Hosting Services Addendum

HOSTING SERVICES ADDENDUM

Effective as of October 1, 2024 (Version Number: 45566)

All terms not defined herein shall have the meaning ascribed to them in the DAS Standard Incorporated Terms and Conditions.

Hosting Services – If the executed COF includes private cloud hosting in any form (not including Microsoft Azure, Amazon AWS, or similar third party hosting vendors, except as provided in subsection(s)), the following additional terms and conditions apply:

Hosting Services will be billed at 50% of the rate on the COF from Effective Date until the Go-Live date, at which time 100% billing starts. The Term for the COF shall be automatically extended for such months with no or partial payment to make the Term start at the Go-Live Date.
Datacenter Facility. “DAS Datacenter” shall mean DAS’s data facilities.
“Hosting Services” shall collectively mean the Virtualized Hosted Servers, Data Storage, Bandwidth and Network Services.
Support Hours for Hosting shall be 8 a.m. to 8 p.m. EST on weekdays, except for holidays, for non-critical issues and 24x7x365 for critical issues, or as otherwise stated on the Service Level Agreement (“SLA”).
Client shall provide DAS with a written list of Users and the level of security to set up Hosting Services. Client shall promptly notify DAS whenever a User is to be added or removed. Client shall be responsible for all of the acts or omissions of authorized Users and any unauthorized Users who gain access by use of any password, identifier or log-on received or obtained, directly or indirectly, lawfully or unlawfully, from Client or any authorized User.
Compensation. By contracting for Hosting Services, Client shall pay a fee equal to the amount specified in the COF or otherwise in the Agreement to be paid monthly on or before the 1^stof the month for which they apply.
1. Unless otherwise stated in the Agreement, the Hosting Services pricing, if Provider-based, includes a maximum ratio of 5 Users and 50 GB of storage for each Provider (inclusive). Additional Charges apply for greater than 5 Users or 50GB per Provider, and may be charged retroactively upon audit at the then standard monthly rate per additional User plus additional storage (or any portion thereof) per Provider. Hosting Services pricing does not include RDP or other connectivity software, which if requested will be billed as an Additional Service.
2. Hosting pricing does not include any VPN or interface setup or maintenance, which if requested, will be charged as Additional Services, will require a BAA from the respective vendor, and may require proof of cyber liability insurance from the respective vendor before being approved. If any third-party vendor requires access to DAS servers, DAS may impose reasonable limitations and safeguards applicable to such access as necessary in DAS’ sole discretion to protect the confidentiality, integrity and availability of DAS systems and data.
3. Any Users over the contracted amount will be billed at standard rates defined in the agreement, and if none is stated then $100 per Additional User per month.
4. Hosting Services required by Client after termination of the Hosting Services shall be provided under the same terms but on a month-to-month basis payable at two times the prior month’s agreed amount including any overages, with such payments due by no later than the 5^th of the month of such service, and one calendar month notice of termination required from Client.
5. Unless otherwise specified, during the Term of Hosting Services, DAS may increase any Hosting Service fees upon ninety (90) days prior written notice.
Overage Charges
1. Bandwidth - In the event, Client exceeds an average of 250mbps in any given month, Client agrees to pay DAS for such excess usage at the then current rate; provided, however, that DAS may cap Client’s bandwidth at 300 mbps, in its sole discretion. Client shall not be responsible for excess bandwidth usage from abnormal spikes in traffic due to denial of service attacks or defective switches. Normal bandwidth growth over time due to system, user, or bandwidth growth is billable by DAS and to be paid by Client.
2. CPU/RAM – In the event Client currently exceeds, or has previously exceeded, their contracted allocated CPU or RAM, Client agrees to pay DAS for such excess usage at the then current rate.
The Hosting Services COF creates a limited and non-transferable license to use the Hosting Services. The parties specifically agree that in the event the COF is terminated, the license is then terminated, and DAS may take immediate possession of the Hosting Services. Under no circumstances must DAS be required to initiate any legal action to regain possession of the Virtualized Servers.
Equipment. All servers, other hardware equipment and operating system licenses located in DAS’s Datacenters or in DAS’ possession shall at all times remain the property of DAS (unless explicitly acknowledged by an officer of DAS in writing) and are not subject to customer demands.
In the event Client independently purchases the required hardware and/or third-party software needed to operate the Hosted Services, such hardware and/or third-party software to be deemed “Client Supplied Items”, Client understands and acknowledges that DAS does not make any representation on, and provides no warranty on any hardware and third party software not sold or managed by DAS. Any problems or issues dealing with the hardware, the operating system software and/or third party software provided by Client is outside the scope of any supported services provided by DAS under this Agreement, and shall be charged as Additional Services.
Hosting includes secure data hosting, 99.99% Uptime (as more specifically defined in the SLA), and daily backups. Notwithstanding periodic backups, loss of data is always possible. DAS will use its reasonable commercial efforts to provide backup services pursuant to the SLA, but does not guarantee data recovery or availability.
Optional Disaster Recovery (“DR”) services are available as Additional Services. Disaster Recovery (“DR”) services will be included only if purchased as a separate line item on a COF. DR services are not a guarantee and, loss of data is always possible. DAS will use its reasonable commercial efforts to provide disaster recovery services pursuant to the SOW, but does not guarantee data recovery or availability.
DAS does not support local “thin client” environments in a hosted solution. To the extent that Client maintains a thin client environment, Client is solely responsible for all thin client maintenance, including Software upgrades and error detection and analysis for any errors that arise that may potentially be caused by (even if not conclusively resulting from) such thin client environment.
Unless PM/EHR Support is contracted with DAS, Client agrees that it has an in-force and effective agreement to cover all required software licenses, including maintenance and support, and DAS has no responsibility whatsoever for any software updates or maintenance. Any services provided by DAS, other than those specifically provided for pursuant to this Section, unless specifically included on an executed COF, will be billed as Additional Services. If Client does not maintain hosted Software (either through DAS Software Maintenance or otherwise) to within two prior versions back, DAS may, at its discretion, update the Software to the current version and charge such upgrade to Client as an Additional Charge.
Hosting Administrative Rights
1. Administrative Rights may be contracted for and purchased separately on a COF and will grant Client administrative rights to Client’s hosted servers in DAS’s Datacenter, where the administrative rights (“Administrative Rights”) include, but are not limited to, active directory administrative privileges (including critical Window services such as DNS, DHCP, Domain Security Policy, Group Policy, etc.), SQL Server DBA privileges and PM/EHR application administrative privileges. DAS may require proof of cyber liability insurance or require Client listing DAS on such insurance policy as an additional insured before being granted Administrative Rights.
2. Interfaces in requesting or accepting these Administrative Rights, Client acknowledges the following:
  1. Shared Responsibility: Client agrees and accepts that the Availability, Performance, Security and Manageability of Client’s Hosted Servers shall be a shared responsibility between Client and DAS. Client agrees to cooperate with DAS in adhering to administrative policies and procedures related to the management and administration of the Hosted Servers. Client further agrees that the active directory objects (including but not limited to organizational units, security groups and group policy objects, but excluding user and printers) shall be an integral component of DAS’ monitoring, accounting and auditing functions and shall not be modified by Client without DAS’ express written consent.
  2. Availability: Granting Administrative Rights privileges to anyone other than DAS may preclude DAS from meeting any availability representations or terms of any applicable and specifically provided “Availability Guarantee”. Client agrees that DAS shall not be accountable for any breaches to any such availability representations or terms of any applicable “Availability Guarantee” in the event Client’s acts or omissions contributed to the breach event.
  3. Performance: Administrative Rights privileges granted to Client may preclude DAS from providing acceptable performance levels of the Hosted Servers. Client agrees DAS shall not be accountable for performance degradation to the extent Client’s acts or omissions contributed to the degradation. Client further agrees that additional fees may be charged in the event DAS needs to remediate performance degradation caused by Client’s acts or omissions.
  4. Security & Liability: Granting Client Administrative Rights has the potential for misuse of authority, propagating access rights to others, and accidental proliferation of privileged and protected ePHI. Client agrees to indemnify and hold DAS harmless in the event Client’s acts or omissions cause or contribute to any breach of security (including but not limited to unauthorized access to ePHI).
  5. DAS may suspend or remove Client’s Administrative Rights at any time, even if separately contracted, if DAS determines, in its sole discretion, that Client's usage may jeopardize the hosting environment. In the event of such suspension or removal, DAS and Client will work together in good faith in an attempt to determine an acceptable business resolution.
At the termination of any Hosting Services, Client will be provided options for data retrieval at then current prices, which options may include (subject to the technological ability to complete the retrieval, at DAS sole discretion):
1. a provision of full data backup, including the backup files in their native format (no deconversion shall be included) for a minimum $1,500 flat fee (fees subject to increase based on database size and structure). All data will be transferred by secure electronic transmissions via Azure Transient Cloud Storage, billed in arrears at Microsoft standard pricing;
2. a de-converted database that is able to be readily converted into another format for $2,000 (appointments), $3,000 (demographics), $5,000 plus $10 per 10GB in excess of 100GB (attachments). All data will be transferred by secure electronic transmission via Azure Transient Cloud Storage, billed in arrears at Microsoft standard pricing;
3. electronic copies of patient files in .PDF format for $5,000 per practice plus $500 per Provider. All data will be transferred by secure electronic transmission via Azure Transient Cloud Storage, billed in arrears at Microsoft standard pricing; and/or
4. continued Read Only Hosting, if available, for fees as outlined hereunder.
All data retrieval options require advance payment in full of any amounts due under the Agreement through the end of the Term. Additional charges may apply from third party vendors for data access, which will be provided at DAS’ cost. DAS will permanently destroy its copy of all Client data no sooner than thirty (30) days but not later than sixty (60) days following termination.
Read Only Hosting is a special form of hosting for clients who have otherwise terminated Hosting Services. For COFs including Read Only Hosting, or when Read Only Hosting is implemented after termination of Hosting Services, the following additional terms apply:
1. As of the Effective Date of the Read Only Hosting COF, Client will have Read-Only access to their database for the unique Users and during the term specified on the COF. COF must include all Providers included in the Client’s most recent COF, notwithstanding whether those Providers are still current at the time of the Read Only Hosting COF.
2. Client understands and acknowledges that they will not be able to make any changes to any files, or transmit or receive any electronic data interchange, including but not limited to, prescriptions, claims, or remittances. Due to the database being in read-only status, Users may experience degraded or limited printing functionality, certain reports and functions may not be available, and the client may receive errors. Client further agrees that the amounts listed on the COF will be direct debited from their account on file, and that the terms of the DDA on file will continue in force for the remaining term of the Agreement. Support services for Read Only Hosting is limited to only providing reasonable assistance with obtaining access, and no other support.
3. The full amount for the Term of the COF will be deducted or is payable immediately upon receipt and acceptance by DAS of the COF. Any partial months will be calculated as if a full calendar month. If a DDA is provided, the MSC Amount will be deducted on the first of each month until terminated pursuant to these Standard Incorporated Terms & Conditions. If a DDA is not provided, and notwithstanding anything to the contrary in these Terms, the COF is not renewable and will automatically terminate upon the end of the stated Term, and a new Setup and Database Recovery Fee will be required to continue service thereafter.
4. Read Only Hosting pricing is as follows:
  1. Aprima: one-time fee of $500 per Provider plus $100 PPPM, with a minimum of twelve (12) months paid in advance.
  2. assessURhealth: one-time fee of $250 plus $50 MSC, with a minimum of twelve (12) months paid in advance.
  3. Other: Not available at this time.
5. Notwithstanding anything to the contrary contained elsewhere in the Agreement, unless the Client continues with other services under the Agreement (not including the Read Only service), all other rights of Client under the Agreement are terminated with the execution of any Read Only Hosting COF and will be of no further force or effect, although Client’s obligations under the Agreement continue.
Microsoft Azure, Amazon AWS, and similar third-party hosting vendors’ hosting terms are covered under the respective End User License Agreements available at https://DAShealth.com/documents, and specifically incorporated by reference and made a part of this Agreement. Azure, AWS, and similar third-party hosting vendors’ usage over the agreed amount will be billed as Additional Charges.
Non-Standard Third Party Application Hosting. If the executed COF includes Non-Standard Third Party Application Hosting, DAS will provide hosting services (as defined herein), but in no event shall DAS be responsible for the Third Party software, functionality, service or support