Terms & Conditions

This Services Agreement (“Agreement”) is entered into by and between Vizium360, LLC, a Delaware limited liability company, (hereinafter referred to as the “Company”), and the client individual or entity receiving services from Company as identified in the signed Order Form (hereinafter referred to as the “Client”). Company and Client may be referred to individually as a “Party” and collectively as the “Parties.”

  1. Term.

1.1 Term. Unless a different term is defined on the proposal, the term of this Agreement shall be for a period of one year commencing on the Service Start Date (the “Effective Date”) and ending one year thereafter. 

1.2 Renewal. Unless different renewal terms are defined on the proposal, this Agreement shall renew automatically for successive periods of one (1) year each thereafter (each a “Renewal Term”), with services billed monthly as described in Section 3.1.  

1.3 Termination. Either Party may terminate this Agreement at any time and for any reason with sixty (60) days’ written notice. Such termination shall take effect at the end of the notice period without further notice or action by either Party.  

1.4 Survival. Sections 2.1 - Maintenance of Intellectual Property Protection, 3, 4, 6, 7, 8, 10, and 14 shall survive termination or expiration of this Agreement.

  1. Responsibilities and Obligations of the Parties.

2.1 Responsibilities and Obligations of Client. 

  1. Client shall either provide Company with the names, mobile phones and e-mail addresses of patients of Client who have had or are considering having medical care, or Client shall provide Company with access to their practice management system so that reports may be pulled that include this information.
  2. Maintenance of Intellectual Property Protection. Client shall not remove, disable, manipulate or otherwise adversely affect any means or device intended to prevent unauthorized use or reproduction of any underlying software, process, methodology, analysis or know how (collectively, the "Vizium360 Products"), including, without limitation, removal or obscuration of any copyright, trademark notice or restrictive legend. Except as otherwise expressly permitted by this Agreement, Client shall not (i) decompile, reverse engineer or disassemble the Vizium360 Products or otherwise attempt to reconstruct or discover any of Vizium360’s trade secrets; (ii) disclose, disseminate, grant access to, copy, reproduce, deliver, transmit, publish, display, sublicense, lease, rent, lend, assign or otherwise transfer any Vizium360 Products, or any portion thereof or any derivation thereof, via any medium whatsoever, by operation of law or otherwise to any third party, directly or indirectly, without Vizium360’s prior written consent; or (iii) alter, hide or remove from any part of the Vizium360 Products any proprietary rights or copyright notices or identification that indicate Vizium360’s ownership interest therein. Without limiting the foregoing, in no event shall Client or its authorized users, directly or indirectly, use any of the Vizium360 Products to develop a product competitive with any Vizium360 Product. Client shall take any and all commercially reasonable actions which are reasonably necessary or desirable to prevent access to the Vizium360 Products which Client possesses or to which Client has access or use thereof by any person or entity not authorized hereby. Client shall ensure that its authorized users comply with the provisions of this Section 2.1(b). Client shall promptly notify Company in writing of any unauthorized disclosure or use of any Vizium360 Products of which Client becomes aware.

 

2.2 Responsibilities and Obligations of Company after Compensation Arrangement is Established. 

  1. License. After the parties have entered into a compensation arrangement as described below, on the terms and conditions set forth in this Agreement and for the Compensation set forth in Section 3, Company grants to Client a limited, nonexclusive, royalty-bearing right to (i) authorize and enable Client’s Eligible Patients to voluntarily participate in the Surveys on such terms and conditions as may be established by Company and Vizium360; and (ii) access and use the Vizium360 Portal to obtain the results of the Surveys and related patient satisfaction measurement data. Access to the Vizium360 Portal shall be restricted through the use of unique usernames and passwords, and the Vizium360 Portal shall be used only by Client’s personnel for the purposes of viewing and using the data compiled and made available under this Agreement. Client shall not allow any third party to access or view the Vizium360 Portal. The License shall terminate immediately upon termination or expiration of this Agreement.
  2. Set Up. Company shall assist Client with the establishment of its user account with Vizium360 and will provide advice and assistance to Client in connection with Client’s retrieval of data from the Vizium360 Portal.
  3. Invitation. Company shall e-mail or otherwise provide to each Eligible Patient identified by Client an invitation to complete a patient satisfaction Survey (the "Invitation").
  4. Surveys. Company shall provide Surveys available for completion by Eligible Patients.
  5. Survey Results. Company shall make the results of the Surveys and related patient satisfaction measurement data available to Client on the Vizium360 Portal. 
  6. Ratings and Reviews. Company shall publish survey ratings and patient-approved reviews on Company website(s), Client website(s) and those of allied organizations.

  1. Compensation.

3.1 Fees. As compensation for the services provided by Company, Client shall pay Company the compensation agreed upon as defined in the Order Form (“Compensation”). The One-Time Fee is due and payable within thirty (30) days of the Effective Date. The Recurring Fee is due and payable monthly in advance, based on an annual contract term. Client authorizes Company to charge the credit card on file or debit the account provided via ACH (Automated Clearing House) for all monthly payments. Services will automatically renew and continue monthly under the same terms unless cancelled in accordance with Section 1.3.  

 

3.2 Interest and Late Payment Penalty. Compensation not paid when due shall bear interest at the annual rate of twelve percent (12%) or the maximum rate of interest allowed by law, whichever is less. Payments shall be applied first to accrued interest and second to the outstanding principal amount owed. If payment is not received by Company on or before the date on which it is due, Client shall pay to Company a late fee equal to five percent (5%) of the past due amount.

 

3.3 Right to Suspend Services and Terminate for Nonpayment. If any payment due under this Agreement remains unpaid for more than thirty (30) days after its due date, Vizium360 reserves the right to suspend all services immediately and, at its sole discretion, terminate this Agreement without further notice. Such termination shall not relieve the Client of its obligation to pay all fees and charges accrued prior to the effective date of termination, including any applicable interest and late fees.

 

4. Confidentiality.

 

"Confidential Information" shall mean all information, in whatever form or media, provided by a party (the "Discloser") to the other party (the "Recipient") concerning its business, products, or services that are not generally known to the public including, without limitation, information relating to the Discloser’s business affairs, customers, vendors, trade secrets, prices, products, services, accounting, marketing, finances, business systems and computer programs.

 

"Confidential Information" shall also include all information, in whatever form or media, provided or otherwise made known or available to Client concerning Company or its business, products or services that are not generally known to the public including, without limitation, information relating to Company’s business affairs, customers, vendors, trade secrets, prices, products, services, accounting, marketing, finances, business systems and computer programs, underlying software, process, methodologies, analysis and know how. With respect to Company’s Confidential Information, Company shall be the "Discloser." 

 

Confidential Information does not include information that (a) was known to the Recipient before disclosure by the Discloser; (b) is or becomes information within the public domain (through no fault of the Recipient); (c) is independently developed by the Recipient; (d) is rightfully received by the Recipient from third parties not subject to an obligation of confidence to the Discloser; or (e) the release of which is approved by the Discloser in writing. 

 

Each Recipient agrees that any Confidential Information disclosed to or otherwise received by it will be used solely for the purpose of fulfillment of each party’s obligations under this Agreement or as otherwise permitted in this Agreement. Except as expressly authorized under this Agreement, without the prior written consent of the Discloser, the Recipient shall not use or disclose to any third party any Confidential Information disclosed by the Discloser to the Recipient, nor permit any third party to have access to such Confidential Information, nor use such Confidential Information for any purpose that will breach confidentiality or violate ownership rights. If the Recipient or any of its representatives are required or requested (by legal process, civil investigative demand or similar process) to disclose any Confidential Information, the Recipient will promptly notify the Discloser in writing so that the Discloser may seek an appropriate protective order or waive compliance with the confidentiality obligations of this Agreement by providing such waiver in writing. Each Recipient further agrees that, except as otherwise expressly provided under this Agreement, upon termination or expiration of this Agreement, each Recipient will immediately deliver to the Discloser all the materials and things embodying any of the Confidential Information and the Recipient shall not retain any copies or reproductions thereof nor shall the Recipient disclose of any such materials and things or copies or reproductions thereof to any third party.

4.1 Indemnification

Client agrees to indemnify, defend, and hold harmless Company and its officers, directors, employees, and agents from and against any and all claims, damages, liabilities, costs, and expenses (including reasonable attorneys’ fees) arising out of or related to: (a) Client’s unauthorized use, disclosure, or misuse of any Vizium360 Products; (b) Client’s violation of any applicable Privacy Laws, including but not limited to HIPAA; or (c) Client’s breach of its obligations under this Agreement.

4.2 Use of De-Identified Work for Marketing

Client grants Company the right to use de-identified, non-confidential elements of the services provided under this Agreement—including anonymized screenshots, website visuals, and general descriptions of project scope and results—for inclusion in Company’s portfolio, case studies, marketing materials, and promotional efforts. Client further authorizes Company to use Client’s name and logo solely for the purpose of identifying Client as a customer in marketing materials, proposals, and on Company’s website. Such use shall not include any Protected Health Information (PHI), confidential business information, or statements implying Client’s endorsement without prior written consent.

 

5. Notices.

 

Any notices given hereunder shall be in writing and shall be given or made by confirmed email, confirmed facsimile, by certified or registered mail or by overnight carrier with confirmed delivery notification, to the parties at the address indicated below, or to such other address as a party may specify by notice in accordance with this section. Any such notice shall be deemed to have been given on the date it is actually received.

 

6. Ownership of Data. 

 

6.1 Client shall own data collected by Company in connection with services provided by Company in accordance with this Agreement. Client may use data collected by Company or reported Results for any third-party reporting requirements. Client represents and warrants that it has procured all required consents, authorizations or permissions from each of Client’s Patients, Authorized Users, and other individuals to whom the Client Data relates that are necessary under applicable Privacy Laws. Client acknowledges and agrees that Vizium360  may acquire, use or disclose Client Data as required to perform Vizium360’s obligations under the Agreement or permitted under Privacy Laws. Client acknowledges and agrees that Vizium360 may use Client Data in creating data that is not individually identifiable (“De-identified Data”) in accordance with the applicable Privacy Laws, including HIPAA de-identification requirements. Vizium360 may use and provide to third parties such De-identified Data (i) in connection with providing the Products pursuant to the Agreement as well as same or similar products or services to other customers, (ii) for its or their internal business purposes to benchmark, analyze, develop and improve its or their product and services, and (iii) for any other purposes not prohibited by law, including commercialization of such De-identified Data. Vizium360 owns all right, title and interest in such De-identified Data and any data, information or material created with such De-identified Data. Vizium360 may grant licenses to third parties to do any of the foregoing with respect to De-identified Data (with rights to sublicense), but subject to the same restrictions as apply to Vizium360 hereunder.

 

6.2 Company shall be the sole and exclusive owner of all presentations and reports generated by Company as part of the Services provided in accordance with Agreement and made available to Client; provided, however, that Client shall have a perpetual, royalty-free, worldwide right and license to make copies of all presentations and reports delivered to Client by Company. All other intellectual property and proprietary rights of any kind relating to this Agreement, including without limitation, all computer programming, software and computer interfaces, know-how, methodologies, designs and processes, will remain at all times the sole and exclusive property of Company. Without limiting the generality of the foregoing, Client acknowledges that all rights, title and interest in and to the Vizium360 Products (and all copies thereof) and any portions thereof that may be embodied in a derivative work, including all associated patents, copyrights, trademarks, trade names, trade secrets, know-how and other intellectual property rights related thereto, are, and shall at all times remain, the exclusive property of Company.

 

7. Business Associate Addendum.

 

Client shall comply with the Business Associate Addendum to this Agreement set forth below. Client hereby agrees that Company shall be a subcontractor of Client as permitted by the Business Associate Addendum.

 

8. Disclaimer of Warranties and Limitation of Liability.

 

THE VIZIUM360 PRODUCTS ARE PROVIDED ON AN "AS IS" AND "WITH ALL FAULTS" BASIS AND COMPANY AND VIZIUM360 EXPRESSLY DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, REGARDING OR RELATING TO THE VIZIUM360PRODUCTS, OR TO ANY SERVICES OR OTHER MATERIAL FURNISHED OR PROVIDED TO CLIENT PURSUANT TO THIS AGREEMENT. VIZIUM360 SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE, AND ANY WARRANTY ARISING UNDER STATUTE OR OTHERWISE IN LAW OR FROM A COURSE OF DEALING, COURSE OF PERFORMANCE, USAGE OR TRADE PRACTICE. FURTHER, VIZIUM360 DOES NOT WARRANT, GUARANTEE, OR MAKE ANY REPRESENTATIONS REGARDING THE USE OF, OR THE RESULT OF THE USE OF, THE VIZIUM360 PRODUCTS IN TERMS OF CORRECTNESS, QUALITY, ACCURACY, RELIABILITY, OR OTHERWISE AND CLIENT RELIES ON THE VIZIUM360 PRODUCTS SOLELY AT ITS OWN RISK. NO ORAL OR WRITTEN ADVICE OR INFORMATION PROVIDED BY COMPANY, VIZIUM360 OR ANY OF THEIR RESPECTIVE AGENTS, EMPLOYEES OR THIRD- PARTY SUPPLIERS SHALL CREATE A WARRANTY, AND CLIENT IS NOT ENTITLED TO RELY ON ANY SUCH ADVICE OR INFORMATION. THIS DISCLAIMER OF WARRANTIES IS AN ESSENTIAL CONDITION OF THE AGREEMENT. IN NO EVENT WILL VIZIUM360 BE LIABLE FOR ANY SPECIAL, EXEMPLARY, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES ARISING UNDER TORT, CONTRACT, STRICT LIABILITY OR ANY OTHER LEGAL THEORIES ARISING FROM OR RELATED TO THIS AGREEMENT, EVEN IF VIZIUM360 IS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT WILL VIZIUM360’S LIABILITY FOR ANY CLAIM, WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, EXCEED THE PAYMENTS MADE BY CLIENT TO COMPANY UNDER THIS AGREEMENT IN THE SIX-MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO SUCH LIABILITY.

 

9. Entire Agreement; Modification; Effective Laws.

 

This Agreement shall constitute the entire agreement between Client and Company with respect to the subject matter hereof. Except as provided elsewhere in this Agreement to the contrary, no modification hereof shall be effective unless the same is in writing signed by Client and Company. This Agreement is entered into and shall be governed by and construed under the laws of the State of Connecticut. Any and all disputes arising under or out of this Agreement shall be brought in the City of Hartford, Hartford County, Connecticut.

 

10. Agreement Binding; Survival.

 

This Agreement shall be binding upon and inure to the benefit of the parties hereto, their heirs, successors and assigns. Client may not assign this Agreement or any of its rights or obligations hereunder without the express prior written approval of Company. Any assignment in violation of this provision shall be void and of no force and effect. All provisions hereof relating to rights or obligations regarding payment of amounts due or regarding indemnities shall survive the termination of this Agreement.

 

11. Captions and Titles.

 

All paragraph, section, addendum, and schedule titles contained in this Agreement are for convenience only and shall not be deemed a part of this Agreement.

 

12. Controlling Agreement.

 

This Agreement shall control the relationship between the parties and supersedes any prior agreements unless otherwise indicated.

 

13. Attorneys’ Fees.

 

If any party commences or is made a party to any litigation, arbitration or other proceeding to enforce, interpret or obtain a declaration of rights under this Agreement, the prevailing party in any such proceeding shall be entitled to recover from the other party reasonable attorneys' fees and costs incurred in connection with such proceedings, any appeal of such proceeding and the enforcement of any judgment obtained in such proceeding.

 

14. Counterparts.

 

This Agreement may be executed in two (2) or more counterparts, each of which shall be deemed an original but all of which together shall constitute one and the same instrument. Execution and delivery of this Agreement by delivery of a facsimile or electronically recorded copy (including a .pdf file) bearing a copy of the signature of a party shall constitute a valid and binding execution and delivery of this Agreement by such party. Such copies shall constitute enforceable original documents.

 

15. Waiver.

 

No waiver of any breach of any provisions of this Agreement will be effective unless made in writing. If any provision of this Agreement is deemed unlawful, void or for any reason unenforceable, it shall be deemed severable from, and shall in no way affect the validity or enforceability of the remaining provisions.

 

16. Force Majeure.

 

Neither party will be liable for any failure or delay in its performance under this Agreement, except the making of payments, due to causes which are beyond its reasonable control, including an act of God, act of civil or military authority, fire, epidemic, flood, earthquake, riot, war, act of terrorism, sabotage, failure of suppliers and remaining provisions.

 

17. Construction.

 

This Agreement has been negotiated at arm’s length and each party has been given the opportunity to be represented by legal counsel and to the extent each party has deemed necessary, each party has consulted with independent legal counsel with respect to such party's rights and obligations under this Agreement. Accordingly, any rule of law or legal decision that would require interpretation of any ambiguities in this Agreement against the party drafting it is not applicable and is waived. The provisions of this Agreement shall be interpreted in a reasonable manner to affect the intent of the parties and the purpose of this Agreement.

 

Business Associate Addendum

1. UNDERLYING FACTS / RECITALS

 

  1. Pursuant to this Agreement ("Services Agreement"), Company provides services to Client. In connection with the provision of such services by Company, Client may disclose to Company or Company may create or receive on behalf of Client certain Protected Health Information (“PHI”) and Electronic Protected Health Information (“EPHI”) that is subject to protection under the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C.A. Sections 1320d-1320d-7, 45 C.F.R., Parts 142 and 160 through 164, as amended ("HIPAA"). For purposes of this agreement, all references to PHI shall mean and include both PHI and EPHI.
  2. Client may be a "Covered Entity," as that term is defined in HIPAA. If Client is a Covered Entity, Company, as recipient of PHI from Client, is a "Business Associate" of Client, as that term is defined in HIPAA.
  3. Pursuant to HIPAA, all business associates of Client, as a condition of doing business with Client, must agree in writing to certain mandatory provisions regarding, among other things, the use and disclosure of PHI.
  4. The purpose of this addendum is to satisfy the requirements of the HIPAA Privacy Rule and Security Rule, 45 C.F.R. Parts 160 and 164, as amended by Title XIII of Division A of the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), as incorporated in the American Recovery and Reinvestment Act of 2009, and its implementing regulations and guidance issued by the Secretary of the Department of Health and Human Services (the ”Secretary”) at Federal Register, Vol. 78, No. 17, Page 5566, Friday, January 25, 2013 (the HITECH Omnibus Final Rule), as may be amended from time to time.

 

2. DEFINITIONS

 

Unless otherwise defined in this addendum, capitalized terms shall have the meanings set forth in HIPAA and the HITECH ACT, as amended.

 

3. APPLICABILITY

 

As used in this addendum, PHI means and includes (i) Individually Identifiable Health Information created or received by Company for or on behalf of Client; (ii) Individually Identifiable Health Information disclosed to Company by Client; and (iii) Individually Identifiable Health Information disclosed to Company to enable Company to perform services for Client pursuant to the Services Agreement. PHI does not include and this addendum is not applicable to Individually Identifiable Health Information created or received by or disclosed to Company in connection with services rendered by Company outside the scope of the Services Agreement.

 

4. USE AND DISCLOSURE OF PHI BY COMPANY

 

4.1 Permitted Uses. Company shall not use or disclose PHI for any purpose other than:

  1. as permitted or required by this addendum or the Services Agreement;
  2. for the proper management and administration of Company or to carry out the legal responsibilities of Company, if (i) the disclosure is required by law; or (ii) Company obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies Client of any instances of which it is aware in which the confidentiality of the PHI has been breached;
  3. Company may use PHI to provide Data Aggregation services as defined by HIPAA;
  4. Company may use PHI to create de-identified health information in accordance with the HIPAA de-identification requirements and Section 12.2 of the Agreement. Vizium360’s right to use such de-identified health information under this Section will survive the termination of this Addendum
  5. as required or allowed under HIPAA and the HITECH Act; or
  6. as otherwise Required by Law. In no event shall Company use or disclose PHI in a manner that violates or would violate HIPAA if such activity were engaged in by Client. Further, Company shall use and disclose PHI only if such use or disclosure is in compliance with each applicable requirement of 45 C.F.R. Section 164.504(e) (i.e., the HIPAA standard with respect to business associate contracts).

4.2 Minimum Necessary Limitation. Company shall request from Client and disclose to its affiliates, subsidiaries, agents and subcontractors or third parties only the minimum amount of PHI necessary to perform or fulfill a specific function required or permitted under the Services Agreement.

 

5. SAFEGUARDS FOR THE PROTECTION OF PHI

 

Company shall implement and maintain such administrative, operational, technical and technological safeguards as are necessary to ensure that PHI disclosed to or created or received by Company is not used or disclosed by Company, or by any subcontractors, affiliates, or business associates of Company, except as provided in the Services Agreement and/or this addendum, and in so doing Company shall comply with all terms, conditions, and requirements of the HIPAA Privacy Rule and HIPAA Security Rule applicable to Company.

 

6. REPORTING OF UNAUTHORIZED USES OR DISCLOSURES

 

Company shall promptly report to Client any use or disclosure of PHI of which Company becomes aware that is not provided for or permitted in the Services Agreement, this addendum or HIPAA. Company shall permit Client to investigate any such report in accordance with the provisions of paragraph 14 of this addendum. Company shall ensure that any agents to whom Company provides PHI received from, or created or received by Company on behalf of, Client agree to the same restrictions and conditions that apply to Company with respect to such PHI.

 

7. MITIGATION

 

Company shall use commercially reasonable efforts to mitigate, to the extent practicable, any harmful effect of a use or disclosure of PHI of which Company becomes aware that is not provided for or permitted in the Services Agreement, this addendum, or HIPAA.

 

8. USE OF SUBCONTRACTORS

 

Company shall ensure that each subcontractor to whom Company provides access to PHI that is received from Client or that is created or received on behalf of Client enters into a HIPAA-compliant Business Associate Agreement with Company that contains, at a minimum, all of the requirements set forth in this addendum that are applicable to Company. Such agreement shall require that the subcontractor and each downstream subcontractor of the subcontractor comply with the terms of this paragraph 8 with respect to their subcontractors.

 

9. AUTHORIZED ACCESS TO PHI

 

Upon Client’s written request, Company shall make available PHI to Client in accordance with this Addendum for so long as Company maintains the PHI, in accordance with 45 C.F.R. §164.524. If Company receives a request for access to PHI directly from an Individual, Company shall forward such request to Client within ten (10) business days; and Client shall have the sole responsibility for approving such request and providing such access to the Individual.

 

10. AMENDMENT OF PHI

 

Upon Client’s written request Company shall provide PHI to Client for amendment, and incorporate any such amendments in the PHI for so long as Company maintains such information, in accordance with 45 C.F.R. § 164.526. If Company receives a request for amendment to PHI directly from an Individual, Company shall forward such request to Client within ten (10) business days. Client shall have the sole responsibility for approving such request and making such amendment.

 

11. ACCOUNTING OF DISCLOSURES OF PHI

 

Within thirty (30) business days of written notice by Client to Company that it has received a request for an accounting of disclosures of PHI (other than disclosures to which an exception to the accounting requirement applies), Company shall make available to Client such information as is in Company’s possession and is required for Client to make the accounting required by 45 C.F.R. § 164.528. If Company receives a request for an accounting directly from an Individual, Company shall forward such request to Client within ten (10) business days; and Client shall have the sole responsibility for providing an accounting to the Individual.

 

12. EPHI Reporting Requirements

 

Company shall report any Security Incident involving EPHI that is not an Unsuccessful Security Incident (as defined below) of which Company becomes aware without unreasonable delay, and in no case later than forty-five (45) days after discovery of the Security Incident. Company hereby notifies Client of pings and other broadcast attacks on a firewall, denial of service attacks, port scans, unsuccessful login attempts, interception of encrypted information where the encryption key is not compromised, and other Unsuccessful Security Incidents. Company will provide additional information about Unsuccessful Security Incidents on a reasonable basis, orally or in writing, if requested by Client. If the HIPAA security regulations are amended to remove the requirement to report Unsuccessful Security Incidents, the requirement hereunder to report Unsuccessful Security Incidents will no longer apply as of the effective date of the amendment. “Unsuccessful Security Incident” means a Security Incident that does not involve unauthorized access, use, disclosure, modification or destruction of EPHI or interference with an Information System in a manner that poses a material threat to the Confidentiality, Integrity, or Availability of the EPHI.

 

13. NOTIFICATION OF BREACH OF UNSECURED PHI

 

If Company becomes aware of a use or disclosure of PHI in violation of this Addendum by Company or by a third party to which Company disclosed PHI, including a Breach of Unsecured PHI, Company shall report any such use or disclosure to the Client in accordance with 45 C.F.R. § 164.410 without unreasonable delay, and in no case later than forty-five (45) days after discovery of the Breach.

 

14. STATE PRIVACY LAWS

 

Company shall comply with state privacy laws to the extent such laws are not preempted by HIPAA or the HITECH Act.

 

15. RIGHT TO AUDIT

 

Company shall make its practices, books and records related to PHI available to the Secretary and to Client for the purpose of determining Company’s compliance with this addendum and HIPAA, and Company shall cooperate with the Secretary if the Secretary undertakes an investigation or compliance review of the policies, procedures, or practices of Company to determine whether Company is complying with the applicable administrative simplification provisions of HIPAA. If any information required of Company under this paragraph is in the exclusive possession of any other agency, institution, or person and the other agency, institution, or person fails or refuses to furnish the information, Company shall certify and describe the efforts Company has made to obtain the information. If it is determined that Company’s conduct would result in violation of HIPAA by Client or is in violation of this addendum, Company shall promptly remedy any such violation and shall certify the same in writing to Client.

 

16. STANDARD TRANSACTIONS

 

If Company conducts any Standard Transactions on behalf of Client, Company shall comply with the applicable requirements of 45 C.F.R. Part 162.

 

17. OBLIGATIONS OF CLIENT

 

Client shall notify Company of:

  1. any limitations in its notice of privacy practices, to the extent such limitations may affect Company’s use or disclosure of PHI;
  2. any changes in, or revocation of, permission by the Individual who is the subject of the PHI, to the extent such changes may affect Company’s use

or disclosure of PHI; and

  1. any restriction to the use or disclosure of PHI Client has agreed to in accordance with 45 C.F.R. Section 164.522, to the extent such restriction may affect Company’s use or disclosure of PHI.

 

18. TERM AND TERMINATION

 

18.1 Term. The term of this addendum shall commence on the date Client accepts the terms and conditions of the Services Agreement and shall terminate when all of the PHI provided by Client to Company or created or received by Company on behalf of Client is destroyed or returned to Client pursuant to paragraph 19.3.

 

18.2 Termination Upon Breach. Upon knowledge by one party (the "Nonbreaching Party") of the breach of a material provision of this addendum by the other party (the "Breaching Party"), the Nonbreaching Party shall:

  1. if cure of the breach is possible, provide the Breaching Party written notice of such breach and a reasonable opportunity to cure such breach. If the Breaching Party does not cure the breach within a reasonable period of time designated by the Nonbreaching Party, the Nonbreaching Party may terminate the Services Agreement immediately, with termination effective as of the date the Nonbreaching Party gives notice of termination to the Breaching Party;
  2. if cure of the breach is not possible in the reasonable determination of the Nonbreaching Party, the Nonbreaching Party may terminate the Services Agreement immediately, with termination effective as of the date the Nonbreaching Party gives written notice of termination to the Breaching Party; and
  3. if cure of the breach and termination of the Services Agreement are not possible in the reasonable determination of the Breaching Party, the Services Agreement shall not be terminated, but further uses and disclosures of PHI shall be limited to those purposes making termination of the Services Agreement not possible.

 

18.3 Protection of PHI After Expiration or Termination. Upon termination of the Services Agreement for any reason, Company shall, at Client’s expense, return to Client or, at Client’s direction, delete, purge and destroy, all PHI in any form, recorded on any medium, or stored in any storage system. Client or Company may, in their reasonable discretion, determine that return or destruction of the PHI is infeasible, in which event Company shall extend the protections of this addendum to the information and shall limit further uses and disclosures to those purposes that make the return or destruction of the PHI infeasible. Company shall remain bound by the provisions of this addendum after termination of the Services Agreement until such time as all PHI has been returned or otherwise destroyed as provided in this paragraph.

 

19. GENERAL PROVISIONS

 

19.1 Amendment. The parties acknowledge that state and federal laws related to privacy of PHI are rapidly evolving and that amendment of this addendum may be required to comply with applicable laws. The parties shall negotiate in good faith to amend this addendum when and as necessary to comply with applicable laws. If either party does not agree to so amend this addendum within 30 days after receiving a request for amendment from the other, either party may terminate the Services Agreement upon written notice. To the extent an amendment to this addendum is required by law and this addendum has not been so amended to comply with the applicable law in a timely manner, the amendment required by law shall be deemed to be incorporated into this addendum automatically and without further action required by either of the parties.

 

19.2 Severability. Each provision of this addendum is independent, separate and divisible, and in the event any provision shall be held to be invalid or unenforceable, the remaining provisions shall continue to be in full force and effect.

 

19.3 Construction. This addendum shall be construed to implement and comply with HIPAA, as applicable to Client and Company. Any ambiguity in this addendum shall be resolved in favor of a meaning that complies with HIPAA.

 

19.4 Effect of Addendum. The sole purpose of this addendum is to ensure compliance with HIPAA and the HITECH Act. This addendum is not intended to, nor shall it be construed to, reduce or diminish any of Company’s or Client’s rights or obligations under the Services Agreement. If there is any conflict between the provisions of the Services Agreement and this addendum, the terms and conditions of this addendum shall control. 

 

Reporting of Attempted Security Incidents

 

The parties understand and agree the reporting of all routine, minor and unsuccessful attempts to access, use, disclose, modify or destroy PHI in Company’s possession or control or to interfere with system operations in Company’s information system would create an undue and unnecessary burden on both Client and Company.

 

Company hereby notifies Client that Company is subject to the following ongoing types of unsuccessful attempts to access, use, disclose, modify or destroy information or to interfere with system operations in Company’s information systems:

 

  • pings on Company’s firewall;
  • port scans;
  • attempts to log on to a system or enter a database with an invalid username or password;
  • denial-of-service attacks that do not result in a server being taken off-line;
  • malware, such as worms or viruses, that do not penetrate Company’s perimeter and protection systems.

 

Company shall not be required to notify Client of each unsuccessful attempt described above, but Company shall maintain an internal record (electronic or otherwise) of such attempts and shall make such internal record available to Client and the Secretary of the Department of Health and Human Services upon request. Records of unsuccessful attempts shall be maintained by Company for at least 6 years.

 

Notwithstanding the foregoing, if an attempt is of sufficient severity that Company’s system must be taken off-line or PHI is at substantial risk of disclosure, Company shall promptly notify Client of the attempt.

 

Patient Survey & Review Integrity Policy

Vizium360 is committed to helping practices collect authentic patient feedback and reviews that accurately reflect the patient experience. To maintain the integrity of our platform and comply with applicable laws and review site policies, all clients agree to the following requirements.

Patient Inclusion

Clients must provide Vizium360 with substantially all eligible patient encounters for survey and review outreach. Patients may only be excluded for legitimate reasons such as:

  • The patient has opted out of receiving communications.
  • Valid contact information is unavailable.
  • Outreach is prohibited by law or regulation.
  • Duplicate records or system errors exist.
  • Other exclusions approved by Vizium360.

Clients may not selectively choose which patients are included or excluded based on expected satisfaction levels, treatment outcomes, complaints, provider preferences, or any other factor intended to influence survey results or review ratings.

No Review Gating

Vizium360 does not permit review gating.

Review gating includes any practice that attempts to influence review outcomes by targeting only patients who are likely to leave positive feedback or by preventing other patients from sharing their experiences.

Clients may not:

  • Send surveys or review requests only to selected patients.
  • Screen patients before providing an opportunity to leave a review.
  • Direct positive patients to public review sites while withholding review opportunities from others.
  • Exclude dissatisfied patients from survey or review outreach.
  • Use any process designed to artificially improve ratings, review volume, or survey results.

Compliance with Review Platform Policies

Clients agree to comply with all applicable laws and the policies of review platforms, including Google, Yelp, Healthgrades, RealPatientRatings, Facebook, and other platforms where reviews may be displayed.

Data Integrity

Clients agree to provide accurate and complete patient data and to submit at least 95% of all eligible patient encounters for outreach unless otherwise restricted by law, patient preference, invalid contact information, or other approved exclusions.

Clients may not intentionally alter patient lists, eligibility criteria, workflows, or submission processes for the purpose of influencing ratings, reviews, survey scores, rankings, or benchmark results.

Monitoring and Compliance

Vizium360 reserves the right to review participation rates and patient submission data to ensure compliance with this policy.

If Vizium360 reasonably believes that a client is selectively submitting patients, engaging in review gating, or otherwise manipulating survey or review results, Vizium360 may:

  • Request corrective action;
  • Suspend survey or review services;
  • Remove affected data from reports;
  • Withhold publication of reviews or ratings; or
  • Terminate services for repeated or unresolved violations.

Client Responsibility

Clients are responsible for ensuring their participation in Vizium360 programs complies with this policy. Any attempt to manipulate patient feedback, review outcomes, or survey results may result in suspension or termination of services.

By using Vizium360 services, the Client acknowledges and agrees to these requirements and certifies that patient data submitted for outreach represents a fair and accurate sample of its eligible patient population.

Patient Review Anonymity & HIPAA Compliance

Vizium360® and RealPatientRatings® are committed to maintaining the highest standards of patient privacy and regulatory compliance. All patient reviews collected and published through our platform are 100% anonymous and are handled in accordance with HIPAA (Health Insurance Portability and Accountability Act) requirements.

Anonymity of Patient Reviews

All patient feedback is submitted and displayed without personally identifiable information. Patient names, contact details, or any protected health information (PHI) are never published or disclosed. This ensures that patient privacy is fully protected while preserving the authenticity of the feedback.

No Substitution or Alteration of Identity

To maintain the integrity and compliance of the platform:

  • Anonymous reviews must remain anonymous at all times
  • Fictitious or placeholder names may not be added to any patient review
  • Reviews may not be altered in a way that could imply identification of a specific individual

Any attempt to assign names or modify anonymity is strictly prohibited, as it violates Vizium360 and RealPatientRatings policies and may compromise HIPAA compliance.

Platform-Wide Compliance

All Vizium360 services, including but not limited to RealPatientRatings®, ReviewMultiplier™, PX360™, and PatientReach™, adhere to these same privacy and compliance standards. Patient feedback used across reviews, reporting, marketing content, blogs, and social media is fully anonymized and managed in a manner that protects both patients and healthcare providers.

Commitment to Trust and Integrity

Our platform is built on verified, authentic patient experiences. By maintaining strict anonymity and compliance standards, Vizium360 ensures that all feedback remains credible, trustworthy, and legally compliant, supporting both patient confidence and practice integrity.