
and Athena agree is Athena’s sole and exclusive liability for such termination for convenience,
except as otherwise set forth in this PSA. Minimum volume commitments from Athena shall not apply
to the six (6) months immediately prior to the effective date of the termination.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 5 of 17

 

 

Confidential Materials omitted and filed separately with the
Securities and Exchange Commission. Asterisks denote omissions.

          iii. in the case of termination by IBM, IBM will pay Athena a $* termination fee. The parties
agree this is IBM’s sole and exclusive liability for such termination for convenience, except as
otherwise set forth in this PSA.

          iv. Restricted Activities

               A. In the event that, during the Term, IBM engages in Restricted Activities, Athena may, upon providing IBM with *
days advance written notice and opportunity to cease any Restricted Activities, terminate this
Agreement *.

               B. “Restricted Activities” means *

               C. “Athena Competitors” means eClinicalWorks; Epic Systems Corporation; GE Healthcare;
Greenway Medical Technologies, Inc.; McKesson Corporation; Sage Software Healthcare, Inc.;
Allscripts-Misys Healthcare Solutions, Inc.; Siemens Medical Solutions USA, Inc.; and Quality
Systems, Inc. and their successors-in-interest upon notice to IBM.

     c. Termination for Cause

          i. Athena or IBM (the “Nonbreaching Party”) may elect to terminate this PSA because of a
material breach of this PSA by the other (the “Breaching Party”) by following the process set forth
in this Section.

          ii. The Nonbreaching Party will provide the Breaching Party with written notice of such
material breach within sixty (60) days after becoming aware the material breach, describing in
detail the specific nature and dates of the material breach, and will provide the Breaching Party
with the opportunity to cure the material breach as follows:

               A. in the event of a failure to pay any amount due on the payable date specified in this PSA
or a Schedule to the PSA, ten (10) days after receipt of such written notice; and

               B. in the event of any other material breach, forty-five (45) days after receipt of such
written notice. If the nature of any nonmonetary breach is such that it would be unreasonable to
expect a cure within forty-five (45) days, an additional fifteen (15) days will be allowed.

          iii. If the material breach is not cured during the applicable cure period set forth above,
the Nonbreaching Party may terminate this PSA for material breach by providing the Breaching Party
with written notice within sixty (60) days after the expiration of the cure period specified above,
declaring termination of this PSA for material breach under this Section, effective on the date
stated in such notice. Such effective date will be no later than 120 days after the Breaching
Party’s receipt of such notice of termination for material breach. Minimum volume commitments from
Athena shall not apply to the time period between the date of such notice and the effective date of
the termination. If IBM terminates for cause due to failure to pay by Athena, then Athena will pay
the Termination Charges for Cause and Winddown Charges set forth in Schedule C, Exhibit C-4:
Termination for Cause and Winddown Charges for the month in which termination becomes effective; if
Athena terminates for cause, then Athena shall not owe any such amounts to IBM.

     d. Transfer Assistance

          i. If Athena desires IBM’s assistance in transferring Services back to Athena or a third party
upon termination or expiration of this PSA (“Transfer Assistance”), upon Athena’s six (6) month
advance written request, or mutually agreed shorter period of time in the case of Termination for
Cause by Athena, IBM will provide such Transfer Assistance to Athena:

               A. to the extent IBM can perform such requested Transfer Assistance using its then-existing
resources dedicated solely to providing the Services under this PSA, until expiration or
termination of this PSA; and

               B. to the extent IBM reasonably agrees to perform the requested Transfer Assistance, for the
period of time requested by Athena, which period will end no later than twelve (12) months

			
	 	 	 
	IBM/Athena Confidential
	 	Page 6 of 17

 

 

after the effective date of the expiration or termination of this PSA (the “Transfer
Assistance Period”). Charges associated with Transfer Assistance will be subject to an inflation
adjustment.

          ii. If IBM’s Transfer Assistance will require the use of different or additional services or
resources beyond that which IBM is then using to provide the Services in accordance with the agreed
baselines and performance metrics, such request for Transfer Assistance will be considered a New
Service and performed for an additional charge.

          iii. During the Transfer Assistance Period, IBM will provide Athena and its third-party
designees, as necessary, with reasonable access to the Machines and Software, provided:

               A. any such access does not interfere with IBM’s ability to provide the Services or Transfer
Assistance; and

               B. such third parties and Athena’s Enterprise comply with IBM’s security and confidentiality
requirements, including execution of a confidentiality agreement reasonably acceptable to IBM.

          iv. Athena will allow IBM to use the Facilities, subject to reasonable notification and
Athena’s reasonable confidentiality and privacy restrictions as communicated to IBM, to enable IBM
to effect an orderly transition of resources, for up to sixty (60) days after the later of:

               A. the expiration or termination of this PSA; or

               B. the last day of the Transfer Assistance Period.

          v. IBM will not provide Transfer Assistance if such Transfer Assistance will unreasonably
interfere with IBM’s ability to perform the Services.

          vi. If IBM terminates this PSA for cause, IBM may provide Athena with Transfer Assistance only
if Athena pays for such Transfer Assistance in advance.

          vii. The applicable provisions of this PSA will remain in full force and effect during the
Transfer Assistance Period.

     e. Data Entry Application Access

     If IBM terminates for convenience or Athena terminates pursuant to either Section 4(b)(iv) or
Section 4(c), IBM will provide Athena access to the data entry application (Intelligence Forms
Processing) for internal use by Athena for up to one (1) year from the effective date of
termination on IBM’s standard license terms for that application. IBM shall waive the license or
usage fees associated with such access for that one year. For any other termination, the above
access shall be granted at the license or usage fees associated with such access at the then
current commercially available rates. Athena shall pay for any required services, support, or
maintenance at the then current commercially available rates during that one (1) year.

5. The Services

     IBM shall perform the Services in a professional and workmanlike manner while striving to meet
the Service Levels specified in Schedule A. IBM shall not, absent the prior written consent of
Athena, subcontract any portion of the Services. The Parties acknowledge that IBM Daksh is a
wholly owned subsidiary of IBM that will be performing the Services under this PSA, and IBM will
remain responsible for the performance of IBM Daksh under this PSA. Athena shall, at its cost and
in a timely manner, provide the information or materials and perform the actions required of it
under this PSA. IBM’s failure to perform its obligations under this PSA shall be excused if and to
the extent that IBM’s non-performance is caused by Athena’s failure to perform its obligations
under this PSA or by circumstances beyond the reasonable control of IBM. Any change to the scope
of the Services may only be effected as an amendment to Schedule A to this PSA.

     If, following any applicable training and initial ramp-up period and subject to the terms of
this PSA, IBM’s performance falls significantly below the Service Levels or Quality Standards
specified in Schedule A, Athena will notify IBM of that fact, and IBM will develop and implement
agreed remedial actions to address such performance

			
	 	 	 
	IBM/Athena Confidential
	 	Page 7 of 17

 

 

Confidential Materials omitted and filed separately with the
Securities and Exchange Commission. Asterisks denote omissions.

issues within one week of its notification. Athena may reduce the volume of work provided to
IBM to allow IBM opportunity to implement the agreed remedial actions or for other reasons in
Athena’s reasonable discretion; the parties may also adjust the minimum volume commitments by
mutual agreement in writing.

     Athena and IBM will work together during the initial ninety (90) days of the Initial Term to
establish a governance structure to be used in the management of the Services provided under this
PSA to be updated thereafter as appropriate within ninety (90) days of the effective date of any
subsequent effort authorized under this PSA. Such governance structure will be mutually agreed by
the Parties and may include guidance related to specific roles under the PSA and escalation
procedures.

     Should IBM determine the need to provide the Services from an alternative location other than
those contemplated in Schedule A as of the Effective Date of this PSA, IBM will submit to Athena
for approval notification of such proposed move, including any known impact to the Services,
provided that such approval be provided within thirty (30) days of such notification and such
approval may not be unreasonably withheld by Athena.

6. Pricing and Payment

     a. Athena shall pay to IBM the fees for the Services at the rates set forth in Schedule C.
IBM shall invoice Athena for the Services provided each month by the third (3rd)
Business Day of the following month. The IBM invoice shall include the Athena PO number, the
invoiced rate for each type transaction that is separately priced, the number of billable
transactions, and the total billing for each process. Athena shall remit payment to IBM for all
invoiced amounts, not subject to reasonable dispute in accordance with Section 6(b) below, by wire
transfer to a bank account designated by IBM no later than the last day of the month in which
Athena received such invoice (the “Payment Due Date”). In the event that IBM provides the invoice
after the third (3rd) Business Day of the month, Athena shall remit payment to IBM
within thirty (30) days of IBM’s submission of the invoice. To support invoicing by IBM on the
third (3rd) Business Day of each month, Athena shall make available monthly production
reports necessary for invoicing by the first (1st) Business Day of the month following
when the Services were provided. In the event that IBM’s invoicing is delayed beyond the
3rd Business Day of the month due to Athena’s failure to provide the monthly production
reports by the 1st Business Day of the month, Athena’s payment of such invoice shall
still be due for the last day of the month in which the invoice is submitted by IBM. In any event,
if Athena fails to provide the monthly production reports by the 5th Business Day of the
month, IBM will invoice Athena based off IBM’s operational data and Athena shall pay such invoice
later than the last day of the month. All amounts payable for the performance of the Services
shall be invoiced in US dollars. For any undisputed payment not received within * days of the
Payment Due Date, Athena shall pay a late payment fee equal to the lesser of *% of the balance due
per month or the maximum rate allowed by applicable law. IBM will provide prompt notice of any
late payment.

     b. In the event either Party in good faith disputes the accuracy or applicability of any
amount payable under this PSA, such Party shall, in writing notify the other Party of the disputed
amount in sufficient detail, including basis for the dispute, within five (5) Business Days
following the submission of the invoice by IBM, or for claims that are not discernable within this
time period, within five (5) Business Days after becoming aware of the disputed matter. In the
event of a dispute pursuant to which a Party in good faith believes it is entitled to withhold
payment or receive a credit, said Party shall continue to perform its obligations under this PSA
pending resolution of the dispute as provided herein. The Parties agree that Athena may withhold
payment provided such withheld amounts do not exceed an amount equal to the average monthly fees
for the preceding * (“Disputed Fee Cap”)). IBM shall continue to perform the Services and Athena
shall continue to pay any charges in excess of the Disputed Fees Cap, under protest without waiver
of its rights to dispute such fees. Upon resolution of such dispute, if Athena owes the disputed
fees, such fees shall be paid to IBM within ten (10) Business Days. Athena shall also pay IBM any
late payment fees accrued from the original Payment Due Date until such payment is received by IBM.

     c. Foreign Exchange Adjustment. IBM will be responsible for the first * in price
fluctuation (either up or down) from the original price associated with changes in exchange rates
as set forth in Schedule C for the respective charges. Any deviation in price (up or down) beyond
* based on the currency exchange rate stated in Schedule C will be reflected as a price adjustment
to the amounts invoiced Athena, as more specifically set forth in Schedule C.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 8 of 17

 

 

Confidential Materials omitted and filed separately with the
Securities and Exchange Commission. Asterisks denote omissions.

     d. Economic Change Adjustment (ECA). Athena will be responsible for the first * in
price fluctuation (either up or down) associated with changes in the cost of living based on the
economic index value set forth in Schedule C for the respective charges and such price adjustment
will be reflected in the amounts invoiced Athena. Any deviation in price (up or down) beyond *
from the economic index value stated in Schedule C will be the responsibility of IBM. The ECA
factor applicable to any Services set forth in Schedule A will be calculated based on the economic
index value stated in Schedule C as compared to the then current economic index value for the
applicable country. This comparison will be performed on an annual basis using the most recent
economic index factor rate as published by the applicable country and any adjustment to rates will
be reflected in the next month’s invoice.

7. Taxes

     a. If any authority imposes a duty, tax, levy, or fee, excluding those based on IBM’s net
income, upon any transaction under this PSA, then Athena agrees to pay that amount as specified in
an invoice or supply exemption documentation. Specifically, Athena will pay all:

          i. applicable taxes such as sales (including sales tax on services), use, gross receipts,
excise, occupation, value-added, and other transaction-based taxes, duties, levies, and fees on
IBM’s charges;

          ii. personal property, sales, value-added, and use taxes on Athena’s personal property or the
use of IBM’s personal property;

          iii. telecommunication taxes for network access (for example, lines) and services used or
provided by Athena; and

          iv. taxes, assessments, and other levies on Athena’s owned, leased, rented, or purchased real
property.

     b. IBM will pay all:

          i. personal property, sales, value-added, and use taxes on IBM’s personal property operated by
IBM personnel; and

          ii. taxes, assessments, and other levies on IBM’s owned, leased, rented, or purchased real
property.

     c. Each party shall be responsible for taxes based on its net income and for compliance
related to employment taxes of its employees.

     d. Athena and IBM agree to cooperate reasonably with the other to determine Athena’s tax
liability on IBM’s charges. IBM’s invoices will state applicable taxes chargeable on the Services,
if any, by tax jurisdiction. IBM and Athena will provide and make available to the other any
resale certificates; tax exemption certificates; information regarding out-of-state sales or use of
equipment, materials, or services; direct pay certificates; and other exemption certificates.

     e. Should Athena be required under any law or regulation of any governmental entity or
authority, domestic or foreign, to withhold or deduct any portion of the payments due to IBM, then
the sum payable to IBM shall be increased by the amount necessary to yield to IBM an amount equal
to the sum it would have received had no withholdings or deductions been made.

8. HIPAA

     a. Generally. During the term of this PSA, Athena will provide IBM with access to
“Protected Health Information,” as that term is defined under the Health Insurance Portability and
Accountability Act of 1996 and the regulations promulgated thereunder, as amended (collectively,
“HIPAA”). IBM is therefore acting as a “Business Associate” (as defined under HIPAA) of Athena in
the course of performing the Services. Athena and IBM therefore agree to be bound by the Business
Associate Terms and Conditions attached hereto as Schedule B.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 9 of 17

 

 

     b. Security Measures. Capitalized terms used in this Section, but not otherwise
defined, shall have the same meaning as those terms in 45 CFR §§160 through 164. In addition to
and without diminishing its other obligations under this PSA with respect to privacy, security, and
confidentiality, IBM will:

          i. implement authentication and access controls to safeguard PHI consistent with the
requirements of HIPAA as specified in this PSA or as directly applicable to IBM under HIPAA;

          ii. use encryption as mutually agreed by both IT teams when it transmits PHI electronically;

          iii. not store PHI beyond periods necessary to perform work under this PSA and to conduct
reasonable troubleshooting and quality control checking in connection with performance of such
work;

          iv. maintain a formal program to comply with privacy and security requirements, including
written policies;

          v. maintain a full-time privacy officer on location;

          vi. not perform or allow performance of any work under this PSA other than on IBM company
premises and guard such facilities at all times with access to them controlled by key cards and
posted guards or similar protection;

          vii. restrict entry into work processing areas by proximity cards or similar protection; and

          viii. except as required for the provision of the Services, restrict employee access to the
Internet, e-mail, and removable media, including without limitation smart cards, USB devices,
floppy disks, CDs, DVDs, removable hard drives, and tapes to deter removal of PHI from IBM’s
premises.

     c. To the extent that HIPAA laws and security measures are applicable directly to IBM, IBM
shall remain solely responsible for its compliance with such laws and security measures.

9. Confidentiality

     a. Definition. Subject to Section 9(b) below, “Confidential Information” means any
and all information pertaining to the business, products, services, or technology of a Party, or
any third party on whose behalf that Party holds such information in confidence, that is disclosed
by that Party (the “Disclosing Party”) or its agents to another Party (the “Recipient”) or its
agents, and (i) is identified as Confidential Information under any provision of this PSA; (ii) is
clearly labeled or otherwise identified in writing as confidential; (iii) is identified orally as
confidential at the time of disclosure with written confirmation within fifteen days thereafter; or
(iv) would be apparent to a reasonable person, familiar with the Disclosing Party’s business and
the industry in which it operates, to be of a confidential or proprietary nature the maintenance of
which is important to the Disclosing Party. Confidential Information shall include, but not be
limited to, financial information, business plans, marketing strategies, research and development
activities, trade secrets, computer programs and codes, software design, network topology and
security measures, claims processing rules and procedures, data relating to customers and customer
transactions, pricing information, and information relating to the discussion or negotiation of any
agreement or other relationship between the Parties, including the terms of this PSA and its
attachments.

     b. Exceptions. Regardless of any other provision of this PSA to the contrary,
Confidential Information shall not include any information that (i) is or becomes publicly
available (other than through unauthorized disclosure by the Recipient), (ii) is shown by written
record to have been in the possession of or known to the Recipient prior to its disclosure
hereunder, (iii) is shown by written record to have been independently developed by the Recipient,
or (iv) is made available without restriction to the Recipient by any person other than the
Disclosing Party or any of its directors, officers, employees, attorneys, or other advisors without
breach of any obligation of confidentiality of such other person.

     c. Use and Disclosure. From and after the Effective Date, the Recipient shall hold
and maintain all Confidential Information in confidence with at least the same precautions and
degree of care as the Recipient treats its own confidential information, without disclosure to any
third party absent the prior written consent of the Disclosing Party, and shall use such
information solely for the purpose of performing the Recipient’s obligations under this PSA. The
Recipient shall use reasonable care to maintain the confidentiality of Confidential Information,
provided that such care shall be at least as great as the precautions taken by the Recipient to
protect its own confidential information. Regardless of any provision of this PSA to the contrary,
the Recipient may disclose Confidential Information (i) on a “need-to-know” basis to any of the
Recipient’s directors, officers, and

			
	 	 	 
	IBM/Athena Confidential
	 	Page 10 of 17

 

 

employees to the extent that the Recipient causes that individual to treat, hold, and maintain
such Confidential Information in the strictest confidence and only use such Confidential
Information for the purpose of performing the Recipient’s obligations under this PSA and (ii) as
required by law or any court or governmental order, if, to the extent legally permissible, the
Recipient provides the Disclosing Party with prompt written notice of such requirement so that the
Disclosing Party may seek an appropriate protective order with respect thereto.

     d. Return. Following termination of this PSA and upon the Disclosing Party’s request,
the Recipient will promptly deliver to the Disclosing Party all materials containing or consisting
of Confidential Information in the Recipient’s actual or constructive possession or control. At
such time, the Recipient will also destroy any Confidential Information in an intangible format
(e.g., electronic or magnetic) that is in its actual or constructive possession or control on
equipment or media not owned by the Disclosing Party. Despite any provision of this PSA to the
contrary, the Recipient may retain for its records a single copy of any correspondence between the
Recipient and the Disclosing Party that contains Confidential Information, which correspondence
will be kept strictly confidential by the Recipient.

     e. Ownership. All Confidential Information is and shall remain the property solely of
the Disclosing Party or the third party that provided such information to the Disclosing Party, and
the Recipient shall not obtain any right, title, or interest in or to any Confidential Information
under this PSA or by the performance of any obligations hereunder. The Recipient may not
decompile, reverse engineer, or disassemble any portion of the Disclosing Party’s software,
programs, or code.

     f. Remedies. The Recipient acknowledges that a breach of this Section 9 may cause
irreparable harm to the Disclosing Party for which the Disclosing Party could not be adequately
compensated by money damages. Accordingly, the Recipient agrees that, in addition to all other
remedies available to the Disclosing Party in an action at law, in the event of any breach or
threatened breach by the Recipient of the terms of this Section 9, the Disclosing Party maybe
entitled to seek injunctive relief, including, but not limited to, specific performance of the
terms hereof without the necessity of posting any bond or other security.

10. Intellectual Property

     a. All data, statistics, records, reports, programs, procedures, rules, business processes,
formats, screens, functionality, and similar items disclosed or provided by Athena, obtained by IBM
from Athena in connection with this PSA (including, but not limited to, data and databases provided
by Athena under this PSA that have been processed or altered by IBM and the formats for such data),
or developed by IBM in connection with the performance of the Services and either specifically
developed at Athena’s request, as documented under a Schedule or Change Order, or derivative of
products or services of Athena, as well as any intellectual property rights associated with any of
the foregoing (all of the foregoing, collectively, “Athena Property”) is and will at all times
remain the sole property of Athena or Athena’s customers. Athena grants to IBM a nonexclusive,
non-assignable, non-sublicensable, worldwide, paid-up, irrevocable license for the term of this PSA
to use, execute, reproduce, display, perform, distribute copies of, and modify Athena Property that
may be developed by IBM under this PSA solely in accordance with this PSA and for the purpose of
performing IBM’s obligations under this PSA. IBM hereby irrevocably and exclusively assigns to
Athena any and all right, title, and interest IBM might have in or to any and all Athena Property
and shall use all reasonable efforts to assist Athena in obtaining and enforcing, anywhere in the
world, all applicable intellectual property rights in any Athena Property, in each case at Athena’s
expense.

     b. Notwithstanding any provision to the contrary, nothing in this PSA shall assign to a Party
any ownership rights in or to the Pre-Existing Intellectual Property of the other Party. For the
purposes of this PSA, “Pre-Existing Intellectual Property” means intellectual property or materials
either (i) developed, owned by, or licensed to a Party prior to the Effective Date; (ii) otherwise
independently developed outside of the scope of this PSA; or (iii) any enhancements, modifications,
or derivative works of (i) through (iii) above. To the extent that the Parties agree to develop
any intellectual property not otherwise covered in this Section 10, the ownership of such property
will be agreed to by the Parties at such time.

11. Indemnification; Limitations

     a. Indemnification

          i. Indemnification by IBM. Subject to the limitations imposed by Section 11(b), IBM
shall indemnify, defend, and hold harmless Athena and Athena’s directors, officers, employees, and
agents from and

 
			
	 	 	 
	IBM/Athena Confidential
	 	Page 11 of 17

 

 

against any and all third-party claims, suits, proceedings, damages, liabilities, losses,
costs, and expenses (including, but not limited to, reasonable attorneys’ fees) (all of the
foregoing, collectively, “Claims”) to the extent that such Claims relate to or arise out of IBM’s
(A) infringement of any intellectual property right of a third party, except to the extent that IBM
is acting at Athena’s direction or resulting from Athena’s combination of the Services or any
deliverable with any other intellectual property not supplied by IBM pursuant to this PSA; (B)
breach of confidentiality as stated in Section 9 or of Schedule B of this PSA; (C) violation of any
applicable law or regulation to which IBM is obligated to comply under this PSA; (D) breach of any
of the representations and warranties of IBM in Section 13; or (E) the * of IBM or any of IBM’s
directors, officers, employees, or agents.

          ii. Indemnification by Athena. Subject to the limitations imposed by Section 11(b),
Athena shall indemnify, defend, and hold harmless IBM and its directors, officers, employees, and
agents from and against any and all third-party claims, suits, proceedings, damages, liabilities,
losses, costs, and expenses (including, but not limited to, reasonable attorneys’ fees) (all of the
foregoing, collectively, “Claims”) to the extent that such Claims relate to or arise out of
Athena’s (A) infringement of any intellectual property right of a third party; (B) breach of
confidentiality as stated in Section 9 or of Schedule B of this PSA; (C) violation of any
applicable law or regulation to which Athena is obligated to comply under this PSA; (D) breach of
any of the representations and warranties of Athena in Section 13; or (E) the recklessness or
willful misconduct of Athena or any of Athena’s directors, officers, employees, or agents.

          iii. Procedure. Each indemnitee shall promptly notify the Party from which it is
seeking indemnification of any Claim that might give rise to that Party’s obligations under this
Section 11, and that Party shall be relieved of such obligations as to that indemnitee if the
indemnitee fails to provide such notice and that Party is materially harmed by such failure. The
indemnifying Party shall have the right to immediately take control of the defense and
investigation of such Claim and to employ and engage attorneys of its sole choice to handle and
defend the same, at the its sole expense. Each indemnitee shall cooperate in all reasonable
respects with the indemnifying Party and its attorneys in the investigation, trial, and defense of
each Claim and any appeal arising therefrom; provided, however, that the indemnitee may
participate, at its own expense, in such investigation of such Claim arising therefrom. No Party
shall be liable for any costs or expenses incurred without that Party’s prior written
authorization. The indemnifying Party has full authority to settle any indemnified claims at the
indemnifying Party’s expense, except that any settlement requiring action by the indemnitee must be
approved by the indemnitee, such approval not to be unreasonably withheld.

     b. Limitation of Liability

     Notwithstanding any provision of this PSA to the contrary and subject to Section 1.10 of the
Master Agreement, except for breach of Section 10, no Party shall, in any event, regardless of the
form of claim, be liable for (i) any indirect, special, punitive, exemplary, speculative, or
consequential damages (including, but not limited to, any loss of use, loss of data, business
interruption, and loss of income or profits), regardless of whether it had an advance notice of the
possibility of any such damages; or (ii) damages relating to any claim that accrued more than two
(2) years before the institution of adversarial proceedings thereon.

12. AthenaNet System Access and Use

     a. Definitions

          i. The “athenaNet System” means software applications, associated databases, and associated
technology made available by Athena on an ASP basis that comprises Athena’s multi-user practice and
clinical management system. The athenaNet System technology includes, without limitation, the
screens, functions, and formats for organizing or presenting data and data made available by Athena
as part of the athenaNet System and the manuals, specifications, instructions, and training
provided by Athena in connection with the athenaNet System, whether written or otherwise.

          ii. “Other Systems” means other electronic systems or databases of Athena to which IBM may
need access rights for the performance of its obligations under this PSA.

          iii. “Athena Systems” mean the athenaNet System and Other Systems, collectively.

     b. Access and Use. IBM shall take, and have each of its users take, the following
steps when accessing the Athena Systems:

			
	 	 	 
	IBM/Athena Confidential
	 	Page 12 of 17

 

 

          i. To the extent necessary for provision of Services under this PSA, during the term of this
PSA, Athena hereby grants to IBM the right to access and use the Athena Systems on a non-exclusive
basis subject to the terms and conditions contained herein.

          ii. IBM will not access or use the Athena Systems other than in compliance with all policies
and procedures that Athena may provide to IBM from time to time (including, without limitation,
policies and procedures for administering role-based access levels and adding and removing users).

          iii. To the extent that any software, hardware, equipment, or other electronic system at
Athena is necessary for use by IBM for provision of the Services and is licensed to Athena by a
third party, IBM will not access or use such system other than in compliance with such license, and
Athena will provide the terms and restrictions of such license to IBM. Athena shall secure IBM the
right to access and use any such third-party system, and Athena shall pay any fees, costs, and
expenses associated with such access.

          iv. IBM will not knowingly, directly or indirectly, export or transmit (A) any software,
application, access to any Athena Systems, or any related documentation or technical data or (B)
any product, part, process, or service that is the direct product of any of the Services in or to
any country to which such export or transmission is restricted by regulation or statute without the
prior written consent, if required, of the Office of Export Administration of the United States
Department of Commerce or such other governmental entity as may have jurisdiction over such export
or transmission. In addition, and without limitation of the foregoing, IBM will not knowingly,
directly or indirectly, export or transmit any of the foregoing to any country other than as
required to perform its obligations under this PSA. Athena acknowledges IBM’s need and right to
access the Athena Systems from the remote locations set forth in this PSA.

          v. IBM will not access or use the Athena Systems except as required to perform its obligations
under this PSA.

          vi. In accessing or using the Athena Systems, IBM will not (A) make such access or use in
connection with provision of any services to any third party; (B) make such access or use other
than through and by its own employees who are registered with Athena individually as authorized
users thereof; (C) make such access or use other than by electronically secure means and methods
approved in advance in writing by Athena and only by the use of unique and confidential Login IDs
and passwords applied to each individual user; (D) resell, lease, encumber, sublicense, distribute,
publish, transmit, or provide such access or use to any third party in any medium whatsoever; (E)
make such access or use accessible on any public system or multiple computer or user arrangement or
network to anyone except Athena and IBM; (F) derive specifications from, reverse engineer, reverse
compile, disassemble, or create derivative works based on Athena Systems applications; (G) copy
data or screens from the Athena Systems; or (H) knowingly input or post through or to the Athena
Systems any content that is illegal, threatening, harmful, lewd, offensive, or defamatory or that
infringes the intellectual property rights, privacy rights, or rights of publicity of others or
that contains any virus, worm, Trojan Horse, or other mechanism that could damage or impair the
operation of the Athena Systems or grant unauthorized access thereto.

          vii. IBM will not make or operate or permit operation of any copy of any elements of the
Athena Systems, except as explicitly authorized by Athena in writing or as may be necessary for the
provision of the Services. If and to the extent that IBM makes or operates any copy of the Athena
Systems, such copy will belong exclusively to Athena and will be located only upon a server with a
root password solely owned and controlled by Athena, and IBM will not restrict or permit
restriction of electronic or physical access of Athena to such server.

          viii. In accessing or using the Athena Systems, IBM will not knowingly order, review, access,
or use any data in excess of that reasonably necessary for it to perform its obligations under this
PSA.

          ix. IBM will limit access to and use of the Athena Systems by its personnel to secure levels
agreed to by Athena. IBM is responsible for the actions of individuals to which IBM grants access
to the Athena Systems. If IBM or any of its employees discloses user credentials to an
unauthorized person, IBM is validating the identity and authority of such person to act on its
behalf as to any access or use of Athena Systems with such credentials and will be responsible for
such access and use. IBM will notify Athena immediately if it becomes aware of any unauthorized
use of any Athena Systems username or password, or, where applicable, a IBM user making more than
three failed system log-on attempts during any given day, and will take reasonable steps with

			
	 	 	 
	IBM/Athena Confidential
	 	Page 13 of 17

 

 

Athena to shut off access to the Athena Systems by the individual associated with such username or
password, and Athena will reset access only with IBM authorization.

     c. Facility Security. With respect to a facility owned or leased by or on behalf of
IBM where it creates, receives, maintains, or transmits PHI on behalf of Athena, where applicable,
IBM shall implement administrative, physical, and technical safeguards that reasonably and
appropriately protect the confidentiality, integrity, and availability of PHI.

13. Representations and Warranties

     a. Representations and Warranties of Both Parties. Each Party makes the following
representations and warranties to the other Party.

          i. Neither it nor, to its knowledge, its agents or permitted subcontractors: (A) has been
convicted of a federal health care crime; (B) has been excluded from participation in any federal
health care program; or (C) is currently under investigation or involved in any legal proceeding
which may lead to such a conviction or exclusion. Each Party will notify the other Party
immediately if any of the foregoing occur, and such events shall constitute cause for termination
on the part of the notified Party.

          ii. Throughout the Term, it will maintain a compliance program intended to conform in material
respects with the guidelines set forth in the U.S. Sentencing Guidelines and the Office of
Inspector General’s Compliance Program Guide for Third Party Medical Billing Companies. Upon
request, a copy of such compliance program will be provided to the other Party, which program shall
be treated as Confidential Information.

          iii. It has all requisite corporate power and authority to execute, deliver, and perform its
obligations under this PSA; the execution, delivery, and performance of this PSA has been duly
authorized by it; and no approval, authorization, or consent of any governmental or regulatory
authority is required to be obtained by it or made in order for it to enter into and perform its
obligations under this PSA.

          iv. Throughout the Term, it shall not knowingly or as a result of gross negligence permit any
media, data, or software provided by it to the other Party to contain any code, virus, or other
mechanism to disable, adversely affect, harm, or grant unauthorized access or use to Athena Systems
or Athena’s equipment or data. Upon its discovery of any such code, virus, or mechanism, it shall
promptly notify the other Party.

          v. Throughout the Term, (A) it shall not disclose Medicaid Confidential Data as defined under
statues or regulations of the State or New York without prior written approval of the New York
State Department of Health Office of Medicaid Management; (B) to the extent that it has access to
eligibility data from Medicare or any Medicaid Program, it will each restrict its access to such
Medicaid and Medicare eligibility data to the sole purpose of verification of patient eligibility
for Medicaid and Medicare benefits respectively where the patient has requested such payment for
medical services; and (C) to the extent that it receives or has access to health information
sourced from or provided by the State of New York or any agency thereof, it shall be in compliance
with the New York State AIDS/HIV Related Confidentiality Restrictions Notice hereinafter stated:

“This information has been disclosed to you from confidential records,
which are protected by state law. State law prohibits you from making
any further disclosure of this information without the specific
written consent of the person to whom it pertains, or as otherwise
permitted by law. Any unauthorized further disclosure in violation of
state law may result in a fine or jail sentence or both. A general
authorization for the release of medical or other information is not
sufficient authorization for further disclosure.”

     b. Representations and Warranties of IBM. IBM makes the following representations and
warranties to Athena.

          i. During the Term, IBM will comply with all employee and workplace laws, regulations, and
requirements in the countries in which IBM provides the Services. IBM will provide to Athena, upon
Athena’s

 
			
	 	 	 
	IBM/Athena Confidential
	 	Page 14 of 17

 

 

reasonable request from time to time, appropriate written assurances regarding the
specific compliance steps and measures that IBM has taken.

          ii. IBM has sufficient right and title to all third-party software, hardware, or other
equipment (other than Athena Systems and third-party software) that it uses in the provision of
Services under this PSA, and, throughout the Term, IBM will comply with all terms and conditions of
licenses or consents agreed to by IBM with any third party in respect of any software, hardware, or
other equipment that IBM uses to provide the Services.

          iii. Throughout the Term, any encryption software provided by IBM to Athena for use in
connection with the Services or used by IBM in connection with the Services complies substantially
with the encryption requirements set forth in HCFA Internet Security Policy issued November 24,
1998, as it may be amended or updated from time to time, and provides encryption protection equal
to or exceeding 128-bit encryption.

          iv. Each of the provisions of this PSA are valid and enforceable with respect to each IBM
entity in each jurisdiction in which IBM may provide the Services.

14. General Provisions

     a. Nothing in this PSA is intended or shall be construed or interpreted to give any person or
entity other than the Parties any legal or equitable right, remedy, or claim under or in respect of
this PSA or any provision contained herein.

     b. This PSA may be executed in counterparts, each of which shall be deemed an original, but
both of which together shall constitute one and the same instrument.

     c. This PSA shall be governed and construed in all respects in accordance with the laws of the
Commonwealth of Massachusetts. Any claims relating to this PSA or the provision of the Services
shall be brought in the federal or state courts sitting in Massachusetts, and IBM shall be
considered IBM’s agent for service of process.

     d. Nothing in this PSA shall be deemed to create a partnership, joint venture, agency, or
employment relationship between the Parties. IBM shall be deemed to be an independent contractor.
Except as expressly provided in this PSA, IBM shall be responsible for all of its costs and
expenses incurred in connection with the provision of the Services, including, but not limited to,
all costs and expenses pertaining to its employees and agents.

     e. No Party may assign any of its rights or obligations under this PSA to any third party
without the prior written consent of the other Party; provided, however, that Athena may assign its
rights and obligations hereunder to any of its affiliates or any successor-in-interest as the
result of merger, consolidation, or the acquisition of all or substantially all of the assets of,
or a majority equity interest in, Athena.

     f. Each Party shall be relieved of its failure to perform any obligations under this PSA,
other than a payment obligation, if and to the extent that such failure is attributed to
circumstances outside of its control, including, but not limited to, the other Party’s failure to
perform any of its responsibilities in accordance with this PSA.

     g. Any amendment of or supplement to this PSA, and any waiver of any breach or provision
hereof, must be in writing and signed by both Parties.

     h. All notices and other communications under this PSA (other than routine operational
communications) must be in writing and shall be deemed given (i) upon hand delivery, (ii) one day
after deposit with an internationally recognized overnight courier with a reliable system for
tracking delivery, or (iii) upon receipt of facsimile or electronic mail with confirmation of
delivery, in each case to the address, facsimile number, or email address of the intended recipient
set forth below or such other address, facsimile number, or email address as the intended recipient
may specify by notice from time to time:

 
			
	 	 	 
	IBM/Athena Confidential
	 	Page 15 of 17

 

 

	 	 	 
	If to IBM:

	 	International Business Machines Corporation
	 

	 	Senior Counsel, Managed Business Process Services
	 

	 	294 Route 100, Building 4, 2D-09
	 

	 	Somers, NY 10589-3216
	 

	 	Attn: David Brown
	 

	 	Facsimile: (914) 766-8445
	 

	 	Email:                   
                  
                  
	 
	 	 
	If to Athena:

	 	athenahealth, Inc.
	 

	 	311 Arsenal Street
	 

	 	Watertown, MA 02472
	 

	 	Attn: Daniel Orenstein, General Counsel
	 

	 	Facsimile: +1 617-402-1099
	 

	 	Email: dorenstein@athenahealth.com

The remainder of the page intentionally left bank.

 
			
	 	 	 
	IBM/Athena Confidential
	 	Page 16 of 17

 

 

          In witness whereof, the Parties have executed this PSA as of the Effective Date.

	 	 	 	 	 	 	 	 	 	 
	International Business Machines Corporation	 	 	 	athenahealth, Inc.	 
	 
	 	 	 	 	 	 	 	 	 
	By:

	 	/s/ Anthony C. Martinez
	 	 	 	By:
	 	/s/ Jonathan Bush	 
	 

	 	 
	 	 	 	 	 	 	 
	 

	 	Name: Anthony C. Martinez
	 	 	 	 	 	Name: Jonathan Bush	 
	 

	 	Title: General Manager
	 	 	 	 	 	Title: CEO	 
	 
	 	 	 	 	 	 	 	 
	Date: 10/2/09	 	 	 	Date: 10/2/09	 

 
			
	 	 	 
	IBM/Athena Confidential
	 	Page 17 of 17

 

 

Exhibit A — FORM OF PROJECT CHANGE REQUEST

In accordance with the terms and conditions of the Professional Services Agreement dated
September 30, 2009 (the “PSA”), between athenahealth, Inc. (“Athena”) and International Business
Machines Corporation (“IBM”), it is agreed between the parties thereto that the additional services
described below (the “Services’’) are not currently included in the scope of services of Schedule A
to the PSA, as it may have been modified from time to time.

Athena has therefore requested a project change to include the Services under the PSA, and IBM is
willing to provide the Services under the same terms and conditions of the PSA and Schedule A
thereto, subject to the additional terms (including payment terms) described herein:

IBM shall perform such Services as described below:

This Change Order is to be effective from _________ (the “Commencement Date”).

1. Description of Services

	 	a.	 	Initial Scope of Support:
	 
	 	b.	 	Required FTE’s and other required support personnel:
	 
	 	c.	 	Is billable training required to support implementation of PCR?
	 
	 	d.	 	If yes, describe below in detail the training to be delivered, each parties
responsibility related to the delivery of the training, and the number of billable training
hours authorized by the Athena
	 
	 	e.	 	In support of implementation of the Services, the Athena will:
	 
	 	f.	 	In support of implementation of the Services, IBM will:
	 
	 	g.	 	Completion Criteria: This section to be used to document the criteria that will
indicate completion of this PCR

2. Payment

The price to be charged for the services will be as set forth below. The invoicing and payments
terms will be as per the PSA (if this is the case).

This section should include any relevant details supporting the Payment required including number
or hours, rates, any non-personnel related charges (travel expenses, hardware or software,
development costs, etc.)

3. Service Levels

This section to be used to document any expected Service Level impact related to implementation of
the change

4. Forecasts

This section to be used to document any expected Forecast impact related to implementation of the
change

In witness whereof, the parties below have executed this Project Change Request as of the date
first signed below.

	 	 	 	 	 	 	 	 	 	 	 
	International Business Machines Corporation	 	 	 	 athenahealth, Inc.	 	 
	 
	 	 	 	 	 	 	 	 	 	 
	By:

	 	 

	 	 
	 	By:
	 	 

	 	 
	 

	 	Name:
	 	 	 	 	 	Name:	 	 
	 

	 	Title:
	 	 	 	 	 	Title:	 	 
	 
	 	 	 	 	 	 	 	 	 	 
	Date:

	 	 

	 	 	 	Date:
	 	 

	 	 

			
	 	 	 
	IBM/Athena Confidential
	 	Exhibit A-1

 

 

Schedule A — Services Description

This Schedule A describes the Services to be provided by IBM under the PSA including the
duties and responsibilities of IBM and Athena related to IBM’s provision of the Services as well as
any related service levels and deliverables. This Schedule A also consists of the following
attachments which describe the specific effort which comprise the Services:

	 	1)	 	Schedule A-1 — Explanation of Benefits Posting Process
	 
	 	2)	 	Schedule A-2 — Payer Contact Services
	 
	 	3)	 	Schedule A-3 — Enrollment Services
	 
	 	4)	 	Schedule A-4 — Clinical Document Services

Capitalized terms used but not defined in this Schedule shall have the same meaning assigned to
such terms in the PSA unless the context in which such terms are used in this Schedule require a
different meaning.

1. Definitions

	 	1)	 	Agent means an IBM resource working on the Athena account.
	 
	 	2)	 	At Risk Amount shall mean the amount available for Service Level Credits and shall not
exceed an amount equal to * of the previous month’s monthly recurring charges for the
Service described in that specific Schedule (e.g., Schedule A-1, Schedule A-2, etc). For
the avoidance of doubt, in no event shall the aggregate At Risk Amount for any month exceed
* of the aggregate recurring charges for such month.
	 
	 	3)	 	athenaNet means the Athena proprietary application used by IBM to provide the Services
described in this Schedule to Athena.
	 
	 	4)	 	Available Hour means the number of hours an Agent is available to work on Athena’s
project.
	 
	 	5)	 	Batch means a group of images which may include EOBs, checks, and other remittance
documents. This batch of documents will be provided to IBM by Athena as set forth in this
Schedule A for processing by IBM.
	 
	 	6)	 	Business Days refers to the days in which Athena is open for business. For purposes of
this Schedule A, it will be Monday through Friday (excluding Saturday and Sunday and Athena
holidays. Athena and IBM will establish the holiday schedule on an annual basis.
	 
	 	7)	 	Claim Data Dump means the daily file provided by Athena listing all claims sent to the
Payers in a mutually agreed format.
	 
	 	8)	 	EOB means the scanned image of the paper copy of the explanation of benefits supplied
by the Payers.
	 
	 	9)	 	Evaluation Period shall mean * days from the Go Live date for a given business process
during which period IBM will validate the targeted Service Levels which have been provided
to IBM by Athena.
	 
	 	10)	 	FTP Server means the file transfer protocol server provided by IBM for Athena to
transfer daily batch of EOBs, Claims Data Dump, Payer Data Dump and Remittance Data File.
	 
	 	11)	 	Go Live means the time when pre-process and process training is complete and Agents
begin to perform the Services.
	 
	 	12)	 	IBM Project Executive means the full-time IBM resource responsible for the delivery of
the Athena project. The IBM Project Executive will be a full-time resource who acts as a
single point of contact for the Athena management.
	 
	 	13)	 	Kick Code means a code attached to a claim to identify its current status and/or the
next step(s) in the claim handling process.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 1 of 20

 

 

	 	14)	 	Payer means health insurance companies to whom Athena sends claims on behalf of the
providers.
	 
	 	15)	 	Payer Data Dump means the daily file provided by Athena listing Payer information in a
mutually agreed format.
	 
	 	16)	 	Payment Posting Process means the Athena process of processing the electronic
remittance file (ANSI 835 transaction) and Remittance Data File into the athenaNet
application.
	 
	 	17)	 	Remittance Data File means the daily file created by IBM by entering EOB remittance
data in a mutually agreed format.
	 
	 	18)	 	Service Level shall mean those levels of service as established in accordance with
Section 4 of this Schedule A and set forth in Schedules A-1 through A-4.
	 
	 	19)	 	Wave means a group of IBM trainees starting and completing pre-process and process
training together as a class.

2. Overall Description of Services

IBM shall provide the Services as specifically described in Schedules A-1 through A-4 attached
hereto. In support of the provision of such Services and in addition to the responsibilities set
forth in Schedules A-1 through A-4, the parties will perform the general responsibilities described
below.

	 	2.1	 	General Responsibilities

	 	(a)	 	IBM Responsibilities. In support of the Services, IBM will:

	 	(i.) 	 	Participate in conference calls (as needed) to review
progress against mutually agreed transition plan and ongoing operations.
Provide web conference and/or video conference capabilities if available and
as necessary to accommodate business needs;
	 
	 	(ii.) 	 	Provide process training to IBM resources after the
completion of process training for the initial transition Wave at designated
IBM locations in India and the Philippines;
	 
	 	(iii.) 	 	Provide Athena with clear and consistent communication related to the any
issues affecting or impacting the delivery of requirements described in each
of the schedules;
	 
	 	(iv.) 	 	Perform athenaNet administration tasks necessary to
maintain the user groups for IBM resources;
	 
	 	(v.) 	 	Communicate to the Athena Operations Manager any changes
that may materially affect Athena’s business operating environment;
	 
	 	(vi.) 	 	Report to Athena management problems and issues impacting
IBM’s provision of the Services that may require Athena’s attention and/or
resolution;
	 
	 	(vii.) 	 	Coordinate resolution of issues raised by Athena management and, as
necessary, escalate within IBM;
	 
	 	(viii.) 	 	Work with Athena to provide findings and recommendations intended to
improve operational efficiencies;
	 
	 	(ix.) 	 	Manage the transition of the processes according to the
agreed schedule; and
	 
	 	(x.) 	 	Jointly work with Athena to develop a communication and
management plan, which may consist of the following:

			
	 	 	 
	IBM/Athena Confidential
	 	Page 2 of 20

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

	 	a.	 	Performance reviews with respect to
the Services;
	 
	 	b.	 	Forecasting and scheduling review
with Athena’s workforce management team;
	 
	 	c.	 	Training review with Athena’s
training team;
	 
	 	d.	 	Quality review with Athena’s quality
team;
	 
	 	e.	 	Quality calibrations; and
	 
	 	f.	 	Monthly and quarterly reviews as
agreed by both Parties.

To the extent that Athena’s performance of any obligation requires or is contingent upon IBM’s
performance of an obligation under this Schedule, and IBM unreasonably delays or withholds its
performance beyond the applicable time period therefor (or beyond five (5) business days, if a
time period is not specified), Athena will be relieved of such obligation until a reasonable
period following IBM’s performance of its responsibility. *

	 	(b)	 	Athena Responsibilities. In support of the Services, Athena will:

	 	(i)	 	Provide forecasts and transaction inflow data to identify
anticipated volume patterns for each Service. Current estimates of those
volume distribution patterns are provided in each subsequent schedule;
	 
	 	(ii)	 	Ensure athenaNet system is available daily from 6 AM to 1
AM ET, seven (7) days a week, with 99.7% availability during this timeframe;
	 
	 	(iii)	 	Provide trainers and training material to IBM during
process training for the initial transition Wave at designated IBM locations
in India and the Philippines. The support of Athena trainers and SME to IBM
would continue as needed for a period of up to four (4) weeks following
completion of classroom training of the initial transition Wave;
	 
	 	(iv)	 	Provide training materials as appropriate for any changes
in AthenaNet application or Athena-owned business processes. Any
extraordinary training would be through the PCK process. Routine updates are
covered in cost;
	 
	 	(v)	 	Maintain the underlying athenaNet functionality that
supports the activities comprising the Services;
	 
	 	(vi)	 	Provide detailed workflow information and supplemented
training information as needed to support the Services;
	 
	 	(vii)	 	Provide IBM with a glide path for Service Level
performance goals during Evaluation Period for each of the Services described
in this Schedule;
	 
	 	(viii)	 	Manage the transition of the processes according to the agreed schedule;
	 
	 	(ix)	 	Provide IBM clear and consistent direction and
communication related to the Services, and manage communication between IBM
and any other parties engaged by Athena;
	 
	 	(x)	 	Participate in conference calls (as needed) to review
progress against mutually agreed transition plan and ongoing operations.
Provide web conference and/or video conference capabilities if available and
as necessary to accommodate business needs; and
	 
	 	(xi)	 	Jointly work with IBM to develop a communication and
management plan, why may consist of the following:

			
	 	 	 
	IBM/Athena Confidential
	 	Page 3 of 20

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

	 	1.	 	Performance reviews with respect to the Services;
	 
	 	2.	 	Forecasting and scheduling review with Athena’s
workforce management team;
	 
	 	3.	 	Training review with Athena’s training team;
	 
	 	4.	 	Quality review with Athena’s quality team;
	 
	 	5.	 	Quality calibrations; and
	 
	 	6.	 	Monthly and quarterly reviews as agreed by both
Parties.

To the extent that IBM’s performance of the Services requires or is contingent upon Athena’s
performance of an obligation (including providing approval or notification or taking a
recommended corrective action) under this Schedule, and Athena unreasonably delays or withholds
its performance beyond the applicable time period therefor (or beyond * business days, if a time
period is not specified), IBM will be relieved of its obligation to perform such Services until
a reasonable period following Athena’s performance of its responsibility. Athena will pay IBM
for any additional expenses incurred as a result of Athena’s delay or nonperformance.

	 	2.2	 	Disaster Recovery Responsibilities

Within the first 90 days following the Effective Date, IBM will work with Athena to jointly
develop a business continuity/disaster recovery plan for the delivery of Services. IBM will at
all times maintain, at a minimum, its predefined Level 1/Level 2 support disaster recovery plan
which includes the following:

	 	 	 
	Information & Technology

	 	*
	Power & Utilities

	 	*
	Transport & Catering

	 	*
	Fire & Medical Emergencies

	 	*
	IT services Availability

	 	*
	Server Management Level

	 	*
	Network & Connectivity Media Level

	 	*
	Call Center Technology / Voice Infrastructure

	 	*

			
	 	 	 
	IBM/Athena Confidential
	 	Page 4 of 20

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

Infrastructure

3. Service Levels

	 	3.1	 	Evaluation Period

	 	(a)	 	With respect to the Service Levels set forth in this Schedule A, IBM shall,
during the Evaluation Period, measure the actual performance of the Services against
such Service Levels using the measurement tools and processes agreed upon by the
Parties and, based on such measured actual performance. The value for such Service
Level following the Evaluation Period shall be established by taking into account the
average levels of performance achieved by Athena prior to the Effective Date of the
PSA and the levels achieved by IBM during the Evaluation Period. If it is determined
that the Evaluation Period is not indicative of Athena’s normal operating
environment, Athena and IBM shall mutually define another period, which is
representative of Athena’s normal operating environment.
	 
	 	(b)	 	Service Level Credits will not apply during the Evaluation Period.

	 	3.2	 	Service Level Performance Reports

Each Service Level shall be measured on a monthly basis unless otherwise set forth in the
applicable Schedule. Within * Business Days after the end of each calendar month during the
Term, IBM shall provide to Athena monthly performance reports, in soft copy form, to verify
IBM’s performance with respect to the Service Levels, including any failures to achieve the
Service Levels and any Service Level Credits to which Athena is entitled for such month. IBM
shall provide reasonably detailed supporting information for each report to Athena in
machine-readable form suitable for use on a personal computer. For Service Levels that are not
capable of being measured using a system tool, the Parties shall agree upon an appropriate
measurement methodology, including sample size and measurement and reporting frequencies.

	 	3.3	 	Service Level Values.

Service Level values for the Services are set forth in the respective Schedules A-1 through A-4
attached hereto.

	 	3.4	 	Credit Calculation.

For failure to meet a Service Level, IBM will pay Athena a Service Level Credit which will be
determined according to the following:

	 	1.	 	Each Service Level is assigned a weighting factor, as set forth in the respective
Services Schedules. No single weighting factor shall exceed * with the exception of those Services Schedules that have *. The total of the weighting factors for all
Service Levels within a Service Schedule shall not exceed *.
	 
	 	2.	 	The weighting factor for any missed Service Level in a given month will be multiplied
by the applicable At Risk Amount for such month to determine the amount of Service Level
Credit to be subtracted from the following months invoice. In no event shall the total
amount due as a credit in any given month exceed the At Risk Amount for such month.
Additionally, if the monthly recurring charge for a given month has not been incurred, or
for any other reason has been credited or waived, no Service Level Credit will be
applicable for such month.
	 
	 	3.5	 	Service Level Exclusions.

IBM shall be excused from failure to meet any Service Level (including being excused from any
related Service Level Credit) to the extent such failure is attributable to:

			
	 	 	 
	IBM/Athena Confidential
	 	Page 5 of 20

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

	 	(a)	 	Force Majeure;
	 
	 	(b)	 	Breach of the PSA by Athena or any Athena obligation under the PSA to the
extent it affects IBM’s ability to achieve any Service Level;
	 
	 	(c)	 	Act or omission by Athena;
	 
	 	(d)	 	Athena’s prioritization of IBM’s resources provided IBM has informed Athena
that such prioritization may adversely impact IBM’s performance, including Athena
request for or utilization of the Services beyond * of the forecasted volumes;
	 
	 	(e)	 	Problems determined to be caused by software code provided by Athena;
	 
	 	(f)	 	Problems attributed to world wide web Internet cloud beyond IBM control;
and
	 
	 	(g)	 	Problems resulting from a technology component (network, hardware,
software, applications, etc.) for which Athena is responsible to the extent it
affects IBM’s ability to achieve any Service Level.

4. Reporting

IBM will provide standard monthly reports of volume processed each month and the quality and turn
around results as measured by IBM based on reports provided by athenaNet. Athena will provide
standard monthly report to IBM listing quality results of Athena quality monitoring process. In
addition, Athena will provide IBM timely access to necessary production reports to enable IBM to
manage their performance of the Services.

5. Charges

IBM will invoice Athena in accordance with Section 6 of the PSA for the Services described herein
based on the amounts set forth in Schedule C.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 6 of 20

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

Schedule A-1 — Explanation of Benefits Posting Process

1. Description of Services

The EOB posting process involves the processing of remittance related documents received by
Athena. Non-electronic payments, related EOB forms, and other payment related documents are
posted to provider accounts.

2. Exhibits

	 	•	 	Exhibit 1 — Claim Data Dump format
	 
	 	•	 	Exhibit 2 — Payer Data Dump format
	 
	 	•	 	Exhibit 3 — Remittance Data File format

3. Location and Hours of Operations

EOB posting services will be provided from IBM location in Pune, India. Services may be
provided between the hours of 5 AM to 1 AM ET (following day) seven (7) days a week. Volume
distribution by day is expected to be approximately as follows (these estimates are to be used
for planning purposes only):

	 	 	 	 	 	 	 	 	 	 	 	 	 
	 	 	Monday	 	Tuesday	 	Wednesday	 	Thursday	 	Friday	 	Saturday
	Volume

	 	*
	 	*
	 	*
	 	*
	 	*
	 	*

4. IBM Responsibilities

	 	4.1	 	Payment Posting Services

	 	(a)	 	Payment Batch Creation: IBM will review images in a daily batch
and perform any divisions necessary to prepare batches appropriate for EOB data entry
using the athenaNet application.
	 
	 	(b)	 	EOB Data Entry: IBM will:

	 	(i)	 	Perform data entry of payment and denial data from EOBs,
payer or patient checks, and other Payer provided documentation using IBM
provided offline application;
	 
	 	(ii)	 	Validate line item charges on EOBs against the Claims Data
Dump and payment;
	 
	 	(iii)	 	Enter denial data into Remittance Data File;
	 
	 	(iv)	 	Utilize the Claims Data Dump and the Payer Data Dump to
facilitate data validation and to auto populate fields in order to expedite
the data entry process;
	 
	 	(v)	 	Provide the completed data from the application to Athena
using the Remittance Data File;
	 
	 	(vi)	 	post the Remittance Data File to the IBM FTP server upon
creation; and
	 
	 	(vii)	 	not be required to archive any of these images after the
processing of the image.

	 	(c)	 	Manual Payment Posting: IBM will:

			
	 	 	 
	IBM/Athena Confidential
	 	Page 7 of 20

 

 

	 	(i)	 	manually post EOB charge lines that fail to auto-match
and/or auto-post in athenaNet; and
	 
	 	(ii)	 	will resolve the transactions in the batch that were not
automatically posted to athenaNet using IBM staff (“Posting Analysts”).

	 	4.2	 	Resolution of Unpostable Records: IBM will resolve records marked as unpostable during
the Payment Posting process and queued accordingly in the AthenaNet application.
	 
	 	4.3	 	Resolution of Posting Errors: IBM will correct records that are identified as having
been posted in error and queued accordingly in the AthenaNet application.

5. Athena Responsibilities

In support of IBM’s provision of the Services as described in this Schedule, Athena will:

	 	(a)	 	Populate IBM posting exception work queues in AthenaNet by 5 AM ET each
Business Day;
	 
	 	(b)	 	Perform the following activities on days when images are to be processed:

	 	(i)	 	Prepare daily batch of images and transfer them to the FTP
Server by 5 AM ET each Business Day;
	 
	 	(ii)	 	Transfer Claims Data Dump to the FTP Server by 5 AM ET each
Business Day; and
	 
	 	(iii)	 	Transfer Payer Data Dump to the FTP Server by 5 AM ET each
Business Day.

	 	(c)	 	Provide monthly forecast of projected volume in terms of relevant planning
and billing units for each process;
	 
	 	(d)	 	Pull IBM posted Remittance Data File from the FTP Server daily throughout
the Business Day per the agreed upon schedule
	 
	 	(e)	 	Maintain the connectivity of their FTP servers to the Internet and
sufficient bandwidth to support the volume and timeframes depicted in this Schedule;
	 
	 	(f)	 	Provide IBM with application licenses required to perform the Services,
including CITRIX licenses if required; and
	 
	 	(g)	 	Provide a real-time assignment queue in athenaNet to allocate unresolved
batches in priority order to Posting Analysts.

6. Service Levels

In accordance with Section 4 of Schedule A, IBM will strive to perform the Services in accordance
with business rules supplied by Athena as of the Effective Date and meet the Service Levels and
Quality Standards set forth in this Section. If such business rules change in a manner so that
the Service Levels and Quality Standards are affected, then IBM shall notify Athena, and the
Parties will work together as necessary to establish new Service Levels and Quality Standards.

During the Evaluation Period for each process, IBM will evaluate the actual performance against the
targeted service levels which have been provided by Athena. Should discrepancies exist, IBM and
Athena will jointly develop an appropriate plan to revise the targeted Service Level.

	 	6.1	 	Measurement.

Performance against the Service Levels stated herein will be measures as described below.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 8 of 20

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

	 	(a)	 	Process Turnaround Time: Average process turnaround time for all
remittance related documents in any given month will be within *. Process turnaround
time will be measured as the time duration between the placement of the remittance
images on the IBM FTP Server by Athena to the placement of the Remittance Data File
on the IBM FTP server by IBM.
	 
	 	(b)	 	Quality: IBM and Athena will work jointly to develop a data
accuracy quality management process by the end of Evaluation Period. IBM is expected
to meet * data accuracy quality standard.

	 	6.2	 	Service Level Weighting Factors:

	 	 	 	 	 
	Service Level	 	Weighting Factor
	Process Turnaround Time

	 	 	*	 
	Quality

	 	 	*	 
	Total Weighting Factor (not to exceed 100%)

	 	100%

			
	 	 	 
	IBM/Athena Confidential
	 	Page 9 of 20

 

 

Schedule A-1, Exhibits 1, 2 and 3

Exhibit 1 — Claim Data Dump format (attachment removed)

Exhibit 2 — Payer Data Dump format (attachment removed)

Exhibit 3 — Remittance Data File format (attachment removed)

			
	 	 	 
	IBM/Athena Confidential
	 	Page 10 of 20

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

Schedule A-2 — Payer Contact Services

1. Description of Services

Payer Contact Services consist of the communication needed between Athena and the payer
community for the purposes of Revenue Cycle Management. Payers may be contacted to determine
the status of a claim and related payment, provide additional detail regarding a claim, or
clarify the reason for denied claim.

2. Location and Hours of Operations

Payer Contact Services will be provided from IBM locations in Pune, India and in Manila,
Philippines. Services may be provided between the hours of 8 AM to 8 PM ET on Business Days.
Volume distribution by day is expected to be approximately as follows (these estimates are to be
used for planning purposes only):

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 
	 	 	Monday	 	Tuesday	 	Wednesday	 	Thursday	 	Friday	 	Saturday
	Volume
	 	 	*	 	 	 	*	 	 	 	*	 	 	 	*	 	 	 	*	 	 	 	*	 

3. IBM Responsibilities

	 	3.1	 	Claim Tracking Services

Claim Tracking involves contacting payers via web, telephone, fax, and direct mail inquiries in
an effort to obtain claim status information and to update athenaNet with the same. The claims
processed in this workflow have an unknown payer adjudication status or require payer contact to
process. The goal of the workflow is to identify any payer processing issues that may have
delayed adjudication and payment and to either resolve the issue or notify the appropriate next
responsible party to initiate resolution.

Athena places claims in this workflow in a worklist daily for processing by the IBM Claim
Tracking Team. Prior to contacting the payer for claim status, claims must first be thoroughly
reviewed through a detailed analysis of the claim history, including, without limitation, (i)
review of claim-related events in chronological order to understand the processing to date of
each claim, (ii) review of any payments posted or documentation attached to the claim that could
impact the dialogue with the payer once contact is established, and (iii) review of all relevant
demographic data prior to contacting the payer so that the call agent has a firm understanding
of the types of insurance coverage the patient currently has or may have had in the past.

On completion of the above analysis, including identification of the payer with whom processing
status is unknown, the agent will contact the payer by calling the number(s) listed in
athenaNet, or by another contact method as directed by Athena.

The Claim Tracking team will follow documented workflows supplied by Athena. Details of the
call and the relevant data points collected for each payer contact event will be updated in
athenaNet through (i) direct entry in unique data fields and (ii) creation of an updated claim
note that contains a unique Kick Code to characterize the information received from the payer
and to identify the specific reason for the call.

	 	3.2	 	Remittance Tracking Services

Remittance Tracking involves contacting payers via web, telephone, fax, and direct mail
inquiries to obtain copies of claim remittance and proof of payment to be used for posting

			
	 	 	 
	IBM/Athena Confidential
	 	Page 11 of 20

 

 

activities. The claims processed in this workflow are known to be paid claims, as documented in
connection with a previous payer contact event. The goals of this workflow are to (i) obtain a
copy of the remittance detail (EOB/ERA) and proof of payment (check copy of verbal confirmation
of disbursement details), (ii) forward the remittance detail and proof of payment to the posting
department for claim posting, and (iii) identify any possible reasons for the initial failure of
the remittance documents to be received and processed in a timely manner. The primary activity
is confirmation of the pay-to address used by the relevant payer.

Athena places claims in this workflow in a worklist daily for processing by the IBM Remittance
Tracking Team. Prior to contacting the payer for claim status, claims must first be thoroughly
reviewed through a detailed analysis of the claim history, including, without limitation, (i)
review of claim-related events in chronological order to understand the processing to date of
each claim, (ii) review of any payments posted or documentation attached to the claim that could
impact the dialogue with the payer once contact is established, (iii) review of all relevant
unpostables inventory in athenaNet to search for missing remittance documentation prior to
contacting the payer, and (iv) review of all relevant demographic data.

It can be the case that the remittance documents have already been received and a processing
oversight or timing delay may have resulted in a failure to apply information to the claim.
Since the payer has already been contacted and confirmed payment, the claim history will contain
many of the payment details. These payment details can be used to search data fields in the
unpostables library in order to aid the process of identifying previously received data that
might now be able to be applied to the claim.

On completion of the above analysis, including identification of the payer from which remittance
documentation is needed, the agent will contact the payer by calling the number(s) listed in
athenaNet, or by another contact method as directed by Athena.

The Remittance Tracking Team will follow documented workflows supplied by Athena. Details of
the call and the relevant data points collected for each payer contact event will be updated in
athenaNet through (i) direct entry in unique data fields, and (ii) creation of an updated claim
note that contains a unique Kick Code to characterize the information received from the payer
and to identify the specific reason for the call.

	 	3.3	 	Unpostables Tracking

Unpostables Tracking involves contacting payers via web, telephone, fax, and direct mail
inquiries to obtain detailed claim data or copies of claim remittance and proof of payment to be
used for posting activities for unpostable records. Unpostable records are not able to be
uniquely associated with a specific charge line in athenaNet and therefore are not yet postable
into the system. The goal of the workflow is to obtain the information needed to supplement the
unpostable record so that the data can then be applied to individual charge lines in athenaNet
and posted accordingly.

Only unpostable records for which contact with the payer is required to aid resolution are
processed in this workflow. Unpostable records are categorized by the characteristics and
resolution path of the records. The categories handled by the Unpostables Tracking process are:

	 	•	 	Missing EOB
	 
	 	•	 	Missing Check
	 
	 	•	 	Missing EFT
	 
	 	•	 	Missing Page
	 
	 	•	 	Provider Takeback
	 
	 	•	 	Check Amount Different than EOB
	 
	 	•	 	Rebate Check

			
	 	 	 
	IBM/Athena Confidential
	 	Page 12 of 20

 

 

	 	•	 	Unreadable EOB

Athena places claims in this workflow daily for processing by the IBM Unpostables Tracking Team.
Prior to contacting the payer on an unpostable record, the record must first be thoroughly
reviewed through a detailed analysis of the unpostable history, including, without limitation,
(i) review of all events visible from the unpostable edit page in chronological order to
understand the processing to date of each record, and (ii) review of any changes in status or
added notes that could impact the dialogue with the payer once contact is established.

On completion of the above analysis, including identification of the payer from which remittance
documentation is needed, the agent contacts the payer by calling the number(s) listed in
athenaNet, or by another contact method as directed by Athena.

The Unpostables Tracking team will follow documented workflows supplied by Athena. Details of
the call and the relevant data points collected for each payer contact event will be updated in
athenaNet through (i) direct entry in unique data fields; (ii) creation of an updated unpostable
note that contains a unique Kick Code to characterize the information received from the payer
and to identify the specific reason for the call; and (iii) identify likely reasons for the
initial failure of the transaction to be received and processed in a timely manner.

	 	3.4	 	Denial Management Services

Denials Management involves contacting payers via web, telephone, fax, and direct mail inquiries
in an effort to obtain denial status information and to update athenaNet with the same. The
claims processed in this workflow have been processed and denied by payers. The goal of the
workflow is to identify any opportunity to initiate reprocessing or reconsideration of the claim
to have the denial overturned and payment issued. In the case of a final denial, the goal is to
obtain as much detail about the reasons for the denial as possible to appropriately categorize
the payer and to use such information to avoid future denials.

Athena places claims in this workflow in a worklist daily for processing by the IBM Denial
Management Team. Prior to contacting the payer for claim status, claims must first be
thoroughly reviewed through a detailed analysis of the claim history, including, without
limitation, (i) review of claim-related events in chronological order to understand the
processing to date of each claim, (ii) review of any payments posted or documentation attached
to the claim that could impact the dialogue with the payer once contact is established, and
(iii) review of all relevant demographic data prior to contacting the payer so that the call
agent has a firm understanding of the types of insurance coverage the patient currently has or
may have had in the past.

On completion of the above analysis, including identification of the payer with which the claim
has been denied, the agent will contact the payer by calling the number(s) listed in athenaNet,
or by another contact method as directed by Athena.

The Denials Management team will follow documented workflows supplied by Athena. Whenever
possible, reconsideration should be initiated over the phone. Team members must exercise any
available opportunity to initiate action over the phone or a follow-up faxed resubmission, which
may quickly re-start activity on the claim and obtain payment. Details of the call and the
relevant data points collected for each payer contact event will be updated in athenaNet through
(i) direct entry in unique data fields and (ii) creation of an updated claim note that contains
a unique Kick Code to characterize the information received from the payer and to identify the
specific reason for the call, and (iii) identify likely reasons for the initial failure of the
claim to be received and processed/approved in a timely manner.

4. Athena Responsibilities

In support of IBM’s provision of the Services as described in this Schedule, Athena will:

			
	 	 	 
	IBM/Athena Confidential
	 	Page 13 of 20

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

	 	(a)	 	Populate IBM work queues in athenaNet by 7 AM ET on all Business Days; and
	 
	 	(b)	 	Provide IBM timely access to necessary production reports to enable IBM to
manage their performance of the Services; and
	 
	 	(c)	 	Provide IBM with application licenses required to perform the Services,
including CITRIX licenses if required.

5. Service Levels

In accordance with Section 5 of Schedule A, IBM will strive to perform the Services in accordance
with business rules supplied by Athena as of the Effective Date and meet the Service Levels and
Quality Standards set forth in this Section. If such business rules change in a manner so that
the Service Levels and Quality Standards are affected, then IBM shall notify Athena, and the
Parties will work together as necessary to establish new Service Levels and Quality Standards.

During the Evaluation Period for each process, IBM will evaluate the actual performance against the
targeted service levels which have been provided by Athena. Should discrepancies exist, IBM and
Athena will jointly develop an appropriate plan to revise the targeted Service Level.

	 	5.1	 	Measurement.

Performance against the Service Levels stated herein will be measures as described below.

	 	(a)	 	Average process turnaround time for all claims in any given month will be
within *. Process turnaround time will be measured as the duration from the date and
time that the claim is received into the IBM work queue until the date and time that
the claim has been updated with a Kick Code and claim note.
	 
	 	(b)	 	Quality: IBM will strive to maintain a quality rate of at least *
each of the service activities included in this Schedule A-2. The quality rating
shall be a combined quality score based on separate equally weighted scores for each
of (i) claims and (ii) calls, with respect to each such payer contact activity,
evaluated by Athena and IBM on a monthly basis. The quality measurement tool and
scoring method will be provided by Athena.
	 
	 	 	 	IBM will be required to perform its own independent quality review using the Athena
quality methodology. Calibration sessions will be held periodically throughout the
month to assist in synchronization of global quality efforts. The size of the
quality sample will be determined and agreed by Athena and IBM.

	 	5.2	 	Service Level Weighting Factors:

	 	 	 	 	 
	Service Level	 	Weighting Factor
	Process Turnaround Time

	 	 	*	 
	Quality

	 	 	*	 
	Total Weighting Factor (not to exceed 100%)

	 	100%

6. Workflow, Security, and Technology

Specific workflow and training documentation will be provided by Athena. All work to be
completed must be based in, and all responses logged in, athenaNet directly. All PHI and
transaction data must be directly entered into athenaNet and not stored in any auxiliary
systems. Whenever present, discreet data fields must be individually populated to store
information rather than storing the same in free text note fields. Each member of IBM’s staff
must have an individual workstation configuration that includes (at a minimum) Adobe

			
	 	 	 
	IBM/Athena Confidential
	 	Page 14 of 20

 

 

Reader, and a desktop efax software program, as well as a direct call-back extension and an
individual voicemail box; protocols will be provided by Athena regarding each staff member’s
access to MS Office, personal email, web browsing, printers, removable drives, and related
matters. IBM will provide to Athena the IP addresses of each workstation for access to
athenaNet. Live call monitoring and recording must be available.

As it relates to information technology,

IBM will:

	 	•	 	extend the voice connectivity provided by IBM at the IBM Points of Presence (PoP) at
New York and Los Angeles to the IBM Service Delivery locations using IBM owned and
maintained equipment. The application accessibility will be through an internet based
VPN connectivity;
	 
	 	•	 	procure and maintain voice circuits and the associated toll free numbers (TFN);
	 
	 	•	 	provide voice T1 at IBM POPs for outbound calling;
	 
	 	•	 	access application servers at the Athena data center for application access (there
is no local application server to be hosted at IBM );
	 
	 	•	 	record * of voice calls after obtaining any consent required from each call
recipient to do so, which will be stored on-line for thirty days and archived to tape
for at least one year (Athena to provide such advice and data as may be reasonably
necessary to determine whether consent is required); and
	 
	 	•	 	generate a standard Avaya CMS report to view agent statistics.

Athena will:

	 	•	 	provide and maintain any external connectivity requirements to any other third-party
suppliers; and
	 
	 	•	 	provide application licenses required to perform the Services, including
CITRIX licenses if required.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 15 of 20

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

Schedule A-3 — Enrollment Services

1. Description of Services

This service consists of the activities necessary to onboard provider’s onto Athena’s system
with accurate remittance information, as well as to maintain/monitor remittance information
maintained by the payer. Activities include contact payers and providers to validate remittance
addresses and other billing related information.

2. Location and Hours of Operations

Enrollment Services will be provided from IBM location in Manila, Philippines. Services may be
provided Business Days between the hours of 8 AM to 8 PM ET. Volume distribution by day is
expected to be approximately as follows (these estimates are to be used for planning purposes
only):

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 
	 	 	Monday	 	Tuesday	 	Wednesday	 	Thursday	 	Friday	 	Saturday
	Volume
	 	 	*	 	 	 	*	 	 	 	*	 	 	 	*	 	 	 	*	 	 	 	*	 

3. IBM Responsibilities

	 	3.1	 	Outbound calling

This service entails verification and provider enrollment work across different zones (Pay-to
verification & changes, Lockbox Migration, Eligibility, Small Group Implementation, Post Live
Provider Number Add Services). Enrollment Analysts typically call the Payer to verify the
information provided in athenaNet is accurate and follow up with Payers to make sure enrollment
paperwork is approved and confirmed. Once the Payer has verified the correct information, then
the same is documented in the athenaNet System along with any pertinent information. In
addition, the required documents (W-9, request letter, Payer form) are faxed to the Payer to
change the address. The majority of the enrollment work is voice related, however in some cases
faxing and/or website verification is utilized. The Enrollment Analysts are allotted their
daily work through tasks in the AthenaNet application. If a client signature is required for
migration work, the US Team will complete this work. Any forms can be saved to Citrix and sent
back to the athena US Based Enrollment Team for completion. Enrollment Analysts refer to the
Payer Set-up Guide to determine the eligibility enrollment process for Payers and
clearinghouses. The Enrollment Analysts then follow the process outlined in the Payer Set-up
Guide to complete enrollment.

4. Athena Responsibilities

In support of IBM’s provision of the Services as described in this Schedule, Athena will:

	 	(a)	 	Populate IBM work queues in athenaNet by 7 AM ET each Business Day; and
	 
	 	(b)	 	Provide IBM timely access to necessary production reports to enable IBM to
manage their performance of the services.

5. Service Levels

In accordance with Section 5 of Schedule A, IBM will strive to perform the Services in accordance
with business rules supplied by Athena as of the Effective Date and meet the Service Levels and
Quality Standards set forth in this Section. If such business rules change in a manner so that
the Service Levels and Quality Standards are affected, then IBM shall notify Athena, and the
Parties will work together as necessary to establish new Service Levels and Quality Standards.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 16 of 20

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

During the Evaluation Period for each process, IBM will evaluate the actual performance against the
targeted service levels which have been provided by Athena. Should discrepancies exist, IBM and
Athena will jointly develop an appropriate plan to revise the targeted Service Level.

	 	5.1	 	Measurement.

Performance against the Service Levels stated herein will be measures as described below.

	 	(a)	 	Process Turnaround Time: IBM will process the work items in an
average of no later than * from the day the work item is received in the IBM work
queue. During the Evaluation Period, the Parties will work to define specific
timeframes at a task level. Process turnaround time will be measured as the date and
time from which the work is received into the IBM work queue until the date and time
that the appropriate update to the record has been made.

	 	5.2	 	Service Level Weighting Factors:

	 	 	 	 	 
	Service Level	 	Weighting Factor
	Process Turnaround Time
	 	100%
	Total Weighting Factor (not to exceed 100%)
	 	100%

6. Workflow, Security, and Technology

Specific workflow and training documentation will be provided by Athena. All work to be
completed must be based in, and all responses logged in, athenaNet directly. All PHI and
transaction data must be directly entered into athenaNet and not stored in any auxiliary
systems, unless dictated by the process as defined by Athena. Whenever present, discreet data
fields must be individually populated to store information rather than storing the same in free
text note fields. Each member of IBM’s staff must have an individual workstation configuration
that includes (at a minimum) Adobe Reader, and a desktop efax software program, as well as a
direct call-back extension and an individual voicemail box; protocols will be provided by Athena
regarding each staff member’s access to MS Office, personal email, web browsing, printers,
removable drives, and related matters. IBM will provide to Athena the IP addresses of each
workstation for access to athenaNet. Live call monitoring and recording must be available.

As it relates to information technology,

IBM will:

	 	•	 	extend the voice connectivity provided by IBM at the IBM Points of Presence (PoP) at
New York and Los Angeles to the IBM Service Delivery location using IBM owned and
maintained equipment. The application accessibility will be through an internet based
VPN connectivity;
	 
	 	•	 	procure and maintain voice circuits and the associated toll free numbers (TFN);
	 
	 	•	 	provide voice T1 at IBM POPs for outbound calling;
	 
	 	•	 	access application servers at the Athena data center for application access (there
is no local application server to be hosted at IBM);
	 
	 	•	 	record 100% of voice calls after obtaining any consent required from each call
recipient to do so, which will be stored on-line for thirty days and archived to tape
for at least one year (Athena to provide such advice and data as may be reasonably
necessary to determine whether consent is required); and

			
	 	 	 
	IBM/Athena Confidential
	 	Page 17 of 20

 

 

	 	•	 	generate a standard Avaya CMS report to view agent statistics.

Athena will:

	 	•	 	provide and maintain any external connectivity requirements to any other third-party
suppliers; and
	 
	 	•	 	provide application licenses required to perform the Services, including CITRIX
licenses if required.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 18 of 20

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

Schedule A-4 — Clinical Document Services

1. Description of Services

This service includes appropriate classification and data extraction of various document types
of general correspondence to the provider office. The classified documents follow specific
works flows which facilitate further action (filing, data entry, or other steps). Documents may
include HIPAA forms, sports physical forms, prescriptions, and lab results.

2. Location and Hours of Operations

Clinical Document Services will be provided from IBM location in Pune, India. Services may be
provided Business Days between the hours of 5 AM to 10 PM ET. Volume distribution by day is
expected to be approximately as follows (these estimates are to be used for planning purposes
only):

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 
	 	 	Monday	 	Tuesday	 	Wednesday	 	Thursday	 	Friday	 	Saturday
	Volume
	 	 	*	 	 	 	*	 	 	 	*	 	 	 	*	 	 	 	*	 	 	 	*	 

3. IBM Responsibilities

IBM will work collaboratively with Athena to improve the efficiency of the operation over time.

	 	3.1	 	Clinical Document Classification Services

IBM will identify the Document type and classify each Document in athenaNet in accordance with
the Business Rules. IBM will also, if applicable and in accordance with the Business Rules,
identify the patient to whom a Document applies by reviewing the unique identifiers in each
relevant document.

	 	3.2	 	Clinical Data Entry Services

IBM will enter appropriate data into the relevant fields in athenaNet in accordance with the
Business Rules.

	 	3.3	 	Clinical Quality Monitoring Services

IBM will perform quality assurance steps on each document by comparing the information that IBM
enters in athenaNet to the data contained within each document, in accordance with quality
assurance measures as mutually agreed between Athena and IBM. In addition, Athena and IBM shall
work together during the term of this Statement of Work to develop formal, written Clinical
Services quality assurance specifications (the “QA Specifications”) which shall apply upon
approval by Athena and IBM. Prior to approval of the QA Specifications, quality assurance shall
be performed by both IBM and Athena. Upon such approval of the QA Specifications, IBM shall
assume full responsibility for quality assurance with respect to the Clinical Services.

4. Athena Responsibilities

In support of IBM’s provision of the Services as described in this Schedule, Athena will:

	 	(a)	 	Provide IBM timely access to necessary production reports to enable IBM to
manage their performance of the services.
	 
	 	(b)	 	Maintain the underlying functionality of athenaNet that supports the
worklists and queuing of records for each of the clinical document services
activities.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 19 of 20

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

	 	(c)	 	Provide application licenses required to perform the Services, including
CITRIX licenses if required.
	 
	 	(d)	 	Work collaboratively with IBM to improve the efficiency of the operation
over time.

5. Service Levels

In accordance with Section 5 of Schedule A, IBM will strive to perform the Services in accordance
with business rules supplied by Athena as of the Effective Date and meet the Service Levels and
Quality Standards set forth in this Section. If such business rules change in a manner so that
the Service Levels and Quality Standards are affected, then IBM shall notify Athena, and the
Parties will work together as necessary to establish new Service Levels and Quality Standards.

During the Evaluation Period for each process, IBM will evaluate the actual performance against the
targeted service levels which have been provided by Athena. Should discrepancies exist, IBM and
Athena will jointly develop an appropriate plan to revise the targeted Service Level.

	 	5.1	 	Measurement.

     Performance against the Service Levels stated herein will be measured as described below.

	 	(a)	 	Process Turnaround Time: IBM will process the work item in *from
the time the document is received and placed in athenaNet in the appropriate IBM work
queue. Other work items may have a turnaround time of * from the time the work item
is received on the IBM work queue. These turnaround times are valid for the planned
hours of operation as set forth in this Schedule. Process turnaround time will be
measured as the date and time from which the work is received into the IBM work queue
until the date and time that IBM has performed the applicable action based on
document type.

	 	5.2	 	Service Level Weighting Factors:

	 	 	 	 	 
	Service Level	 	Weighting Factor
	Process Turnaround Time
	 	 	*	 
	Total Weighting Factor (not to exceed 100%)
	 	100%

	 	5.3	 	Service Level Objectives

     Performance against the service level objective (SLO) stated below will be measured as described
below.

	 	(a)	 	Agent Productive Time: Assuming the IBM work queues are full, IBM will achieve a monthly average of * per agent per hour with no agent below
a monthly average of * per hour.

This Service Level Objective will be monitored and benchmarked during the Evaluation Period.
Subsequent to the Evaluation Period, the Service Level Objective shall revert to a Service Level
Measurement, which will carry its own performance target and Weighting Factor and all of the same
standards and obligations of other Service Level Measurements. At the time of its introduction as
a Service Level Measurement, the Productive Time Measure will be equally weighted with the Process
Turnaround Time Measure. Parties intend to move to a transaction based pricing model over time at
which time, this service level measure may be replaced.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 20 of 20

 

 

Schedule B — BUSINESS ASSOCIATE TERMS AND CONDITIONS

1. Definitions. For purposes of this Appendix, capitalized terms used, but not otherwise
defined in the PSA or this Appendix shall have the same meaning as given to those terms in 45 CFR
§§160 and 164. For purposes of this Appendix, “Business Associate” refers to IBM, and “Covered
Entity” refers to Athena. “Privacy Rule” refers to the privacy standards adopted under HIPAA and
set forth at 45 CFR § 164 Subpart E. “Security Rule” refers to the security standards adopted
under HIPAA and set forth at 45 CFR § 164 Subpart C.

2. Obligations and Activities of Business Associate

     Notwithstanding any provision to the contrary in the PSA, Business Associate will:

     a. not use or disclose Protected Health Information that it receives from or on behalf of
Covered Entity (including Protected Health Information of Covered Entity’s customers) or that it
creates on behalf of Covered Entity (collectively “PHI”) other than as permitted or required by the
PSA, this Appendix, or as required by law;

     b. not use or disclose PHI in a manner that would violate the requirements of the Privacy Rule
when done by Covered Entity, except as permitted by the PSA, Section 3(b) or 3(c) below;

     c. use appropriate safeguards as specified in the PSA or as directly applicable to IBM under
HIPAA to prevent use or disclosure of the PHI other than as provided for by the PSA and this
Appendix;

     d. implement administrative, physical, and technical safeguards that reasonably protect the
confidentiality, integrity, and availability of PHI (including electronic PHI) in accordance with
the Privacy Rule as specified in the PSA or as directly applicable to IBM under HIPAA;

     e. mitigate, to the extent practicable, any harmful effect that is known to Business Associate
of a use or disclosure of PHI by Business Associate in violation of the requirements of the PSA or
this Appendix;

     f. report promptly to Covered Entity (i) any use or disclosure of the PHI not provided for by
the PSA or this Appendix and (ii) any “security incident” as defined in the Security Rule;

     g. require any agent, including a subcontractor, to whom it provides PHI agrees to the same
restrictions and conditions that apply through this Appendix to Business Associate with respect to
such information, and provide evidence of such restrictions and conditions to Covered Entity at its
request;

     h. provide access, at the request of Covered Entity, and in the time and manner designated by
Covered Entity, to PHI in a Designated Record Set, to Covered Entity in order to meet the
requirements under 45 CFR §164.524;

     i. make any amendment(s) to PHI in a Designated Record Set that Business Associate maintains,
if any, that Covered Entity directs or agrees to pursuant to 45 CFR §164.526 at the request of
Covered Entity or an individual, and in the time and manner designated by Covered Entity;

     j. make its internal practices, books, and records relating to the use and disclosure of PHI
available to Covered Entity, or at the request of Covered Entity to the Secretary, in a time and
manner designated by the Covered Entity or the Secretary, for purposes of the Secretary determining
Covered Entity’s compliance with the Privacy Rule;

     k. document such disclosures of PHI and information related to such disclosures as would be
required for Covered Entity to respond to a request by an individual for an accounting of
disclosures of PHI in accordance with 45 CFR §164.528;

     l. provide to Covered Entity, in a time and manner designated by Covered Entity, information
collected in accordance with this Appendix, to permit Covered Entity to respond to a request by an
individual for an accounting of disclosures of PHI in accordance with 45 CFR 164.528;

     m. establish and enforce appropriate clearance procedures and supervision such that its
workforce follows requirements consistent with HIPAA as specified in the PSA or as directly
applicable to IBM under HIPAA;

     n. act immediately to terminate access to PHI of any of its staff upon such staff member’s
termination or reassignment;

			
	 	 	 
	IBM/Athena Confidential
	 	Schedule B-1

 

 

     o. provide training for its staff to comply with its obligations consistent with the
requirements of HIPAA as specified in the PSA or as directly applicable to IBM under HIPAA; and

     p. implement (i) disposal and reuse procedures with respect to documents and equipment, (ii)
authentication and access controls, and (iii) encryption, in ease case to protect PHI consistent
with the requirements of the Security Rule as specified in the PSA or as directly applicable to IBM
under HIPAA.

3. Permitted Uses and Disclosures by Business Associate

     a. Except as otherwise limited in this Appendix or by other applicable federal or state law,
Business Associate may use PHI only as necessary for its provision of the Services consistent with
the PSA.

     b. Business Associate will not disclose PHI to any person or entity other than Covered Entity
without Covered Entity’s express prior written consent.

     c. Business Associate will not disclose PHI to subcontractors or agents of Business Associate
without Covered Entity’s express prior written consent, except as may be required for the provision
of the Services.

4. Obligations of Covered Entity

     a. Covered Entity will notify Business Associate of any changes in, or revocation of,
permission by an individual to use or disclose PHI of which Covered Entity has knowledge, to the
extent that such changes may affect Business Associate’s use or disclosure of PHI.

     b. Covered Entity will notify Business Associate of any restriction on the use or disclosure
of PHI to which Covered Entity is bound under 45 CFR §164.522 and of which Covered Entity has
knowledge, to the extent that such restriction may affect Business Associate’s use or disclosure of
PHI.

5. Term and Termination

     a. The term of this Appendix will be the same as that of the PSA.

     b. Upon material breach of this Appendix by Business Associate, Covered Entity:

          i. Will provide an opportunity for Business Associate to cure the breach or to end the
violation, and, if Business Associate does not cure the breach or end the violation within a
reasonable time specified by Covered Entity, Covered Entity will have the right to terminate the
PSA effective on notice of termination, without further liability by reason of such termination;

          ii. If cure is not possible, Covered Entity will have the right immediately to terminate the
PSA without further liability by reason of such termination; or

          iii. If neither termination nor cure is feasible, Covered Entity will report the violation to
the Secretary.

     c. Except as provided in paragraph (d) of this Section 5, upon any termination or expiration
of the PSA, Business Associate will return all PHI to Covered Entity. Business Associate will
retain no copies of PHI (including, but not limited to, paper or electronic copies).

     d. If return or destruction of the PHI is not feasible, Business Associate will notify Covered
Entity in writing of the conditions that make its return or destruction not feasible. Business
Associate will extend the protections of this Appendix to such PHI and limit further uses and
disclosures of such PHI to those purposes that make its return or destruction not feasible, for so
long as Business Associate maintains such PHI.

6. Miscellaneous

     a. The parties agree to take such action to amend the PSA and this Appendix from time to time
as is necessary for either party to comply with the requirements of HIPAA, the Privacy Rule, and
the Security Rule.

     b. The obligations of Business Associate under Sections 5(c) and (d) of this Appendix will
survive the termination of the PSA.

			
	 	 	 
	IBM/Athena Confidential
	 	Schedule B-2

 

 

Confidential Materials omitted and filed separately with the
Securities and Exchange Commission. Asterisks denote omissions.

Budget and Planning Estimate

Schedule C — Charges

This Schedule C sets forth the Charges applicable to the Services to be provided by IBM under
the PSA. Such charges may include one-time charges, ramp-up service charges, monthly recurring
charges, training charges, pass-thru charges and termination charges.

Capitalized terms used but not defined in this Schedule shall have the same meaning assigned to
such terms in the PSA or Schedule A unless the context in which such terms are used in this
Schedule require a different meaning.

	1.	 	Service Delivery Locations
	 
	 	 	Services will be delivered out of Manila, Philippines and Pune, India. For detail on the
types of Services being performed from each location, please refer to Exhibit C-1 (Baselines).
	 
	2.	 	Service Ramp and Volume Schedule
	 
	 	 	For detailed description of the projected monthly volume by location please refer to
Exhibit C-1 (Baselines). Each service category in this table has been defined as either voice or
non-voice.
	 
	 	 	All non-voice work will be performed in Pune, India. All voice work will be delivered * from
Pune, India and Manila, Philippines. Should Athena make a request to increase voice work in
Manila and/or reduce the amount of voice work in Pune, which results in the number of Agents in
Manila exceeding the total number of Voice Agents in Pune, India; such excess voice work
performed in Manila will be charged *.
	 
	 	 	The total number of voice Agents across Philippines and India will be less than * of the total
number of Agents.
	 
	 	 	Athena will commit to annual minimum charges as reflected by minimum charges amount in Exhibit
C-2 (Annual Charges).
	 
	3.	 	Billing Unit and Rates
	 
	 	 	For detailed information on billing unit and rates, please refer to Exhibit C-1
(Baselines).
	 
	4.	 	Transaction Based Payments
	 
	 	 	For Services which are billed on a per transaction or other per unit basis, as set forth in
Exhibit C-1 (Baselines), IBM will invoice Athena in accordance with Section 6 of the PSA for the
Services provided during the previous calendar month and also submit to Athena a spreadsheet
showing the number of transactions executed during the preceding month as calculated by IBM
based on transaction information (“Monthly Transactions Spreadsheet”).
	 
	 	 	Athena will be responsible for maintaining the athenaNet application(s) for IBM to perform
its responsibilities in the provision of the Services. Should any outage period of athenaNet
exceed one hour in duration during a non-maintenance window, and that results in unbillable time
for any transaction based operation, IBM will invoice for the outage period based on the average
daily volume for the same period for the same operation during the previous week;, not exceeding
*.
	 
	 	 	Should Athena’s business process or supporting applications, such as athenaNet, change
requiring IBM to significantly update the training previously provided to its Agents, the
Parties will address such changes via the PCR process.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 1 of 6

 

 

Confidential Materials omitted and filed separately with the
Securities and Exchange Commission. Asterisks denote omissions.

Budget and Planning Estimate

	5.	 	Hourly Based Payments
	 
	 	 	For Services which are billed on an hourly basis, as set forth in the pricing table in
Exhibit C-1 (Baselines), IBM will invoice Athena in accordance with Section 6 of the PSA for the
applicable Services provided by the mutually agreed minimum number of Agents in the previous
month’s forecasting cycle. Athena shall pay IBM for a fixed number of * hours per Agent per
month. The Parties acknowledge that the objective is to limit the hourly-based payment method
to initial piloting of new Service areas or piloting Services to be performed in a new manner or
new location and the terms and conditions in respect of the same shall be mutually agreed
between the Parties and set forth in the applicable Schedule or in a change order.
	 
	6.	 	Forecasting
	 
	 	 	Athena shall provide IBM with a 12-month rolling volume forecast for the various Services.
This forecast will be provided quarterly according to the following schedule:

	 	 	 
	Forecast Delivery Date	 	Forecast Period
	November 1

	 	January to December
	February 1

	 	April to March
	May 1

	 	July to June
	August 1

	 	October to September

	 	 	Forecast volumes are not inclusive of * per month variance buffers within which it is
assumed there would be no degradation in Service Level Measurements. Should actual monthly
volume be greater than * above the most recent forecast for any given month, IBM will make
reasonable effort to staff accordingly for the additional volume. Should the parties find it
necessary, they may mutually agree to use the PCR process to authorize IBM to use overtime to
respond and achieve additional volume. If the actual transaction/volumes in a month are less
than * of that month’s committed forecast, IBM will invoice and Athena shall pay at * of the
committed volumes. IBM will accommodate changes to the committed volumes with minimum lead time
of * days.
	 
	 	 	Should IBM fail to deliver in accordance with the levels of service set forth in Schedule A
during the Evaluation Period, the Parties’ respective Project Executives will meet to discuss
the matter and determine what reductions, if any, to the ramp forecast may be appropriate.
	 
	7.	 	Foreign Exchange
	 
	 	 	Subject to Section 6(b) of the PSA, IBM will calculate and apply an adjustment to the
billing rates in Exhibit C-1 (Baselines) annually based upon movements in the underlying
currency rates as described below starting on January 1, 2011. IBM has established the billing
rates as of the Effective Date based on the foreign exchange rates in the table below as Current
Foreign Exchange Rate (CFER).

	 	 	 	 	 	 	 
	Service Location	 	Currency	 	CFER 1 $U.S. equivalent to:
	India
	 	India (Rupee)	 	47.72	 INR
	Philippines
	 	Philippines (Peso)	 	47.55 	 Pesos

	 	 	Actual foreign exchange rate (AFER) published in the New York Times as of the last Business
Day of the previous calendar year will be used to calculate the rate adjustment. A foreign
exchange rate adjustment percentage for each currency will be calculated as follows: ((CFER —
AFER) / CFER). *

	 	 	For example, if the AFER published in the New York Times for India as of December 30, 2010 equals 50.60 INR to 1 USD, the foreign
exchange adjusted would be calculated as follows:

*

			
	 	 	 
	IBM/Athena Confidential
	 	Page 2 of 6

 

 

Confidential Materials omitted and filed separately with the
Securities and Exchange Commission. Asterisks denote omissions.

Budget and Planning Estimate

	8.	 	Economic Cost Adjustment (ECA)
	 
	 	 	For purposes of pricing under this Schedule C, the economic index factors set forth below
will be used for calculating annual economic cost adjustment for the respective Services based
on their location of delivery beginning January 1, 2011. The rates set forth may be adjusted in
accordance with Section 6 of the PSA as applicable using these values as a basis:

	 	 	 
	Service	 	 
	Location	 	Source
	India

	 	Consumer Price index for All India Urban Non-Manual
Employees (UNME) as published by the Government of India,
Ministry of Statistics
(http://mospi.nic.in/mospi_cpi.htm) (India Price
Index)
	 
	 	 
	Philippines

	 	Monthly Consumer Price Index for all Income Households
NCR by Commodity Group, as published by Philippines
National Statistics Office
(http://www.census.gov.ph/data/sectordata/datacpi.html
(Philippines National Capital Region Price Index)

	 	 	In the event the current source stops publishing the values or substantially changes its content
and format, the Parties may substitute another comparable index published by a mutually
agreeable source.
	 
	 	 	IBM will calculate and invoice Athena for the ECA, if any, starting January 2011 and annually
thereafter. In January of each year, beginning 2011, the ECA will be calculated as a percent
increase in the index value between the previous two (2) Decembers. *
	 
	 	 	The cost of living adjustment in each calendar year shall be determined as follows:
	 
	 	 	Adjusted Rate = Prior Rate x (1 + Economic Change Factor) where “Adjusted Rate” means the rates
for the calendar year for which the cost of living adjustment is being computed, and “Prior
Rate” means the rate set forth in Section 3, as such rate has been adjusted for ECA and foreign
exchange adjustment (if any).
	 
	 	 	For example, if the December 2009 Base Year Index is 180, and the December 2010 Economic Change Index is 182.6, then beginning January 2011, the ECA Factor would be *
	 
	 	 	ECA Factor equals *
	 
	 	 	Resource Unit Price equals *
	 
	 	 	New Resource Unit Price would be *
	 
	9.	 	Termination Charges
	 
	 	 	In the event of termination for convenience by Athena in accordance with Section 4(b) of
the PSA, IBM will invoice Athena the applicable termination and wind-down fees on the effective
date of the termination as set forth in Exhibit C-3 (Termination for Convenience and Winddown
Charges).
	 
	 	 	In the event of termination for cause by IBM in accordance with Section 4(c) of the PSA,
IBM will invoice Athena the applicable unrecovered investment and wind-down fees set forth in
Exhibit C-4 (Termination for Cause Charges).
	 
	10.	 	Composition of Services
	 
	 	 	The pricing set forth in this Schedule C is based on the factors affecting the entire portfolio
of Services provided under the PSA including the types, quantities and physical locations of
such Services. As substantial changes in factors relating to the Services provided under this
PSA may impact the economic feasibility of continuing to provide the Services, the parties agree
to act in good faith to promptly amend the PSA or applicable Schedules to reflect in equitable
adjustment in the terms to restore the economic feasibility of the continued provision of the
Services under this PSA.

			
	 	 	 
	IBM/Athena Confidential
	 	Page 3 of 6

 

 

Confidential Materials omitted and filed separately with the
Securities and Exchange Commission. Asterisks denote omissions.

Budget and Planning Estimate

Exhibit C-1: Baselines.

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 
	 	 	 	 	 	 	 	 	 	 	Production	 	 	Monthly Baseline	 	 	Monthly Minimum	 	 	 	 
	Description	 	Location	 	 	Unit	 	 	Start Date	 	 	Volume	 	 	Volume	 	 	2009/2010 Rates	 
	*
	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 

Exhibit C-2: Annual Charges.

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 
	 	 	2009	 	 	2010	 	 	2011	 	 	2012	 	 	2013	 	 	2014	 
	*
	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 

			
	 	 	 
	IBM/Athena Confidential
	 	Page 4 of 6

 

 

Confidential Materials omitted and filed separately with the
Securities and Exchange Commission. Asterisks denote omissions.

Budget and Planning Estimate

Exhibit C-3: Termination for Convenience and Winddown Charges.

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 
	 	 	Termination Charges	 	 	 	 	 	 	 	 	 	 	 	 	 	 	Termination Charges	 	 	 	 	 	 	 
	Month	 	for Convenience	 	 	Windows Charges	 	 	Total	 	 	Month	 	 	for Convenience	 	 	Windows Charges	 	 	Total	 
	*
	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 

			
	 	 	 
	IBM/Athena Confidential
	 	Page 5 of 6

 

 

Confidential Materials omitted and filed separately with the
Securities and Exchange Commission. Asterisks denote omissions.

Budget and Planning Estimate

Exhibit C-4:
Termination for Cause and Winddown Charges.

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 
	 	 	Termination Charges	 	 	 	 	 	 	 	 	 	 	 	 	 	 	Termination Charges	 	 	 	 	 	 	 
	Month	 	for Convenience	 	 	Windows Charges	 	 	Total	 	 	Month	 	 	for Convenience	 	 	Windows Charges	 	 	Total	 
	*
	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 

			
	 	 	 
	IBM/Athena Confidential
	 	Page 6 of 6exv10w28

Exhibit 10.28

MASTER AGREEMENT

FOR

U.S.
AVAILABILITY SERVICES

BETWEEN

SUNGARD AVAILABILITY SERVICES LP

(“SunGard”)

AND

ATHENAHEALTH, INC.

A Delaware corporation

(“Customer”)

DATED
DECEMBER 1, 2009

By the signatures of their duly authorized representatives below, SunGard and Customer,
intending to be legally bound, agree to all of the provisions of this
Master Agreement.

	 	 	 	 	 	 	 	 	 
	SUNGARD AVAILABILITY
SERVICES LP	 	 	 	CUSTOMER:
ATHENAHEALTH, INC.
	 
	 	 	 	 	 	 	 	 
	By:

	 	/s/ Christopher Coleman 	 	 	 	By:	 	/s/ Carl B. Byers 
	 

	 	 
	 	 	 	 	 	 

	 

	 	Print:          CHRISTOPHER COLEMAN
	 	 	 	 	 	Print Name: Carl B. Byers
	 

	 	Print Title: VICE PRESIDENT
	 	 	 	 	 	Print Title:   SVP &
CFO
	Date Signed: 12/4/09
	 	 	 	Date Signed: December 1, 2009

This
agreement is comprised of the general terms and conditions set forth below and the
terms and conditions set forth in the services exhibit(s) attached
hereto (each a “Services
Exhibit”). The general terms and conditions set forth below and the Services Exhibit(s) are
referred to collectively as the “Master Agreement” and the services described in the Services
Exhibits are referred to collectively as the
“Services”. The Services selected by Customer shall be
set forth on a schedule(s) which will designate the type of Services it covers by reference to one
of the Services Exhibits (each a “Schedule”). Each Schedule entered into hereunder represents a
separate contract between SunGard and Customer or one of its Affiliates (as defined below) that
Incorporates and is governed by all of the terms of this Master Agreement. Each Schedule may be
signed by Customer or one of its Affiliates, and such signer shall be
deemed to be “Customer” for
purposes of that Schedule, provided that the Customer who signed this Master Agreement shall be
jointly and severally liable with such Affiliate for the performance of all obligations under such
Schedule. If there is a conflict between the general terms and conditions set forth below, a
Services Exhibit, or a Schedule, the order of precedence shall be as follows: 1) the Schedule, 2)
the Services Exhibit, and 3) these general terms and conditions.
“Affiliate” means any entity which
directly or indirectly controls, is controlled by, or is under common control with a party for as
long as such relationship remains in effect.

THE
TERMS OF THIS MASTER AGREEMENT ARE CONFIDENTIAL

 

GENERAL TERMS AND CONDITIONS.

1. CONTRACT TERM. This Master Agreement shall continue in effect as long as there is a Schedule
in effect. The term of a Schedule, and Customer’s rights to use the Services selected on that
Schedule, shall begin on the Commencement Date stated in that Schedule and continue in effect for
the Agreed Term stated in that Schedule. There shall be no automatic renewals of this Master
Agreement or any Schedule to the Master Agreement. Customer acknowledges that SunGard requires
this advance notice due to the substantial long-term equipment and facilities commitments SunGard
makes in reliance upon its customer contracts. Each Schedule is a non-cancelable contract that may
be terminated only in accordance with its express terms.

2. FEES AND EXPENSES. All Monthly or Annual Fees (as defined in a Schedule) shall be
invoiced by SunGard in advance at the billing address defined in the Schedule. All other fees, and
any out-of-pocket expenses reasonably incurred by SunGard on behalf of Customer shall be invoiced
by SunGard as and when incurred. Customer’s payments shall be due within thirty (30) days after
receipt of invoice. For any amount not paid when due, Customer will pay interest at the lesser of
fifteen percent (15%) per annum or the maximum amount permitted by law. Unless Customer provides a
valid tax exemption certificate, Customer shall be responsible for any sales, use, excise or
comparable taxes assessed or imposed upon the Services provided or the amounts charged under a
Schedule.

3. CONFIDENTIALITY.

(a) All information disclosed by one party to the other in connection with this Master
Agreement shall be treated as confidential (“Confidential Information”). With respect to
Confidential Information disclosed by one party (“disclosing party”) to the other party (“receiving
party”), (i) the receiving party shall hold such Confidential Information in strict confidence
using the same standard of care as it uses to protect its own confidential information but not less
than a reasonable standard of care, (ii) the receiving party shall not use or disclose such
Confidential Information for any purpose except as necessary to fulfill its obligations under a
Schedule or this Master Agreement, or except as required by law provided that the disclosing party
is given a reasonable opportunity to obtain, at its expense, a protective order (the receiving
party shall reasonably cooperate with the disclosing party in connection therewith), (iii) the
receiving party shall limit access to such Confidential Information to such of its employees,
agents and contractors who need such access to fulfill the receiving party’s obligations under a
Schedule, and (iv) the receiving party shall require its employees, agents and contractors who have
access to such Confidential Information to abide by the confidentiality provisions of this Master
Agreement.

(b) Without limiting the generality of the foregoing, such Confidential Information includes, but
is not limited to, (i) with respect to Customer, Customer’s data and software (including Customer
NPI as defined below) and the details of Customer’s computer operations and recovery procedures,
which may include trade secrets of Customer, data relating to Customer’s clients and client
transactions, (ii) with respect to SunGard, SunGard’s physical security systems, access control
systems, specialized recovery equipment and techniques, pricing information, Services Guides, and
E-Testing Program, which include trade secrets of SunGard, and (iii) with respect to both parties,
the terms of this Master Agreement and all Schedules and any detailed information regarding the
performance of this Master Agreement or any Schedule.

(c) Confidential Information shall not include information that (i) is or becomes publicly
available through no wrongful act of the receiving party, (ii) was known by the receiving party
without any obligation of confidentiality at the time of disclosure by the disclosing party, (iii)
was obtained by the receiving party from a third party without restriction on disclosure, or (iv)
was developed independently by the receiving party.

(d) To effect the purposes of a Schedule, Customer may from time to time provide SunGard with
certain “nonpublic personal information” as defined by the Gramm-Leach-Bliley Act of 1999 (Public
Law 106-102, 113 Stat. 1138) and the rules and regulations promulgated thereunder (“Customer NPI”).
To protect the privacy of Customer NPI pursuant to the requirements of such act, SunGard shall, in
addition to complying with the confidentiality requirements set forth above, (i) implement
appropriate administrative, technical and physical safeguards designed to ensure the security and
confidentiality of Customer NPI, protect against any anticipated threats or hazards to the security
or integrity of Customer NPI and protect against unauthorized access to or use of Customer NPI that
could result in substantial harm or inconvenience to a customer of Customer; and (ii) permit
Customer to monitor SunGard’s compliance with the foregoing during Customer’s use of the Services,
provided that such monitoring shall not interfere with another customer’s use of SunGard’s services
or with SunGard’s operations.

4. TERMINATION.

(a) If either party breaches any of its obligations under a Schedule in any material respect
and the breach is not substantially cured within the cure period specified below, then the other
party may terminate that Schedule, without penalty, by giving written notice to the breaching party
at any time before the breach is substantially cured. If this Master Agreement includes a Recovery
Services Exhibit or a Restoration Services Exhibit for Managed IT Services (“RS for MS Exhibit”),
then (i) with respect to a breach of SunGard’s obligations to provide the Recovery or Restoration
Services to Customer during a Disaster (as such terms are defined in the Recovery Services
Exhibit), the cure period shall be five (5) days, and (ii) with respect to Customer’s obligations
under the access and use provisions set forth in Sections A.2, A.3 and C of the Recovery Services
Exhibit or the RS for MS Exhibit, there shall be no cure period (and SunGard shall have the right
to terminate the applicable Schedule immediately). With respect to Customer’s obligations to comply
with SunGard’s Network Policies (as defined in the applicable Services Exhibit), the cure period
shall be five (5) days. With respect to all other obligations, unless otherwise specified, the cure
period shall be thirty (30) days after receipt of written notice describing the breach, provided
that, if a longer period is reasonably required to cure the breach and the cure is promptly begun,
such cure period shall be extended for as long as the cure is being diligently prosecuted to
completion.

(b) If a Schedule is terminated due to an uncured material breach by Customer, or if Customer
properly

 

 

exercises a right to cancel a Schedule before the end of the Agreed Term for any reason other than
due to SunGard’s uncured material breach, then Customer shall (i) pay to SunGard the unamortized
balance attributable to any equipment and software purchased by SunGard on behalf of Customer (as
designated in the applicable Schedule) and (ii) reimburse SunGard for any cancellation charges for
third party services purchased by SunGard on behalf of Customer.

5. LIABILITY AND INDEMNIFICATION.

(a) Each party (“liable party”) shall be liable to the other party for any direct damages
caused by any breach of contract, negligence or willful misconduct of the liable party (or any of
its employees or agents).

(b) The liable party shall indemnify and hold harmless the other party (and its Affiliates and
their respective employees and agents) against any claims, actions, damages, losses or liabilities
to the extent arising from any breach of contract, negligence or willful misconduct of the liable
party (or any of its employees or agents).

(c) In addition, SunGard shall indemnify and hold harmless Customer against any claims, actions,
damages, losses or liabilities to the extent arising from infringement of any U.S. patent,
copyright or other proprietary right resulting from Customer’s use of intellectual property
developed or owned by SunGard and used to provide the Services. In addition to the foregoing
indemnification, SunGard’s liability with respect to this Section 5(c) is limited to making the
Services non-infringing or arranging for Customer’s continued use of the Services, provided that,
if both of the foregoing options are commercially impracticable for SunGard, then upon written
notice to Customer, SunGard may cancel the affected portion of the Services and refund to Customer
any prepaid fees for such Services. With respect to intellectual property of third parties that is
used by SunGard to provide the Services, SunGard will, to the extent possible, provide to Customer
the full benefit of all applicable warranties and indemnities granted to SunGard by such third
parties.

(d) In addition, Customer shall indemnify and hold harmless SunGard against any claims, actions,
damages, losses or liabilities to the extent arising from (i) infringement of any U.S. patent,
copyright or other proprietary right attributable to Customer’s data, content, software or other
materials, (ii) Customer’s use of any Services in violation of any law, rule or regulation, (iii)
Customer’s violation of any of SunGard’s Network Policies (as defined in the applicable Services
Exhibit), or (iv) Customer’s use, control or possession of any Mobile Resources at non-SunGard
facilities.

(e) An indemnifying party shall have no obligation for indemnification unless the other party
promptly gives written notice to the indemnifying party after any applicable matter arises and
allows the indemnifying party to have sole control of the defense or settlement of any underlying
claim; provided that the indemnifying party may not settle a claim without the other party’s prior
written consent. Notice will be considered prompt as long as there is no material prejudice to the
indemnifying party.

6. LIMITATION OF LIABILITY

(a) Under no circumstances shall either party be liable for lost revenues, lost profits, loss
of business, or
consequential, indirect, exemplary, special or punitive damages of any nature, whether such
liability is asserted on the basis of contract, tort (including negligence or strict liability) or
otherwise, and whether or not the possibility of such damages is foreseeable; provided that this
exclusion shall not apply to (i) the party’s respective confidentiality obligations under Section
3, (ii) SunGard’s indemnification obligations under Section 5(b) with respect to willful misconduct
and under Section 5(c), and (iii) Customer’s indemnification obligations under Section 5(b) with
respect to willful misconduct and under Section 5(d). Customer acknowledges and agrees that for the
purposes of this section, “lost profits” and “lost revenues” does not include its payment
obligations to SunGard pursuant to this Master Agreement.

(b) Except for SunGard’s indemnification obligations under Section 5(b) with respect to willful
misconduct and under Section 5(c), SunGard’s total liability under a Schedule, whether in contract,
tort (including negligence or strict liability), or otherwise, shall not exceed (i) the actual
Monthly Fees paid by Customer to SunGard under that Schedule for the most recent eighteen (18)
month period, or (ii) in the case of Professional Services, the actual service fees paid by
Customer for the Professional Services under that Schedule.

(c) Except for any direct damages caused by SunGard’s negligence or willful misconduct, or in the
case of Managed IT Services, SunGard’s breach of contract, SunGard shall have no liability for any
damage to, or loss or theft of, any of Customer’s tangible property located at a SunGard facility
or in a SunGard vehicle.

(d) Except for any direct damages caused by SunGard’s negligence or willful misconduct, or in the
case of Managed IT Services, SunGard’s breach of contract, SunGard shall have no liability for any
of Customer’s data, content, software or other materials located, used or restored at a SunGard
facility or in a SunGard vehicle, or transmitted using SunGard’s Network Services. If Customer’s
data is damaged, lost or stolen as a result of SunGard’s breach of contract or negligence, then
SunGard shall be liable to Customer only for Customer’s documented out-of-pocket expenses incurred
to recreate such data. The foregoing sentence shall not supersede or otherwise amend SunGard’s
liability for a breach of its obligations under Section 3 (Confidentiality) herein. Under no
circumstances will SunGard be considered the official custodian or record keeper of Customer’s data
for regulatory or other purposes.

(e) WITH RESPECT TO EACH SCHEDULE, EXCEPT AS SPECIFICALLY STATED IN THIS MASTER AGREEMENT OR SUCH
SCHEDULE, SUNGARD MAKES NO REPRESENTATIONS OR WARRANTIES, ORAL OR WRITTEN, EXPRESS OR IMPLIED,
ARISING FROM COURSE OF DEALING, COURSE OF PERFORMANCE OR OTHERWISE, INCLUDING WITHOUT LIMITATION
ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, CONFORMITY TO ANY
REPRESENTATION OR DESCRIPTION, NONINTERFERENCE OR NON-INFRINGEMENT.

7. FORCE MAJEURE. Neither party shall be liable for, nor shall either party be considered
in breach of this Master Agreement or any Schedule due to, any failure to perform its obligations
as a result of a cause beyond its control, including any natural calamity, act of God or a public
enemy, act of any

 

 

military, civil or regulatory authority, change in any law or regulation, disruption or outage of
communications, power or other utility, failure to perform by any supplier or other third party, or
other cause which could not have been prevented with reasonable care.

8. NOTICE. All notices, consents and other communications under this Master Agreement
shall be in writing and shall be deemed to have been received on the earlier of (a) the date of
actual receipt at the designated street address, (b) the first business day after being sent to the
designated street address by a reputable overnight delivery service, or (c) the third business day
after being mailed to the designated street address by first class mail. Any notice may be given by
e-mail to the designated e-mail address or by fax to the designated fax number, provided that a
signed written confirmation is received at the designated street address within seventy-two (72)
hours thereafter. Disaster declaration notice (as described in the Recovery Services Exhibit) may
be given orally, provided that a signed written confirmation is received at the applicable recovery
facility within twenty-four (24) hours thereafter. Communications sent to any street address,
e-mail address or fax number other than those designated in this Master Agreement or the applicable
Schedule shall not be valid. Customer’s street address, e-mail address and fax number for notice
are stated in the applicable Schedule. SunGard’s street address for notice is 680 East Swedesford
Road, Wayne, Pennsylvania 19087, Attention: Contract Administration. SunGard’s e-mail address for
notice is contract.admin@sungard.com. SunGard’s fax number for notice is 1-610-225-1125.

9. PUBLICITY. Neither party will, without the other party’s prior written consent, (a)
use the name, trademark, logo or other identifying marks of the other party in any sales, marketing
or publicity activities or materials, or (b) issue any press release, interviews or other public
statement regarding this Master Agreement or any Schedule; provided that either party may publicly
refer to the other by name as a vendor or customer and may disclose the existence and general
nature of this Master Agreement (but not any of the specific terms of this Master Agreement or any
Schedule or any detailed information regarding the performance of this Master Agreement or any
Schedule). Notwithstanding the foregoing, either party may disclose the general terms and length of
term of this Master Agreement to such party’s current and prospective business partners and
investors provided that prior to the disclosure of the Confidentiality Information in Section 3
described above, such party’s current and prospective business partners and investors will execute
or have executed an agreement with such party whereby that party’s current and prospective business
partners agree (i) that it will not use the Confidential Information for any purpose other than
stated herein and (ii) that it will not share the Confidential Information with any of its
affiliates nor any persons not having a need to know the Confidential Information. In addition,
notwithstanding the other party’s consent to the disclosure, the party disclosing Confidential
Information to its current and prospective business partners and investors agrees to indemnify the
other party for any damages, losses, claims, actions or liabilities to the extent arising from any
third party’s unauthorized use of the Confidential Information. In addition, Customer may disclose
the terms of this Master Agreement, but only to the extent necessary, to comply with applicable
securities laws. In such event, Customer shall reasonably co-operate with SunGard in determining
which terms of this Master Agreement need to be disclosed to the necessary securities authorities.

In addition, notwithstanding the other party’s consent to the disclosure, the party disclosing
Confidential Information to its current and prospective business partners and investors agrees
to indemnify the other party for any damages, losses, claims, actions or liabilities to the extent
arising from any third party’s unauthorized use of the Confidential Information. In addition,
Customer may disclose the terms of this Master Agreement, but only to the extent necessary to
comply with applicable securities laws. In such event, Customer shall reasonably co-operate with
SunGard in determining which terms of this Master Agreement need to be disclosed to the necessary
securities authorities.

10. ENTIRE UNDERSTANDING. This Master Agreement states the entire understanding between
the parties with respect to its subject matter, and supersedes all prior proposals, negotiations
and other written or oral communications between the parties with respect to its subject matter.
Each Schedule states the entire understanding between the parties with respect to its subject
matter, and supersedes all prior proposals, negotiations and other written or oral communications
between the parties with respect to its subject matter. No modification of this Master Agreement or
any Schedule, and no waiver of any breach of this Master Agreement or any Schedule, shall be
effective unless in writing and signed by an authorized representative of the party against whom
enforcement is sought. No waiver of any breach of this Master Agreement or any Schedule, and no
course of dealing between the parties, shall be construed as a waiver of any subsequent breach
thereof. Any purchase order submitted by Customer to SunGard shall be used only for invoice
processing purposes and shall have no legal effect.

11. PARTIES IN INTEREST. Neither party may assign this Master Agreement or any Schedule,
or any rights or obligations thereunder, without the prior written consent of the other party,
which will not be unreasonably withheld; provided that either party may assign any Schedule to an
Affiliate by giving prior written notice to the other party, and assign this Master Agreement and
any Schedule hereto as part of a corporate reorganization, consolidation, merger, change of control
with respect to its outstanding stock, or sale of substantially all of its assets, provided however
that (i) the financial condition of any such successor entity or purchaser, as applicable, shall
not have a material adverse effect on the ability of SunGard to receive contracted payments under
this Master Agreement or any Schedule thereto as a result of such assignment or transfer and (ii)
any such successor entity or purchaser, as applicable, agrees to be bound by the obligations set
forth in this Master Agreement. This Master Agreement and each Schedule shall bind, benefit and be
enforceable by and against both parties and their respective successors and permissible assigns. No
third party shall be considered a beneficiary of, or entitled to any rights under, this Master
Agreement or any Schedule.

12. CONSTRUCTION. THIS AGREEMENT AND EACH SCHEDULE SHALL BE GOVERNED BY SUBSTANTIVE
PENNSYLVANIA LAW. This choice of governing law shall not be considered determinative of the
jurisdiction or venue of any action between the parties. In any action relating to this Master
Agreement or any Schedule, (a) each of the parties irrevocably waives the right to trial by jury,
(b) each of the parties irrevocably consents to service of process by first class certified mail,
return receipt requested, postage prepaid, to the designated street address at which the party is
to receive

 

 

notice in accordance with Section 8 of this Master Agreement, and (c) the prevailing party shall be
entitled to recover its reasonable attorney’s fees (including, if applicable, charges for in-house
counsel), court costs and other legal expenses from the other party. A determination that any term
of this Master Agreement or any Schedule is invalid or unenforceable shall not affect the other
terms thereof. Section headings are for convenience of reference only and shall not affect the
interpretation of this Master Agreement or any Schedule. The relationship between the parties
created by this Master Agreement or any Schedule is that of independent contractors, and not
partners, joint venturers or agents. Sections 3, 5, 6 and 12 shall survive any termination of this
Master Agreement or any Schedule.

13. ENFORCEMENT. Each party acknowledges that the provisions of this Master Agreement
regarding confidentiality and access to and use of the other party’s resources are
reasonable and necessary to protect the other party’s legitimate business interests. Each party
acknowledges that any breach of such provisions shall result in irreparable injury to the other for
which money damages could not adequately compensate. If there is a breach of such provisions, then
the injured party shall be entitled, in addition to all other rights and remedies which it may have
at law or in equity, to have a decree of specific performance or an injunction issued by any
competent court, requiring the breach to be cured or enjoining all persons involved from continuing
the breach. The existence of any claim or cause of action that a party (or any other person
involved in the breach) may have against the other party shall not constitute a defense or bar to
the enforcement of such provisions.

©2008 SunGard Availability Services LP, all rights reserved.

MSA0608

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omission.

Schedule Number
3003703300 v. 1.0

For Managed IT Services Governed by

Master Agreement for U. S. Availability Services

Between

SunGard Availability Services LP and ATHENAHEALTH

Dated December 1, 2009

Page 1 of 4

Schedule Reference Name: Scottsdale Data Center

This is a
new Schedule having an Agreed Term of 26 months with a Commencement Date of December 1, 2009.

SUMMARY OF SERVICES AND FEES

	 	 	 	 	 
	Selected Services
	 	 	 	 
	Hosting Services
	 	 	 	 
	Network Services
	 	 	 	 
	Security Services
	 	 	 	 
	One-Time Fee
	 	 	$ *	 
	Monthly Fee
	 	See Billing Schedule	 

All One-Time Fees will be invoiced to Customer upon counter-execution of the Schedule by
SunGard and are due in accordance with the Master Agreement.

BILLING SCHEDULE

	 	 	 	 	 
	Invoice From:	 	Monthly Fee:
	 
	12/01/2009
	 	$	*	 
	02/01/2010
	 	$	*	 
	02/01/2011
	 	$	*	 
	 

Section 2, Fees and Expenses, of Master Agreement is amended by deleting the last sentence of
the Section during the current Agreed Term of the Schedule.

By the signatures of their duly authorized representatives below, SunGard and Customer,
intending to be legally bound, agree to all of the provisions of this Schedule and ratify the terms
of the Master Agreement.

	 	 	 	 	 	 	 	 	 
	SUNGARD AVAILABILITY
SERVICES LP	 	 	 	ATHENAHEALTH
	 
	 	 	 	 	 	 	 	 
	By:

	 	/s/ Christopher Coleman 	 	 	 	By:	 	/s/ Carl B. Byers 
	 

	 	 
	 	 	 	 	 	 

	 

	 	Print Name: Christopher Coleman
	 	 	 	 	 	Print Name: Carl B. Byers
	 

	 	Print Title:   Vice President
	 	 	 	 	 	Print Title:   SVP &
CFO
	Date Signed: 12/4/09
	 	 	 	Date Signed: December 1, 2009

			
	 	 	 
	
	 	DOC ID: 3003703300 VER.: 1.0

ACCOUNT NUMBER: 64256 QUOTE ID: 102519

PRINTED: NOV. 23, 2009 10:33:08 AM

THE
TERMS OF THIS SCHEDULE ARE CONFIDENTIAL

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omission.

Schedule Number 3003703300 v. 1.0

For Managed IT Services Governed by

Master Agreement for U. S. Availability Services

Between

SunGard Availability Services LP and ATHENAHEALTH

Dated December 1, 2009

Page 2 of 4

This Schedule is subject to the terms and conditions of the Managed IT Services Exhibit version
MITS-0109.

	 	 	 
	CUSTOMER INFORMATION	 	 
	 
	BILL TO ADDRESS:

	 	311 ARSENAL STREET, WATERTOWN, MA 02472 US

GEORGE SMITH
	NOTIFICATION ADDRESS:

	 	311 ARSENAL STREET, WATERTOWN, MA 02472 US

GEORGE SMITH
	DESIGNATED SUNGARD FACILITY:

	 	*

			
	 	 	 
	
	 	DOC ID: 3003703300 VER.: 1.0

ACCOUNT NUMBER: 64256 QUOTE ID: 102519

PRINTED: NOV. 23, 2009 10:33:08 AM

THE
TERMS OF THIS SCHEDULE ARE CONFIDENTIAL

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omission.

Schedule Number 3003703300 v. 1.0

For Managed IT Services Governed by

Master Agreement for U. S. Availability Services

Between

SunGard Availability Services LP and ATHENAHEALTH

Dated December 1, 2009

Page 3 of 4

	 	 	 	 	 
	Qty	 	 	Hosting Services
	 
	 	20	 	 	Hardware Installation Service

	 	5	 	 	Operational Support Services (Hours per
Month)

	 	2	 	 	Secure Cabinet (208/220V 30A 3-Phase)

	 	 	 	 	 	 	 	 	 	 	 	 	 
	Qty	 	 	Network Services	 	 	 	 	 	 	 	 
	 
	 	1	 	 	*
	 	Usage Based Fee
	 	 	$*	1
	 	1	 	 	*
	 	 	 	 	 	 	 	 
	 	2	 	 	*
	 	 	 	 	 	 	 	 
	 	1	 	 	*
	 	 	 	 	 	 	 	 
	 	1	 	 	*
	 	 	 	 	 	 	 	 
	 	1	 	 	*
	 	 	 	 	 	 	 	 

	 	 	 	 	 
	Qty	 	 	Security Services
	 
	 	1	 	 	*

	 	1	 	 	*

	 	1	 	 	*

			
	 	 	 
	
	 	DOC ID: 3003703300 VER.: 1.0

ACCOUNT NUMBER: 64256 QUOTE ID: 102519

PRINTED: NOV. 23, 2009 10:33:08 AM

THE
TERMS OF THIS SCHEDULE ARE CONFIDENTIAL

 

 

Schedule Number 3003703300 v. 1.0

For Managed IT Services Governed by

Master Agreement for U. S. Availability Services

Between

SunGard Availability Services LP and ATHENAHEALTH

Dated December 1, 2009

Page 4 of 4

FOOTNOTES

 

			
	1.	 	Usage Fee per Mbps over Committed Bandwidth Tier Level.

			
	 	 	 
	
	 	DOC ID: 3003703300 VER.: 1.0

ACCOUNT NUMBER: 64256 QUOTE ID: 102519

PRINTED: NOV. 23, 2009 10:33:08 AM

THE
TERMS OF THIS SCHEDULE ARE CONFIDENTIAL

 

 

MANAGED IT SERVICES EXHIBIT TO THE

MASTER AGREEMENT for U.S. AVAILABILITY SERVICES

Dated December 1, 2009

A. POLICIES AND SERVICES GUIDE

The services provided under this Exhibit shall at all times be used in compliance with SunGard’s
then-current general policies and guidelines (“General Policies”) and the policies and guidelines
of SunGard’s underlying telecommunications providers (“Network Policies”) (collectively, the
General Policies and Network Policies are sometimes herein referred to as “Policies”). Customer
agrees to be bound by the Policies, as amended. All Policies, including change management policies
and procedures, and additional detail regarding the specifications of the service offerings, are
set forth in SunGard’s Services Guide, which is available to Customer at SunGard’s customer portal
http://www.MySunGard.com (“Portal”). In addition, all implementation services which are included as
part of a service offering, are detailed in the Services Guide.

Upon completion and full execution of a Managed IT Services Schedule, Customer will receive access
to the Portal. Upon receiving access, Customer shall enter the Portal and subscribe to the
Services Guide in accordance with the instructions specified in the Portal and shall provide an
email address(es) electronically so that notices of changes to the Services Guide will
automatically be sent to the email address(es) provided. The email will notify Customer that the
Services Guide has been changed and upon accessing the Services Guide, the cover page will indicate
the Section(s) modified, deleted or added.

B. HOSTING SERVICES

1. Space

a. SunGard hereby grants to Customer the right to use the Space (as defined in the
Schedule) for the placement and maintenance of the computer and communications equipment specified
in the Schedule (“Equipment”) which may be interconnected to the Network Services offered by
SunGard (as defined herein) or to other communications carriers via facilities offered by SunGard.
The Equipment and any necessary software (“Software”) may be provided by Customer
(“Customer-provided Equipment” or “Customer-provided Software”) or by SunGard (“SunGard-provided
Equipment” or “SunGard-provided Software”) as specified in the Schedule. Customer acknowledges
that the Space shall be used in accordance with the Equipment vendor’s specifications for
electrical, airflow, and clearance.

With the exception of the Full Infrastructure Management Space option, as defined herein, if
Customer desires to install Equipment in the Space that exceeds the vendor specification(s),
SunGard reserves the right to require Customer to contract for additional Space. This Exhibit does
not create any interest in real estate and is strictly an agreement for the provision of services,
which are personal in nature to the parties. The Monthly Fees and any other fees in connection
with Customer’s use of the Space are set forth in the Schedule. Customer’s use of the Space shall
not interfere
with any other SunGard customer’s use of SunGard’s facilities. Customer represents and warrants
that it has the full legal right to utilize any Customer-provided Equipment and Software. The
Equipment shall operate on conditioned UPS-based power with transparent and immediate access to a
backup power source capable of sustaining power to the Equipment during any interruption to the
primary power source.

b. SunGard shall perform such janitorial services, environmental systems
maintenance, power plant maintenance and other services as are reasonably required to maintain the
facility in which the Space is located in good condition suitable for the placement of Equipment.
With the exception of the Full Infrastructure Management Space option (as defined herein),
Customer shall keep the Space clear of all refuse, cardboard or any potentially hazardous material.
Customer shall maintain the Space in an orderly and safe condition, and shall return the Space to
SunGard at the conclusion of the Agreed Term as defined in the Schedule in the same condition
(reasonable wear and tear excepted) as when such Space was delivered to Customer. EXCEPT AS
EXPRESSLY STATED HEREIN, THE SPACE SHALL BE DELIVERED AND ACCEPTED “AS IS”. THE SPACE SHALL BE IN
SECURE FACILITIES MONITORED TWENTY-FOUR (24) HOURS PER DAY, SEVEN (7) DAYS PER WEEK BY ON-SITE
STAFF, WITH CARD KEY ACCESS AND CLOSED CIRCUIT TV MONITORING, CONDITIONED POWER UTILIZING UPS
SYSTEMS AND BACK-UP POWER GENERATOR CAPABILITY (“INFRASTRUCTURE”). SunGard represents that it will
not materially diminish such Infrastructure at the Designated SunGard Facility (as defined in the
Schedule) during the Agreed Term. At its sole risk and expense, Customer shall be
responsible for installation of the Customer-provided Equipment in the Space, unless Customer
elects to contract for Hardware Installation Services as set forth herein. If Customer elects to
contract for Hardware Installation Services, then SunGard shall be responsible for the installation
of the Customer-provided Equipment to the extent provided herein. At its sole risk and expense,
Customer shall be responsible for installation of Customer-provided Software in the Space. Upon
termination or expiration of the Schedule, Customer shall be responsible for removal of the
Customer-provided Equipment and Software from the Space within ten (10) business days of such
termination or expiration.

c. In addition to the Policies, Customer shall abide by any posted rules
relating to the use of, access to, or security measures respecting the Space. The Customer-provided
Equipment shall be installed, operated, inspected, maintained, repaired, replaced and removed only
by qualified agents of Customer who are properly licensed, if applicable, a list of whom shall be
provided to SunGard in advance of any such activity. Customer shall not permit any liens to be
placed against all or any portion of the Space or any SunGard-provided Equipment or Software.
Customer shall not make any material alterations to the Space without the prior written consent of
SunGard. In the event that unauthorized parties gain access to the Space through access cards,
keys or other access devices provided to Customer (“Access Devices”),

 

 

Confidential Materials omitted and filed separately with the Securities and Exchange
Commission. Asterisks denote omissions.

Customer shall be responsible for any damages incurred as a result thereof. Customer shall be
responsible for the cost of replacing any Access Devices lost or stolen after delivery thereof to
Customer.

If Customer fails to pay SunGard any amounts due under a Schedule, and such failure continues for
more than thirty (30) days after receipt of SunGard’s written notice of nonpayment, included in
SunGard’s right to terminate Customer’s use of the Space is the right to disconnect and remove any
or all of the Equipment from the Space (including any data or Software resident on such Equipment),
and store any Customer-provided Equipment in any reasonable location for a period not to exceed six
(6) months and assess Customer reasonable charges for such storage. Upon conclusion of the six (6)
month period, SunGard may dispose of such Equipment without liability to Customer. SunGard may
redeploy any SunGard-provided Equipment in any manner in its sole discretion and shall delete all
Customer data residing on such SunGard-provided Equipment before redeployment. Any of Customer’s
data or Software resident on Customer-provided Equipment shall be removed, stored and/or disposed
of in the manner and for the period specified above for Customer-provided Equipment. Exercise of
any of the above rights by SunGard shall not relieve Customer of any of its payment obligations
under the Master Agreement.

d. SunGard reserves the right to change the location or configuration of the Space, at
SunGard’s sole expense, within the Designated SunGard Facility or to another SunGard facility;
provided, however, that SunGard shall not arbitrarily or discriminatorily require such changes.
SunGard and Customer shall work in good faith to minimize any disruption to Customer’s Services
that may be caused by such change in location or configuration of the Space. If the location of
the Space is to be moved to another SunGard facility, SunGard shall provide Customer with at least
ninety (90) days prior written notice of such relocation and Customer shall have the right to (a)
elect to be relocated to another SunGard facility, or (b) elect to terminate the Schedule without
penalty. Customer shall provide SunGard with written notice of its decision regarding the
preceding sentence within thirty (30) days after receipt of SunGard’s written notice. In addition,
SunGard reserves the right to upgrade or modify the infrastructure used to provide the Services
provided that any such change will not adversely affect Customer’s environment in the Space.

e. Prior to Customer’s occupancy, and during the Agreed Term of the Schedule, Customer shall
procure and maintain the following minimum insurance coverage: (i) Workers’ Compensation in
compliance with all applicable statutes of appropriate jurisdiction; Employer’s Liability with
limits of $500,000 each accident; (ii) Commercial General Liability with combined single limits of
$1,000,000 each occurrence, and a $2,000,000 general aggregate limit; and (iii) “All Risk” Property
insurance covering the Customer-provided Equipment located in the Space. Customer shall provide to
SunGard a certificate of insurance demonstrating that it has obtained the required insurance
coverage prior to Customer’s occupancy of the Space. Such certificate shall contain a statement
that Customer shall notify SunGard of any material changes or cancellation promptly. Customer
shall require any contractor entering the Space on its behalf to procure and maintain the same
types and amounts of insurance as set forth in this section.

f. With the exception of the Full Infrastructure Management Space option (as defined herein),
SunGard shall provide to Customer (including any of its employees, agents and other
authorized representatives as Customer may from time to time reasonably designate in writing),
access to the part of the Designated SunGard Facility from which SunGard is providing the Space,
twenty-four (24) hours per day, seven (7) days per week, including statutory holidays. All of
Customer’s designees shall adhere to SunGard’s Policies.

g. Space Options — Customer may subscribe to any of the following options available relating
to Space: (i) SunGard-provided 19” Cabinet; (ii) Secure Cabinet; (iii) Secure Space; (iv) Secure
Cage; and (v) Secure Suite.

(i) SunGard-provided 19” Cabinet — The SunGard-provided 19” Cabinet option includes: (i) a minimum
of 42 U EIA rack space for the Equipment; (ii) proper air ventilation for the Equipment; (iii) two
(2) stationary equipment shelves; and (iv) security by lock and key, managed by SunGard.

(ii) Secure Cabinet — The Secure Cabinet option includes: (i) a SunGard-provided 19” Cabinet (as
defined above); (ii) Space to support the SunGard-provided Cabinet; (iii) and the redundant power
configuration as set forth in the Schedule with the corresponding voltage (“V”) and amperage
(“A”).

(iii) Secure Space — The Secure Space option includes the amount of Space in the square feet
increments defined in the Schedule and: (i) one (1) Standard Power Circuit (as defined herein) per
twenty-five (25)
square feet of Space defined for the Secure Space option in the Schedule or one (1) Standard Power
Circuit (as defined herein) for each Cabinet installed in the Secure Space; and (ii) five (5) hours
of Operational Support Services (as defined herein) per month.

(iv) Secure Cage — The Secure Cage option includes the amount of Space defined in the Schedule or
the amount of Space necessary to install the number of Cabinets as set forth in the Schedule and:
(i) perimeter metal fence with an access door; (ii) security by lock and key, managed by SunGard;
(iii) one (1) Standard Power Circuit (as defined herein) per twenty-five (25) square feet of Space
defined for the Secure Cage option in the Schedule or one (1) Standard Power Circuit (as defined
herein) per Cabinet installed in the Secure Cage; and (iv) five (5) hours of Operational Support
Services (as defined herein) per month.

(v) Secure Suite — The Secure Suite option includes the amount of Space defined in the Schedule
for the number of cabinets as set forth in the Schedule. The Secure Suite option includes: (i)
perimeter metal fence or perimeter walls with an access door; (ii) private security with card key
and pin code or by lock and key; (iii) one (1) Standard Power Circuit (as defined herein) per
twenty-five (25) square feet of Space defined for the Secure Suite option in the Schedule or one
(1) Standard Power Circuit (as defined herein) for each cabinet installed in the Secure Space; and
(iv) ten (10) hours of Operational Support Services (as defined herein) per month.

h. *

i. *

j. *

2. *

3. Support Services

a. Hardware Installation Services. SunGard shall provide Hardware Installation
Services for the number of devices set forth in the Schedule. Hardware Installation Services
include the one-time installation of hardware devices and do not include on-going support. Hardware
Installation Services include: (i) the unpacking and installation of the Equipment into nineteen
inch (19”) computer racks or cabinets in

2

 

accordance with hardware vendor recommendations and Customer requirements; (ii) the installation of
network cables and cross-connects; and (iii) floor cutouts, as necessary.

b. Operational Support Services. SunGard will provide Customer with access to technical personnel
to assist Customer on a 24x7x365 basis for the number of hours per month as set forth in the
Schedule. In the event that Customer exceeds the number of hours indicated in the Schedule in any
month, Customer may then elect to have SunGard attempt to resolve the problem on a time and
materials basis at SunGard’s then prevailing hourly rate. Operational Support Services shall
include: (i) the execution of a command or series of commands as directed by Customer to determine
operating status or to facilitate configuration changes; (ii) enlisting of vendor support as
requested by Customer and as available pursuant to Customer’s agreement with the applicable vendor;
(iii) visual inspection of Equipment and power up, restart or reboot as directed by Customer; (iv)
insertion and ejection of media as directed by Customer; and (v) preparation of media for pickup at
the Designated SunGard Facility as requested by Customer. Customer is responsible for providing all
media, related materials, storage containers, procedures and any off-site storage contract for the
media.

c. Equipment Management Services. SunGard shall provide Equipment Management Services for the
Equipment set forth in the Schedule. Equipment Management Services include: (i) resolution of
detected Equipment failures; (ii) coordination of preventative maintenance; (iii) installation of
microcode or firmware upgrades; (iv) power cycling or reboot; (v) issuance of software or firmware
commands; and (vi) physical inspection of all Equipment components. With respect to
Customer-provided Equipment, Customer is responsible for obtaining the consent of the maintenance
vendor in order for SunGard to act as Customer’s agent.

d. SunGard-provided Equipment. If necessary in support of certain Services, SunGard may install
certain SunGard-provided Equipment in Customer’s Space.

4. Server Services. For all Services listed in this Section, Customer shall place
Customer-provided Equipment and Customer-provided Software under a valid maintenance contract with
the original equipment/software manufacturer for 24x7x365 support with four (4) hour onsite
response time. In the event that Customer elects to contract for an Operating System license under
SunGard’s Software Licensing Services (as defined herein), SunGard shall provide a valid
maintenance contract for the Operating System license with the original software manufacturer. If
Customer elects to contract for maintenance services with a vendor other than the original
equipment/software manufacturer, Customer is responsible for all issues arising as a result thereof
and associated obligations.

Customer acknowledges that for SunGard to provide Server Services,
Customer’s server(s) must be configured with a drive capable of reading a CD-ROM to facilitate the
installation of utility software on the disk volume where the operating system resides. Customer
must subscribe to Data Back-up Services (as defined herein) or Vaulting Services — Restoration
Support Option (as defined herein) and provide a minimum of one (1) dedicated network interface per
server for administration and monitoring, as well as one (1) dedicated network interface per server
for Data Back-up Services (as defined herein) in order to receive Server Services. Customer
acknowledges that SunGard will install utility software on the server(s) on which the operating
system resides.

As an option, Customer may elect to contract for Extended Services for Operating System Management
Services (as
defined below) which provide support for direct attached storage device(s). Extended Services for
Operating System Management Services include: (i) the configuration of the direct attached storage;
and (ii) the installation of the connection between the server(s) and the direct attached storage.

a. Operating System Management Standard Services.
SunGard shall provide Operating System Management Standard Services for the number of servers set
forth in the Schedule. Operating System Management Standard Services includes Advanced Monitoring
Services — Operating System (as defined herein) and as requested by Customer and in accordance
with Customer’s written instructions: (i) the initial base operating system build on the server;
(ii) operating system patch maintenance and reporting; (iii) resolution of detected operating
system failures; (iv) Hardware Installation Services (as defined herein); (v) Equipment Management
Services (as defined herein); (vi) configuration of operating system level backups; and (vii)
tracking of physical inventory and installed patches for the servers/devices under contract with
SunGard. In order for SunGard to provide Operating System Management Standard Services, Customer
shall provide SunGard with ROOT or ADMIN security access.

b. Operating System Management Advanced Services.
SunGard shall provide Operating System Management Advanced Services for the number of servers and
partitions set forth in the Schedule. Operating System Management Advanced Services include: (i)
the
initial operating system build on the server; (ii) Advanced Monitoring Services — Operating System
(as defined herein); (iii) operating system patch maintenance, if available from the vendor, and
upon Customer request; (iv) resolution of detected operating system failures; (v) Hardware
Installation Services (as defined herein); (vi) Equipment Management Services (as defined herein);
(vii) operating system configuration changes upon Customer request; (viii) configuration of
operating system level backups; (ix) tracking of physical inventory and installed patches for the
managed servers; and (x) management of ROOT or ADMIN security access. Customer must provide
SunGard with exclusive control of root security access to be eligible for the Service Level
Commitment specified in Section J. In order for SunGard to provide Operating System Management
Advanced Services, Customer shall provide SunGard with ROOT or ADMIN security access.

c. Operating System Management Enterprise Services. SunGard shall provide Operating System
Management Enterprise Services for the number of enterprise class servers and partitions set forth
in the Schedule. Enterprise class servers are servers that are configured with a SunGard-supported
clustering technology and/or servers capable of running multiple OS instances on one hardware
platform. OS instances are isolated from each other through logical (software/firmware) and/or
physical (hardware) partitioning. Operating System Management Enterprise Services include: (i)
Operating System Management Advanced Services; (ii) management of the separate partitions on the
server; and (iii) management of SunGard-supported clustering technology as set forth in the
Services Guide. In order for SunGard to provide Operating System Management Enterprise Services,
Customer may be required to provide the appropriate management console (hardware and software) to
manage the servers with logical and/or physical partitions.

5. Application Services. For all Services listed in this Section, Customer shall place
Customer-provided Equipment and Customer-provided Software under a valid maintenance

3

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

contract with the original equipment/software manufacturer for 24x7x365 support with four (4) hour
onsite response time. In the event that Customer elects to contract for an application license
under SunGard’s Software Licensing Services (as defined herein), SunGard shall provide a valid
maintenance
contract for the application license with the original software manufacturer. If
Customer elects to contract for maintenance services with a vendor other than the original software
vendor, Customer is responsible for all issues arising as a result thereof and associated
obligations. In order to be eligible for Application Services, Customer must contract for Operating
System Management Advanced or Enterprise Services, Data Back-up Services (as defined herein) or
Vaulting Services — Restoration Support Option (as defined herein), and provide a minimum of two
(2) dedicated network interfaces per physical server for connectivity to SunGard’s backup and
management networks.

a. *

b. Managed Database Services. SunGard shall provide Managed Database Services for the number
of servers and instances set forth in the Schedule. Managed Database Services include: (i)
Advanced Monitoring Services — Database (defined herein); (ii) the initial database build on the
server; (iii) database software patch maintenance and tracking including one (1) version upgrade
per contract year, if available from the database vendor, and upon Customer request; (iv)
resolution of detected database failures; (v) table compaction or reorganization upon Customer
request; (vi) database configuration changes upon Customer request; and (vii) management of
database security access in accordance with Customer-provided written specifications. In addition
to the specific Services defined above for Managed Database Services, if Customer also contracts
with SunGard for Data Back-up Services, SunGard will define and implement database backup and
restore methodology.

c. *

d. *

e. *

f. Application Support — System Utility Services. SunGard shall provide Application Support —
System Utility Services for the application(s) set forth in the Schedule. Application Support —
System Utility Services include: (i) installation of releases, maintenance uplifts and patches upon
Customer request; (ii) one (1) version upgrade per contract year, if available from utility
software vendor and upon Customer request; (iii) resolution of detected utility software failures
reported by Customer or detected by SunGard; (iv) utility software configuration changes upon
Customer request; and (v) management of ROOT security access, if applicable to the utility. This
Service is only available for servers under contract with SunGard for Server Services (as defined
herein) and utility applications currently supported by SunGard as set forth in the Services Guide.

g. *

C. NETWORK SERVICES

1. Network services include those network services and Internet Access Services (as defined below)
set forth in the Schedule and as described below (“Network Services”). Network Services are only
available to a customer who has subscribed to other Service(s) under this Exhibit. The Network
Services set forth in the Schedule shall be made available to Customer on an exclusive, 24-hour a
day, 7-days per week basis (excluding downtime attributable to previously scheduled routine and
preventative maintenance). All circuits will be
connected between the entry point on the SunGard network, as designated and coordinated by SunGard
(“Point of Presence”), and the Designated SunGard Facility set forth in the Schedule. If selected
on a Schedule, SunGard shall provide connectivity between the Customer location set forth in the
Schedule to the Point of Presence.

2. Internet access services provide Customer with access to the Internet from the Designated
SunGard Facility set forth in the Schedule (“Internet Access Services”). The Internet is not owned,
operated or managed by, or in any way affiliated with, SunGard or any of SunGard’s affiliates. The
Internet is an international computer network of both Federal and non-Federal inter-operable packet switched data
networks. SunGard cannot and does not guarantee that the Internet Access Services will provide
Internet access that is sufficient to meet Customer’s needs. Customer agrees that its use of the
Internet is solely at its own risk and is subject to all applicable local, state, national and
international laws and regulations (“Applicable Laws”). Customer represents and warrants that it
will comply with all Applicable Laws in its use of the Internet Access Services.

3. Customer hereby acknowledges receipt of SunGard’s Network Policies and agrees to comply with
such Policies at all times while utilizing the Network Services. Customer acknowledges that
SunGard may from time-to-time revise its Network Policies, and any revisions will be communicated
to Customer by posting on the Portal or via email notification. Customer also acknowledges that a
breach of any of the Network Policies may result in the termination of the Network Services if any
such breach is not cured within twenty-four (24) hours of SunGard’s written notice of such breach
to Customer. SunGard shall have no liability to Customer for any restriction or termination of the
Network Services pursuant to Customer’s violation of the Network Policies.

4. Network addresses assigned from a SunGard IP network block are non-portable. Network space
allocated to Customer by SunGard must be returned to SunGard in the event Customer discontinues
Internet Access Services as defined in this Exhibit for any reason, or upon expiration or
cancellation of the Schedule.

5. Managed Internet Access Services. Managed Internet Access Services provide Customer with a
dedicated IP connection of Committed Bandwidth Tier Level (as defined in the Schedule) as selected
by Customer. Customer can contract to burst above the selected Committed Bandwidth Tier Level up to
the Burstable Limit set forth in the Schedule (“Incremental Burstable Limit”), subject to available
bandwidth on SunGard’s network. Customer’s selected Committed Bandwidth Tier Level as well as the
associated Incremental Burstable Usage Fees are specified in the Schedule. Customer’s monthly
billing is based on the Committed Bandwidth Tier Level and the actual level of sustained burstable
usage (“Burstable Usage”). An Incremental Burstable Usage Fee will be charged for each Mbp
exceeding the contracted Committed Bandwidth Tier Level. All Incremental Burstable Usage Fees are
invoiced monthly in arrears. Customer’s Burstable Usage level is determined by traffic samples
taken every five (5) minutes over the course of a month. The traffic samples are ranked from
highest to lowest with the top five-percent (5%) discarded to account for temporary traffic bursts.
The level at which ninety-five (95%) of the samples fall, will be the Customer’s Burstable Usage
for that month and will determine the Customer’s total Incremental Burstable Usage Fees. Burstable
Usage will be determined based upon Customer’s utilization data as maintained by

4

 

Confidential Materials omitted and filed separately with the Securities and Exchange
Commission. Asterisks denote omissions.

SunGard. In addition, Managed Internet Access Services include domain name administration
services for up to ten (10) primary and/or secondary Customer domain(s).

6. *

7. Dedicated Transport Services. SunGard shall provision third party telecommunications
circuit(s) for Customer as set forth in the Schedule. Dedicated Transport Services include: (i)
provisioning and installation of dedicated SunGard or third party circuit(s); and (ii) port
connections from SunGard’s network distribution center to the Equipment situated in the Space.

8. *

9. Managed Load Balancing Services. SunGard shall provide Managed Load Balancing Services for the
number of load balancer devices within a single Designated SunGard Facility as set forth in the
Schedule. Managed Load Balancing Services include: (i) Equipment Management Services (as defined
herein); (ii) Standard Monitoring Services (as defined herein); (iii) load balancer policy
configuration upon Customer request; (iv) resolution of load balancer problems; and (v) Hardware
Installation Services (as defined herein).

10. Geographic Load Balancing Services. SunGard shall provide Geographic Load Balancing Services
for the number of load balancer devices situated across multiple Designated SunGard Facilities as
set forth in the Schedule. Geographic Load Balancing Services include: (i) Equipment Management (as
defined herein); (ii) Standard Monitoring Services (as defined herein); (iii) load balancer policy
configuration upon Customer request; (iv) resolution of load balancer problems; and (v) Hardware
Installation Services as defined herein.

11. *

12. *

D. STORAGE SERVICES

*

1. SAN Services. SunGard shall provide storage area network services (“SAN Services”) for the
amount of storage in gigabytes (“GB”) or terabytes (“TB”) and in association with the specific
servers (target servers) set forth in the Schedule. SAN Services include: (i) initial installation
of connectivity between the storage device and target server(s) each located at the Designated
SunGard Facility; (ii) initial allocation and configuration of storage units to target servers in
accordance with the SunGard-supplied and Customer completed design requirements form; and (iii)
problem resolution related to storage connectivity and storage device. If Customer has contracted
for Server Services (as defined herein) for the target servers, then SAN Services shall also
include: (i) the initial installation and configuration of path management software, if applicable;
(ii) installation of storage management software and related device driver software on the target
servers; (iii) application of maintenance changes; and (iv) problem resolution of path management
software, storage management software and related device driver software. Alteration of the
storage allocations, the number of connections, the number of target servers, or hardware and
software replacements, will require a modification or upgrade to the affected Schedule prior to any
of these additional services being rendered by SunGard. SAN Services do not include installation
or support for volume management or volume replication software.

a. Shared SAN Services. If SAN Services are provided through the SunGard shared SAN, the Services
include: (i) monitoring and maintenance of SAN performance and capacity
utilization; (ii) SAN capacity upgrades; and (iii) maintenance services for the storage device.
Shared SAN Services products are referenced in the Schedule as Shared Primary Disk RAID protected
as set forth in the Schedule. In order for SunGard to provide Shared SAN Services, Customer must
provide server(s) that each contain two (2) SunGard supported Host Bus Adapters, as specified in
the Services Guide.

b. Dedicated SAN Services. If SAN Services are provided through dedicated and/or
Customer-provided storage devices, the Services shall include Equipment Management Services (as
defined herein) for the associated storage devices. Customer acknowledges that the specifications
for the design of the SAN must include IP network connectivity to the hardware, software and
network components of the SAN in order for SunGard to provide Equipment Management Services to
Customer through SunGard’s management
network. In order for SunGard to provide Dedicated SAN Services for Customer-provided storage
devices, Customer must: (i) provide SunGard with the appropriate system access and management
console (hardware and software) to manage the storage devices; and (ii) contract with the original
Equipment manufacturer for the installation and configuration of the storage devices.

Dedicated SAN Services are only available for storage and network devices, servers and adapters
that are supported by SunGard, as specified in the Services Guide. SAN Services do not include
installation or support for volume management or volume replication software.

2. Data Backup Services

a. Standard Data Backup Services. SunGard shall provide Standard Data Back-up Services for the
amount of storage in association with the specific servers (at least one backup agent is required
for each target server) as set forth in the Schedule. Standard Data Back-up Services include: (i)
initial connectivity between backup network and target servers; (ii) installation of backup agent
software on target servers; (iii) configuration of daily backup schedules in accordance with
Customer design requirements form; (iv) execution of daily backup schedules; (v) retention of file
system data and/or daily database data as set forth in the Schedule; (vi) weekly off-site rotation
of media; (vii) file restore from media upon Customer request; and (viii) modification(s) to the
backup schedule upon Customer request. This Service does not include the definition or the
implementation of any backup and/or restoration methodology to be utilized for the database(s).

b. Advanced Data Backup Services. SunGard shall provide Advanced Data Backup Services for the
amount of storage and in association with the specific servers (at least one backup agent is
required for each target server) as set forth in the Schedule. Advanced Data Backup Services
include: (i) initial connectivity between backup network and target servers; (ii) installation of
backup agent software on target servers; (iii) configuration of daily backup schedules in
accordance with Customer design requirements form; (iv) execution of daily backup schedules; (v)
retention of file system data and/or daily database data (one on-site and one off-site) as set
forth in the Schedule; (vi) daily off-site rotation of media; (vii) file restore from media upon
Customer request; and (viii) modifications to the backup schedule upon Customer request. This
Service does not include the definition or the implementation of any backup and/or restoration
methodology to be utilized for the database(s).

c. General Provisions Applicable to Data Backup Services.
SunGard will use commercially reasonable efforts to schedule backups within the Customer identified
backup window(s).

5

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

SunGard cannot guarantee that backup schedule(s) will be completed within Customer’s requested
backup window(s) as backup times are dependent on the number of files and the quantity of data to
transfer. If backup schedules cannot be completed during Customer’s requested backup window, a
customized solution may be required. A customized solution will require a modification to the
Schedule and a detailed statement of work identifying any additional hardware, software and service
requirements. Customer must provide a minimum of two (2) dedicated network interfaces per target
server for connectivity to the backup and SunGard management networks. Customer agrees to provide
SunGard with administrative access to all target servers requiring Data Backup Services to
facilitate issue and/or problem resolution.

The Schedule will define Customer’s committed storage
amount in GB or tapes and the additional charge to be assessed for each GB or tape used by Customer
in excess of the contracted committed storage GB capacity or tape quantity.

d. *

3. *

a. *

b. *

c. *

4. *

E. *

F. SECURITY SERVICES

1. Managed Firewall & VPN Services. SunGard shall provide Managed Firewall Services for the
number of firewalls set forth in the Schedule and five (5) Virtual Private Network (VPN) tunnels
for each firewall (site to site VPN or client VPN) or connectivity support to Customer managed or
SunGard managed compatible authentication device. Managed Firewall
& VPN Services include: (i) Equipment Management Services (as defined herein); (ii) Standard
Monitoring Services (as defined herein); (iii) firewall configuration based on Customer’s written
specifications; (iv) resolution of firewall problems; (v) Hardware Installation Services (as
defined herein); (vi) LAN Services (as defined herein) for a SunGard-provided production switch;
and (vii) firewall log reports available to Customer at the Portal and are retained for 90 days. If
Customer subscribes to dual firewalls per device (i.e. router, server etc.), SunGard shall provide
dual firewall devices configured to provide redundancy should one of the firewalls fail to operate.
Customer is responsible for software management and configuration of Customer managed VPN
end-point. Customer acknowledges that SunGard does not monitor VPN persistence.

2. Managed Intrusion Protection Services

a. Managed Intrusion Detection Services (IDS). SunGard shall provide IDS as set forth in the
Schedule as Network IDS and/or Host IDS. For Network IDS, the Services are provided for the number
of IDS appliances and network segments as set forth in the Schedule. If multiple network segments
are to be monitored, the network architecture must support VLAN tagging or one Ethernet interface
per network segment being monitored. For Host IDS, the Services are provided for the number of
servers as set forth in the Schedule. IDS includes: (i) Hardware Installation Services (as
defined herein); (ii) installation and configuration of IDS software; (iii) configuration of IDS
rules; (iv) resolution of IDS configuration problems; (v) signature file, appliance and management;
(vi) 24 x 7 x 365 intrusion monitoring and notification to Customer of detected
alerts based upon manufacturer or Customer approved settings; and (vii) intrusion reports available
to Customer at the Portal and retained for 90 days.

b. Managed Intrusion Prevention Services (IPS). SunGard shall provide IPS as Network IPS and/or
Host IPS for the number of appliances or servers set forth in the Schedule. IPS includes: (i)
Hardware Installation Services (as defined herein; (ii) installation and configuration of IPS
software; (iii) network traffic monitoring 24x7x365; (iv) detection of attempted intrusions and
server misuse consisting of traffic abnormalities and/or pre-defined known attack signatures; (v) a
monthly report of IPS incidents; and (vi) configuration of IPS rules. For in-line IPS solutions
where the network traffic passes directly through the appliance, the appliance will be configured
to monitor and automatically filter attacks based on a predefined list of threats
and vulnerabilities. Customer understands and acknowledges that the device(s) utilized to provide
the IPS make decisions to drop packets based upon Customer’s selected criteria and that a packet
may generate a “false positive” and be dropped, possibly disrupting valid network activity.

3. Managed Vulnerability Protection Services. SunGard shall provide Managed Vulnerability
Protection Services for the number of IP addresses set forth in the Schedule. Managed Vulnerability
Protection Services are delivered over the Internet to scrutinize Customer’s Internet facing
devices for security vulnerabilities. Managed Vulnerability Protection Services: (i) identify
visible perimeter and/or network devices and map underlying Customer network devices that are
accessible from the Internet and provide information about each device; (ii) characterize devices
as access gateways, routers, or other types of equipment, by machine type and operating system;
(iii) provide information, such as machine names, and where possible, identifying information about
private networks and intranets; and (iv) identify common TCP/IP services, such as HTTP servers,
SMTP servers, and telnet or SSH servers. Scans can be conducted either monthly or quarterly (as
set forth in the Schedule) on a date that is mutually agreed to between the parties. Customer will
be provided with a report which includes a summary of the security of the network devices,
including summary information about the scan, general network information, specific host
information, a list of detected vulnerabilities and an executive overview that provides a global
view of the security level of all networks and IP addresses.

4. *

G. MONITORING SERVICES

Monitoring Services include: (i) the implementation by SunGard of monitoring rules provided by
Customer for the requested device(s), database(s), operating system(s) or website(s); (ii) 24x7x365
monitoring of alerts generated by the monitoring system; and (iii) notification to Customer
of monitoring alerts that may include a service impacting event (as defined in the Services Guide).
Monitoring Services are provided within a measurement period (“Polling Period”) whereby the
monitoring system detects resource availability and resource utilization. There may be occasions
when monitored resources reset completely within the Polling Period and therefore may not be
monitored during such reset period. In the event there is more than one instance or partition of
an operating system or application running on a monitored device or server, then the SunGard
monitoring “unit” is per instance instead of per device or server. Monitoring Services also

6

 

Confidential Materials omitted and filed separately with the Securities and Exchange
Commission. Asterisks denote omissions.

include the provision of the switch as set forth on the applicable Schedule.

1. Standard Monitoring Services. SunGard shall provide Standard Monitoring Services for the
number of devices and servers set forth in the Schedule. Standard Monitoring Services include the
detection of the failure of a device(s) and/or server(s) to respond. The frequency of the polling
of devices and/or server(s) will be every five (5) minutes. Standard Monitoring Services also
include a TCP/UDP port monitor, as applicable, to verify that a connection can be made to the
network port.

2. Advanced Monitoring Services — Database. SunGard shall provide Advanced Monitoring Services —
Database for the number of servers and the number of databases set forth in the Schedule. Advanced
Monitoring Services — Database include: (i) the provision and installation of a monitoring agent;
and (ii) the monitoring of table-space utilization, related logs and file systems. The frequency of
polling will be every five (5) minutes.

3. Advanced Monitoring Services — Operating System.
SunGard shall provide Advanced Monitoring Services — Operating System for the number of servers
and the number of operating system partitions set forth in the Schedule. Advanced Monitoring
Services — Operating System include: (i) the provision and installation of a monitoring agent;
(ii) the monitoring of CPU, memory, and system disk utilization; and (iii) the monitoring of IP
port availability. The frequency of polling will be every five (5) minutes.

4. Advanced Monitoring Services — Web. SunGard shall provide Advanced Monitoring Services — Web
for the number of servers set forth in the Schedule. Advanced Monitoring Services — Web include:
(i) provisioning and installation of a monitoring agent; (ii) monitoring of Customer specified web
server specific services or processes (i.e. DLLhost, InetInfo, and www service); (iii) system level
web server logs; (iv) web server performance metrics, such as users and connections; and (v) the
detection of HTTP error codes as described in the Services Guide and URL failure to respond to an
HTTP GET request within a specified threshold. The frequency of the polling of URLs will be every
five (5) minutes.

5. Advanced Monitoring Services — Device. SunGard shall provide Advanced Monitoring Services —
Device for the number of devices set forth in the Schedule. Advanced Monitoring Services — Device
include: (i) the monitoring of device CPU, memory, physical hardware and environmental components
(i.e. temperature, voltage, power supply failure, fan failure); and (ii) Wide Area Network
interface utilization, as applicable. The frequency of the polling will be every five (5) minutes.

6. *

7. Web Transaction Monitoring Services. SunGard shall provide Web Transaction Monitoring Services
for the number of transactions set forth in the Schedule. Web Transaction Monitoring Services
include: (i) the development of a specific URL sequence as a synthetic user; and (ii) the detection
of transaction failures as developed. Transactions may include up to five (5) discrete steps. The
polling frequency of the actual transaction(s) will be determined during transaction development.
Customer agrees to provide a technical contact to assist SunGard in the development of each
transaction.

H. PROBLEM RESOLUTION

1. Detection, Notification and Diagnosis. Within fifteen (15) minutes of SunGard’s determination
that there has been a Service impacting event, SunGard will notify Customer of the problem (unless
SunGard was first notified by Customer). If the service impacting event is associated with a
device(s) for which Customer has contracted with SunGard for Equipment Management Services, then
SunGard shall immediately engage then-available technical support to assist in problem diagnosis.
If the appropriate technical support resource has not been assigned to problem analysis within
fifteen (15) minutes of problem determination, escalation to the next level of Technical Services
Management (as defined in the Services Guide) occurs, culminating with escalation of the problem to
the Vice President of Operations at the Designated SunGard Facility in accordance with SunGard’s
standard operational procedures.

2. Resolution of Service Impacting Event. As necessary, following the detection and notification
to Customer of a Service impacting event associated with a device for which Customer has contracted
with SunGard for Equipment Management Services, if the problem has resulted in a Service outage,
SunGard will continue to escalate the problem internally until the Service is restored. If the
Service is not restored within thirty (30) minutes of problem determination, escalation to the
Technical Services Manager and Customer Service occurs. If the Service is not then restored within
sixty (60) minutes, escalation to the Technical Services Director occurs. If the Service is not
then restored within ninety (90) minutes, escalation to Vice President of Operations occurs.
SunGard shall provide continuous support to Customer in accordance with the terms of the Master
Agreement for problem resolution until the Service has been restored. As necessary, SunGard shall
coordinate with the applicable maintenance vendor to facilitate resolution of the issue.

I. EXPIRATION/CANCELLATION OF SCHEDULE AND TRANSITION SERVICES

1. Upon expiration/cancellation of a Schedule to this Exhibit for any reason other than due to
an uncured material breach by Customer, and provided Customer is not in default of its payment
obligations under the applicable Schedule, SunGard shall provide Customer with reasonable
transition services and information and documentation that reasonably may be needed by Customer in
connection with the orderly and expeditious transition of the Services (“Transition Services”).
Customer shall have thirty (30) days to cure any default due to payment obligations under the
applicable Schedule in order to receive the Transition Services. The Transition Services shall be
provided for a period of up to one hundred twenty (120) days, provided Customer continues to make
timely payments of the Monthly Fees attributable to all Schedules to the Master Agreement.

     Upon the expiration/cancellation of a Schedule to this Exhibit, or as the case may be after
the provision of reasonable Transition Services by SunGard to Customer, for any reason SunGard
shall delete all Customer data residing on SunGard-provided Equipment.

J. SERVICE LEVEL COMMITMENTS

The following subsections define the criteria for the Services and the compensation in the form of
credit(s) for which Customer is eligible in the event that the defined criteria was not met for the
Service.

1. Internet Access Availability

7

 

	•	 	Guarantee — During any calendar month, the Internet protocol network utilized to access the
Internet from the Designated SunGard Facility will have availability of 99.99% for Customer to
transmit to, and receive information from, the Internet.
	 
	•	 	Definition — “Internet availability” is defined as the ability to route a data packet from
Customer’s environment located within a Cabinet or Suite in the Space, to the egress point to the
public Internet.
	 
	•	 	Measurement — SunGard will measure availability of the SunGard Internet protocol network by
computing the total number of successful performance measurements between agents as a percentage of
the total number of attempts between agents. “Agents” are defined as passive devices that are
located in every SunGard hosting facility. Network error conditions are considered “failed
attempts”. Measurements will be posted to the Portal.
	 
	•	 	Remedy — If SunGard fails to provide Internet access in accordance with the Guarantee, then
Customer is entitled to a credit of one (1) day’s Monthly Fee for the Services on the applicable
Schedule. If Customer exceeds eight (8) or more cumulative full hours of unavailability during a
calendar month, Customer shall be issued a total credit of one (1) month’s Monthly Fee under the
applicable Schedule for the calendar month in which SunGard failed to meet the Internet Access
Availability Guarantee.

2. Latency

	•	 	Guarantee — The average round trip latency between any two agents within SunGard’s Internet
protocol network will not exceed an average of 50 milliseconds in North America during any calendar
month.
	 
	•	 	Definition — Latency is defined as the round trip time it takes for a data packet to travel
between two agents within SunGard’s Internet protocol network. “Agents” are defined as passive
devices that are located in every SunGard hosting facility. Each Agent is placed on that hosting
facility’s network infrastructure to take measurements across the SunGard Internet protocol
network.
	 
	•	 	Measurement — SunGard will measure latency by averaging sample measurements taken during the
prior calendar month between agents on SunGard’s Internet protocol network. SunGard records the
packet measurement based on the time in milliseconds that it takes to send a data packet and to
receive the acknowledgement of that data packet. Measurements will be posted to the Portal.
	 
	•	 	Remedy — If SunGard’s average monthly latency is greater than the Guarantee above, then Customer
is entitled to a credit of one (1) day’s Monthly Fee for the applicable Schedule for the calendar
month in which SunGard failed to meet the average trip Latency Guarantee.

3. Packet Delivery

	•	 	Guarantee — A monthly average success rate of 99.9% for packet delivery through SunGard’s
Internet protocol network.
	 
	•	 	Definition — “Unsuccessful delivery” is defined as packets dropped due to transmission errors or
router overload before exiting the SunGard Internet protocol network.
	 
	•	 	Measurement — SunGard shall measure packet loss by the number of re-transmitted data packet
requests. All data packet retransmits are assumed to be due to a lost packet. Daily measurements
will be summed and then
divided by thirty (30) to calculate a monthly average. Measurements will be posted to the Portal.
	 
	•	 	Remedy — If SunGard’s average successful monthly packet delivery is less than 99.9%, then
Customer is entitled to a credit of one (1) day’s Monthly Fee for the applicable Schedule for the
calendar month in which SunGard failed to meet the monthly Packet Delivery Guarantee.

4. Power

	•	 	Guarantee — 100% power availability in the Designated SunGard Facility.
	 
	•	 	Definition — Provision of uninterrupted power to the Designated SunGard Facility infrastructure
and to the Equipment located within the Designated SunGard Facility based upon the capacity
specified in the Schedule. Only Customers who contract for a B-Side Circuit and have
Customer-provided Equipment that supports multiple redundant power feeds or who have integrated a
static switch to provide redundancy to a single fed piece of Customer-provided Equipment qualify
for the Guarantee. The Service Level Commitment is not available to Customers who have contracted
for only A-Side Power Circuit(s) (without a B-Side Circuit(s)) or if Customer’s total utilization
of an A & B Side pair exceeds 80% of the capacity of one of the circuits in the pair.
	 
	•	 	Measurement — Power availability is measured as the unscheduled time that the SunGard-provided
dual power feeds were simultaneously unavailable.
	 
	•	 	Remedy — If power is unavailable as a result of SunGard’s actions or inactions, such that
Customer’s Services are interrupted, then Customer is entitled to a credit of one (1) day’s Monthly
Fee for the applicable Schedule for each incident. If Customer exceeds eight (8) or more cumulative
full hours of unavailability during a calendar month, Customer shall be issued a total credit of
one (1) month’s Monthly Fee under the applicable Schedule for the calendar month in which SunGard
failed to meet the power availability Guarantee.

5. System Availability

	•	 	Guarantee — The servers for which Customer has contracted with SunGard for Operating System
Management Advanced Services or Operating System Management Enterprise Services shall be
operational and available to Customer 99.9% of the time during the Agreed Term of the Schedule
(“System Availability”), if the server(s) are configured with a hardware RAID controller, dual
power supplies and Customer subscribes to Power Infrastructure B-Side Upgrade. As used herein,
“System” is defined to mean the Equipment and the operating system situated thereon and does not
include the network infrastructure connected to the server. Additionally, in the event Customer
retains ROOT or ADMIN privileges, or equivalent, SunGard and Customer shall work together to
determine the cause of the service-impacting event and the Service Level Commitment will not be
applicable to the event.
	 
	•	 	Measurement — System Availability will be measured utilizing internal monitoring software to
measure the availability of Customer’s System. The System shall be deemed available if the System
is responsive to standard ICMP or SNMP requests.
	 
	•	 	Remedy — If during any three (3) month period, System Availability for any two (2) months falls
below the

8

 

Confidential Materials omitted and filed separately with the Securities and Exchange
Commission. Asterisks denote omissions.

applicable percentage as an average for the month, SunGard will credit Customer ten percent
(10%) of the then current Monthly Fee for the affected Schedule, for each of the two months during
which the System Availability Guarantee was not met.

6. Network Hardware Availability

	•	 	Guarantee — Network hardware components which are provided by SunGard to facilitate LAN
Services, Managed Firewall Services, Managed Intrusion Protection Services, Managed Load Balancing
Services, or Geographic Load Balancing Services which are configured in a redundant configuration,
wherein all single points of failure have been eliminated, shall be operational and available to
Customer 99.95% of the time during the Agreed Term of the Schedule. Notwithstanding the foregoing,
for all network hardware provided by SunGard in which the hardware is configured in a single
architecture, SunGard commits that associated network hardware shall be operational and available
to Customer 99.5% of the time during the Agreed Term of the Schedule.
	 
	•	 	Measurement — SunGard shall monitor the network hardware and the network devices shall be
polled every five (5) minutes via a standard ICMP or SNMP poll.
	 
	•	 	Remedy — If during any three (3) month period, network hardware availability for any two (2)
months falls below the applicable Guarantee percentage as an average for the month, SunGard will
credit Customer ten percent (10%) of the then current Monthly Fee for the affected Schedule, for
each of the two months during which the Network Hardware Availability Guarantee was not met.

*

8. *

9. Notification

	•	 	Guarantee — SunGard shall notify Customer, in the manner as set forth herein and in SunGard’s
Services Guide within fifteen (15) minutes after SunGard has determined that Customer’s
Equipment/Services are unavailable.
	 
	•	 	Remedy — SunGard shall credit Customer one (1) day’s Monthly Fee for the applicable Schedule for
each incident during the prior calendar month in which SunGard fails to meet the Notification
Guarantee. In the event that Customer notifies SunGard regarding unavailability of
Equipment/Services, this remedy is not operational.

10. *

11. *

12. *

13. *

14. Remedies General

If SunGard fails to meet a defined Service Level during the Agreed Term of the Schedule, as
Customer’s sole monetary
remedy, Customer shall be entitled to receive the credits as reflected herein by Service Level.
Failure to meet the same Service Level three (3) times in any contract year shall entitle Customer
to terminate the applicable Schedule upon ninety (90) days prior written notice to SunGard. In no
event will the total credits for any occurrence exceed Customer’s then current Monthly Fee for the
applicable Schedule.

SunGard shall not be responsible for the failure to meet a Service Level if the failure is caused
by: (a) the breach of the Master Agreement or this Exhibit by Customer; (b) the negligence or
intentional acts or omissions of Customer or its employees or agents; (c) Equipment malfunction
(provided said Equipment has been maintained by SunGard in accordance with the terms of the Master
Agreement); or (d) the failure of any Software to perform in accordance with its specifications
(“Software Failure”) and such Software Failure is not caused by SunGard’s negligence, willful
misconduct or failure to maintain a maintenance contract on such software. Further, any scheduled
maintenance (including upgrades, repair or component replacement or scheduled backups) or other
mutually agreed-to downtime shall not be included in calculating any Guarantee has been met. In
addition, the Guarantees do not include any downtime as a result of: (a)
Customer-made changes to applications or data; (b) Customer retaining ROOT or ADMIN privileges; (c)
Customer requiring SunGard to maintain, or continue to run unsupported Software or hardware
releases; (d) Software or hardware failures resulting from the absence of an update, patch,
configuration change, maintenance change or repair recommended by SunGard but rejected or delayed
by Customer for any reason; or (e) Customer retaining access control to the network and/or security
device(s) for which SunGard is providing the Services.

15. Software Failure. Customer acknowledges that SunGard is not the developer of any of the
Software product(s) used to provide the Services hereunder. In the event of a Software Failure, if
in the reasonable discretion of SunGard and Customer, such Software Failure cannot be cured and if,
at the time of such failure no other functionally equivalent Software compatible with the Equipment
is commercially available, Customer shall have the right to immediately terminate the applicable
Schedule without penalty to either party. SunGard shall not be liable to Customer or any third
party for any damages with respect to such termination.

All trademarks and registered trademarks are the property of their respective owners.

©2009 SunGard Availability Services LP, all rights reserved

MIT0809

9

 

CONSULTING SERVICES EXHIBIT

TO THE MASTER AGREEMENT FOR U.S. AVAILABILITY SERVICES

Dated December 1, 2009

1. DESCRIPTION OF SERVICES

Each Schedule to this Services Exhibit specifies the consulting and assessment services to be
provided by SunGard to Customer and the deliverables as more specifically described in the Schedule
and all related Statements of Work incorporated by reference therein (“Consulting Services”). All
Consulting Services to be provided by SunGard shall be performed by qualified personnel in
accordance with professional standards, and all Consulting Services provided, and documents and
reports delivered, by SunGard shall conform to the requirements of this Exhibit, the Schedule and
the related Statement of Work. Notwithstanding anything to the contrary herein, SunGard reserves
the right to subcontract the Consulting Services to a third party without the prior written consent
of Customer.

Except as otherwise stated in the Consulting Services Schedule or related Statement of Work, the
parties intend that all Consulting Services to be provided to Customer under this Exhibit shall be
completed within one year after the Effective Date of the Schedule or the date the Schedule is
signed by SunGard, whichever is later. Customer acknowledges and agrees that SunGard’s fees are
based on SunGard performing the Consulting Services within the specified time period set forth in
the applicable Schedule or Statement of Work and that SunGard allocates and commits resources to
performing the Consulting Services upon SunGard’s execution of the Schedule. Customer understands
that its delay in providing SunGard access to information or in the performance of Customer’s
responsibilities as noted in the Statement of Work may result in additional costs and delay the
completion of the Consulting Services. Customer agrees to pay SunGard the additional costs
associated with Customer’s delay in performing its responsibilities. Any deficiencies, as
determined by generally accepted professional standards, shall be promptly reported by Customer to
SunGard and, in any event, within
30 days after receipt of the Consulting Services involved. SunGard will correct such deficiencies
in its Consulting Services within a mutually agreeable time period.

2. PERSONNEL

All SunGard personnel, when working at Customer’s premises, will conduct themselves in a
professional manner and will use commercially reasonable efforts to minimize disruptions to
Customer’s business. SunGard will retain full responsibility for its own personnel, including
payment of compensation and payroll taxes, provision of benefits, and maintenance of workers’
compensation and other required insurance. SunGard and Customer also agree that for one (1) year
following completion of the applicable Consulting Services neither party will interview for
employment purposes or employ current employees of the other that were directly involved the
applicable Consulting Services. Nothing contained herein, however, will limit either party’s right
to hire any
employee of the other party who responds to a general solicitation for employment not targeted at
such employee or other general advertisements or employment initiated exclusively by the employee.

3. CUSTOMER’S RESPONSIBILITIES

Material to SunGard’s obligation to provide Consulting Services is Customer’s obligation to
promptly provide SunGard, as and when requested, all information, data and other materials
concerning Customer’s personnel, operations and facilities and other relevant aspects of Customer’s
business, to the extent required by SunGard to properly perform the Consulting Services. All such
information, data and materials provided to SunGard by any of Customer’s personnel will be
accurate, current and complete, and may be relied upon by SunGard in performing the Consulting
Services.

 

Customer will be responsible for preparing and maintaining backup or duplicate copies of all such
information, data and materials, and SunGard will have no liability for any loss or damage
resulting from Customer’s failure to do so.

Further, Customer will provide SunGard access to Customer’s offices and facilities at mutually
agreeable times, make available to SunGard experienced personnel having knowledge of Customer’s
operations and other relevant aspects of Customer’s business, and cooperate with SunGard in all
respects reasonably necessary to allow SunGard to perform the Consulting Services.

4. FEES AND EXPENSES

SunGard will invoice Customer for the Consulting Services in the manner set forth in the Schedule.

Except as otherwise set forth on the Schedule, Customer agrees to reimburse SunGard for all travel,
lodging, food and incidental actual costs incurred by SunGard in providing the Consulting Services
to Customer provided that SunGard complies with the Customer’s applicable travel and expense
policy. SunGard will issue monthly invoices to Customer as the expenses are incurred.

5. CONFIDENTIALITY

Customer acknowledges that SunGard’s property includes trade secrets, confidential information and
proprietary property of SunGard, having great commercial value to SunGard, and that the development
and design of SunGard’s property has involved and will involve the expenditure by SunGard of
substantial amounts of time and money. All items of SunGard’s property are being provided by
SunGard to Customer on a strictly confidential basis and only for in-house use for the purpose of
allowing Customer to establish, maintain and implement business recovery and other plans and
procedures. Except with the prior written consent of SunGard, Customer will not, nor will it permit
any other entity or individual to (a) use any SunGard property for any purpose not authorized by
the Master Agreement, (b) refer to or otherwise use any
SunGard property as part of any effort to provide similar Services to any entity or individual, or
(c) remove, erase or tamper with any copyright or other proprietary notice of SunGard printed or
stamped on, affixed to, or encoded or recorded in any SunGard property.

6. OWNERSHIP

Neither party will gain by virtue of this Exhibit any rights of ownership of copyrights, patents,
trade secrets, trademarks or any other intellectual property rights owned by the other. SunGard
will retain exclusive ownership in all materials, documents, software or other programming
documentation created hereunder and will own all intellectual property rights, title and interest
in any ideas, concepts, know how, documentation or techniques developed under this Exhibit
(“Deliverables”). Customer will retain exclusive ownership in all of its data included in any
Deliverables. Except for any SunGard software products which shall be licensed separately, SunGard
grants Customer a non-exclusive, non-transferable, royalty-free right to use the Deliverables
solely for Customer’s internal use.

7. TERMINATION

Termination of the Consulting Services under a Schedule to this Exhibit for any reason will not
relieve Customer of liability for all fees payable and expenses incurred. If Customer unilaterally
decides it no longer requires the Consulting Services under a Schedule to this Exhibit, Customer
acknowledges and agrees to pay to SunGard, together with written notice of termination, an amount
equal to the present value (calculated using an annual discount rate equal to the then current
prime rate published in The Wall Street Journal) of all remaining fees due under the applicable
Schedule(s), and Customer shall remain liable for any reimbursable expenses incurred by SunGard
before termination. If Customer breaches any of its obligations under the Master Agreement in any
material respect, then, in addition to SunGard’s right to terminate the Master Agreement and any
other rights and remedies that SunGard may have, SunGard may suspend performance of all Consulting
Services under a Schedule to this Exhibit until the default is cured. If Customer breaches any of
its

 

material obligations and responsibilities under any Schedule to this Exhibit and/or related
Statement of Work and Customer’s breach is not cured within thirty (30) days after receiving
written notice from SunGard, SunGard may, at its election, (a) exercise any remedy for such breach
set forth elsewhere in the Master Agreement; (b) pursue any remedy available at law or in equity,
(c) terminate the Schedule to this Exhibit, and (d) suspend or discontinue Consulting Services or
performance under the applicable Schedule to this Exhibit.

8. MISCELLANEOUS

Customer will comply with the general obligations specified in the Master Agreement together with
any specific Customer obligations described in the Statement of Work, in a timely manner. Customer
acknowledges that SunGard’s ability to deliver the Consulting Services is dependent upon Customer’s
full and timely cooperation with SunGard, as well as the accuracy and completeness of any
information and data Customer provides to SunGard.

© 2009 SunGard Availability Services LP, all rights reserved

CSE0809

 

Addendum to the Master Agreement for U.S. Availability Services

Between

SunGard Availability Services LP and ATHENAHEALTH

Dated March 31, 2007

Page 1 of 1

The Master Agreement for U.S. Availability Services, having the above date, between SunGard
Availability Services LP (“SunGard”) and the Customer named below (“Master Agreement”) is amended
effective December 1, 2009, as follows:

Notwithstanding anything to the contrary, in consideration of Customer’s execution of the Master
Agreement and Schedule Number 3003703300 v. 1.0 for Managed IT Services and Schedule Number
3003735000 v. 1.0 for Consulting Services, all having a Commencement Date of December 1, 2009,
SunGard agrees to replace and supersede in its entirety the Master Agreement for U.S. Availability
Services having a Commencement Date of March 31, 2007, including all Schedules, Exhibits, Addenda
and Amendments thereto, except for Schedule Number 20448 v. 1.0 for Managed IT Services (including
any Addenda thereto) having a Commencement Date of July 1, 2007 which shall remain in effect from
December 1, 2009 through January 31, 2010 at its current monthly fee.

By the signatures of their duly authorized representatives below, SunGard and Customer, intending
to be legally bound, agree to all of the provisions of this Addendum and ratify the terms of the
Master Agreement.

	 	 	 	 	 	 	 	 	 	 	 
	SUNGARD AVAILABILITY SERVICES LP	 	 	 	CUSTOMER: ATHENAHEALTH, INC.	 	 
	 
	 	 	 	 	 	 	 	 	 	 
	By:

	 	/s/ Christopher Coleman
	 	 	 	By:
	 	/s/ Carl Byers	 	 
	 

	 	 
	 	 	 	 
	 	 	 	 
	 

	 	Print Name: Christopher Coleman
	 	 	 	 	 	Print Name: Carl B. Byers
	 	 
	 

	 	Print Title: Vice President
	 	 	 	 	 	Print Title: SVP & CFO
	 	 
	 
	 	 	 	 	 	 	 	 	 	 
	Date Signed: 12/4/09	 	 	 	Date Signed: December 1, 2009	 	 

			
	 	 	 
	
	 	QUOTE ID.:102519

THE TERMS OF THIS ADDENDUM ARE CONFIDENTIAL

 

Confidential Materials omitted and filed separately with the Securities and Exchange Commission. Asterisks denote omissions.

Schedule Number 3003735000 v. 1.0

For Consulting Services Governed by the

Master Agreement For U.S Availability Services

Between

SunGard Availability Services LP and ATHENAHEALTH

Dated December 1, 2009

Page 1 of 2

Schedule Effective Date: December 1, 2009

The following Services to be provided under this Schedule are described in the Statement of Work
(“SOW”) Tech Recovery and Test Development & LDRPS 10 Software Configuration dated 11/16/2009 (ID
30018) which is incorporated herein by reference and made a part hereof:

	Service #1	 	Tech Recovery Tests as described in the Tech Recovery and Test Development & LDRPS 10
Software Configuration for fixed fee of $ * , which is due and payable as follows.

	 	 	 	 	 	 	 	 	 	 	 	 	 
	# of Periods	 	 	 	Invoice	 	 	 	 	 	 
	to be billed	 	Frequency	 	Amount	 	 	Billing Commencement	 	Details	 
	12
	 	Quarterly	 	$	*	 	 	December 1, 2009	 	 	 	 

Reimbursable expenses (travel, lodging, food and incidental actual costs) will be billed on a
monthly basis as the expenses are incurred.

	Service #2 	 	Tech Recovery test Plan Dev as described in the Tech Recovery and Test Development
& LDRPS 10 Software Configuration for fixed fee of $ * , which is due and payable as follows.

	 	 	 	 	 	 	 	 	 	 	 	 	 
	# of Periods	 	 	 	Invoice	 	 	 	 	 	 
	to be billed	 	Frequency	 	Amount	 	 	Billing Commencement	 	Details	 
	1
	 	One-Time	 	$	*	 	 	One Month Following
Schedule Effective Date	 	 	 	 
	1
	 	One-Time	 	$	*	 	 	Two Months Following Schedule Effective Date	 	 	 	 
	1
	 	One-Time	 	$	*	 	 	Three Months Following Schedule Effective Date	 	 	 	 
	1
	 	One-Time	 	$	*	 	 	At Project Completion	 	 	 	 

Reimbursable expenses (travel, lodging, food and incidental actual costs) will be billed on a
monthly basis as the expenses are incurred.

	Service #3 	 	LDRPS 10 Software Config as described in the Tech Recovery and Test Development &
LDRPS 10 Software Configuration for fixed fee of $ * , which is due and payable as follows.

	 	 	 	 	 	 	 	 	 	 	 	 	 
	# of Periods	 	 	 	Invoice	 	 	 	 	 	 
	to be billed	 	Frequency	 	Amount	 	 	Billing Commencement	 	Details	 
	1
	 	One-Time	 	$	*	 	 	Upon Schedule Effective Date	 	 	 	 

Reimbursable expenses (travel, lodging, food and incidental actual costs) will be billed on a
monthly basis as the expenses are incurred.

By the signatures of their duly authorized representatives below, SunGard and Customer,
intending to be legally bound, agree to all of the provisions of this Schedule and ratify the terms
of the Master Agreement.

	 	 	 	 	 	 	 	 	 	 	 
	SunGard Availability Services LP	 	CUSTOMER: ATHENAHEALTH
	 
	 	 	 	 	 	 	 	 	 	 
	
By:
	 	/s/ Christopher Coleman	 	By:	 	/s/ Carl Byers 	 
	 

	 	Print Name:
	 	Christopher Coleman 	 	 	 	Print Name:	Carl Byers 	 
	 

	 	Print Title:
	 	Vice President 	 	 	 	Print Title:	SVP & CFO 	 
	Date Signed:      12/4/09
	 	Date Signed:      December 1, 2009
	 

			
	 
	
	 	DOC ID: 3003735000 VER. 1.0

ACCOUNT NUMBER: 64256 QUOTE ID: 102519

PRINTED: November 23, 2009 10:33:20 AM

THE TERMS OF THIS SCHEDULE ARE CONFIDENTIAL

 

 

Schedule Number 3003735000 v. 1.0

For Consulting Services Governed by the

Master Agreement For U.S Availability Services

Between

SunGard Availability Services LP and ATHENAHEALTH

Dated December 1, 2009

Page 2 of 2

This Schedule is not subject to auto-renewal.

CUSTOMER INFORMATION

	 	 	 
	BILL TO ADDRESS:

	 	311 ARSENAL STREET

WATERTOWN MA 02472

GEORGE SMITH
	 
	 	 
	NOTIFICATION ADDRESS:

	 	311 ARSENAL STREET

WATERTOWN MA 02472

GEORGE SMITH

			
	 
	
	 	DOC ID: 3003735000 VER. 1.0

ACCOUNT NUMBER: 64256 QUOTE ID: 102519

PRINTED: November 23, 2009 10:33:20 AM

THE TERMS OF THIS SCHEDULE ARE CONFIDENTIAL

Source: [{"source": "alea-institute/alea-institute/kl3m-data-edgar-agreements/train-00170-of-00352.parquet"}, [{"source": "alea-institute/alea-institute/kl3m-data-edgar-agreements/train-00170-of-00352.parquet"}]]