Document:

10.21 IndemnificationAgreement

INDEMNIFICATION AGREEMENT
This INDEMNIFICATION AGREEMENT, dated as of November 4, 2011 (the “Agreement”), is among Chiron Guernsey Holdings L.P. Inc., a Guernsey limited partnership (“Guernsey Parent LP”), Chiron Holdings GP, Inc., a Delaware corporation and the general partner of Guernsey Parent LP (“Guernsey Parent GP”), Chiron Guernsey L.P. Inc., a Guernsey limited partnership (“Guernsey Sub LP”), Chiron Guernsey GP Co. Limited, a Guernsey limited company and the general partner of Guernsey Sub LP (“Guernsey Sub GP”), Chiron Topco, Inc., a Delaware corporation and wholly-owned subsidiary of Guernsey Sub LP (“Topco”), Chiron Holdings, Inc., a Delaware corporation and wholly-owned subsidiary of Topco (“Parent”), Kinetic Concepts, Inc., a Texas corporation and wholly-owned subsidiary of Parent (the “Company” and, together with Guernsey Parent LP, Guernsey Parent GP, Guernsey Sub LP, Guernsey Sub GP, Topco and Parent, the “Company Entities”), and Apax Partners, L.P., CPPIB Equity Investments Inc. and Datura Private Investments Inc. (collectively, the “Managers” and each, a “Manager”).  Capitalized terms used herein without definition have the meanings set forth in Section 1 of this Agreement.
RECITALS
A.The Company, Parent, and Chiron Merger Sub, Inc., a Texas corporation and wholly-owned subsidiary of Parent (“Merger Sub”), entered into an Agreement and Plan of Merger, dated as of July 12, 2011 (as the same may be amended from time to time in accordance with its terms, the “Merger Agreement”), pursuant to which Merger Sub will be merged with and into the Company with the Company as the surviving corporation (the “Merger”).
B.    In connection with the Merger, certain Affiliates and entities advised by the Managers (such persons, the “Investors”) have entered into equity commitment letters with Parent, pursuant to which they have agreed to contribute or cause to be contributed cash equity investments in Parent.
C.    The Investors or their Affiliates, along with certain co-investors and certain other persons, have entered into an Amended and Restated Limited Partnership Agreement of Guernsey Parent LP (as the same may be amended from time to time in accordance with the terms thereof, the “Partnership Agreement”), dated as of the date hereof, setting forth certain agreements with respect to, among other things, the management of Guernsey Parent LP and transfers of its limited partnership units in various circumstances.
D.    In order to finance the Merger and related transactions, certain of the Managers and Affiliates of the Managers have assisted Guernsey Parent LP in arranging to sell limited partnership units to the Investors (or their Affiliates) and certain co-investors, including such other limited partners of Guernsey Parent LP as are listed on the signature pages to the Partnership Agreement (the “Equity Offering”).
E.    In order to finance the Merger, the Company has (1) entered into senior secured credit facilities and (1) issued notes (the “Notes Offering”) (collectively, together with the repayment (via tender, conversion or otherwise) of any existing indebtedness of the Company and its Subsidiaries, the “Financings”), which Financings have been facilitated and arranged with the assistance of certain of the Managers.
F.    Members of the Company Group from time to time in the future may (1) offer and sell, or cause to be offered and sold, equity or debt securities (such offerings, collectively, the “Subsequent Offerings”), including (a) offerings of shares of equity interests of a member of the Company Group, and/or options to purchase such equity interests, to employees, directors and consultants of and to a member of the Company Group (any such offering, a “Management Offering”) and (b) one or more offerings of debt securities for the purpose of refinancing any indebtedness of a member of the Company Group or for other purposes and (1) repurchase, redeem or otherwise acquire certain securities of a member of the Company Group or engage in recapitalization or structural reorganization transactions relating thereto (any such repurchase, redemption, acquisition, 

recapitalization or reorganization, a “Redemption”), in each case subject to the terms and conditions of the Organizational Documents and any other applicable agreement, which offerings and/or Redemptions are expected to be arranged and facilitated with the assistance of certain of the Managers or Affiliates thereof as provided herein and pursuant to the terms of those certain letter agreement between the Company and Apax Partners, L.P., CPPIB Equity Investments Inc. and Datura Private Investments Inc., respectively, dated as of the date hereof (collectively, the “Material Event Services Agreement”).
G.    The parties hereto recognize the possibility that claims might be made against and liabilities incurred by the Investor Parties or their respective related Persons or Affiliates, under applicable securities laws or otherwise in connection with the Transactions or the Securities Offerings, or relating to other actions or omissions of or by members of the Company Group or their Agents, or relating to the provision of financial advisory, investment banking, syndication and consulting services (the “Transaction Services”) to members of the Company Group by the Managers, including under those certain letter agreements between Topco and Apax Partners, L.P., CPPIB Equity Investments Inc. and Datura Private Investments Inc., respectively, dated as of the date hereof (collectively, the “Services Agreement”), and the parties hereto accordingly wish to provide for the Investor Parties and their respective related Persons and Affiliates to be indemnified in respect of any such claims and liabilities.
H.    The parties hereto recognize that claims might be made against and liabilities incurred by directors, officers and managers of any member of the Company Group in connection with their acting in their respective capacities, and accordingly wish to provide for such directors, officers and managers to be indemnified to the fullest extent permitted by law in respect of any such claims and liabilities.
I.    The parties hereto recognize that the Company Group benefits from the services provided by each Investor Party and the ability of each Investor Party to share internally portfolio company information.  Each of Guernsey Parent LP and the Company has therefore consented to the Investor Directors sharing any information such Investor Directors receive from any member of the Company Group with officers, directors, members, employees and representatives of the Managers and their respective Affiliates (other than other portfolio companies of the investment funds managed by the Managers or their Affiliates) and to the internal use by the Managers and such Affiliates of any information received from any member of the Company Group, subject, however, to the Managers maintaining adequate procedures to prevent such information from being used in connection with the purchase or sale of securities of members of the Company Group in violation of applicable law.
NOW, THEREFORE, in consideration of the foregoing premises, and the mutual agreements and covenants and provisions herein set forth, the parties hereto hereby agree as follows:
1.Definitions.
“Affiliate” means, with respect to any Person, (1) any other Person directly or indirectly Controlling, Controlled by or under common Control with, such Person, (1) any Person directly or indirectly owning or Controlling 10% or more of any class of outstanding voting securities of such Person, (1) any other Person directly or indirectly advising, advised by or under common advisement with, such Person or (1) any officer, director, general partner, limited partner or trustee of any such Person described in clause (i) or (ii).
“Agent” means present or past representatives, attorneys, financial or investment advisors, consultants, accountants, investment bankers, commercial bankers, engineers, advisors or other agents.
“Agreement” has the meaning set forth in the preamble.

“Change in Control” means (1) the sale of all or substantially all of the assets of Guernsey Parent LP, Guernsey Sub LP, Topco, Parent or the Company, as applicable, to any Person (or group of Persons acting in concert), other than to (x) the Investors or their Affiliates or (y) any employee benefit plan (or trust forming a part thereof) maintained by Guernsey Parent LP, Guernsey Sub LP, Topco, Parent, the Company or their respective Affiliates or other Person of which a majority of its voting power or other equity securities is owned, directly or indirectly, by Guernsey Parent LP, Guernsey Sub LP, Topco or Parent; (1) a merger, recapitalization or other sale by Guernsey Parent LP, or the Investors or any of their respective Affiliates (which includes for the avoidance of doubt Guernsey Sub LP, Topco, Parent and the Company), to a Person (or group of Persons acting in concert) of equity interests or voting power that results in any Person (or group of Persons acting in concert) (other than (x) the Investors or their Affiliates or (y) any employee benefit plan (or trust forming a part thereof) maintained by Guernsey Parent LP, Guernsey Sub LP, Topco, Parent, the Company or their respective Affiliates or other Person of which a majority of its voting power or other equity securities is owned, directly or indirectly, by Guernsey Parent LP, Guernsey Sub LP, Topco or Parent) owning more than 50% of the equity interests or voting power of Guernsey Parent LP (or any resulting company after the merger), Guernsey Sub LP, Topco, Parent or the Company, as applicable, or (1) any similar event which results in the Investors or their Affiliates ceasing to hold the ability to elect a majority of the members of the board of directors of Guernsey Parent GP.
“Claim” means, with respect to any Indemnitee, any claim by or against such Indemnitee involving any Obligation with respect to which such Indemnitee may be entitled to be indemnified by any member of the Company Group under this Agreement.
“Commission” means the United States Securities and Exchange Commission or any successor entity thereto.
“Company” has the meaning set forth in the preamble.
“Company Director Indemnity” means any services, stockholder, indemnification or other agreement the Investor Directors have entered into with any member of the Company Group providing for indemnification and for advancement of expenses for the Investor Directors in connection with their service as a director, manager or member of any member of the Company Group, and the Investor Directors may, in their capacities as directors, managers or members of any member of the Company Group, be indemnified and/or entitled to advancement of expenses under the certificate or articles of incorporation, bylaws, limited liability company operating agreement, limited partnership agreement, any other organizational documents of, or any policies of insurance procured by, the applicable member of the Company Group.
“Company Entities” has the meaning set forth in the preamble.
“Company Group” means Guernsey Parent LP, Guernsey Sub LP, Topco, Parent, the Company and any of their respective Subsidiaries or Affiliates (other than the Managers and their respective Affiliates to the extent such entities are Affiliates of Guernsey Parent LP, the Company or any of their respective Subsidiaries or Affiliates as a result of an investment in Guernsey Parent LP, the Company or any of their respective Subsidiaries).
“Control”, including the correlative terms “Controlling”, “Controlled by” and “under common Control with”, of any Person shall consist of the power to direct the management and policies of such Person (whether through the ownership of voting securities, by contract, as trustee or executor, or otherwise).
“Equity Offering” has the meaning set forth in the recitals.
“Exchange Act” means the Securities Exchange Act of 1934, as amended, and the rules and regulations promulgated thereunder.

“Expenses” means all attorneys’ fees, disbursements and expenses, retainers, court, arbitration and mediation costs, transcript costs, fees of experts, bonds, witness fees, costs of collecting and producing documents, travel expenses, duplicating costs, printing and binding costs, telephone charges, postage, delivery service fees and all other disbursements or expenses of the types customarily incurred in connection with prosecuting, defending, preparing to prosecute or defend, investigating, being or preparing to be a witness in, appealing or otherwise participating in a Proceeding.
“Financings” has the meaning set forth in the recitals.
“Guernsey Parent GP” has the meaning set forth in the preamble.
“Guernsey Parent LP” has the meaning set forth in the preamble.
“Guernsey Sub GP” has the meaning set forth in the preamble.
“Guernsey Sub LP” has the meaning set forth in the preamble.
“Indemnifying Party” has the meaning set forth in Section 2(a).
“Indemnitee” means each of the Investor Parties and their respective Affiliates (other than the members of the Company Group), their respective successors and assigns, and each of the Investor Parties’ and their respective Affiliates’ (including the members of the Company Group) directors, officers, managers, partners, members, employees, agents, advisors, consultants, representatives and Controlling Persons of each of them, or of their partners, members and Controlling Persons, and each other Person who is or becomes a director, officer or manager of any member of the Company Group, in each case irrespective of the capacity in which such Person acts.
“Investor Directors” means executives of the Managers or their respective Affiliates who serve as directors, managers or members of any member of the Company Group, and other Persons (who are not executives of the Managers or their respective Affiliates) who serve as directors, managers or members of any member of the Company Group as an appointee or designee of any Investor Party.
“Investor Indemnification Agreements” means one or more certificate or articles of incorporation, bylaws, limited liability company operating agreement, limited partnership agreement and any other organizational document, and insurance policies maintained by each of the Investor Parties providing for, among other things, indemnification of and advancement of expenses for the Investor Directors for, among other things, the same matters that are subject to indemnification and advancement of expenses under this Agreement, any Related Document and the Company Director Indemnity.
“Investor Indemnitors” means the Investor Parties and/or their respective Affiliates and Controlling Persons, in their capacity as indemnitors to the Investor Directors under the Investor Indemnification Agreements.
“Investor Parties” means the Managers and their respective Affiliates (excluding, for purposes of this Agreement, any portfolio companies of the investment funds advised by the Managers or their Affiliates unrelated to the operations of the Company).
“Investors” has the meaning set forth in the recitals.
“Management Offering” has the meaning set forth in the recitals.
“Managers” has the meaning set forth in the preamble.
“Material Event Services Agreement” has the meaning set forth in the recitals.

“Merger” has the meaning set forth in the recitals.
“Merger Agreement” has the meaning set forth in the recitals.
“Merger Sub” has the meaning set forth in the recitals.
“New York Court” has the meaning set forth in Section 7.
“Notes Offering” has the meaning set forth in the recitals.
“Notice of Advances” has the meaning set forth in Section 4(b).
“Notice of Claim” has the meaning set forth in Section 4(a).
“Notice of Payment” has the meaning set forth in Section 4(c).
“Obligations” means, collectively, any and all claims, obligations, liabilities, causes of actions, Proceedings, investigations, judgments, decrees, losses, damages (including punitive and exemplary damages), fees, fines, penalties, amounts paid in settlement, costs and Expenses (including interest, assessments and other charges in connection therewith and disbursements of attorneys, accountants, investment bankers and other professional advisors), in each case whether incurred, arising or existing with respect to third parties or otherwise at any time or from time to time.
“Organizational Documents” means the certificate of incorporation and bylaws, limited liability company agreement, limited partnership agreement or other organizational documents of similar substance and purpose, as may be amended from time to time in accordance with the terms thereof, of any member of the Company Group.
“Parent” has the meaning set forth in the preamble.
“Partnership Agreement” has the meaning set forth in the recitals.
“Person” means an individual, corporation, limited liability company, limited or general partnership, trust or other entity, including a governmental or political subdivision or an agency or instrumentality thereof.
“Proceeding” means a threatened, pending or completed action, suit or proceeding, whether civil, criminal, administrative or investigative, including a claim, demand, discovery request, formal or informal investigation, inquiry, administrative hearing, arbitration or other form of alternative dispute resolution, including an appeal from any of the foregoing.
“Redemption” has the meaning set forth in the recitals.
“Related Document” means any agreement, certificate, instrument or other document to which any member of the Company Group may be a party or by which it or any of its properties or assets may be bound or affected from time to time relating in any way to the Transactions or any Securities Offering or any of the transactions contemplated thereby, including, in each case as the same may be amended from time to time, (1) any registration statement filed by or on behalf of any member of the Company Group with the Commission in connection with the Transactions or any Securities Offering, including all exhibits, financial statements and schedules appended thereto, and any submissions to the Commission in connection therewith, (1) any prospectus, preliminary, free-writing or otherwise, included in such registration statements or otherwise filed by or on behalf of any member of the Company Group in connection with the Transactions or any Securities Offering or used to offer or confirm sales of their respective securities in any Securities Offering, (1) any private placement or offering memorandum or circular, information statement or other information or materials distributed by or on behalf of any member of the Company Group or any placement agent or underwriter in connection with the 

Transactions or any Securities Offering, (1) any federal, state or foreign securities law or other governmental or regulatory filings or applications made in connection with any Securities Offering, the Transactions or any of the transactions contemplated thereby, (1) any dealer-manager, underwriting, subscription, purchase, stockholders, option or registration rights agreement or plan entered into or adopted by any member of the Company Group in connection with any Securities Offering, (1) any purchase, repurchase, redemption, recapitalization or reorganization or other agreement entered into by any member of the Company Group in connection with any Redemption or (1) any quarterly, annual or current reports or other filing filed, furnished or supplementally provided by any member of the Company Group with or to the Commission or any securities exchange, including all exhibits, financial statements and schedules appended thereto, and any submission to the Commission or any securities exchange in connection therewith.
“Securities Act” means the Securities Act of 1933, as amended, and the rules and regulations promulgated thereunder.
“Securities Offerings” means the Equity Offering, the Notes Offering, any Management Offering, and any Subsequent Offering.
“Services Agreement” has the meaning set forth in the recitals.
“Subsequent Offerings” has the meaning set forth in the recitals.
“Subsidiary” means each corporation or other Person in which a Person owns or Controls, directly or indirectly, capital stock or other equity interests representing more than 50% of the outstanding voting stock or other equity interests.
“Topco” has the meaning set forth in the preamble.
“Transactions” means the Merger, the Equity Offering, the Financings and transactions for which Transaction Services are provided.
“Transaction Services” has the meaning set forth in the recitals.
“Unpaid Director Indemnity Amounts” means the amount that the Indemnifying Party fails to indemnify or advance to an Investor Director as required or contemplated by this Agreement, any Related Document or any Company Director Indemnity.
2.    Indemnification.
(a)    Each of the Company Entities (each an “Indemnifying Party” and collectively the “Indemnifying Parties”), jointly and severally, agrees to indemnify, defend and hold harmless each Indemnitee:
(i)    from and against any and all Obligations, whether incurred by such Indemnitee with respect to third parties or otherwise, in any way resulting from, arising out of or in connection with, based upon or relating to (A) the Securities Act, the Exchange Act or any other applicable securities or other laws, in connection with any Securities Offering, the Financings, any Related Document or any of the transactions contemplated thereby, (B) any other action or failure to act by any member of the Company Group (or any of their Agents) or any of their predecessors, whether such action or failure has occurred or is yet to occur or any obligation of any member of the Company Group or any of their predecessors or any such Agent or (C) the performance by the Managers or any of their respective Affiliates of Transaction Services for any member of the Company Group (whether performed prior to the date hereof, hereafter, pursuant to the Services Agreement, the Material Event Services Agreement or otherwise);

(ii)    to the fullest extent permitted by the law specified herein as governing this Agreement, by the law of the place of organization of an Indemnifying Party, or by any other applicable law in effect as of the date hereof or as amended to increase the scope of permitted indemnification, whichever is greater (except, with respect to any Indemnifying Party, to the extent that such indemnification may be prohibited by the law of the place of organization of such Indemnifying Party), from and against any and all Obligations whether incurred with respect to third parties or otherwise, in any way resulting from, arising out of or in connection with, based upon or relating to (A) the fact that such Indemnitee is or was a director, officer or manager of any member of the Company Group or is or was serving at the request of such entity as a director, officer, manager, member, employee or agent of or advisor or consultant to another corporation, partnership, joint venture, trust or other enterprise or (B) any breach or alleged breach by such Indemnitee of his or her fiduciary duty as a director, officer or manager of any member of the Company Group; and
(iii)    to the fullest extent permitted by the law specified herein as governing this Agreement, by the law of the place of organization of an Indemnifying Party, or by any other applicable law in effect as of the date hereof or as amended to increase the scope of permitted indemnification, whichever is greater (except, with respect to any Indemnifying Party, to the extent that such indemnification may be prohibited by the law of the place of organization of such Indemnifying Party), who was or is a party, or is threatened to be made a party, to any Proceeding (including (x) any action by or in the right of, or relating to, the Company Group and (y) any past, current or future litigation relating to the Transactions or its equity ownership in the Company Group), by reason of any actions or omissions or alleged acts or omissions arising out of such Indemnitee’s activities either on behalf of the Company Group or in furtherance of the interests of the Company Group or arising out of or in connection with the purchase and/or ownership of equity interests in the Company Group or any involvement in the Transactions, from and against any and all Obligations; provided, that such Indemnitee was not guilty of fraud, a willful breach of this Agreement or a willful illegal act;
in each case including any and all fees, costs and Expenses (including fees and disbursements of attorneys and other professional advisers) incurred by or on behalf of any Indemnitee in asserting, exercising or enforcing any of its rights, powers, privileges or remedies in respect of this Agreement, the Services Agreement, the Material Event Services Agreement or any Related Document.
(b)    Without in any way limiting the foregoing Section 2(a), each of the Indemnifying Parties agrees, jointly and severally, to indemnify, defend and hold harmless each Indemnitee from and against any and all Obligations resulting from, arising out of or in connection with, based upon or relating to liabilities under the Securities Act, the Exchange Act or any other applicable securities or other laws, rules or regulations in connection with (1) the inaccuracy or breach of or default under any representation, warranty, covenant or agreement in any Related Document, (1) any untrue statement or alleged untrue statement of a material fact contained in any Related Document or (1) any omission or alleged omission to state in any Related Document a material fact required to be stated therein or necessary to make the statements therein not misleading.  Notwithstanding the foregoing, the Indemnifying Parties shall not be obligated to indemnify such Indemnitee from and against any such Obligation to the extent that such Obligation arises out of or is based upon an untrue statement or omission made in such Related Document in reliance upon and in conformity with written information furnished to the Indemnifying Parties, as the case may be, in an instrument duly executed by such Indemnitee and specifically stating that it is for use in the preparation of such Related Document.
(c)    Without limiting the foregoing, in the event that any Proceeding is initiated by an Indemnitee or any member of the Company Group to enforce or interpret this Agreement or any rights of such Indemnitee to indemnification or advancement of expenses (or related Obligations of such Indemnitee) under any member of the Company Group’s certificate of incorporation or bylaws (or similar organizational documents), any other agreement to which such Indemnitee and any member of the Company Group are party, any vote of directors of 

any member of the Company Group, the law of incorporation or formation of any member of the Company Group or any other applicable law or any liability insurance policy, the Indemnifying Parties shall indemnify such Indemnitee against all costs and Expenses incurred by such Indemnitee or on such Indemnitee’s behalf in connection with such Proceeding, whether or not such Indemnitee is successful in such Proceeding, except to the extent that the court presiding over such Proceeding determines that material assertions made by such Indemnitee in such proceeding were in bad faith.
(d)    (i)    Each of the Company Entities acknowledges and agrees that the obligations of the Indemnifying Parties under this Agreement, any Related Document or any Company Director Indemnity to indemnify or advance expenses to any Investor Director for the matters covered thereby shall be the primary source of indemnification and advancement of such Investor Director in connection therewith, and any obligation on the part of any Investor Indemnitor under any Investor Indemnification Agreement to indemnify or advance expenses to such Investor Director shall be secondary to the Indemnifying Party’s obligation and shall be reduced by any amount that the Investor Director may collect as indemnification or advancement from the Indemnifying Party.  In the event that the Indemnifying Party fails to indemnify or advance expenses to an Investor Director as required or contemplated by this Agreement, any Related Document or any Company Director Indemnity, and any Investor Indemnitor makes any payment to such Investor Director in respect of indemnification or advancement of expenses under any Investor Indemnification Agreement on account of such Unpaid Director Indemnity Amounts, such Investor Indemnitor shall be subrogated to the rights of such Investor Director under this Agreement, any Related Document or any Company Director Indemnity, as the case may be, in respect of such Unpaid Director Indemnity Amounts.
(ii)    Each of the Company Entities, each as an Indemnifying Party from time to time, agrees that, to the fullest extent permitted by applicable law (A) its obligation to indemnify any Indemnitee under this Agreement, any Related Documents or any Company Director Indemnity shall include any amounts expended by any Investor Indemnitor under the Investor Indemnification Agreements in respect of indemnification or advancement of expenses to any Investor Director in connection with litigation or other proceedings involving his or her service as a director of any member of the Company Group to the extent such amounts expended by such Investor Indemnitor are on account of any Unpaid Director Indemnity Amounts and (B) it shall not be entitled to contribution or indemnification from, or subrogation against, any Investor Indemnitor in respect of amounts expended by it to indemnify or advance expenses to any Investor Director under this Agreement, any Related Documents or any Company Director Indemnity.
(e)    The rights, indemnities and remedies herein provided are cumulative and are not exclusive of any rights, indemnities or remedies that any party or other Indemnitee may otherwise have by contract, at law or in equity or otherwise, provided that 1) to the extent that any Indemnitee is entitled to be indemnified by any member of the Company Group and by any other Indemnitee or any insurer under a policy procured by any Indemnitee, the obligations of such member of the Company Group hereunder shall be primary and the obligations of such other Indemnitee or insurer secondary and 1) none of the members of the Company Group shall be entitled to contribution or indemnification from or subrogation against such other Indemnitee or insurer.
(f)    To the extent that any other agreement or undertaking of any Indemnifying Party or other Person seeking to provide indemnification to any Indemnitee is inconsistent with the terms of this Agreement, the agreement or undertaking that provides the broader indemnification protection to the Indemnitee shall govern.
3.    Contribution.
(a)    If for any reason the indemnity provided for in Section 2(a) is unavailable or is insufficient to hold harmless any Indemnitee from any of the Obligations covered by such indemnity, then the Indemnifying Parties, jointly and severally, shall contribute to the amount paid or payable by such Indemnitee as a result of such 

Obligation in such proportion as is appropriate to reflect 1) the relative fault of each member of the Company Group and their Agents, on the one hand, and such Indemnitee, on the other, in connection with the state of facts giving rise to such Obligation, 1) if such Obligation results from, arises out of, is based upon or relates to any Transaction or any Securities Offering, the relative benefits received by each member of the Company Group and their Agents, on the one hand, and such Indemnitee, on the other, from such Transaction or Securities Offering and 1) if required by applicable law, any other relevant equitable considerations.
(b)    If for any reason the indemnity specifically provided for in Section 2(b) is unavailable or is insufficient to hold harmless any Indemnitee from any of the Obligations covered by such indemnity, then the Indemnifying Parties, jointly and severally, shall contribute to the amount paid or payable by such Indemnitee as a result of such Obligation in such proportion as is appropriate to reflect 1) the relative fault of each of the members of the Company Group and their Agents, on the one hand, and such Indemnitee, on the other, in connection with the information contained in or omitted from any Related Document, which inclusion or omission resulted in the inaccuracy or breach of or default under any representation, warranty, covenant or agreement therein, or which information is or is alleged to be untrue, required to be stated therein or necessary to make the statements therein not misleading, 1) the relative benefits received by the members of the Company Group and their Agents, on the one hand, and such Indemnitee, on the other, from the Transactions or Securities Offering and 1) if required by applicable law, any other relevant equitable considerations.
(c)    For purposes of Section 3(a), the relative fault of each member of the Company Group and their Agents, on the one hand, and of an Indemnitee, on the other, shall be determined by reference to, among other things, their respective relative intent, knowledge, access to information and opportunity to correct the state of facts giving rise to such Obligation.  For purposes of Section 3(b), the relative fault of each of the members of the Company Group and their Agents, on the one hand, and of an Indemnitee, on the other, shall be determined by reference to, among other things, 1) whether the included or omitted information relates to information supplied by the members of the Company Group and their Agents, on the one hand, or by such Indemnitee, on the other, 1) their respective relative intent, knowledge, access to information and opportunity to correct such inaccuracy, breach, default, untrue or alleged untrue statement, or omission or alleged omission and  applicable law.  For purposes of Section 3(a) or 3(b), the relative benefits received by each member of the Company Group and their Agents, on the one hand, and an Indemnitee, on the other, shall be determined by weighing the direct monetary proceeds to the Company Group, on the one hand, and such Indemnitee, on the other, from the Transactions or Securities Offering.
(d)    The parties hereto acknowledge and agree that it would not be just and equitable if contributions pursuant to Section 3(a) or 3(b) were determined by pro rata allocation or by any other method of allocation that does not take into account the equitable considerations referred to in such respective Sections.  No Indemnifying Party shall be liable under Section 3(a) or 3(b), as applicable, for contribution to the amount paid or payable by any Indemnitee except to the extent and under such circumstances such Indemnifying Party would have been liable to indemnify, defend and hold harmless such Indemnitee under the corresponding Section 2(a) or 2(b), as applicable, if such indemnity were enforceable under applicable law.  No Indemnitee shall be entitled to contribution from any Indemnifying Party with respect to any Obligation covered by the indemnity specifically provided for in Section 2(b) in the event that such Indemnitee is finally determined to be guilty of fraudulent misrepresentation (within the meaning of Section 11(f) of the Securities Act) in connection with such Obligation and the Indemnifying Parties are not guilty of such fraudulent misrepresentation.
4.    Indemnification Procedures.
(a)    Whenever any Indemnitee shall have actual knowledge of the assertion of a Claim against it, such Indemnitee shall notify the appropriate member of the Company Group in writing of the Claim (the “Notice of Claim”) with reasonable promptness after such Indemnitee has such knowledge relating to such Claim; provided the failure or delay of such Indemnitee to give such Notice of Claim shall not relieve any Indemnifying Party of 

its indemnification obligations under this Agreement except to the extent that such omission results in a failure of actual notice to it and it is materially injured as a result of the failure to give such Notice of Claim.  The Notice of Claim shall specify all material facts known to such Indemnitee relating to such Claim and the monetary amount or an estimate of the monetary amount of the Obligation involved if such Indemnitee has knowledge of such amount or a reasonable basis for making such an estimate.  The Indemnifying Parties shall, at their expense, undertake the defense of such Claim with attorneys of their own choosing reasonably satisfactory in all respects to such Indemnitee, subject to the right of such Indemnitee to undertake such defense as hereinafter provided.  An Indemnitee may participate in such defense with counsel of such Indemnitee’s choosing at the expense of the Indemnifying Parties.  In the event that the Indemnifying Parties do not undertake the defense of the Claim within a reasonable time after such Indemnitee has given the Notice of Claim, or in the event that such Indemnitee shall in good faith determine that the defense of any claim by the Indemnifying Parties is inadequate or may conflict with the interest of any Indemnitee (including Claims brought by or on behalf of any member of the Company Group), such Indemnitee may, at the expense of the Indemnifying Parties and after giving notice to the Indemnifying Parties of such action, undertake the defense of the Claim and compromise or settle the Claim, all for the account of and at the risk of the Indemnifying Parties.  In the defense of any Claim against an Indemnitee, no Indemnifying Party shall, except with the prior written consent of such Indemnitee, consent to entry of any judgment or enter into any settlement that includes any injunctive or other non-monetary relief or any payment of money by such Indemnitee, or that does not include as an unconditional term thereof the giving by the Person or Persons asserting such Claim to such Indemnitee of an unconditional release from all liability on any of the matters that are the subject of such Claim and an acknowledgement that such Indemnitee denies all wrongdoing in connection with such matters.  The Indemnifying Parties shall not be obligated to indemnify an Indemnitee against amounts paid in settlement of a Claim if such settlement is effected by such Indemnitee without the prior written consent of Guernsey Parent LP (on behalf of all Indemnifying Parties), which shall not be unreasonably withheld.  In each case, each Indemnitee seeking indemnification hereunder will cooperate with the Indemnifying Parties, so long as an Indemnifying Party is conducting the defense of the Claim, in the preparation for and the prosecution of the defense of such Claim, including making available evidence within the control of such Indemnitee, as the case may be, and persons needed as witnesses who are employed by such Indemnitee, as the case may be, in each case as reasonably needed for such defense and at cost, which cost, to the extent reasonably incurred, shall be paid by the Indemnifying Parties.
(b)    An Indemnitee shall notify the Indemnifying Parties in writing of the amount requested for advances (“Notice of Advances”).  The Indemnifying Parties hereby agree to advance reasonable costs and Expenses incurred by any Indemnitee in connection with any Claim (but not for any Claim initiated or brought voluntarily by an Indemnitee other than a Proceeding pursuant to Section 2(c)) in advance of the final disposition of such Claim without regard to whether such Indemnitee will ultimately be entitled to be indemnified for such costs and expenses upon receipt of an undertaking by or on behalf of such Indemnitee to repay amounts so advanced if it shall ultimately be determined in a decision of a court of competent jurisdiction from which no appeal can be taken that such Indemnitee is not entitled to be indemnified by the Indemnifying Parties as authorized by this Agreement.  The Indemnifying Parties shall make payment of such advances no later than 10 days after the receipt of the Notice of Advances.
(c)    An Indemnitee shall notify the Indemnifying Parties in writing of the amount of any Claim actually paid by such Indemnitee (the “Notice of Payment”).  The amount of any Claim actually paid by such Indemnitee shall bear simple interest at the rate equal to the JPMorgan Chase Bank, N.A. prime rate as of the date of such payment plus 2% per annum, from the date the Indemnifying Parties receive the Notice of Payment to the date on which any Indemnifying Party shall repay the amount of such Claim plus interest thereon to such Indemnitee.  The Indemnifying Parties shall make indemnification payments to such Indemnitee no later than 30 days after receipt of the Notice of Payment.
(d)    Independent Legal Counsel.  If there has not been a Change in Control, independent legal counsel shall be selected by Guersney Parent LP and approved by such Indemnitee (which approval shall not be 

unreasonably withheld or delayed).  If there has been a Change in Control, independent legal counsel shall be selected by such Indemnitee and approved by Guernsey Parent LP (which approval shall not be unreasonably withheld or delayed).  The Indemnifying Parties shall pay the fees and expenses of such independent legal counsel and indemnify such independent legal counsel against any and all Expenses, claims, liabilities and damages arising out of or relating to its engagement.
5.    Certain Covenants.
(a)    The rights of each Indemnitee to be indemnified under any other agreement, document, certificate or instrument or applicable law are independent of and in addition to any rights of such Indemnitee to be indemnified under this Agreement and, to the extent applicable, subject to Section 2(d).  The rights of each Indemnitee and the obligations of the Indemnifying Parties hereunder shall remain in full force and effect regardless of any investigation made by or on behalf of such Indemnitee.  Following the Transactions, each of the Company Entities, and each of their corporate successors, shall implement and maintain in full force and effect any and all corporate charter and bylaw (or similar organizational document) provisions that may be necessary or appropriate to enable it to carry out its obligations hereunder to the fullest extent permitted by applicable law, including a provision of its certificate of incorporation (or similar organizational document) eliminating liability of a director for breach of fiduciary duty to the fullest extent permitted by applicable law, as amended from time to time.  So long as any member of the Company Group maintains liability insurance for any directors, officers, employees or agents of any such Person, the Indemnifying Parties shall ensure that each Indemnitee serving in such capacity is covered by such insurance in such a manner as to provide such Indemnitee the same rights and benefits as are accorded to the most favorably insured of the Company Group’s then current directors and officers.
(b)    The Company hereby agrees that it will not amend any Company Director Indemnity as in effect on the date hereof to alter the rights of any Investor Director in any manner that would alter any Investor Director’s rights with respect to conduct pre-dating the date of any such amendment without the consent of the Managers.
6.    Notices.  All notices and other communications hereunder shall be in writing and shall be delivered by certified or registered mail (first class postage prepaid and return receipt requested), facsimile, overnight courier or hand delivery, as follows:
(a)    If to Guernsey Parent LP, Guernsey Parent GP, Guernsey Sub LP, Guernsey Sub GP, Topco and/or Parent, to:
c/o Apax Partners, L.P. 
601 Lexington Avenue, 53rd Floor 
New York, New York  10022 
Attention:  Buddy Gumina 
Facsimile:  (646) 349-3306
c/o Canada Pension Plan Investment Board 
One Queen Street East, Suite 2600 
P.O. Box 101 
Toronto, Ontario  M5C 2W5 
Attention:  Erik Levy 
Facsimile:  (416) 868-8684
c/o Public Sector Pension Investment Board 
1250 René-Lévesque Blvd. West, Suite 900 
Montréal, Québec  H3B 4W8 

Attention:      First Vice President and Chief Legal Officer 
Facsimile:  (514) 937-0403
c/o Kinetic Concepts, Inc. 
8023 Vantage Drive 
San Antonio, Texas 78230 
Attention:  John T. Bibb 
Facsimile:  (210) 255-6990
with an additional copy (which shall not constitute notice) to:
Simpson Thacher & Bartlett LLP 
425 Lexington Avenue 
New York, New York  10017 
Attention:  Ryerson Symons, Esq. 
Facsimile:  (212) 455-2502
(b)    If to any other member of the Company Group:
Kinetic Concepts, Inc. 
8023 Vantage Drive 
San Antonio, Texas 78230 
Attention:  John T. Bibb 
Facsimile:  (210) 255-6990
with an additional copy (which shall not constitute notice) to:
Simpson Thacher & Bartlett LLP 
425 Lexington Avenue 
New York, New York  10017 
Attention:  Ryerson Symons, Esq. 
Facsimile:  (212) 455-2502
(c)    If to the Managers, as applicable, to:
Apax Partners, L.P. 
601 Lexington Avenue, 53rd Floor 
New York, New York  10022 
Attention:  Buddy Gumina 
Facsimile:  (646) 349-3306
or
CPPIB Equity Investments Inc. 
c/o Canada Pension Plan Investment Board 
One Queen Street East, Suite 2600 
P.O. Box 101 
Toronto, Ontario  M5C 2W5 
Attention:  Erik Levy 
Facsimile:  (416) 868-8684
or

Datura Private Investments Inc.
c/o Public Sector Pension Investment Board 
1250 René-Lévesque Blvd. West, Suite 900 
Montréal, Québec  H3B 4W8 
Attention:      First Vice President and Chief Legal Officer 
Facsimile:  (514) 937-0403
with a copy (which shall not constitute notice) to:
Simpson Thacher & Bartlett LLP 
425 Lexington Avenue 
New York, New York  10017 
Attention:  Ryerson Symons, Esq. 
Facsimile:  (212) 455-2502
or to such other address or such other person as the Company Entities or the applicable Manager shall have designated by notice to the other parties hereto.  All communications hereunder shall be effective upon receipt by the party to which they are addressed.
7.    Governing Law; Jurisdiction, Waiver of Jury Trial.  This Agreement shall be governed in all respects, including validity, interpretation and effect, by the law of the State of New York, regardless of the law that might be applied under principles of conflict of laws to the extent such principles would require or permit the application of the laws of another jurisdiction.  Each of the parties hereto irrevocably and unconditionally 1) agrees that any legal suit, action or proceeding brought by any party hereto arising out of or based upon this Agreement or the transactions contemplated hereby may be brought in any court of the State of New York or Federal District Court for the Southern District of New York located in the City, County and State of New York (each, a “New York Court”), 1) waives, to the fullest extent that it may effectively do so, any objection that it may now or hereafter have to the laying of venue of any such proceeding brought in a New York Court, and any claim that any such action or proceeding brought in a New York Court has been brought in an inconvenient forum, 1) submits to the non-exclusive jurisdiction of any New York Court in any suit, action or proceeding and 1) ACKNOWLEDGES AND AGREES THAT ANY CONTROVERSY THAT MAY ARISE UNDER THIS AGREEMENT IS LIKELY TO INVOLVE COMPLICATED AND DIFFICULT ISSUES, AND THEREFORE HEREBY WAIVES ANY RIGHT THAT SUCH PARTY MAY HAVE TO A TRIAL BY JURY IN RESPECT OF ANY LITIGATION DIRECTLY OR INDIRECTLY ARISING OUT OF OR RELATING TO THIS AGREEMENT, OR THE BREACH, TERMINATION OR VALIDITY OF THIS AGREEMENT.  With respect to clause (d) of the immediately preceding sentence, each of the parties hereto acknowledges and certifies that 1) no representative, agent or attorney of any other party has represented, expressly or otherwise, that such other party would not, in the event of litigation, seek to enforce the waiver contained therein, 1) it understands and has considered the implications of such waiver, 1) it makes such waiver voluntarily and 1) it has been induced to enter into this Agreement by, among other things, the mutual waivers and certifications contained in this Section 7.  No Indemnifying Party shall seek any order of a court or other governmental authority that would prohibit or otherwise interfere with the performance of any of the Indemnifying Parties’ advancement, indemnification and other obligations under this Agreement.
8.    Severability.  If any provision or provisions of this Agreement shall be held to be invalid, illegal or unenforceable, the validity, legality and enforceability of the remaining provisions hereof shall not in any way be affected or impaired thereby.
9.    Successors; Binding Effect.  Each Indemnifying Party will require any successor (whether direct or indirect, by purchase, merger, consolidation, reorganization or otherwise) to all or substantially all of the business and assets of such Indemnifying Party, by agreement in form and substance satisfactory to the Managers 

and their respective counsel, expressly to assume and agree to perform this Agreement in the same manner and to the same extent that such Indemnifying Party would be required to perform if no such succession had taken place.  This Agreement shall be binding upon and inure to the benefit of each party hereto and its successors and permitted assigns, and each other Indemnitee, but neither this Agreement nor any right, interest or obligation hereunder shall be assigned, whether by operation of law or otherwise, by the Company without the prior written consent of Apax Partners, L.P.
10.    Miscellaneous.  The headings contained in this Agreement are for reference purposes only and shall not affect in any way the meaning or interpretation of this Agreement.  This Agreement is not intended to confer any right or remedy hereunder upon any Person other than 1) each of the parties hereto and their respective successors and permitted assigns and 1) each other Indemnitee and, with respect to the provisions of Section 5(b), the Investor Directors, all of whom are intended to be third party beneficiaries thereof.  No amendment, modification, supplement or discharge of this Agreement, and no waiver hereunder shall be valid and binding unless set forth in writing and duly executed by the party or other Indemnitee against whom enforcement of the amendment, modification, supplement or discharge is sought.  Neither the waiver by any of the parties hereto or any other Indemnitee of a breach of or a default under any of the provisions of this Agreement, nor the failure by any party hereto or any other Indemnitee on one or more occasions, to enforce any of the provisions of this Agreement or to exercise any right, powers or privilege hereunder, shall be construed as a waiver of any other breach or default of a similar nature, or as a waiver of any provisions hereof, or any rights, powers or privileges hereunder.  Subject to Section 2(d) hereof, the rights, indemnities and remedies herein provided are cumulative and are not exclusive of any rights, indemnities or remedies that any party or other Indemnitee may otherwise have by contract, at law or in equity or otherwise.  This Agreement may be executed in several counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument.  Whenever the words “include”, “includes” or “including” are used in this Agreement they shall be deemed to be followed by the words “without limitation.”
11.    Information.  Each of Guernsey Parent LP and the Company hereby consents to the Investor Directors sharing any information such Investor Directors receive from any member of the Company Group with officers, directors, members, employees and representatives of the Managers and their respective Affiliates (other than other portfolio companies of the investment funds advised by the Managers or their Affiliates) and to the internal use by the Managers and such Affiliates of any information received from any member of the Company Group, subject, however, to the Managers maintaining adequate procedures to prevent such information from being used in connection with the purchase or sale of securities of any member of the Company Group in violation of applicable law.

IN WITNESS WHEREOF, the parties hereto have duly executed this Agreement by their authorized representatives as of the date first above written.
APAX PARTNERS, L.P.
By: Apax Partners, LLC, its General Partner
By: ______________________________
Name:  
Title:  

CPPIB EQUITY INVESTMENTS INC.
By: ______________________________
Name:  
Title:  
By: ______________________________
Name:  
Title:  

DATURA PRIVATE INVESTMENTS INC.
By: ______________________________
Name:  
Title:  
By: ______________________________
Name:  
Title:  

CHIRON GUERNSEY HOLDINGS L.P. INC.
By: Chiron Holdings GP, Inc. 
its General Partner
By: ______________________________
Name:  
Title:  

CHIRON HOLDINGS GP, INC.
By: ______________________________
Name:  
Title:  

CHIRON GUERNSEY L.P. INC.
By: Chiron Guernsey GP Co. Limited, 
its General Partner
By:______________________________
Name:  
Title:  

CHIRON GUERNSEY GP CO. LIMITED
By:______________________________
Name:  
Title:  

CHIRON TOPCO, INC.
By: ______________________________
Name:  
Title:  

CHIRON HOLDINGS, INC.
By: ______________________________
Name:  
Title:  

KINETIC CONCEPTS, INC.
By: ______________________________
Name:  
Title:Exhibit 10.1 Amendment3-HNFSReqsFinal_Cognizant MSA

Exhibit 10.1
Final Execution Version

AMENDMENT NO. 3 TO
MASTER SERVICES AGREEMENT

This Amendment No. 3 to Master Services Agreement (“Amendment”) is made as of this August 9, 2012, (“Amendment 3 Effective Date”) by and between Cognizant Technology Solutions U.S. Corporation (“Supplier”) and Health Net, Inc., a Delaware corporation (“Health Net”) with reference to the following facts:
A.    Supplier and Health Net entered into a Master Services Agreement dated September 30, 2008, as previously amended (collectively the “Agreement”) which, among other things, requires Supplier to perform Services for Health Net;
B.    Supplier and Health Net wish to amend the Agreement to incorporate Exhibit A-1 (HNFS Requirements) in support of certain Health Net Federal Services, LLC applications; and
D.    Supplier and Health Net desire to modify certain terms and conditions contained in the Agreement as provided in this Amendment.
NOW, THEREFORE, in consideration of the mutual promises, covenants, agreements and other undertakings set forth herein and for other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the parties hereby agree as follows:
1.    Definitions:  Defined terms used in this Amendment shall have the same meaning as in the Agreement unless otherwise specifically defined herein.
2.    The Exhibit A-1 (HNFS Requirements) attached hereto is incorporated into to Schedule A of the Master Services Agreement and each party hereby agrees to comply with and adhere to all of its respective obligations and requirements in the HNFS Requirements document, as may be amended from time to time.
3.    With respect to the HNFS Requirements only and notwithstanding Section 25.11 (Order of Precedence) of the Agreement, in the event of a conflict between the HNFS Requirements and any other term or condition of the Agreement, the HNFS Requirements shall prevail.
4.    Except as amended and modified by this Amendment, all of the terms and conditions of the Agreement shall remain in full force and effect. This Amendment may not be modified except in writing signed by both parties hereto.  This Amendment, the Agreement and exhibits and schedules thereto constitute the entire agreement of the parties with respect to the subject matter contained therein and supersedes any and all prior or contemporaneous agreements between the parties, whether oral or written, concerning the subject matter contained herein.

IN WITNESS WHEREOF, the parties hereto by their duly authorized representatives executed this Amendment to be effective as of the Amendment Effective Date.

COGNIZANT TECHNOLOGY SOLUTIONS    HEALTH NET, INC.
U.S. CORPORATION

By    /s/ David Brown                By    /s/ Robert Bushey        
Name    David Brown                    Name    Robert Bushey            
VP, Strategic Sourcing &
Title    Senior Director                    Title    Procurement            

Exhibit A-1    A-1 - 1    Health Net / Cognizant Confidential

Final Execution Version

EXHIBIT A-1
HNFS REQUIREMENTS

Exhibit A-1    A-1 - 2    Health Net / Cognizant Confidential

Final Execution Version

EXHIBIT A-1 
HNFS REQUIREMENTS

		
	1.
	INTRODUCTION

		
	1.1
	Background.

		
	(a)
	Health Net Federal Services, LLC (HNFS) is a business unit within Health Net. 

		
	(i)
	HNFS’ primary line of business is the TRICARE Program. The TRICARE program is a Department of Defense health care entitlement program, which is administered by private contractors who are selected for participation through a competitive procurement process. 

		
	(ii)
	In addition to the TRICARE line of business, HNFS has other revenue generating sources, including:

		
	(A)
	    Veterans Administration (VA) Preferred Pricing Contract-Health Net is a subcontractor to our Service Disabled Veteran-Owned Small Business Partners, Enterprise Technology Solutions and Primeaux Health Strategies.  Their contracts cover five regions.  The five regions are made up of all 21 Veterans Integrated Service Networks (“VISNs”). VA’s Preferred Pricing Program services allow participating VA Medical Centers to share in savings available through discount agreements with Health Net’s nationwide provider network for a variety of health care services, including hospitalization, outpatient care, ambulatory surgery, behavioral health, ancillary and other services.  (Note that this contract was terminated effective Friday, August 3, 2012, but the parties are working toward restoration of the contract.)

		
	(B)
	    DRG Audit and Recovery Services - HNFS also provides the VA with a review of inpatient medical claims that the VA may have overpaid. HNFS currently holds a single contract to perform this service for all Veterans Administration Medical Centers (VAMCs) nationwide.

		
	(C)
	    DoD Victims Advocate Program – HNFS currently provides Domestic Abuse Victim Advocates (DAVAs) at military installations around the US through a contract with the Department of Defense. The Advocates provide a range of support and advocacy services for victims of domestic violence, including initial response and safety planning and ongoing assistance. The Advocates are HNFS Associates and 

Exhibit A-1    A-1 - 3    Health Net / Cognizant Confidential

Final Execution Version

are managed by the DAVA Management Team located in Johnstown, PA.
		
	(D)
	    HNFS also bids on additional government health care programs that may include comprehensive medical and behavioral health benefits and/or unbundled administrative services applicable to such programs, including, but not limited to provider network, utilization management, claims administration and direct services. 

		
	(E)
	    VA Rural Mental Health Program-The VA Rural Mental Health Program is a pilot program authorized by Congress in Sec. 105 of P.L. 110-387 to provide mental health services to OIF/OEF Veterans who do not live in close proximity to VA Hospital or Community Based Outpatient Clinics.  Health Net is the current contractor for VISNs 19 and 20 and the former contractor for the VISN 6’s Rural Mental Health initiative, which was largely based on the pilot.

		
	(F)
	    California Department of Corrections and Rehabilitation contract whereby HNFS provides administrative support services, including preferred provider organization network services to the California State Prison system.

 
		
	1.2
	General Obligations.

		
	(a)
	This Exhibit A-1 (HNFS Requirements) defines security requirements and related compliance requirements applicable to HNFS.  Security requirements applicable to Health Net under the Agreement that are not in conflict with this Exhibit, shall also apply to HNFS. 

		
	(b)
	As of the Effective Date, Supplier shall comply with all HNFS security-related requirements, policies and standards that apply to the processes, systems, networks, personnel, and facilities that Supplier supports, each as explicitly set forth in this Exhibit A-1, and Supplier shall also comply with all other Health Net security policies and standards as set forth in the Agreement.

		
	(c)
	For the avoidance of doubt, and except in the event of a Change Notice, the Production Support Charge shall be Supplier's sole compensation for Supplier's efforts in complying with and adhering to the obligations and requirements in this Exhibit A-1.  Notwithstanding the foregoing, in accordance with Section 27.6(c) of the terms and conditions of the Agreement, a Regulatory Change may result in a Change pursuant to the Change Control Process.

		
	2.
	SERVICE REQUIREMENTS

		
	2.1
	General.

Exhibit A-1    A-1 - 4    Health Net / Cognizant Confidential

Final Execution Version

		
	(d)
	Supplier must comply with all security requirements applicable to HNFS, as explicitly set forth in this Exhibit A-1.

		
	(e)
	Supplier must also comply with the following documents and guidelines in their support and operation of HNFS systems: 

		
	(i)
	“OMB M-06-16, Protection of Sensitive Agency Information” June 23, 2006: http://www.whitehouse.gov/omb/memoranda/fy2006/m06-16.pdf

		
	(ii)
	DoD Directive 5400.11, “DoD Privacy Program,” September 1, 2011: http://www.dtic.mil/whs/directives/corres/pdf/540011p.pdf

		
	(iii)
	DoD Publication 5200.2-R, “DoD Personnel Security Program,” January 1987: http://www.dtic.mil/whs/directives/corres/pdf/520002r.pdf

		
	(iv)
	FIPS-140 Validated Cryptography: http://csrc.nist.gov/groups/STM/cmvp/validation.html

		
	(f)
	Configuration and operation of systems supported by Supplier will be conducted in compliance with the Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) and STIG checklists.  Compliance with these guides is mandatory for all systems and applications that process, store, access, or transmit Department of Defense data, and associated critical security and support systems as defined by INFOSEC.

		
	(i)
	DISA Security Technical Implementation Guides (STIGs) and checklists: http://iase.disa.mil/stigs/a-z.html

		
	(g)
	Supplier must also comply with HIPAA Privacy and Security rules and corresponding DoD issuances, as described in the TRICARE Operations Manual (TOM) Chapter 19 Section 3 to assure that Military Health System (MHS) data is protected. The Military Health System is the enterprise within the United States Department of Defense responsible for providing health care to active duty and retired military personnel and their dependants.

		
	(h)
	Supplier must also comply with Health Net Incident Response requirements, policies and processes as required by DoD 5400.11-R C4.5, DoD 6025.18-R and DoD 8580.02-R, HIPAA Breach rules

		
	(i)
	Supplier must also comply with the Health Information Technology for Economic and Clinical Health (HITECH) Act, which is subject to regulatory enforcement by the HHS Office for Civil Rights (OCR).

		
	(j)
	The provisions of the Military Family Life Consultant (“MFLC”) contract held by HNFS’ Affiliate, MHN Government Services, Inc. and any follow on contract under the MFLC program. To the extent any requirements or obligations change with respect to a follow-on contract, such changes would be subject to the Change Notice procedures set forth in the Agreement.

Exhibit A-1    A-1 - 5    Health Net / Cognizant Confidential

Final Execution Version

The remainder of this Exhibit A-1 summarizes and consolidates certain of the critical requirements referenced in the documents provided above, and provides additional requirements that Supplier must meet in support of the HNFS security programs.
		
	(k)
	Background Investigations

		
	(i)
	DoD Sensitive Information (DoD SI) includes Protected Health Information (PHI) and other Personally Identifiable Information (PII) associated with DoD personnel, as well as any other information that could adversely affect the DoD if it were disclosed (e.g. security vulnerabilities, troop data, etc.).

PII is defined as any information about an individual that identifies, links, relates, or is unique to, or describes him or her. This also includes information which can be used to distinguish or trace an individual's identity and any other personal information which is linked or linkable to a specified individual.
PHI is defined in Section A of Schedule K to the Terms and Conditions.
		
	(ii)
	Supplier Personnel with permissions to access DoD SI on information systems must be US citizens and must be able to successfully pass a DoD background investigation (National Agency Check with Law Enforcement and Credit (NACLC)) providing an ADP/IT-II Position of Trust. This includes all Supplier Personnel with indirect or potential access to DoD SI as a result of their administrative privileges. The majority of HNFS production systems are involved in the storage or processing of DoD SI, and therefore these requirements apply to most personnel with access to those systems.

		
	(iii)
	The Supplier will coordinate efforts to obtain ADP/IT-II Positions of Trust for its employees and subcontractors with Health Net Industrial Security. The Supplier is responsible for performing pre-employment background checks prior to submission for a Position of Trust to include:

		
	(A)
	Verification of U.S Citizenship

		
	(B)
	Criminal Background Check

		
	(C)
	Credit Check

		
	(D)
	Drug Screen

The background checks are valid for 90 days only. If a resource is not complete with the NACLC process within the 90 days of the completion of the background check, then the background check will need to be repeated.  Supplier must 

Exhibit A-1    A-1 - 6    Health Net / Cognizant Confidential

Final Execution Version

receive notification from Health Net’s Industrial Security Department before access to systems will be provided.
		
	(iv)
	System access that requires ADP/IT-II Positions of Trust includes, but is not limited to, the following applications: 

AHLTA
ART
B2B- Other (DISA)
CCDD
CCS
CHCS
Civilian PCM Panel Reassignment
CLR
CPPR
CRM
DCS
DEERS Security App
DEERS Web
DFAS (DISA)
Direct Care PCM Panel
DMDC/DWR 
DOES
DS Logon
Duplicate Claims
Fastrieve (SourceCorp)
Fee interface
FS PEGA (UAT, Staging and Production)
GIQD
Information Warehouse
Mercury Products
MMS (UAT, Staging and Production)
Notifications (PNT)
OHI/SIT
Patient ID Service
PCDIS/TePRV (DHSS)
PCM Load
PCM Research
PEPR
PERR (Other Applications) DHSS
PGBA CCM
PGBA Claims
PGBA DocFinity
RRS
TED
TePRV Inquiry 
TIP
TITAN
TRICARE Online (TOL)
VISTA 

Exhibit A-1    A-1 - 7    Health Net / Cognizant Confidential

Final Execution Version

WFA
		
	(l)
	Security & Privacy Training.

		
	(i)
	Initially (within 30 days of assignment) and annually, all Supplier Personnel are required to take the Security Awareness training with the appropriate content provided by Health Net in advance. For Supplier Personnel who hold a Position of Trust (National Agency Check), they are required to take and pass the Security Baseline training course within five days of hire or prior to receiving any government system access.  All Supplier Personnel who will have access to HNFS-related systems or data shall be trained in an expeditious manner during the Transition Period, or for Supplier Personnel who start work on the Health Net account after Transition, within five days of starting work (provided that in either case, such training shall occur prior to the applicable Supplier Personnel being granted access to any DoD SI or associated applications).  Subsequent refresher training shall be conducted annually and must be completed within 30 days of assignment of the refresher requirement. This refresher training applies to all Supplier personnel regardless of holding an ADP/IT-II position of trust or not.  Retraining may also be required as necessary if any material changes are made to HIPAA Rules affecting DoD or Health Net policies and procedures, and must occur within 30 days of assignment of the training.

		
	(ii)
	In order to assist with Aerojet’s International Traffic in Arms Regulations (ITAR) and required Department of State (DoS) license and DoS approvals, Health Net has entered into an agreement with Aerojet, whereby employees and contractors who are Foreign Nationals (a Foreign National is an individual who is a citizen of any country other than the United States) and require unescorted access be granted at the Aerojet-Sacramento Facility, will comply with the requirements of Aerojet’s Foreign National Visitor Access Control Plan. Health Net associates and contractors who are Foreign Nationals shall be required to attend a briefing by Aerojet Security regarding identified areas where they are allowed and will wear an identification badge to delineate them as Foreign Nationals on a secured site. Aerojet Security will provide all training and badging services.   

		
	(iii)
	In addition to formal training, HNFS will email security newsletters and bulletins to all personnel (including Supplier Personnel) using or supporting HNFS systems throughout the year as a part of HNFS' security awareness 

Exhibit A-1    A-1 - 8    Health Net / Cognizant Confidential

Final Execution Version

program. HNFS may also require certain security and privacy-related postings at various locations throughout the facilities supporting HNFS to serve as reminders of HNFS security polices and standards. Supplier Personnel shall at all times comply with all policies and standards referenced in such newsletters, bulletins or postings.
		
	(iv)
	In addition to the training required in Schedule A and Section 2.8(c) of the General Terms and Conditions, Supplier Personnel supporting the HNFS applications are required to take the following Health Net provided training:

G&SS HIPPAA Privacy Training
GSS Security Awareness
GSS Records Management Training    
Security Baseline Training
ISO 101-2009
HNFS URAC CORE V3.0 (TRICARE ONLY) 
URAC Applied Training (TRICARE ONLY) 
HNFS Reporting Quality of Care and Serious
Reportable Events 
 
		
	(m)
	Security Audits and Assessments

		
	(i)
	The HNFS NIST Authorization boundary includes all information systems that access, process, display, store or transmit DoD or Veterans Affairs (VA) SI, PII or PHI. It can also include any systems interconnected with these systems, including systems with which information is exchanged via messaging. It typically extends to all intended users of these systems, both directly and indirectly connected, who receive output from the system.

		
	(ii)
	The supplier will support security audit and assessments as required to comply with the NIST SP 800-53 controls listed in the Checklist and Certification for Minimum Level of Enhanced Safeguarding for Unclassified DoD Information as referenced  by TMA Policy no. 11-63 below: 

http://www.tricare.mil/tma/ams/downloads/policyalerts/PA11-63att2.doc
The associated details for the NIST SP 800-53 control requirements listed in that checklist are provided in the following document: http://csrc.nist.gov/publications/

Exhibit A-1    A-1 - 9    Health Net / Cognizant Confidential

Final Execution Version

nistpubs/800-53-Rev3/sp800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf.
The Supplier will also support security audits and assessments for HNFS systems supporting any HNFS contract.  The NIST authorization boundary for VA systems is categorized as NIST “System High.”  Supplier will support those systems and associated audits to meet the system high requirements as specified by NIST SP 800-53.
		
	(iii)
	Supplier shall provide documentation and support for NIST compliance assessments and any other audits or third-party assessments of applications and information systems that Supplier administers.  Typically, this support will consist of requests for information relating to applicable security controls, user access, and system architecture or configuration for the systems and applications supported by the Supplier.  However, in depth assessments may be conducted from 1-3 times per year that require extensive access to applications/systems and audit support from Supplier personnel.  Supplier will provide adequate personnel to support such efforts. Such assessments may include, but are not limited to: (a) attending and supporting audit/assessment meetings; (b) supporting the INFOSEC team during system security testing and evaluation, including provisioning of access to systems and participating in the assessment process (c) participating in any other audit (i.e completing assessment checklists) as required; and (d) providing remediation and/or approved mitigating controls to address any deficiencies identified.

		
	(n)
	Physical Security

		
	(i)
	In the event that Supplier provides service from a non Health Net facility Supplier shall support physical security assessments performed by both Industrial Security and the MHS Information Assurance (external government auditors) assessment team using the criteria from the Physical Security Assessment Matrix in Schedule M (Policies and Procedures). Supplier shall correct any deficiencies of its physical security posture indentified.

		
	(ii)
	Supplier facilities and data center(s) supporting HNFS functions will submit to a pre-audit physical security inspection performed by a member of the Industrial Security team and comply with all directives to ensure mitigation of findings.

		
	(iii)
	In addition, a binder containing site security policies standards and procedures will be provided by Industrial 

Exhibit A-1    A-1 - 10    Health Net / Cognizant Confidential

Final Execution Version

Security and maintained at each facility supporting HNFS functions.
 
		
	(o)
	Security Administration.

		
	(i)
	Supplier shall provide security administration support for all applications and systems supported by Supplier.  Supplier shall provide an assigned point of contact (POC) for Information Security support of each application/system.

		
	(ii)
	Each assigned POC will coordinate Supplier support for the security requirements detailed in this document with INFOSEC. They will act as the primary POCs for the notification and response for security vulnerabilities, will coordinate collection of information for each system/application, and will act as the primary POC for any audit/assessment-related activities for each supported system/application.

		
	(p)
	Applications & Systems Inventory

		
	(i)
	Supplier will provide an updated software inventory list for all supported systems and applications to INFOSEC on a monthly basis. The list provided will include the software name, manufacturer, version, patch level, installed modules or components, and a list of all host names where that software is installed.

		
	(q)
	Data & Systems Network Security and Separation Requirements

		
	(i)
	Non-DoD data may reside on systems within the NIST authorization boundary and access may be provided to that data as necessary as long as appropriate access control mechanisms are in place. 

		
	(ii)
	Physical hardware separation between NIST authorization boundary systems and non-NIST systems is required. Virtual server separation such as that provided by VMware or Citrix is not sufficient.

		
	(iii)
	Systems that support VA contracts must be physically separated from all other systems.  All VA sensitive information, PHI and PII must be encrypted (refer to Section 2.1(b)(iv) of this document for encryption standards) in transit and at rest.

		
	(iv)
	Software supported by Supplier that is required to be included within the NIST Authorization boundary must be configured and installed in accordance with the network controls that define that boundary.  Such software will be installed on the VLANs and subnets identified for NIST boundary systems and will comply with Health Net 

Exhibit A-1    A-1 - 11    Health Net / Cognizant Confidential

Final Execution Version

network communications guidance for permitted ports and protocols. 
		
	(r)
	Change/Configuration Management.

		
	(i)
	Any proposed changes to an information system within the NIST authorization boundary that could affect the security configuration of that system must be reviewed and approved by the INFOSEC team prior to implementation. Any such changes could result in additional testing and evaluation by the INFOSEC team.

		
	(s)
	Disaster Recovery and Continuity of Operations.

		
	(i)
	Without limiting Supplier’s obligations under Section 2.7 of Schedule A, Supplier shall provide input to HNFS’ Continuity of Operations Plan (COOP), revised on an annual basis, which provides for the continued operation of the systems and data that Supplier supports under Health Net’s TRICARE contract. It will include all actions that will be taken to continue operations should a disaster be declared and in the event of hardware, software and/or communications failures. It shall also include plans for relocation/recovery of operations, timeline for recovery, and relocation site information. It shall include connection to the DoD Business to Business (B2B) Gateway to and from the relocation/recovery site in compliance with all security requirements and associated B2B Gateway connectivity processes. Restoration of critical functions such as claims and enrollment is required within five days of the disaster. HNFS reserves the right to re-prioritize the functions and system interactions proposed in the COOP during the review and approval process for the COOP.

		
	(ii)
	Annual disaster recovery testing of all aspects of the COOP for major HNFS functions is required in coordination with HNFS on a timeline agreed to with HNFS in coordination with the DoD and other contractors responsible for the transmission of DoD and/or HNFS data. In the event that any portion of the annual disaster recovery test fails, the Supplier will conduct problem resolutions and retesting of all Services test components in a timely manner.  

		
	(t)
	Security Documentation. Supplier will assist INFOSEC in developing and maintaining security and compliance related documentation by providing any information associated with the applications and systems that the Supplier supports as required. Examples include but are not limited to:

		
	(i)
	Technical specifications 

		
	(ii)
	Security specifications

		
	(iii)
	System/application architecture diagrams

Exhibit A-1    A-1 - 12    Health Net / Cognizant Confidential

Final Execution Version

		
	(iv)
	Processes, procedures, and workflows

		
	(v)
	Roles and responsibilities

		
	(vi)
	Other information to support security review of applications and systems

		
	(u)
	Information Assurance Vulnerability Management (IAVM).

		
	(i)
	Supplier will comply with HNFS IAVM processes as detailed below. The IAVM process is a DoD-mandated patch management process that applies to all HNFS systems. The compliance window for IAVM Alerts (Information Assurance Vulnerability Alerts or IAVA’s) is determined by the DoD and is specific to each individual alert - it is typically 3 weeks, although they have varied from as few as 10 days to as long as a month. IAVA notifications are typically released a few weeks following vendor notifications for security patches, so it is possible that the appropriate patches may have been applied before the IAVA for those patches were received.

		
	(ii)
	Supplier will provide:

		
	(A)
	Acknowledgement of receipt within two days of delivery of IAVA’s, IAV Bulletins, or IAV Technical Advisories from INFOSEC.

		
	(B)
	A list of applicable applications/systems that are supported by the Supplier and a detailed remediation plan for each within five days of delivery of the IAVA’s, IAV Bulletins, or IAV Technical Advisories.

		
	(C)
	Remediation of applicable IAVA-identified vulnerabilities within the compliance date specified within the IAVA document.

		
	(D)
	A detailed remediation report to INFOSEC upon the successful remediation of each vulnerability. The report must include a detailed description of the remediation steps taken and verification that the remediation was successful (e.g. screenshots, log files, monitoring reports, test results, etc.).

		
	(iii)
	If remediation of an IAVA vulnerability is not reasonably achievable within the timeframe specified by the IAVA (as approved by INFOSEC), Supplier will 

		
	(A)
	Develop a detailed Plan of Action & Milestones (POA&M), (form to be provided by INFOSEC) within five days of delivery of the IAVA from INFOSEC.

		
	(B)
	Document and implement mitigating control measures to reduce the associated security risk to a low risk (as determined by INFOSEC).

Exhibit A-1    A-1 - 13    Health Net / Cognizant Confidential

Final Execution Version

		
	(C)
	Initiate projects or appropriate vendor software modifications as necessary to address the risk.

		
	(v)
	Security Vulnerability Remediation.

Supplier will provide:
		
	(i)
	Acknowledgement of receipt within two days of delivery of vulnerability information from INFOSEC.

		
	(ii)
	A detailed remediation plan for all applicable vulnerabilities to INFOSEC within five days of the delivery of the vulnerability information from INFOSEC.

		
	(iii)
	Remediation of all vulnerabilities (other than IAVA’s) within the timeframes described below:

	
		
	Vulnerability Type
	Required Remediation Timeframe
(Upon Supplier receipt of vulnerability data)

	Critical:
DoD Category I findings and any High Risk findings as specified by INFOSEC
	25 Days*

	Non-Critical:
All other findings
	85 Days*

*For remediation efforts that would require a change by the vendor of Commercial Off the Shelf (products that are commercially available, or COTS) or Government Off the Shelf (products that are supplied and owned by the government, or GOTS product or if INFOSEC agrees that the finding should not be remediated due to other circumstances, Supplier will:
		
	•
	Develop a detailed POA&M within five days of delivery of the vulnerability information or approval of the extended timeline by HNFS IA.

		
	•
	Document and implement mitigating control measures to reduce the associated security risk to a low risk (as determined by INFOSEC).

		
	•
	Initiate projects or appropriate vendor software modifications as necessary to address the risk.

		
	(iv)
	A detailed remediation report to INFOSEC upon the successful remediation of each vulnerability. The report must include a detailed description of the remediation steps taken and verification that the remediation was successful (e.g. screenshots, log files, monitoring reports, test results, etc.).

All efforts associated with security remediation efforts will be considered Adaptive Maintenance as defined in the Agreement.  

Exhibit A-1    A-1 - 14    Health Net / Cognizant Confidential

Final Execution Version

		
	(w)
	Privacy & Security Incident Response

		
	(i)
	The Health Net Incident Response team must be notified immediately regarding any potential or confirmed loss of Health Net Data, loss of assets, unauthorized access, exploit of a security vulnerability, or bypass of security controls identified by Supplier personnel.

		
	(ii)
	The Supplier will immediately complete an Incident Report available from the following Lotus Notes Database entitled “Lotus Notes Privacy and Security Incident Report Database” as well as Health Net Connectˆ Business Unitsˆ HNFSˆ Quick Linksˆ Incident Reporting. If the database is not immediately available, Supplier will immediately report the incident to HNGSS_Incidents@healthnet.com             or by phone at 866-321-5876.  Supplier will maintain and use the most recent reporting contact information as provided by Health Net.

		
	(iii)
	Supplier will assist the Health Net Incident Response coordinators in addressing any security or privacy incidents in an expedient manner, providing investigative support (e.g. through event correlation, log analysis, and associated reporting) and remediation of any associated vulnerabilities within the timelines specified elsewhere within this document.

		
	(iv)
	Detection and reporting of security events is a responsibility of the Supplier. When an event is reported as required, INFOSEC will track actions taken and build an accurate timeline of events while also providing analysis and direction to incident response actions. Accurate documentation is required from Supplier to provide accountability and tracking of incident response activities.  

		
	2.2
	Additional Security Policies & Standards

In addition, there are a number of additional HNFS-specific security policies, procedures, processes and standards with which Supplier and its subcontractors must comply. They are available on the Health Net Intranet through HNConnect at the following links, and have been extracted and provided to Supplier separately from this SOW:
		
	(a)
	Health Net Corporate Security Policy

http://hnconnect.healthnet.com/business_units/security/policies_and_procedures/list.jsp
		
	(b)
	HNFS Information Security Policies, Procedures, & Processes

http://kb.hnfs.healthnet.com/hnfskb_itsec.htm

Exhibit A-1    A-1 - 15    Health Net / Cognizant Confidential

Final Execution Version

		
	(c)
	HNFS Industrial Security Policies, Procedures, & Processes

http://kb.hnfs.healthnet.com/hnfskb_ssis.htm
		
	(d)
	HNFS Privacy Compliance Policies, Procedures, & Processes

http://kb.hnfs.healthnet.com/hnfskb_ssprivacy.htm
		
	(e)
	HNFS Records Schedule

http://kb.hnfs.healthnet.com/hnfskb_00003053.htm
		
	3.
	SERVICE MANAGEMENT

		
	3.1
	Service availability: 

Supplier will provide security administration support 24 x 7 x 365.  

		
	3.2
	Escalation:

Supplier will notify INFOSEC and HNFS Industrial Security immediately if at any time current efforts will not meet the required timeframes. Escalation of issues encountered in the performance of this Exhibit A-1or of any non-compliance with this Exhibit A-1 will be addressed according to the issues resolution and escalation procedures defined elsewhere in the Agreement.
		
	3.3
	Points of Contact:

As of August 9, 2012, the following are points of contact for HNFS Security:

Billy Martin
Director of Information Security
billy.martin@healthnet.com
916-935-8151

Matt McCracken
Director of Industrial Security
matthew.t.mccracken@healthnet.com
916-985-1689

Exhibit A-1    A-1 - 16    Health Net / Cognizant Confidential

Source: [{"source": "alea-institute/alea-institute/kl3m-data-edgar-agreements/train-00209-of-00352.parquet"}, [{"source": "alea-institute/alea-institute/kl3m-data-edgar-agreements/train-00209-of-00352.parquet"}]]