Intrahealth Terms and Conditions

Updated on: January 8, 2024

Effective From: January 1, 2024

Introduction

1. These terms: These general terms of use (terms), and any other agreement or specific terms you agree with us, describe our relationship and set out the basis on which we provide our services (services) to you. We may make changes to these terms from time to time and will tell you about any important changes before we apply them. By subscribing to our services and continuing to use them, you agree to comply with these terms (including any changes to them).
2. Who’s who: In these terms, references to “we”, “us” or “our” mean Intrahealth Systems Limited and/or its related companies and/or affiliates, and references to “you” mean the person or organisation that subscribes to and pays for our services.

A bit about our services and terms

3. Core services: We supply innovative software solutions to healthcare markets around the world. Our most common core services include:
   • Healthcare Administrative Electronic Health Records Systems (EHCRs) – an integrated administrative management and electronic healthcare records package designed for operation by clinicians and administrative staff (branded by jurisdiction and market segment: “Profile”, “HCC”, “Legend”, “Fusion” etc).
   • Population Health tools, data aggregation and clinical analysis.
   • Integration Engine.

4. Modules: We also offer “add on” modules (functionality) or applications that integrate into our core services (modules), including:
   • Case management – divides the EHCR into segments, allowing separate control and management of types of care.
   • Contact Tracing – outbreak management and care.
   • Wait Lists – for delayed services.
   • Homecare – additional services for delivery of care outside your institution.
   • Accession – gives patients and you access to permitted elements of their systems record through an internet browser.
   • Aero – cross-platform apps (EHCR agnostic but integrated into the Intrahealth platform) which enable patients and you access to packages of functionality and information through a mobile device.
   • SMS Text Messaging – integrated SMS messaging functionality for contacting patients about appointments, interventions and results.
   • Virtual Care (including Telemedicine) – an integrated telemedicine solution.
   • eFax – enables the sending of faxes directly from the EHCR to the selected recipient.
   • eSignature – enables the electronic signing of documents (including prescriptions and letters) directly on the screen by mouse or via a Topaz Signature Pad.

5. Hosting: Our services can be hosted locally by you (on your own physical architecture), in a cloud environment, or delivered by us as a “software as a service” (SAAS) model. If we (or our hosting partners) are hosting the services for you, then the terms and conditions that apply to you may vary depending on your jurisdiction. More information is set out in the “Hosting” section of these terms.
6. Application of these terms: These terms apply to all of our services (including new services), not just the services referred to in these terms.
7. Third party terms: Some of our services (or parts of them) may contain elements that are provided by our third-party partners. You agree to comply with any applicable third party terms.
8. Implementation and Support: We provide support to assist you with the implementation and use of our services.

Your right to use our services

9. Subscription agreement: When you subscribe to our services, we will enter a subscription agreement with you. The subscription agreement will set out:
   • the services to which you have subscribed (including any modules);
   • when your subscription period will start and renew;
   • who can use the services (which may include external parties, as permitted by the relevant service or explicitly agreed by us) (authorised users), including the charging method that applies to you;
   • the price(s) you will pay for using the services; and
   • any other specific terms that apply to you or your subscription.

10. Service request/SOW(s): When you subscribe to an additional module or service that was not included in your subscription agreement, we will enter a service request or (for some larger requests) a statement of work (SOW) with you. The service request or SOW (as applicable) will set out:
    • the additional module or service to which you have subscribed;
    • the scope of work and deliverables, including work that is “in scope” and work that is “out of scope”;
    • your and our respective contact persons;
    • any specific configuration settings;
    • when we will aim to make the additional module or service available to you;
    • the price(s) you will pay for the additional module or service; and
    • any other commercial terms that apply to the additional module or service.

Additional modules and services in a service request or SOW are deemed to form part of your subscription agreement and are subject to these terms.

11. Non-exclusive use: Your and your authorised users’ use of our services is not exclusive. Our other customers will also have the right to use our services.
12. Your access to the services: We will continue to allow you and your authorised users to use our services so long as:
    • you continue to pay for our services on time; and
    • you and your authorised users continue to comply with these terms and any other applicable terms (including third party terms).

13. How you can use our services: You and your authorised users must only use our services in the way we reasonably intend them to be used. For example:
    • our services can only be accessed and used by you and your authorised users (including external parties as permitted by the relevant service or explicitly agreed by us); and
    • you and your authorised users can only use our services for your own business purposes, and not in a way that is illegal or inconsistent with these terms or any other applicable terms.

14. Subscription period: Unless we explicitly agree otherwise (for example, in the subscription agreement), your subscription will run for an initial period of 3 years (initial period), and then automatically renew for subsequent periods of 1 year (each a renewal period). If you do not want your subscription to renew, then you must tell us at least 90 days before the end of the initial period or a renewal period. You may terminate your subscription before the end of your term, with (90) days’ written notice. Upon termination, you will have to pay an amount equal to the monthly subscription charges for the remaining balance of the term, including any renewal terms which you have agreed to (as liquidated damages, and not a penalty).

Your responsibilities

15. General: Generally speaking, you are responsible for everything to do with your subscription, including:
    • all access and use of our services under your subscription (regardless of who actually uses them);
    • informing us of any increase in the number of people using the services (in excess of the authorised users);
    • the way that you and your authorised users use our services, including your communications with patients;
    • the accuracy of any data that is inputted, uploaded or developed by you and your authorised users (including patient health data), and any other information that you provide to us;
    • telling us if there are changes to your contact details or normal business hours;
    • paying for your subscription, including any backdated charges; and
    • otherwise meeting your obligations under these terms and any other applicable terms.

16. Security: You must make sure that you and your authorised users keep your login details for our services (including passwords) confidential, and do not provide those details to any other person. You must also maintain strong security on your own systems and tell us immediately if you suspect or know of any unauthorised use of our services.
17. Appropriate judgement: Our services should only be used by suitably qualified or trained persons and do not replace your or your authorised users’ administrative or clinical judgment.
18. Backup: Unless we host your production environment (in which case, see the “hosting” section of these terms), you are responsible for maintaining your own backups.
19. Data loss: You are responsible for keeping regular and accurate backup copies of any data that you input, upload or develop within our services.

Our responsibilities

20. General: Generally speaking, we are responsible for the services that we provide to you and your authorised users, including:
    • making the services available to you and your authorised users;
    • providing support in relation to the services;
    • otherwise meeting our obligations under these terms and any other applicable terms.

21. Modifications etc: We may release updates, modifications and upgrades to our services from time to time. We will aim to make those updates, modifications and upgrades available to you provided there are no outstanding charges under your subscription.
22. Support: We will provide you with a system to register a support request (ticket) by telephone or online within your jurisdiction’s normal business hours. We will track, prioritise, and resolve tickets based on:
    • the severity of impact on business operations and patient safety; and
    • the level of support we have contracted for (if any) in the subscription agreement.

Charges and payment 

23. Charges: The subscription agreement and service requests/SOWs will set out the price(s) that apply in relation to your subscription (charges). We will review, and may change, the charges annually. Any changes will take effect on the first day of the next renewal period. If we are increasing the charges, we will tell you what your new charges will be at least 45 days before your subscription period renews.

24. Charging methods: We use different charging methods, depending on your location and individual circumstances. The charging method that applies to you will be set out in the subscription agreement, or any variation of it. Charging methods include:
    • Medical clinic: Under this charging method, you will be charged a rate (MD rate) for one medical doctor (MD) plus two support staff who assist that MD with the administrative and limited clinical activities required for the MD to deliver the MD’s services (support staff). Any additional support staff will be charged at 30% of the MD rate. A part-time MD that works less than 50% full time equivalent (FTE) is charged at 50% of the MD rate and allocated one support staff. There is a minimum charge for the clinic of one MD equivalent.
    • General clinic: Under this charging method, the rate per authorised user is indexed off the MD rate. A part-time MD that works less than 50% FTE is charged at 50% of the MD rate. Other healthcare providers, including nurse practitioners and allied health, are charged at 40% of the MD rate. Support staff (who do not deliver care) are charged at 30% of the MD rate. There is a minimum charge for the clinic of one MD equivalent.
    • Concurrent user or distinct concurrent user:  Under this charging method, a monthly base rate is charged with concurrent user licenses sold in agreed blocks of users. Unless we explicitly agree otherwise, each block is for 25 concurrent users. An additional block must be purchased before additional users start using the services. The charge per block reduces as the number of concurrent users increases, and will be consistent over the relevant subscription period in a way that will be described to you during the sales process.

Regardless of which charging method applies, you must tell us immediately if the number of people using our services exceeds the number and type of authorised users. We will adjust the charges to reflect the additional users with effect from the start of the month in which we authorise or become aware of those additional users.

You cannot change the charging method for your subscription without our explicit agreement.

25. Payment: We will normally invoice you monthly for the charges (or on completion of a service request/SOW). However, we may invoice you more or less frequently at our discretion (including on completion of a service request/SOW, or for charges for variable services such as SMS Text Messaging and Telemedicine). You must make sure the charges are paid to us by the due date on the invoice (except for any amount that is genuinely disputed). If you are paying by direct debit, we will deduct the charges from your nominated bank account on the 1^st day of each month, and you must make sure we have your correct bank details.
26. Taxes: You are responsible for paying any applicable taxes on the charges that apply in your jurisdiction. We will supply you with the required invoices.
27. Overdue charges:
    • Interest: Overdue charges will accrue interest at a rate equal to 5% above the typical prevailing overdraft rate from our principal bank, from the due date until the date of payment.
    • Suspension: If any charges are overdue by more than 30 days, we can limit your authorized users’ access to read only to all or parts of the services. Your subscription period will continue to run, and you will remain liable for all charges that accrue during the read-only period (in addition to all overdue charges and interest).

At all times, Intrahealth will endeavour to protect patient safety by making access to clinical information the last component to be discontinued.

Hosting

28. Application of this section: This section on “hosting” applies if we (or our hosting partners) host our services for you (also referred to as SAAS). In this section, a hosted site is one where we hold and manage the database in a common facility, shared with others. If you host the services locally on your own physical infrastructure, then this section does not apply (and you will be responsible for the subject matter covered within it).
29. Scheduled uptime / availability: We will aim to make our services available at least 97% of the time during the period from 1 hour before until 2 hours after your normal business hours. Outside those times, our services will generally remain available, but we can perform maintenance on your system. If we perform maintenance, and any of your authorised users are still logged in, we will provide a pop-up notification within our core services at least ten minutes before the intended shut down, noting the likely duration and an emergency phone number in case you need us to defer the maintenance. We will do our best to minimise any downtime and perform maintenance during non-peak hours.
30. Scheduled shut down:  We can take a hosted site (including your database) down for scheduled service:
    • once a week for two hours;
    • once a month for four hours;
    • twice a year for 12 hours; and
    • once a year for 24 hours,

even if this occurs during your normal business hours. We will aim tell you about any scheduled outage before it takes place.

31. Site down support: We offer 24/7 mobile phone support for “site down” issues for hosted customers.
32. Good citizen. Although your database will be kept logically and strictly separate from our other hosted customers, it operates on shared equipment. That means your actions can affect other users and sites. You must be considerate of this, and only undertake back-end database and processor-intensive activities outside your normal business hours. We reserve the right to restore your system to original settings, and to terminate any excessive processes.
33. Privacy: We will comply with all applicable privacy laws in your jurisdiction and operate in a way that is consistent with industry standards for holding Identifiable Personal Health Information (PHI). As your “information manager”, we will not release or move your PHI without your explicit consent, except in the delivery of the services as agreed. You agree that you are responsible for advising your patients or clients that Intrahealth is the information manager, as necessary. You agree that you are responsible for obtaining any necessary consents and acknowledgements for this purpose. At the end of the subscription, we will work with you to transfer or securely dispose all PHI. At all times, you are the “information custodian”, making all decisions on the collection, use, and disclosure of information. The sole exception is where we are required by a formal court order to disclose information to the appropriate bodies.
34. Security: We will maintain security protocols that are consistent with industry practice to protect against accidental damage to, or destruction, loss, or alteration of any data. Attacking centralised data centres is a risk, and you must be vigilant to protect access to your system with appropriate passwords and security processes. We will tell you about any incidents we become aware of that our support team has classified as Severity 1 (Critical) or Severity 2 (High).
35. Threat and Risk Assessments (TRA): We will periodically carry out TRAs on the hosted site, or a similarly structured site. You can request additional TRAs at your cost.
36. Our backup policy: We will make full backups once a week, and differential backups (saving only new data since the last full backup) every night. Unless we explicitly agree otherwise (for example, in the subscription agreement), we retain backups for a period of 30 days. After this period, the backups will be automatically deleted. We do not guarantee the availability or restoration of any data or content beyond this 30-day period.
37. Database size: The subscription agreement will set out the maximum size (capacity) of your database. We can charge you for any additional data in excess of the agreed database size, which may be based on your projected size over the subscription period, averaged for the remainder of the subscription period.
38. Disaster Recovery Plan (DRP):  We maintain a DRP, which sets out what happens if an entire data centre is destroyed (for example, due to an earthquake). Our DRP varies by jurisdiction, but essentially involves us recreating your environment and restoring the most recent available database into it. Depending on the nature of the disaster, and the time imperative, the DRP site might not offer the exact same levels of performance until a more definitive solution can be provided.
39. Return to Operation (RTO): Our RTO policy depends on the nature of the loss of service. However, if you experience an unscheduled loss of service, we will work consistently to return you to full service.
40. Bandwidth, latency, and connection:  We recommend latencies of <20ms for good performance, although the system will operate (albeit with performance degradation) with higher latencies than this. The bandwidth you require will depend on the size of your operation. We are not responsible for performance degradation if your bandwidth, or use of the site incoming bandwidth, is used for other purposes (such as streaming video or sound). You are responsible for prioritising your data from our services over other uses.
41. Performance: If there are any sustained performance issues with our services, we will use built-in tools to help diagnose the issue. If those performance issues are caused by us, we will correct them as soon as possible without charge. We are not responsible for any performance-related issues that are outside our reasonable control (for example, internet congestion). If we reasonably believe that the performance issues are caused by you, and that you have caused our other customers to experience performance issues, we can charge you for all reasonable expenses incurred to diagnose and resolve those performance issues.
42. Changing hosting provider: We can change our hosting provider from time to time. We will only do so if we reasonably believe the hosting service from the new provider will be the same or better than the current hosting provider.
43. Claims regarding availability: Subject to clause 57 (Limitation of liability), your sole remedy against us and our hosting partner regarding system availability is for (and limited to) a pro-rata credit for the hosting costs for the month in which the availability issues occurred. All claims for credit must be accompanied by evidence to substantiate the availability issue. By submitting a claim for credit, you grant us access to your database for validation purposes. The decision to issue a credit is at our sole discretion.

Third-party content

44. Our services may contain information that is provided by or sourced from third parties, including drug databases (third party content). All third party content is provided on an “as is” basis, and we are not responsible for its accuracy, completeness, or fitness for purpose. You are responsible for complying with any terms and disclaimers that apply to that third party content, including as published on the third party provider’s website. Third party content must only be used in the manner and for the purposes in which it is intended to be used. All third party content must remain in our services unless otherwise permitted. You must not reverse engineer it for use outside our services unless you are expressly permitted to do so.  If a third party provider charges us for your access to their third party content, then you agree to pay those costs (which we may disburse to you as charges under these terms).

Specific modules

45. Application of this section: This section on “specific modules” applies if you subscribe to a module (either in the subscription agreement or a service request/SOW).
46. General: Unless we explicitly agree otherwise, the pricing for specific modules is available here, and those terms are in accordance with the terms and conditions. 
    The following additional terms apply to all modules:
    • If you subscribe to a module in a service request/SOW, we will invoice for the relevant charges on completion of that service request/SOW. You must pay those charges in accordance with these terms.
    • We are not responsible for any changes to the configuration of the services that are not made by us.
    • We are not responsible for ensuring the successful receipt of any outgoing message/link, nor that any outgoing message will not be read by an unintended recipient.
    • We are not responsible for any clinical outcomes or patient authentication.
    • The time and regional settings on your server will impact the time messages are sent.
    • You are responsible for ensuring you have a policy around consent when required, and an “opt-in” or “opt-out” process.

47. SMS Text Messaging: The SMS Text Messaging module allows for the sending of SMS messages to a participating patient. The SMS message functionality can be incorporated into many aspects of the services, including Appointments, Interventions and Results. The outgoing and incoming message history is maintained within the service for review and action. If you subscribe to this service then, unless we explicitly agree otherwise, the following additional terms apply:
    • A compatible version with suitable configuration is required.
    • You can optionally attempt to process responses.  Given the asynchronous nature of SMS, the configuration will make a best-effort attempt to link to the appointment or other initiating element.
    • There may be limitations due to the complex nature of healthcare appointments – discuss these with your sales representative.
    • Configuration of your network if required is your responsibility.

48. Virtual Care (including Telemedicine): The Virtual Care module allows for a completely integrated telemedicine consultation – whether the consultation is virtual or in-person, the health organisation workflow remains the same. If you subscribe to this service then, unless we agree otherwise, the following additional terms apply:
    • A compatible version with suitable configuration is required.
    • No patient clinical data is stored (documents shared between conference participants are always AES-256 bit encrypted and deleted either on recipient download, or closing the appointment), the Telemedicine session is streamed directly between the two views, not relayed (meetings of 3 or more people may be relayed), and no customer or other data is stored outside our control.
    • Sending a link is required, so email or SMS transmission is required.
    • Quality of the session cannot be guaranteed due to the high number of factors influencing this.
    • Configuration of your network if required is your responsibility.

49. eFax: The eFax module allows for the sending of faxes directly from the service. The eFax functionality is incorporated into many but not all aspects of the service, including Letters, Prescriptions, Requisitions, and Forms. If you subscribe to this service then, unless we agree otherwise, the following additional terms apply:
    • A compatible version with suitable configuration is required.
    • The outgoing fax history is maintained within the service for review and action. Incoming faxes will continue to be managed through the Scan Processor module.
    • eFax is not available in all jurisdictions.
    • Configuration of your network if required is your responsibility.

50. eSignature: The eSignature module allows for electronic signing of documents on-Screen by mouse, or via a Topaz Signature Pad. The eSignature functionality is incorporated into many aspects of the service, including Letters, Prescriptions, Requisitions, and Forms. If you subscribe to this service then, unless we explicitly agree otherwise, the following additional terms apply:
    • A compatible version with suitable configuration is required.
    • Supported eSignature devices: Topaz Signature Pads (Recommended Models: T-S460, T-L(BK)460, T-L(BK)462 (https://www.topazsystems.com/signaturepads.html).  Requires using Windows Desktop application.
    • Configuration of your network if required is your responsibility.

51. Speech and language technologies: These technologies allow for the entering of clinical notes or dictating of letters in the EHCR. If you subscribe to this service then, unless we explicitly agree otherwise, the following additional terms apply:
    • As speech and language technologies are built on Microsoft Cognitive Services, they are subject to the same limitations and abilities of that Microsoft service.
    • You are responsible for ensuring that the output is accurate.

Your privacy and data

52. Privacy: We collect information about you and your authorised users (including personal information about these users) when you subscribe to and use our services. The types of information we collect and the ways that we use, share and protect it, are set out in our privacy policy, which is available at intrahealth.com/privacy-policy.
53. Your data: You and your authorised users own all of the data that is inputted, uploaded or developed within our services under your subscription (including PHI), and (subject to the remainder of this section on “your privacy and data”) grant us the right to use that data so that we can:
    • provide the services to you and your authorised users;
    • develop and improve our services, and create new services; and
    • create anonymised statistical data, which will be used to create new services or products and will also include subscriber or user data.

54. Identifiable Personal Health Information (PHI): We will not access PHI except in extreme cases and only with your explicit consent.
55. Sending us data: If you send us data (including PHI) for analysis, you must encrypt that data or otherwise remove any confidential or personal information relating to patients before sending it to us.  The password must be at least 8 characters long and sent to us separately from the database itself.
56. Data breaches: We will tell you about any data breaches we become aware of that relate to your use of our services. We are not responsible for any data breaches that result from you failing to maintain adequate security of your systems and data.

Liability and indemnity

57. Limitation of liability: Other than liability THAT we legally cannot limit or exclude, our liability to you under or in connection with your subscription and use of our services is limited as follows:

• We are not liable to you for any damages for loss of revenue, profit, goodwill, reputation, earnings, customers, anticipated savings, data, or any other financial or economic benefit, that arises out of your or your authorised users’ use of the services.
• Our liability for loss or corruption of your data is limited to us taking reasonable steps to recover that data from our available backups.
• Our total aggregate liability, in all circumstances, is limited to the total charges you have paid us under your subscription in the 12 months immediately prior to the date of your claim.

58. Indemnity: You indemnify us against all losses, costs (including legal and debt recovery costs), expenses, demands or liability that we incur arising out of, or in connection with, a third party claim against us relating to your use of the service (except to the extent that the claim relates to an issue that has been caused by us).

Intellectual property

59. Our intellection property (IP): We (or our licensors) own all of the rights, including all intellectual property rights, in the services (including all software, underlying source code and content). You must not do anything that could interfere with those rights. We have obtained all required permissions, licenses and rights from third parties to use certain intellectual property and have the full right and authority to provide, market and license the services to you.
60. Your IP: You own all of the rights, including intellectual property rights, in the data that is inputted, uploaded or developed within our services under your subscription. We will not do anything that interferes with those rights.

Confidentiality

61. Both parties must take reasonable steps to protect the other party’s confidential information. We can disclose your confidential information to a regulatory authority if we are legally required to.

Disputes

62. We will try to resolve any issues you have through our support team, and ask that you contact our support team in the first instance. If our support team cannot resolve the issue, we will escalate the issue to senior manager who will try to resolve the issue with you.

Termination

63. Termination: In addition to any other termination rights in these terms, either party can terminate your subscription if the other party has breached these terms (or any other applicable terms) and has failed to remedy that breach within 30 days of being asked formally requested in writing to do so.
64. After termination: If your subscription is terminated or otherwise comes to an end, you must:
    • stop using our services;
    • delete our services (including any copies) from your and your authorised users’ systems;
    • pay all charges that accrued to the date of termination; and
    • in the case of termination by us for a breach by you, pay all monthly subscription charges for the remaining balance of the term (which represents a genuine pre-estimate of liquidated damages, and not a penalty).

We shall work with you to transfer the data in accordance with the terms of this agreement. If we do not receive direction from you with respect to the data by the termination of the subscription, or if our requests for direction go unanswered, we shall permanently delete all data after a reasonable amount of time. If, unless otherwise agreed in writing, you continue to use our software after termination you will be invoiced at the full cost for the use of the software

Data extraction

65. At any point while your subscription is active, at contract termination, or at wind up of the Company, if you or an authorised user wish to extract your user data from our services, then we can (at your request and cost):
    • print the data as PDFs;
    • generate the data as PDF files;
    • generate the data in our portable JFA format;
    • generate the data in a jurisdictional export process (if supported by us).

Some extraction may be available as end-user functionality, and some fidelity is lost each time data is moved.

Other general terms

66. Changes to these terms and other applicable terms: We can change these terms from time to time, and any change will be effective from the date advised by us.  We will tell you about any important changes before we apply them. By continuing to use our services you agree to comply with the terms as changed.
67. Priority: To the extent there is any inconsistency between these terms and any other terms that apply to our services (including the subscription agreement, a service request/SOW or any third party terms) then unless we explicitly agree otherwise those documents will be interpreted in the following descending order of precedence (from high priority to low priority):
    • first, the subscription agreement;
    • second, these terms;
    • third, a service request/SOW; and
    • fourth, the third party terms.

68. Consumer laws: You agree that you are acquiring our services for business purposes, and that  the consumer laws in your jurisdiction do not apply (to the extent that contracting out of or limited consumer laws is legally possible in your jurisdiction). Any statutory warranties or guarantees that cannot legally be limited or excluded (including under the Consumer Guarantees Act 1993 in New Zealand) still apply.
69. Events outside our control (force majeure): We (and our third party partners) are not liable for any failure to provide our services if we are prevented from doing so by an event that is outside of our reasonable control.
70. Communicating with each other: If these terms (or any other applicable terms) require you to tell or ask us something (for example, you need to give us notice), then you must send an email to our email address as noted in the subscription agreement. If we need to tell or ask you something, we will usually send an email to your email address as noted in the subscription agreement, but may also post notifications, and changes to these terms, on our website or as a pop-up within our core services.
71. Electronic messages: You and your authorised users consent to receiving electronic messages from us and our third-party partners regarding our services.
72. Assignment: Your subscription is personal to you. You must not assign your subscription, or any of your rights or responsibilities under it, to any other person without our written consent (such consent to not be unreasonably withheld).
73. Our relationship: Our relationship is one of supplier (us) and customer (you). Neither party is a partner, agent, employee or joint venture of the other.
74. Waiver: Just because a party fails or delays to exercise any right or remedy available to it under these terms (or any other applicable terms) does not mean that party has waived that right or remedy.
75. Invalidity: If any part of these terms is or becomes invalid or unenforceable, then we will ignore that part. All other parts will remain unaffected and enforceable.
76. Remedies cumulative: A party’s rights and remedies in these terms (and any applicable terms) are cumulative, and not exhaustive, of any other legal rights.
77. Governing law: Unless agreed otherwise in the subscription agreement, these terms and your subscription are governed by the laws of British Columbia, Canada, and the parties submit to the non-exclusive jurisdiction of the courts of British Columbia, Canada.

INTRAHEALTH AND SUBSCRIBER OBLIGATIONS FOR EMR USERS IN NEW BRUNSWICK

Part 1 PERSONAL HEALTH INFORMATION

---

1.1 Protection of Personal Health information

The Subscriber agrees to comply with, and cause all employees, contractors, and agents to comply with, PHIPAA and all other applicable provincial and federal privacy legislation. The Subscriber, as a custodian, hereby appoints Intrahealth as an information manager for the purposes of providing the Services. The Subscriber agrees to provide Intrahealth with consent to allow it to share information on its subscription of the EMR Solution with OntarioMD.

Intrahealth shall protect data in accordance with applicable privacy legislation and regulations (e.g., PHIPAA), and shall comply with the medical record requirements of the College of Physicians and Surgeons of New Brunswick.

Part 2 DATA SHARING THROUGH INTRAHEALTH

---

2.1 Additional Definitions for Part 2

In this Part 2:

“Data Sharing Agreement” has the meaning set forth in Section 2.2;

“Electronic Health Record” or “EHR” means the information system owned, managed by and in the custody or under the control of DOH, designated under the EHR Designation as an information network pursuant to Section 37(6)(c)(iii) of PHIPAA;

“EMR Solution” means the computerized system, operated by Intrahealth, installed in physician offices and connected with the EHR Infrastructure, that will enable Health Care Providers to view all available clinically relevant data through a single “viewer”, as well as store, retrieve, and manipulate clinical information electronically;

“Integration Point” means the technology implemented, maintained and housed by the New Brunswick Department of Health to allow for two-way integration of the EMR Solution with the EHR;

“Recipient” with reference to Shared EMR Solution Data means DOH, and with reference to Shared EHR Data means the Subscriber;

“Shared EHR Data” means the EHR data elements described in Part II of Schedule C and shared with health care providers under this Agreement;

“Shared EMR Solution Data” means the EMR data elements identified in Part I of Schedule C and shared with DOH under this Agreement; and

“Shared PHI” means (i) with reference to the Subscriber as a Recipient, Shared EHR Data, and (ii) with reference to DOH as a Recipient, Shared EMR Solution Data.

2.2 Data Sharing Agreement

The Parties acknowledge that, as part of the New Brunswick EMR program, the New Brunswick Department of Health and the New Brunswick Medical Society have entered into an agreement providing for the electronic exchange of certain specified data elements between the EHR and the EMR Solution (the “Data Sharing Agreement”).  To enable that exchange of data as it relates to the subscriber’s patients and the EMR Solution, the Parties agree to comply with the requirements of this Part 2, as and to the extent permitted by applicable law and the subscriber’s professional obligations.

2.3 Transfer of Shared EMR Solution

The Subscriber acknowledges and agrees that the EMR Solution will allow transfer of Shared EMR Solution Data through the Integration Point to the EHR, as contemplated by the Data Sharing Agreement.  The subscriber shall not, and shall ensure that EMR users do not, do anything to prevent or interfere with such transfer as permitted by the operation of the EHR and the EMR Solution.

2.4 Transfer of Shared EHR Data

As and to the extent permitted under the Data Sharing Agreement, Intrahealth shall cause the EMR Solution to allow transfer of Shared EHR Data through the Integration Point to the EMR Solution.  Intrahealth shall not do anything to prevent or interfere with such access as permitted by the operation of the EHR and the EMR Solution.

2.5 Compliance with PHIPAA

The Parties acknowledge and agree that:

– the collection, use and disclosure of Shared EMR Solution Data as contemplated by this Agreement is governed by and shall be carried out by each Party only in accordance with and to the extent permitted by PHIPAA; and

– the collection, use and disclosure of Shared EHR Data as contemplated by this Agreement is governed by and shall be carried out by each Party only in accordance with and to the extent permitted by PHIPAA and the EHR Designation.

2.6 Obligations of Recipients

The subscriber, as a Recipient, shall comply with the provisions of this Section 2.6.  Intrahealth represents and warrants to the subscriber that the New Brunswick Department of Health, as a Recipient, has agreed under the Data Sharing Agreement to comply with provisions substantially equivalent to the provisions of this Section 2.6.

1. The Recipient shall arrange for the immediate notification to Intrahealth’s Chief Privacy Officer or accountable person under PHIPAA if the Recipient becomes aware of any loss or unauthorized use of Shared PHI and assist the other Party in taking such steps as such Party considers necessary to prevent further unauthorized use.
2. The Recipient shall not use the Shared PHI for any purpose whatsoever except as expressly permitted under this Agreement and the EHR Designation.
3. The Recipient will comply with all applicable legal requirements in force from time to time with respect to Shared PHI, including PHIPAA, the Right to Information and Protection of Privacy Act (New Brunswick) and the Personal Information Protection and Electronic Documents Act (Canada).  Without limiting the generality of the foregoing, nothing in this Agreement shall be construed in a manner that would contravene or prevent a Party from complying with PHIPAA or such other or successor legislation in effect in the Province of New Brunswick from time to time.
4. The Recipient warrants that the Recipient is in compliance with all relevant statutory requirements with respect to collection, use and disclosure of the Shared PHI under this Agreement.
5. The Recipient shall take all reasonable steps with respect to Shared PHI in the Recipient’s custody or under the Recipient’s control to enable the exercise by an individual of his or her rights under PHIPAA, including rights to examine and require a correction of such individual’s Personal Health Information stored in the EHR or the EMR Solution.
6. Upon termination of this Agreement, all information provided to a Recipient under this Agreement shall be retained by the Recipient and continue to be subject to the same restrictions as to use and release as set forth in Section 2.5 and this Section 2.6.

2.7 Data Integrity

The Parties and their respective agents shall take all reasonable steps to ensure that the integrity of patient data is maintained, and shall use the tools and processes provided by Intrahealth and the New Brunswick Department of Health to resolve such data integrity issues.

2.8 Data Centres

Intrahealth only uses data centres located in Canada to store and back-up data contained within its EMR Solution. In the event Intrahealth has to use a data centre outside of Canada, or any data is transferred outside of Canada, Intrahealth shall immediately notify the Subscriber.

SCHEDULE C

SHARED DATA ELEMENTS

PART A – SHARED EMR SOLUTION DATA

PART B – SHARED EHR DATA