This EOHHS VIRTUAL GATEWAY SERVICES AGREEMENT ("Agreement") is entered into by and between the Executive Office of Health and Human Services of the Commonwealth of Massachusetts ("EOHHS") and the undersigned organizational entity ("Entity") of the Commonwealth's EOHHS Virtual Gateway Services ("VirtualGateway" or "VG").
1. General. This Agreement states certain terms that apply to Entity's use and access to the EOHHS Virtual Gateway Services, which include critical health and human services programs and information, which information can include, but is not limited to, management and reporting tools. Entity, on behalf of itself and its Access Administrators and End Users, agrees to comply with, and be bound by, this Agreement and to use the EOHHS Virtual Gateway Services only for the express purposes for which use and access has been granted. Use and access of the Virtual Gateway under this Agreement is limited to obtaining or providing information directly related to the services provided to constituents of the Entity, with such access being provided by Entity's designated Access Administrator, as described in Section 2 of this Agreement.
Entity agrees to ensure that its employees, contractors, and agents (including its Access Admiistrators and End Users) that use the Virtual Gateway are aware of, and comply with, this Agreement (including any Riders, Attachments, Amendments, and User Request Forms) and applicable state and federal laws concerning the confidentiality and security of information that is created, modified, accessed or received through the Virtual Gateway. Entity is responsible for ensuring that its employees, contractors, and agents (including its Access Administrators and End Users) comply with all instructions and requirements regarding the Virtual Gateway Terms and Conditions, online application forms, tools, and services available through the EOHHS Virtual Gateway, and use such online application forms, tools, and services only for the purposes for which they are intended. EOHHS agrees to provide Entity with timely information and updates regarding the use of the Virtual Gateway for which the Entity has been authorized, including but not limited to changes in forms, tools and services.
2. Designation of Access Administrator. Entity must designate one or more individuals to serve as its Access Administrator(s). The Access Administrator must be a member of the Entity's staff under the direct control of the Entity. The Access Administrator shall be responsible for communicating to the Virtual Gateway the identity of the individual end users (including employees, contractors, agents, and Business Associates) authorized to access the Virtual Gateway on Entity's behalf (each, "End User" and collectively, the "End Users"). The Access Administrator, on behalf of the Entity, shall: (1) provide EOHHS with such information as it may require for each End User; (2) ensure that all information submitted to EOHHS about each End User is current, accurate, and complete; (3) notify EOHHS promptly of any End User whose access rights must be terminated (for example, when an End User leaves the employment of the Entity); and (4) take such actions as EOHHS may direct or require to ensure the security of the EOHHS Virtual Gateway. Entity will ensure that all its requested Access Administrators will have read and understand the terms of this Agreement. Upon the submission by the Access Administrator of End User information required by this Agreement and any exhibits or amendments thereto for the purposes of access to the Virtual Gateway, and the certification of such information, the Access Administrator acknowledges and accepts the terms of this Agreement. Upon receipt of such information, and any additional information that EOHHS may deem necessary to assign such access rights to End Users, EOHHS shall assign individual account information and access instructions directly to each End User within 5-7 business days. Information regarding End Users shall be maintained in secure environment controlled by EOHHS. Nothing in this Agreement shall be construed to limit EOHHS's right to deny access rights to any End User or terminate the access rights of any End User for any reason.
EOHHS will allow Entities with multiple divisions, departments, and/or facilities to designate such additional Access Administrators as EOHHS in its sole discretion deems appropriate. Entity must notify EOHHS in writing of any change in status of any Access Administrator within 5-7 business days of the change, and must provide the required Access Administrator information whenever it seeks to add or remove an Access Administrator. EOHHS will provide to the Entity, upon request, any information needed related to the change in Access Administrators.EOHHS reserves the right to terminate any Entiy's, Access Administrator's, or End User's right to access the EOHHS Virtual Gateway Services, or to terminate the Access Administrator designation, at any time, with or without cause, without notice and without penalty. None of the foregoing shall be construed: (1) to relieve Entity of responsibility for the acts and omissions of its Access Administrators and End Users; (2) to relieve Entity of any of the responsibilities imposed by this Agreement or by applicable law; or (3) to waive any rights or remedies that EOHHS possesses in the event of unauthorized access to or use of the Virtual Gateway or the Virtual Gateway Services.
3. Use Rights and Obligations. Entity shall ensure that its Access Administrators and End Users agree to only access and view all information accessed via the VG in compliance with this Agreement, as well as other applicable terms and conditions of use in the VG and all other applicable state and federal laws, including but not limited to those concerning the confidentiality of personal information. EOHHS and the organizations and individuals that use the Virtual Gateway are required by law to protect the privacy and security of personal information in the Virtual Gateway. Any use of the EOHHS Virtual Gateway Services to create, modify or access or receive information about an identifiable individual, for example by querying, may make Entity a "Holder" of "Personal Data" as those terms are defined in the Massachusetts Fair Information Practices Act (M.G.L. c. 66A) ("FIPA"). To the extent Entity becomes a Holder of Personal Data, Entity agrees to comply with FIPA and with all other applicable state and federal laws, including, if applicable and without limitation, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). All Personal Data that Entity creates, modifies, accesses or receives from the Virtual Gateway is the exclusive property of EOHHS. EOHHS reserves all of its rights to exercise complete control over the access, use, disclosure, and disposition of Personal Data. Entity agrees to certify to EOHHS, upon request, that in its use of Personal Data it is in compliance with this Agreement. Entity is responsible for limiting access to Personal Data obtained from the Virtual Gateway to those employees, contractors, and agents (including its Access Administrators and End Users) that need such information in furtherance of the purposes for which EOHHS intends the Virtual Gateway to be used or as permitted by appropriate applicant consent documented in the manner directed by EOHHS.
In no event may any user use the VG or any information contained therein in a manner that (i) harasses, abuses, threatens, defames or otherwise infringes or violates the rights of any other party; (ii) is unlawful, fraudulent or deceptive; (iii) uses or launches any automated system to access any of EOHHS websites or computer systems; (iv) attempts to introduce viruses or any other malicious computer code that interrupts, destroys or limits the functionality of any computer software, hardware or telecommunications equipment; (v) attempts to gain unauthorized access to EOHHS computer network or user accounts; (vi) encourages conduct that would constitute a criminal offense, or would give rise to civil liability; (vii) uses the VG to store, upload, send or process any content, data or material for any purpose or manner; (viii) could disable, overburden, damage, or impair the site or interfere with any other party's use of the VG, including their ability to engage in real time activities through the VG; and (ix) that is inconsistent with this Agreement and Entity shall ensure its Access Administrators and End Users compliance with the foregoing use restrictions. Entity agrees that it, its Access Administrators or End Users will not modify the VG in any way, or enhance or otherwise create derivative works based inwhole or in part on theVG or any part thereof, or reverse engineer, decompile or otherwise attempt to secure the source code for all or any part of the VG.
Use of bots or other automated methods, devices or processes, including but not limited to through Single-SignOn (SSO), to access the VG as well as to retrieve, upload, add and/or modify data and/or content contained within the VG is prohibited. Any such use may result in termination of this Agreement, the rights of the Access Administrator or the End User, as may be applicable, and ability to access the VG.
4. Monitoring; Usage Data. EOHHS administrators routinely monitor system activity in order to ensure theconfidentiality, integrity and availability of the VG, as well as to ensure its users are in compliance with these Terms. Use of the VG constitutes Entity's express consent to monitoring, inspection and/or copying of all activity and information that Entity's employees, contractors, and agents (including its Access Administrators and End Users) view, create, or receive during their use of the VG. EOHHS has the right to cooperate fully with any law enforcement authorities or court order requesting or directing us to disclose the identity or other information of anyone posting any materials on or through the VG.
Entity acknowledges and agrees that VG staff and other personnel may also collect, use, process and store diagnostic and usage related content from the computer or other devices Entity's employees, contractors, and agents (including its Access Administrators and End Users) use to access the VG. This may include, but is not limited to, internet protocol (IP) addresses and other information like internet service, location, the type of browser and features that are used and/or accessed, the number and type of data inputs used, and the performance results for the VG (the "Usage Data"). Entity agrees that EOHHS owns the Usage Data and that nothing herein shall be construed as prohibiting EOHHS from utilizing the Usage Data for purposes of operating the VG, including but not limited to: (a) maintaining and improving the performance and integrity of VG, (b) understanding which features of the VG are most commonly deployed and preferred by users and how users interact with the VG and (c) identifying the features of the VG that may require additional maintenance or support.
By using the VG, Entity shall protect the privacy and security of the information, which includes but is not limited to personal information, contained within and accessed as a result of its Access Administrator's or End Users' use of the VG. Each party is solely responsible for the preservation, privacy, and security of information in its possession, including information in transactions received from the other party and other persons. If either party receives from the other information not intended for it, the receiving party will notify the sender to arrange for its return, re-transmission, or destruction promptly upon discovery of such information. Both parties agree: (a) to use their best efforts and to take all steps reasonably necessary to prevent unauthorized access to, use of, or disclosure of Personal Data; and (b) to take such measures as are reasonably necessary to mitigate or address any unauthorized access to, use of, or disclosure of Personal Data. None of the foregoing shall be construed to waive any rights or remedies that either party may possess in the event of unauthorized access to, use of, or disclosure of Personal Data
5. Disclaimers and Liability. Use of the VirtualGateway and the information contained therein is provided on an "AS IS" "AS AVAILABLE" BASIS WITHOUT ANY WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, TO THE FULLEST EXTENT PERMITTED BY LAW.
EOHHS DOES NOT MAKE ANY WARRANTIES OR REPRESENTATIONS REGARDING THE VIRTUAL GATEWAY, ITS CONTENT, OR ANY INFORMATION OR MATERIALS OBTAINED THROUGH THE VIRTUAL GATEWAY INCLUDING, WITHOUT LIMITATION, RELATING TO THE SECURITY, TITLE, ACCURACY, RELIABILITY, MERCHANTABILITY, COMPLETENESS, QUALITY, FITNESS FOR A PARTICULAR USE, TIMELINESS, PERFORMANCE OR AVAILABILITY OF THE VIRTUAL GATEWAY, ITS CONTENT, OR ANY SUCH INFORMATION OR MATERIALS OBTAINED THROUGH THE VIRTUAL GATEWAY. FURTHER, EOHHS DOES NOT MAKE ANY WARRANTIES OR REPRESENTATIONS THAT THE VIRTUAL GATEWAY, ITS CONTENT, OR ANY INFORMATION OR MATERIALS OBTAINED THROUGH THE VIRTUAL GATEWAY WILL BE ERROR-FREE, UNINTERRUPTED, THAT DEFECTS WILL BE CORRECTED OR THAT OUR SITE OR THE SERVER THAT MAKES THE VIRTUAL GATEWAY AVAILABLE IS FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS.
IN NO EVENT WILL EOHHS, ITS SUB-AGENCIES, SERVICE PROVIDERS, EMPLOYEES, AGENTS OR OFFICERS BE LIABLE FOR DAMAGES OF ANY KIND, UNDER ANY LEGAL THEORY, ARISING OUT OF OR IN CONNECTION WITH THE USE, OR INABILITY TO USE, BY ENTITY, ITS ACCESS ADMINISTRATOR(S) OR ASSOCIATED END USERS, OF THE VIRTUAL GATEWAY, ANY WEBSITES LINKED TO IT, ANY CONTENT ON THE VIRTUAL GATEWAY OR SUCH OTHER WEBSITES, INCLUDING ANY DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO, PERSONAL INJURY, PAIN AND SUFFERING, EMOTIONAL DISTRESS, LOSS OF REVENUE, LOSS OF PROFITS, LOSS OF BUSINESS OR ANTICIPATED SAVINGS, LOSS OF USE, LOSS OF GOODWILL, LOSS OF DATA, AND WHETHER CAUSED BY TORT (INCLUDING NEGLIGENCE), BREACH OF CONTRACT, OR OTHERWISE, EVEN IF FORESEEABLE. The exclusive remedy and EOHHS' entire liability for any dispute or claim related to Virtual Gateway services is the cessation of access and use of the Virtual Gateway.
Entity agreesto defend, indemnify, and hold harmless EOHHS and its service providers, and its and their respective officers, directors, employees, contractors, agents, licensors, suppliers, successors, and assigns from and against any claims, liabilities, damages, judgments, awards, losses, costs, expenses, or fees (including reasonable attorneys' fees) arising out of or relating to violation of this Agreement or use of the Virtual Gateway by Entity, Entity's Access Administrator(s), or Entity's End Users, including, but not limited to, use of any information obtained from the Virtual Gateway
6. Entity Acknowledgments. With respect to any use of the VG by its Access Administrators and End Users, Entity acknowledges that:
a. The registration details or other information required to receive or create a VG username, password or any other piece of information as part of EOHHS security procedures to access or submit information to the VG ("Access Methods") are non-transferable, and may not be shared with any other individual. Entity is responsible (i) for ensuring that the VG and the related Access Methods are provided to and used by only the applicable Access Administrator or End User and (ii) is responsible for any and all use and/or misuse of the VG by any person who accesses the VG using its Access Administrators' or End Users' Access Methods, whether or not Entity, its Access Administrators or End Users (as applicable) have authorized them to do so.
b. The VG may contain features that allow users to submit, display, or transmit content or materials (collectively, "User Contributions") on or through the VG. Entity understands and acknowledges that it is responsible for any User Contributions submitted or contributed by its Access Administrators and End Users, including the legality, reliability, accuracy, and appropriateness of any content. EOHHS is not responsible or liable to any third party for the content or accuracy of any User Contributions posted by Entity, its Access Administrators and End Users, or any other user of the VG.
c.The VG and its entire contents, features, and functionality (including but not limited to all information, software, text, displays, and images, and the design, selection, and arrangement thereof) are owned by EOHHS, its licensors, or other providers of such material and are protected by United States and international copyright, trademark, patent, trade secret, and other intellectual property or proprietary rights laws.
d. EOHHS reserves the right to exercise complete control over the access, use, disclosure, and disposition of the information in the VG. EOHHS reserves the right to amend the VG, and any service or material EOHHS provides on the VG, in EOHHS' sole discretion without notice. EOHHS will not be liable if for any reason all or any part of the VG is unavailable at any time or for any period. From time to time, EOHHS may restrict access to some parts of the VG, or the entire VG, to users.
7. Governing Law. Any actions arising out of this agreement shall be governed by the laws of Massachusetts and shall be brought and maintained in a state or federal court in Massachusetts which shall have exclusive jurisdiction thereof.
8. No Waiver. It is specifically agreed between the parties that failure of any of the parties to insist upon compliance of any provisions herein at any time shall not waive such compliance with such provision at any other time. No waiver by any party of any default or breach hereunder by the other shall constitute a waiver of any subsequent default or breach. The rights and remedies herein provided shall be cumulative and not exclusive of any rights and remedies provided by law.
9. No Third Party Beneficiaries. The parties do not intend by this Agreement to create any enforceable rights in debtors, third parties or other similarly situated persons. Any benefits flowing to debtors, third parties or others as a result of this Agreement are merely incidental, and all rights, obligations, benefits and duties are enforceable solely by the parties hereto.
10. Relationship to Other EOHHS or Agency Agreements. This Agreement is in addition to, and not in place of, other agreements that entity has entered into with EOHHS or its agencies.
11. Termination. This Agreement shall commence and shall continue in effect until terminated by either party by written notice given to the other party thirty days prior to the intended termination date. EOHHS may discontinue or suspend the provisions of this Agreement immediately without notice if it determines that any term of this Agreement has been violated. In addition, EOHHS may terminate any user's access to the VG at any time, with or without cause, without notice and without penalty. None of the foregoing shall be construed: (1) to relieve user of any of the responsibilities imposed by these Terms or by applicable law; or (2) to waive any rights or remedies that EOHHS possesses in the event of unauthorized access to or use of the VG.
12. Additional Terms Applicable to EIM/ESM Services. Entities who use or access the Enterprise Invoice Management business service ("EIM") and/or the Enterprise Service Management business service ("ESM") services, on behalf of itself, its Access Administrators, End Users, shall agree to the following additional terms with solely respect its use and access EIM/EMS services on the VG:The EIM business service permits End Users to transmit, access and receive information related to invoice and claims data for service deliverables and individual client claims. The ESM business service permits End Users to transmit, access and receive information related to applicants for or recipients of services from the End User or an EOHHS Agency. Entity agrees that it, and its End Users, shall promptly submit all invoices, claims and required data fields, and utilize EIM/ESM in the manner described by EOHHS and/or the EOHHS Agency. Entity and its End Users shall follow all general EIM/ESM policies, procedures, and operating instructions, as well as any specific EIM/ESM requirements of EOHHS and/or the EOHHS Agency and shall take all necessary steps to ensure that its employees, contractors, agents and affiliates who are authorized to use EIM and/or ESM appropriately utilize the EIM business services. Such actions may include, but are not limited to: (a) ensuring that required access documents are executed; (b) assigning and monitoring appropriate security roles; (c) providing additional providerlevel training if necessary; and (d) providing supervision and provider-level support for the specified business service(s) if necessary. Additionally, Entity shall ensure that its End Users who are authorized to use EIM and/or ESM complete all training required by EOHHS and/or the EOHHS Agency to facilitate the transition from existing services to the EIM business services.
13. Entire Agreement; Survival. The terms and conditions of this Agreement that by their nature are intended to survive shall survive notwithstanding termination of this Agreement, including without limitation, terms relating to warranty and disclaimers thereof, liability and limits thereof, indemnity, and protection of personal information. Entity hereby accepts and agrees to this Agreement and acknowledges that this Agreement and any other terms and conditions which may be required by EOHHS shall constitute the sole and entire understanding between Entity and EOHHS concerning access and use of the VG and supersede all prior and contemporaneous understandings, agreements, representations, and warranties, both written and oral, regarding such access and use of the VG.
