Healthcare Managed Backup Services Exhibit

HEALTHCARE MANAGED BACKUP SERVICES EXHIBIT

This Managed Backup Services Exhibit ("Exhibit") is entered into as of by and between:

1. Purpose and Scope

This Exhibit describes the managed backup services, security controls, retention and restoration obligations for backup and archival of data, including Protected Health Information (PHI), as defined under applicable law. The Provider will perform backup, storage, and restore services for the Client's systems and data as set forth below.

2. Definitions

For purposes of this Exhibit: "Backup Data" means copies of electronic data created and retained by Provider for recovery; "PHI" means individually identifiable health information that is created, received, maintained or transmitted on behalf of Client; "Restore" means recovering Backup Data to a Client-designated system or environment.

3. Data and Systems Covered

Client designates the following systems and data categories for backup under this Exhibit:

4. Service Specifications

Backup frequency, retention, and restoration parameters shall be as follows:

5. Security and Compliance Controls

Provider shall implement and maintain administrative, physical and technical safeguards reasonably designed to protect Backup Data, including PHI, from unauthorized access, use, disclosure or destruction and to satisfy the requirements of applicable privacy and security law.

Encryption in transit and at rest: In transit At rest

6. Integrity, Testing and Reporting

Provider shall perform periodic restore testing and integrity validation. Testing frequency:

Weekly Monthly Quarterly On demand

7. Incident Response and Breach Notification

Provider shall notify Client of any confirmed or suspected security incident involving Backup Data, including unauthorized access to PHI, without unreasonable delay and in no event later than the timeframe required by applicable law. Notification shall include the nature of the incident, data categories involved, and remedial measures taken.

8. Subcontractors and Third-Party Services

Provider may engage subcontractors to perform backup, storage or processing services only if Provider: (a) imposes written contractual obligations on such subcontractors to safeguard Backup Data at least as protective as this Exhibit; and (b) remains responsible for subcontractor performance. Provider shall disclose subcontractors upon Client's request.

9. Fees and Payment

Client shall pay Provider the fees set forth below for backup, storage, data egress and restoration services. Fees for emergency restores, forensic exports, or out-of-scope restores may be billed separately at Provider's standard rates.

10. Term; Termination; Return or Destruction of PHI

This Exhibit commences on the Effective Date and continues for the term specified in the underlying Agreement, unless earlier terminated. Upon termination or expiration, Provider shall, at Client's election, return Backup Data to Client in a mutually agreed format or securely destroy such data in a manner that renders it unreadable and irrecoverable. Provider shall provide certification of destruction upon Client request.

11. Liability, Indemnification and Insurance

Each party's liability shall be governed by the underlying Agreement. Provider shall maintain insurance appropriate for the services provided, including commercial general liability and professional liability/errors & omissions insurance, and cyber liability coverage sufficient to cover potential incidents involving Backup Data.

12. Audit Rights and Compliance

Client may, upon reasonable notice and during normal business hours, audit Provider's compliance with the terms of this Exhibit, including security controls relevant to Backup Data. Provider shall cooperate and provide access to evidence of compliance, including relevant policies, procedures and logs, subject to reasonable confidentiality protections.

13. Confidentiality and Business Associate Obligations

Provider acknowledges that Backup Data may constitute PHI and agrees to be and remain a Business Associate under applicable law. Provider shall comply with obligations to safeguard PHI, report breaches, mitigate harmful effects, and ensure appropriate safeguards with subcontractors.

14. Notices

All notices related to this Exhibit shall be delivered to the parties at the addresses set forth below.

15. Miscellaneous Provisions

This Exhibit supplements and is incorporated into the underlying Agreement between the parties. In the event of any conflict between this Exhibit and the Agreement, the terms of this Exhibit will control with respect to the subject matter addressed herein to the extent expressly required by applicable law or the Agreement.

Sign Now