Skip to main content
Sign In
Schedule a Demo
Sign In
Schedule a Demo

Master Services Agreement & Business Associate Agreement

Version 2026.10.30 · Effective October 30, 2026

Contents

The version in effect on the Effective Date of an Order governs that Order unless RFX and Client agree otherwise in writing.

THIS MASTER SERVICES AGREEMENT ("Agreement") is entered into by and between RFX SOLUTIONS, INC ("RFX") located at 4200 Perimeter Center, Ste 100, Oklahoma City, OK 73112, and the client identified on an Order that references this Agreement ("Client"). This Agreement is effective as of the Effective Date of Client's first Order (the "Effective Date"). By executing an Order that references this Agreement, or by accessing or using the Services, Client agrees to be bound by this Agreement, including the Business Associate Agreement (Exhibit A) and the Service Terms (Exhibit B). If Client and RFX have executed a separate written master services agreement, that written agreement governs instead of this Agreement.

In consideration of the mutual promises set forth herein, RFX and Client hereby agree as follows:

Master Services Agreement

Article I – Definitions

As used in the Agreement, the following words shall have the meaning set forth below:

  1. "Aggregated Statistics" means data and information related to Client's use of the Services that is used in an aggregate and anonymized manner including, without limitation, for benchmarking, research studies, industry, occupational and domain performance and analytics and similar indicators, and to compile statistical and performance information related to the provision, operation and enhancement of the Services.
  2. "Authorized Users" means, subject to the terms of this Agreement, those employees, consultants, contractors and agents of Client who are at least eighteen (18) years of age that Client authorizes to use the Services.
  3. "Client Content" means information, files or images submitted by or on behalf of Client as part of access to and use of Services.
  4. "Community Content" means Feedback, comments, suggestions, leads, or other content posted by or on behalf of Client in the RFX online help portal, on public portions of the RFX website and in social media forums.
  5. "De-Identified Personal Data" means data that has been processed to remove, obscure, aggregate, or alter information that could be used to identify a specific individual.
  6. "Feedback" means suggestions and ideas for improvement, further development or enhancement of, or other comments relating to or in connection with the Services, whether oral or written, which may be provided to RFX.
  7. "Fees" means collectively the Subscription Fees, Professional Services Fees and any additional fees set forth on an Order.
  8. "Laws" means all applicable United States federal, state and local statutes, rules, regulations and ordinances and all binding orders of any court, agency or other governmental body with appropriate authority.
  9. "Order" means a fully executed ordering document including, without limitation, a statement of work, proposal, quote, change order or similar document which sets forth specific Services selected by Client.
  10. "PHI" means Protected Health Information as defined in the Business Associate Agreement that is made a part of this Agreement.
  11. "Personal Information" means information that is linked or reasonably linkable to an identified or identifiable natural person.
  12. "Platform" means the regulatory compliance, operations and professional development platform and repository provided by RFX to Client under the terms of this Agreement.
  13. "Professional Services Fee" means the amount due, as more particularly described in an Order, for implementation, training, White Glove Onboarding, CVO Services and other professional services provided to Client.
  14. "Project Kickoff Call" means the initial call to begin onboarding of Services as more particularly described in an Order and the Service Terms.
  15. "RFX Intellectual Property" means programs, documentation, proprietary software, materials, content, know-how, Community Content, Aggregated Statistics, meta data, indexing and derived data (but excluding Personal Information), and information that embody methods, algorithms, inventions, information, logos, and other elements that qualify for protection under any applicable patent, trademark, copyright or trade secret law as well as worldwide common law and statutory rights as well as any modifications, enhancements and derivatives of the foregoing.
  16. "Services" means the Platform and professional services associated with providing access to and use of the Platform provided to Client under the terms of this Agreement, including implementation, set-up and training, Client Support, Customer Success and, where purchased under an Order, White Glove Onboarding and CVO Services, each as described in the Service Terms.
  17. "Service Terms" means the RFX Service Terms attached hereto as Exhibit B, as revised from time to time in accordance with Article II(c), which describe the scope of, and the parties' respective responsibilities for, the Services.
  18. "Subscription Fee" means the recurring amount due, at the billing frequency and as more particularly described in an Order, for Client's subscription for access to and use of the Platform.
  19. "Subscription Start Date" means the date on which recurring Subscription Fees under an Order begin: the date of the Project Kickoff Call or, if Client reschedules the Project Kickoff Call, a date no later than thirty (30) days after the initially scheduled Project Kickoff Call unless the parties agree otherwise by email.

Article II – Access and Use Right

  1. Right of Access and Use. Subject to the terms of the Agreement, RFX hereby grants to Client a right to access and use the Platform as more particularly described in an Order and solely for Client's internal business purposes. Client agrees not to give a demonstration of the Platform or disclose any information regarding features and functionalities of the Platform to any third parties, RFX competitors or otherwise, unless authorized in advance by RFX in writing.
  2. Platform Updates and Support. Subject to the terms herein, RFX will provide updates to the Platform to the extent RFX generally releases updates to its clients. All such updates including, without limitations, error corrections, bug fixes, patches, or other modifications, are the sole property of RFX. Client is responsible to apply such updates and RFX has no liability for use of the Platform if Client does not timely apply updates. Support for Authorized Users of the Platform will be provided by RFX as described in the Service Terms and during normal business hours set forth online at https://www.rfxsolutions.com/.
  3. Service Terms. The Services are provided in accordance with the Service Terms, which are incorporated into and made a part of this Agreement and each Order. RFX may revise the Service Terms from time to time by posting a revised version online at the location designated by RFX and providing notice to Client, provided that no revision shall reduce the scope of Services purchased under an Order in effect at the time of the revision. In the event of a conflict, the following order of precedence applies: (i) the Business Associate Agreement, as to PHI; (ii) the applicable Order; (iii) the main body of this Agreement; and (iv) the Service Terms.

Article III – Client Fees and Obligations

  1. Fees; Payment Terms. Client agrees to pay the applicable Fees for Services as set forth in an Order, which Fees are noncancelable and nonrefundable except as otherwise stated in this Agreement or the applicable Order. Each Order is governed by this Agreement and is hereby incorporated herein. Except as otherwise stated in an Order, Fees are due within thirty (30) days of the date of an invoice. RFX reserves the right to revise its Fee schedule at any time upon no less than sixty (60) days notice to Client prior to the end of the then-current Order term, provided that such changes shall not go into effect until the subsequent renewal term of an Order.
  2. Late Payments. If RFX does not receive payment when due, after a thirty (30) and sixty (60) day notice and opportunity to cure, RFX may, in its sole discretion, upon no less than five (5) business days’ notice to Client: (a) suspend access to the Platform (Client remains responsible for all Fees incurred during the period of suspension), and/or (b) charge interest on the late fees at the rate of the lesser of one-and-one-half percent (1.5%) or the maximum amount permitted by Laws.
  3. Taxes. All Fees are net amounts and are payable in full, without deduction for taxes of any kind. Client shall be responsible for, and shall promptly pay, all taxes of any kind (including but not limited to sales and use taxes) associated with any Services provided by RFX, except taxes based on RFX's net income.
  4. Order Term, Billing and Project Kickoff Call. The term, renewal, billing frequency, payment method and payment due dates for each subscription are as stated on the applicable Order. RFX will coordinate a mutually agreeable date for the Project Kickoff Call and confirm it to Client by email. Client receives login access to the Platform at the Project Kickoff Call. A request by Client to reschedule the Project Kickoff Call must be made by email in advance; RFX will accommodate the request as quickly as reasonably possible but cannot guarantee a particular new date. Recurring Subscription Fees begin on the Subscription Start Date. Where an Order prices a subscription or add-on by facility size (number of operating and procedure rooms) or by staff count, the applicable tier is based on the figures stated on the Order, as adjusted under the Service Terms if those figures change.

Article IV – Warranties

a. THE SERVICES AND CONTENT ACCESSIBLE THROUGH THE SERVICES ARE PROVIDED "AS IS". TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EXCEPT FOR THE REPRESENTATIONS AND WARRANTIES OTHERWISE EXPRESSLY MADE IN THIS AGREEMENT, RFX DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, REGARDING THE SERVICES (INCLUDING CVO SERVICES AND WHITE GLOVE ONBOARDING), THE PLATFORM, RELATED OR INTEGRATED SERVICES OR CONTENT, INCLUDING ANY REPRESENTATION OR WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE, QUALITY, SECURITY, MERCHANTABILITY, TITLE, NONINFRINGEMENT, COURSE OF DEALING, COURSE OF PERFORMANCE OR USAGE OF TRADE. RFX DOES NOT WARRANT THAT THE PLATFORM OR ANY RELATED SERVICES OR CONTENT IS FREE FROM BUGS, ERRORS, OR OTHER PROGRAM LIMITATIONS. WITHOUT LIMITING THE FOREGOING, RFX DOES NOT WARRANT THAT CLIENT'S DOCUMENTS, PROCESSES, CREDENTIALING DECISIONS OR OPERATIONS COMPLY WITH ANY LAW, REGULATION, PAYER REQUIREMENT OR ACCREDITATION STANDARD, AS FURTHER DESCRIBED IN THE SERVICE TERMS. CVO SERVICES ARE PROVIDED WITHOUT GUARANTEE AS FURTHER DESCRIBED IN SECTION 4.7 OF THE SERVICE TERMS.

Article V – Intellectual Property Rights

  1. Ownership. Client acknowledges that RFX and its licensors have sole ownership of RFX Intellectual Property and no RFX Intellectual Property is sold or transferred to or owned by Client or any Authorized User. Client has no right, title, or interest in the RFX Intellectual Property or copies thereof except as expressly provided in this Agreement.
  2. Restrictions. Client shall not, directly or indirectly, modify, copy, duplicate, decompile, disassemble, reverse engineer, reproduce, license or sublicense any RFX Intellectual Property or transfer or convey the RFX Intellectual Property or any right to access or use the RFX Intellectual Property or otherwise make the RFX Intellectual Property available to any third party without the prior written consent of RFX. Further, Client shall not, and shall not permit any Authorized User or third party to, alter, remove or conceal any copyright, trademark or other proprietary notice or disclaimer provided in connection with the Services. Client will promptly notify RFX of any unauthorized use or access to the Services and will cooperate fully with RFX in timely enforcing its rights to the RFX Intellectual Property. Violation of this paragraph shall be deemed a material breach of the Agreement and RFX has the right to immediately provide notice to Client and suspend or terminate access to and use of Services hereunder if Client (including an Authorized User, for clarity) violates this paragraph.
  3. Client Content. Client grants RFX a non-exclusive, perpetual, royalty free, worldwide license to use Client Content for Aggregated Statistics and a non-exclusive, royalty free, worldwide license during the term of the applicable Order to use Client Content otherwise solely to the extent necessary to provide and maintain the Services as contemplated by this Agreement. The provision of this license includes without limitation, making Client Content available for download and modification by such Authorized Users with whom Client shares projects and as specifically set forth herein. The non-exclusive, royalty free, worldwide license granted in this section shall automatically terminate upon the earlier of RFX ceasing to provide the Services to Client or Client removing the Client Content from the Services. Other than the license to use Client Content for Aggregated Statistics, RFX has no right, title or interest in Client Content nor shall RFX sell, lease or otherwise commercialize Client Content. Client acknowledges and agrees that it is solely responsible for quality control of Client Content including without limitation appropriate backups.
  4. Feedback. Client may, but is not obligated to, provide Feedback. All Feedback and Community Content are and will be owned by RFX without any further action on the part of either party and with no obligation of compensation to Client. RFX’s use of Feedback will not identify Client or any individual, and Feedback will not contain any Client Confidential Information. RFX acknowledges that Feedback is provided by Client on an “AS IS” basis.

Article VI – Limitation of Liability and Damages

a. EXCEPT FOR A BREACH OF A PARTY’S OBLIGATIONS OF CONFIDENTIALITY OR THE BUSINESS ASSOCIATE AGREEMENT, A PARTY’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, A PARTY’S INDEMNIFICATION OBLIGATIONS IN ARTICLE VII (INDEMNIFICATION), AND A PARTY’S MISAPPROPRIATION OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS (COLLECTIVELY, THE “EXCLUSIONS”), THE AGGREGATE LIABILITY OF EITHER PARTY AND THEIR RESPECTIVE REPRESENTATIVES (AS DEFINED BELOW) FOR ANY REASON SHALL BE LIMITED TO THE FEES PAID BY CLIENT UNDER THE APPLICABLE ORDER FOR THE SERVICE GIVING RISE TO THE CLAIM DURING THE TWELVE (12) MONTHS PRECEDING THE INITIAL EVENT GIVING RISE TO THE ALLEGED LIABILITY (THE “GENERAL CAP”). NOTWITHSTANDING THE FOREGOING, EACH PARTY’S ENTIRE LIABILITY FOR A BREACH OF ITS OBLIGATIONS OF CONFIDENTIALITY OR THE BUSINESS ASSOCIATE AGREEMENT SHALL NOT EXCEED AN AMOUNT EQUAL TO THREE TIMES (3X) THE GENERAL CAP. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EXCEPT WITH RESPECT TO THE EXCLUSIONS, NEITHER PARTY NOR ITS OFFICERS, EMPLOYEES, AGENTS, LICENSORS, OR THIRD-PARTY CONTENT OR SERVICE PROVIDERS (COLLECTIVELY, "REPRESENTATIVES") ARE LIABLE FOR ANY INDIRECT, SPECIAL, PUNITIVE, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OR FOR LOSS OF BUSINESS, LOSS OF PROFITS OR INVESTMENT, LOSS OF GOODWILL, LOSS OF SERVICES, INTERRUPTION IN THE AVAILABILITY OF DATA, STOPPAGE OF OTHER WORK, IMPAIRMENT OF OTHER ASSETS, OR THE LIKE, WHETHER BASED ON BREACH OF CONTRACT, BREACH OF WARRANTY, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, EVEN IF THAT PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND NOTWITHSTANDING THE FAILURE OF ANY AGREED OR OTHER REMEDY OF ITS ESSENTIAL PURPOSE.

Article VII – Indemnification

  1. RFX Indemnity. RFX will defend, indemnify, and hold harmless Client in any action brought by a third party against Client to the extent that it is based on a claim that any Platform used within the scope of and as authorized under this Agreement infringes any U.S. patents, copyrights, license or other property right of a third party, provided that RFX is promptly notified in writing of such claim. RFX shall have the right to control the defense of all such claims, lawsuits and other proceedings. In no event shall Client settle any such claim, lawsuit or proceeding without RFX's prior written approval. Client shall provide reasonable cooperation to RFX in defense of such claim at the expense of RFX.
  2. Indemnity Exceptions. Notwithstanding the foregoing, RFX will not indemnify, defend or hold harmless Client for any claim or pay any corresponding damages to the extent the claim is based on: (i) the Services having been altered or modified by Client or any third party without the express written consent of RFX, (ii) the combination, operation, or use of the Services by Client with non-RFX hardware, software, or other materials if the infringement would not have occurred but for the combination, operation, or use by Client, and (iii) any use of the Services in violation of this Agreement or for purposes other than as contemplated by this Agreement.
  3. Infringement Remedy. If, as a result of any claim of infringement under this Article, Client is enjoined from use of the Platform, or if RFX believes that the Platform is likely to become the subject of such a claim of infringement, RFX at its option and expense may procure the right for Client to continue to use the Platform or replace or modify the Platform so as to make it non-infringing. If, in the sole discretion of RFX, neither of these two options is reasonably practicable, RFX may immediately discontinue the Services, terminate, in whole or in part, any applicable Order and refund to Client any associated prepaid Fees, prorated to the date of termination. The foregoing states the sole and exclusive remedy of Client and the entire liability of RFX with respect to a claim that the Platform infringes any U.S. patents, copyrights, license or other property right of a third party.
  4. Client Indemnity. Client shall defend, indemnify, and hold harmless RFX, its officers, employees, agents, and affiliates from and against any third-party claims, demands, or causes of action arising from Client's (i) misuse of the Services in violation of this Agreement or the documentation provided by RFX; (ii) Client Content that infringes, misappropriates, or otherwise violates any third-party intellectual property rights, privacy rights, or other rights; or (iii) any credentialing, privileging, appointment, employment or similar decision made by Client, or the acts or omissions of any practitioner, employee or vendor credentialed, verified or managed using the Services, including any claim for negligent credentialing, and the parties agree that damages to RFX as a result of such claims, demands, or causes of action are direct damages. RFX shall promptly notify Client in writing of any such claim and allow Client to control the defense and settlement of such claim, provided that any settlement that would impose any liability or obligation on RFX shall be subject to RFX's prior written approval, not to be unreasonably withheld or delayed. RFX shall provide reasonable cooperation to Client in the defense of such claim at Client's expense.

Article VIII – Suspension

  1. Suspension With Notice. RFX may suspend Client access or usage of Services, in whole or in part, upon advance written notice if any Authorized User is in violation of Client's obligations under this Agreement. RFX will promptly reinstate such access once the violation is resolved.
  2. Suspension Without Notice. RFX may suspend Client access or usage of the Services, in whole or in part, without advance notice if (i) Client is suspected of an actual data security or privacy breach; (ii) such access or usage is related to a threat against or attack on RFX Intellectual Property or environment, RFX's reputation or operation of the Platform; or (iii) obligated by court order or otherwise required by law.
  3. Effects of Suspension. Suspension may include restriction of access to data stored on or transmitted or processed through the Platform. RFX shall not be liable to Client or any third party for any damages resulting from such suspension. Suspension by RFX under this section shall not preclude RFX from pursuing any available legal or equitable remedies and does not relieve Client of Fees that are payable or become payable during such suspension.

Article IX – Confidentiality, Privacy and Security

  1. Confidentiality. Each party agrees not to disclose, duplicate, publish, release, transfer or otherwise make available to third parties, the other party's confidential information without the other party's prior written consent. "Confidential Information" means any financial, technical, proprietary or business information that a party designates as confidential at the time it is disclosed to the other party, or that a party reasonably should understand to be confidential based on the nature of the information or the circumstances surrounding its disclosure. Without limiting the foregoing definition, for clarity, the RFX Intellectual Property, specific features of the Services and associated documentation are RFX Confidential Information. Client Confidential Information includes Client Content and practitioner information provided to RFX in connection with CVO Services. Confidential Information does not include any information that: (i) is or becomes generally known to the public without breach of a confidentiality obligation; (ii) was independently developed by the receiving party without breach of such party's confidentiality obligation under this Agreement; or (iii) is received from a third party without breach of any confidentiality obligation.
  2. Data Privacy. Client is responsible to and represents that it has obtained all consents necessary for RFX to collect, use and disclose Personal Information pursuant to the terms of this Agreement. Client acknowledges and agrees that when an Authorized User accesses or uses the Platform, RFX may use automatic means (including, for example, cookies) to collect information about the Authorized User's device and use of the Platform. Authorized Users may be required to provide certain information about themselves as a condition to access or use of the Platform or certain of its features or functionality, and the Platform may provide Authorized Users with opportunities to share information about themselves with others. Some of the information collected may be Personal Information. RFX is not responsible for Personal Information in Client Content that is viewed, edited, modified and/or deleted by other Authorized Users.
  3. Security Breach. RFX maintains a commercially reasonable data security program to protect Client Content and Services and will promptly notify Client of any Platform breach that RFX reasonably believes could affect Client Content. Client is responsible for Client systems, internet access, and the browser or other application used to access Services. Client will diligently investigate any breach to its systems or environment to reasonably determine if the Services could be affected and Client will notify RFX as soon as is reasonably practicable in such event. The parties agree to cooperate with each other and diligently pursue mitigation and remediation of any such breach.
  4. De-Identified Personal Data. Client agrees that RFX may use De-Identified Personal Data for Aggregated Statistics. Such De-Identified Personal Data used in accordance with this section is owned by RFX without an obligation to compensate Client for its use. RFX shall maintain De-Identified Personal Data in a de-identified form and shall not attempt to re-identify any individual from such data. RFX shall comply with all applicable laws and regulations regarding the use of De-Identified Personal Data.
  5. Privacy of Health Information. RFX and the Client acknowledge and agree that, to the extent certain PHI may be disclosed to RFX in the course of providing Services under this Agreement, RFX is considered a "business associate" of the Client, as such term is defined in the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191, 42 U.S.C. 1320d et seq. and regulations codified at 45 C.F.R. Parts 160 through 164). Therefore, the parties agree to the terms of the Business Associate Agreement attached hereto as Exhibit A, which is made a part hereof.

Article X – Use of Service, Restrictions

  1. Client Obligations. Client agrees to comply with all Laws and any third-party terms applicable to its use of the Services. Client represents and warrants that (i) Client has legal rights to the documents and information provided in connection with use of the Services and (ii) Client is responsible to exercise independent judgment regarding its business decisions and practices. Client acknowledges that the Services are a tool to inform its decision-making process, and RFX is not responsible for the completeness or accuracy of Client Content or for decisions made by Client based on its interpretation or application of information provided by the Services. Without limiting the foregoing, all credentialing, privileging and appointment decisions remain the sole responsibility of Client, as further described in the Service Terms.
  2. Prohibited Use. Access to Services by an Authorized User shall be solely via login credentials specific to such Authorized User. Each set of login credentials, which includes an email address and password for the Platform, may only be used by a single, individual Authorized User. Client agrees not to (i) allow multiple Authorized Users to access or use the Platform using shared login credentials (e.g., a shared email address and password); (ii) reverse engineer, disassemble, decompile, decode or otherwise attempt to derive or gain access to the source code of the Platform or any part thereof; (iii) access or use the Platform for a deceptive purpose; (iv) permit a third party competitor to access or use the Platform; (v) access or use the Platform or other RFX Intellectual Property or Confidential Information other than in accordance with the instructions or documentation provided by RFX and in compliance with Laws; (vi) use the Platform to distribute "spam", advertise or solicit; (vii) reproduce, modify, rent, loan, sell, distribute, or create any derivative works of the Platform; (viii) use the Platform to harass, abuse, stalk, threaten, defame or violate the rights of any person or entity; (ix) knowingly introduce to or inject the Platform with any disabling code, malicious code, virus or other malware; (x) provide any content or data that is false, misleading, defamatory, threatening, offensive, or infringing of intellectual property rights; (xi) engage in data extraction outside of the permitted use of the Platform; or (xii) access, use or register the Platform for competitive purposes. Client is responsible for the acts and omissions of its Authorized Users. Client agrees its Authorized Users will access and use the Services only as specifically permitted hereunder and Client is responsible for all activity that occurs under the login credentials and in access and use of the Services.
  3. Injunction. If rights associated with the RFX Intellectual Property are violated by Client or an Authorized User, RFX may suffer irreparable harm and obtain an injunction against such violation in addition to other remedies herein or otherwise available to RFX, none of which are waived. Client agrees to cooperate with such injunction and other efforts by RFX to stop the violation.
  4. Third-Party Data. Client acknowledges and agrees that RFX has no liability for importing data from third-party providers in order to access and use the Services. RFX does not have visibility into the data elements migrated from such third parties and is not responsible for the completeness or quality of data imported. Further, Client agrees that RFX is not responsible for any content or information provided, created or submitted by Client, another client, a user of another client or any other person or entity other than RFX including, without limitation, integrated services or information provided by a third party. Additionally, to the extent third-party services integrate with or into the Services, RFX has no liability for use of such third-party services.
  5. Geographic Restrictions. The Services are provided for access and use only by persons located in the United States. Client acknowledges that access to Services may not be available to Client outside the geographic boundaries of the United States and that such access may be prohibited under certain Laws. Each party shall comply with all Laws regarding anti-corruption and anti-bribery including without limitation compliance with all applicable export, re-export and import restrictions and regulations and the prohibition against a transfer, authorization of a transfer or granting access, directly or indirectly, to the Services to a prohibited country or otherwise to any person or entity on the U.S. Department of Treasury List of Specially Designated Nationals or the U.S. Department of Commerce Table of Denial Orders.

Article XI – General

The parties agree that Delaware law, without reference to rules governing conflict of laws, governs the execution and performance of this Agreement and any dispute between the parties related thereto. Any claim or cause of action arising out of or relating to this Agreement shall only be brought in the state or federal courts located in New Castle County, Delaware, and the parties agree to the exclusive personal jurisdiction of such courts. Except for the obligation of Client for payment, neither party will be responsible for any failure to perform its obligations under this Agreement to the extent such failure is caused by events beyond the reasonable control of either party including, without limitation, flood, fire, theft, pandemic, epidemic, internet or communications failure, etc. Nothing in this Agreement creates a partnership, agency or joint venture between the parties and each party is an independent contractor. There are no third-party beneficiaries of this Agreement. Failure of RFX to enforce strict performance or compliance with any provision of this Agreement will not constitute a waiver of the performance or obligation unless specifically waived in writing by RFX or a waiver of the right to subsequently enforce such provision or other provisions of this Agreement. Except as expressly provided otherwise herein, if a court of competent jurisdiction finds any provision of this Agreement to be illegal or unenforceable, the parties agree that the court may modify the unenforceable portion to the extent necessary to render it enforceable to the fullest extent permissible under applicable law and that other provisions of this Agreement will remain in full force and effect. Neither party shall by way of statement, act or omission, discredit, disparage or reflect adversely on the reputation or quality of the other party or Services. All notices required or permitted under this Agreement will be made in writing and deemed to have been given if delivered personally, by electronic mail, or by reputable overnight or express courier and are effective upon delivery to the applicable notice address provided by the receiving Party. For RFX, all notices shall be provided to the attention of the RFX Billing Department at the address listed in the introductory paragraph of this document. For Client, all notices shall be provided to the address listed in the applicable Order. A Party's notice contact information may be updated from time to time with written notice provided to the other Party. This Agreement, together with its Exhibits and each Order, contains the entire understanding of the parties regarding its subject matter and supersedes all prior agreements between the parties, both oral and written, and except as specifically set forth herein (including revisions to the Service Terms under Article II(c)), this Agreement may only be modified in writing and signed by both parties. Except in connection with a reorganization, restructure, or a sale or transfer of all or substantially all its assets, neither party may assign or transfer this Agreement without the prior written consent of the other party and any attempted assignment or transfer is null and void. The following portions of this Agreement survive termination hereof: Articles I (Definitions), II (Access and Use Right), III (Client Fees and Obligations), IV (Warranties), V (Intellectual Property Rights), VI (Limitation of Liability and Damages), VII (Indemnification), IX (Confidentiality, Privacy and Security), X (Use of Service, Restrictions), XII(b) (Effect of Termination) and this Article XI. This Agreement may be executed in counterparts, each of which shall be deemed an original, but all of which taken together shall constitute one single document.

Article XII – Term and Termination

  1. Term and Termination. The term of this Agreement will begin on the Effective Date and continue until terminated pursuant to the terms hereof. Either party may terminate this Agreement if the other party commits a material breach of this Agreement and fails to cure such breach within thirty (30) days of receiving written notice from the non-breaching party that describes details of the breach. If the material breach is for non-payment of Fees, termination of the Agreement may be immediate without further notice if such breach is not cured within fourteen (14) days of receipt of notice. RFX may terminate this Agreement, in whole or in part, immediately if a breach of this Agreement threatens RFX Intellectual Property or RFX systems or environment, as determined in the sole discretion of RFX. The suspension right of RFX under the terms of this Agreement does not limit RFX's right to termination under this section. RFX will not charge an additional termination fee solely as a result of Client's exercise of its right to terminate this Agreement.
  2. Effect of Termination. If this Agreement is terminated, (i) all Fees owed to RFX up to the effective date of termination are immediately due and payable and (ii) all Orders will likewise be terminated and Client access to Services will be terminated as of the effective date of termination except for the limited right to access Services for ninety (90) days following the effective date of termination for the sole purpose of retrieving all Client Content. RFX has no responsibility to retain Client Content beyond such ninety (90) day period. Termination of this Agreement by RFX for Client’s material breach shall not relieve Client of its payment obligations for all contracted Fees listed in the applicable Order(s).

Exhibits

Exhibit A – Business Associate Agreement

Exhibit B – RFX Service Terms

Acceptance

This Agreement does not require a separate signature. Client's execution of an Order that references this Agreement constitutes Client's acceptance of this Agreement and the Service Terms in Exhibit B and, to the extent Client is a covered entity under HIPAA, Client's execution of the Business Associate Agreement in Exhibit A. On request, RFX will countersign a printed copy of this Agreement for Client's records.

Exhibit A – Business Associate Agreement

This Business Associate Agreement is effective as of the Effective Date of the Covered Entity's first Order with RFX (the "Effective Date"), is entered into by and between the client identified on that Order ("Covered Entity") and RFX SOLUTIONS, INC ("Business Associate") (individually, a "Party" and collectively, the "Parties"), and supersedes and amends any prior Business Associate Agreement, and any amendments thereto between the Parties.

Recitals

WHEREAS, Covered Entity and Business Associate have entered into, or are entering into, or may subsequently enter into, agreements or other documented arrangements (collectively, the "Business Arrangements"), pursuant to which Business Associate may create, receive, maintain, or transmit data for or from Covered Entity that constitutes Protected Health Information to perform services ("Services") on behalf of Covered Entity; and

WHEREAS, Covered Entity is or may be subject to the requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act"), and the implementing regulations set forth at 45 CFR Parts 160, 162, and 164 (the "HIPAA Regulations"); and

WHEREAS, to the extent required by the HIPAA Regulations and applicable state law, Business Associate is or may be directly subject to certain privacy and security obligations and penalty provisions of the HIPAA Regulations and state law.

NOW, THEREFORE, in consideration of the foregoing recitals and the mutual covenants contained herein, the Parties, intending to be legally bound, agree as follows:

I. Definitions

Capitalized terms used but not otherwise defined in this Agreement shall have the same meaning as those terms in the HIPAA Regulations. "PHI" shall have the same meaning as the term "Protected Health Information" in 45 CFR § 160.103, limited to the information created, received, maintained, or transmitted by Business Associate from or on behalf of Covered Entity. "Electronic PHI" shall have the same meaning as the term "Electronic Protected Health Information" in 45 CFR § 160.103, limited to the information created, received, maintained, or transmitted by Business Associate from or on behalf of Covered Entity. "Unsecured PHI" shall have the same meaning as the term "Unsecured Protected Health Information" in 45 CFR 164.402, limited to the information created, received, maintained, or transmitted by Business Associate from or on behalf of Covered Entity.

II. Effect of Agreement

The Parties agree that any ambiguity in this Agreement shall be resolved in favor of a meaning that permits the Parties to comply with HIPAA, the HITECH Act, the HIPAA Regulations, and applicable state law.

III. Business Associate Obligations

A. Permitted Uses and Disclosures. Business Associate shall not use and disclose PHI other than as expressly permitted or required by this Business Associate Agreement or as Required By Law. Except as otherwise limited in this Business Associate Agreement, Business Associate is permitted to use and disclose PHI as follows:

  1. Business Associate may use and disclose PHI to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the Business Arrangements, provided that use or disclosure would not violate the HIPAA Regulations if done by Covered Entity.
  2. Business Associate may use and disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate (collectively, "Business Associate's Operations"), provided that Business Associate may only disclose PHI for Business Associate's Operations if the disclosure is Required By Law or Business Associate obtains reasonable assurances, evidenced by a written contract, from the recipient that the recipient will: (1) hold such PHI in confidence and use or further disclose it only for the purpose for which Business Associate disclosed it to the recipient or as Required By Law; and (2) notify Business Associate of any instance of which the recipient becomes aware in which the confidentiality of such PHI has been breached without unreasonable delay and in no event later than five (5) days.
  3. Business Associate may use PHI to provide Data Aggregation services to Covered Entity as permitted by 45 CFR 164.504(e)(2)(i)(B) to the extent expressly required pursuant to the Business Arrangements.
  4. To the extent Covered Entity notifies Business Associate of a restriction request granted by Covered Entity that would limit Business Associate's use or disclosure of PHI, Business Associate will comply with the restriction.
  5. To the extent Business Associate is authorized to make disclosures directly to health plans, Business Associate shall not disclose PHI to a health plan for payment or health care operations purposes if the patient has requested this special restriction, and has paid out of pocket in full for the health care item or service to which the PHI solely relates, as required by 42 USC 17935(a).
  6. Notwithstanding anything herein to the contrary, Business Associate may not use PHI to create information that is not Individually Identifiable Health Information (i.e., de-identified information) unless expressly permitted pursuant to the Business Arrangements. Covered Entity authorizes Business Associate to de-identify PHI in accordance with 45 CFR 164.514 and to use the resulting de-identified data for Aggregated Statistics as described in the Agreement.
  7. Notwithstanding anything herein to the contrary, Business Associate shall not use or disclose PHI for purposes of marketing or fundraising, as defined in the HIPAA Regulations, the HITECH Act, and applicable state law.
  8. Notwithstanding anything herein to the contrary, Business Associate shall not sell or receive remuneration, directly or indirectly, in exchange for PHI; provided, however, that this prohibition shall not be construed to limit or otherwise affect payment by Covered Entity to Business Associate for services provided pursuant to the Business Arrangements.

B. Compliance. Business Associate shall be directly responsible for full compliance with the applicable requirements of the HIPAA Regulations to the same extent as Covered Entity. To the extent Business Associate is to carry out an obligation of Covered Entity under the HIPAA Regulations, Business Associate shall comply with the requirements of the HIPAA Regulations that apply to Covered Entity in the performance of such obligation.

C. Minimum Necessary. Business Associate represents that the PHI requested, used, or disclosed by Business Associate shall be the minimum amount necessary to carry out the purposes of the Business Arrangements. To the extent the requirements of 45 CFR 164.502(b) apply, Business Associate will limit all of its uses and disclosures of, and requests for, PHI (1) when practical, to the information making up a Limited Data Set, and (2) in all other cases, to the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure, or request.

D. Business Associate Agents. Business Associate shall ensure that each agent or subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions and conditions that apply to Business Associate pursuant to this Business Associate Agreement.

E. Appropriate Safeguards; Security. Business Associate shall use and maintain reasonable and appropriate administrative, technical, and physical safeguards to prevent uses and disclosures of PHI other than as permitted in this Business Associate Agreement. In addition, Business Associate agrees to comply with the applicable requirements of 45 C.F.R. Part 164 Subpart C with respect to Electronic PHI and any guidance issued by the Secretary of the Department of Health and Human Services.

F. Access to Records. Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity available to Covered Entity, or to the Secretary of the Department of Health and Human Services, for purposes of determining compliance with the HIPAA Regulations. In the event Business Associate provides such information to the Secretary of the Department of Health and Human Services, Business Associate shall provide Covered Entity with a copy of such information. Covered Entity may, at its option, access and audit the records of Business Associate related to Business Associate's use and disclosure of PHI, require Business Associate to submit to monitoring and reporting, and such other conditions as Covered Entity may determine are necessary to ensure compliance with the HIPAA Regulations.

G. Improper Access, Use, or Disclosure; Security Incident; Breach. Business Associate shall report to Covered Entity in writing any access, use, or disclosure of PHI not permitted by this Business Associate Agreement, any Security Incident, and any Breach of Unsecured PHI of which it becomes aware or which it discovers without unreasonable delay and in no event later than five (5) days after discovery.

  1. A Breach shall be treated as discovered by Business Associate as of the first day on which such Breach is known to Business Associate, or by exercising reasonable diligence would have been known to Business Associate. Business Associate shall be deemed to have knowledge of a Breach if the Breach is known by, or by exercising reasonable diligence would have been known to, any person, other than the person committing the Breach, who is an employee, officer, or other agent of Business Associate.
  2. Any report of Breach required by this section shall include the information specified in 45 CFR 164.410 and such other information as Covered Entity requires.
  3. Business Associate shall promptly provide Covered Entity with updates of information concerning the details of any unauthorized access, use, or disclosure of PHI, Security Incident, or Breach.
  4. Business Associate shall perform a preliminary risk assessment immediately following the discovery of any unauthorized access, use, or disclosure of PHI. Such preliminary risk assessment must take into account those factors set forth in 45 CFR 164.402 as well as such other factors as Covered Entity requests. The results of such preliminary risk assessment shall be provided to Covered Entity in writing without unreasonable delay and in no case later than fifteen (15) days from the date of discovery of the unauthorized access, use, or disclosure of PHI. Business Associate shall promptly provide Covered Entity with updates of information material to a risk assessment undertaken by Covered Entity.
  5. Business Associate shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Business Associate Agreement, a Security Incident, or a Breach of Unsecured PHI. Business Associate shall promptly reimburse Covered Entity for all reasonable costs incurred by Covered Entity with respect to mitigating a Breach involving Business Associate. Business Associate shall undertake mitigation activities under this section in consultation with, and in accordance with the instructions of, Covered Entity.
  6. It is the sole responsibility of Covered Entity to notify individuals of any Breach of Unsecured PHI. Business Associate shall cooperate with Covered Entity in the provision of any such notification. Business Associate shall promptly reimburse Covered Entity for all reasonable costs incurred by Covered Entity with respect to providing notification of a Breach involving Business Associate, including without limitation costs related to printing, postage, and the establishment of hotlines.
  7. Business Associate shall report to Covered Entity in writing any security incident or breach of personal information for which applicable state law may require notification or other action by either Business Associate or Covered Entity. Any such report shall be made in accordance with the requirements of the relevant state law.

H. Access to PHI; Amendment of PHI. To the extent that the Parties mutually agree in writing that PHI is part of a Designated Record Set, and that such Designated Record Set (or a portion thereof) is to be maintained by Business Associate, as the Parties may agree in writing

  1. Business Associate shall within ten (10) days after a written request from Covered Entity provide access, at the request of the Covered Entity, and in the time and manner designated by the Covered Entity, to such PHI to Covered Entity or, as directed by the Covered Entity, to an Individual in order to meet the requirements of 45 CFR § 164.524.
  2. If the requested PHI is maintained electronically, Business Associate shall provide a copy of the PHI in the form and format requested by the Individual, if it is readily producible, or, if not, in a readable electronic form and format agreed to by Covered Entity and the Individual.
  3. In the event that any individual requests access to PHI directly from Business Associate, Business Associate shall immediately and in no event later than ten (10) days of receiving such request forward the request to Covered Entity. Any denials of access to the PHI requested shall be the responsibility of Covered Entity.
  4. Business Associate shall within ten (10) days after a written request from Covered Entity make amendments to such PHI as directed or agreed to by Covered Entity in accordance with the requirements of 45 CFR 164.526.
  5. In the event that a request for an amendment is delivered directly to Business Associate, Business Associate shall immediately and in no event later than ten (10) days of receiving such request forward the request to Covered Entity.

I. Accounting. Business Associate shall document such disclosures of PHI and information related to such disclosures and, within ten (10) days after Covered Entity's written request, shall provide to Covered Entity or to an Individual, in time and manner designated by Covered Entity, information collected in accordance with this section, as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR 164.528. In the event that a request for an accounting is delivered directly to Business Associate, Business Associate shall immediately and in no event later than ten (10) days of receiving such request forward the request to Covered Entity.

IV. Covered Entity's Obligations

  1. Notice of Privacy Practices. Covered Entity shall provide Business Associate with the notice of privacy practices that Covered Entity produces in accordance with 45 CFR 164.520, as well as any subsequent changes to such notice of privacy practices.
  2. Changes in Access by Individual. Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by an Individual to use or disclose PHI, if such changes affect Business Associate's permitted or required uses and disclosures.
  3. Restrictions on Use and Disclosure of PHI. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR 164.522.

V. Termination

  1. Term. The Term of this Agreement shall be effective as of the Effective Date and shall remain in effect until termination of the Business Arrangements; provided, however, that certain obligations shall survive termination of this Agreement as set forth in Section V(3).
  2. Termination for Cause. Covered Entity may immediately terminate this Agreement in the event that Business Associate materially breaches any provision of this Agreement. In its sole discretion, Covered Entity may permit Business Associate the ability to cure or take substantial steps to cure such material breach to Covered Entity's satisfaction within thirty (30) days after receipt of written notice from Covered Entity. If termination pursuant to this section is infeasible, Covered Entity shall report the breach to the Secretary of the Department of Health and Human Services. The Parties understand and agree that termination of this Business Associate Agreement pursuant to this section shall constitute a material breach by Business Associate under the Business Arrangements.
  3. Return or Destruction of PHI. Upon termination, if feasible, Business Associate shall return or destroy, at no cost to Covered Entity, all PHI that Business Associate still maintains in any form and shall retain no copies of such information. Prior to doing so, Business Associate further agrees to recover any PHI in the possession of its subcontractors or agents. If it is infeasible to return or destroy PHI, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction of PHI infeasible and Business Associate shall continue to extend the protections of this Agreement to such PHI, and limit further use of such PHI solely to those purposes that make the return or destruction of such PHI infeasible. The provisions of this section shall survive the expiration or termination of this Business Associate Agreement.

VI. Miscellaneous

  1. Ownership of PHI. Business Associate acknowledges that Business Associate has no ownership rights with respect to PHI.
  2. Amendment to Comply with Law. The Parties acknowledge that it may be necessary to amend this Business Associate Agreement to comply with modifications to HIPAA, the HITECH Act, the HIPAA Regulations, and applicable state law, including but not limited to statutory or regulatory modifications or interpretations by a regulatory agency or court of competent jurisdiction. The Parties agree to use good faith efforts to develop and execute any amendments to this Business Associate Agreement as may be required by any such modifications.
  3. Amendment. This Business Associate Agreement may be amended or modified only in writing signed by the Parties.
  4. Assignment. Notwithstanding anything in the Business Arrangements to the contrary, neither Party may assign this Business Associate Agreement, in whole or in part, without the prior written consent of the other Party; provided, however, that Covered Entity may assign this Business Associate Agreement without the consent of the other Party to an affiliate or in conjunction with a merger, reorganization, consolidation, change of control or sale of all or substantially all of its assets. Subject to the requirements of this paragraph, this Business Associate Agreement shall be binding upon and inure to the benefit of the respective successors and permitted assigns of the Parties.
  5. No Third Party Beneficiaries; Agency Relationship. Nothing expressed or implied in this Business Associate Agreement is intended to confer, nor shall anything herein confer, upon any person other than Covered Entity, Business Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever. Nothing in this Business Associate Agreement shall be construed to create any agency relationship between the parties.
  6. Governing Law. This Business Associate Agreement shall be governed by and construed in accordance with the governing law provision in the Business Arrangements.
  7. Paragraph Headings. The paragraph headings in this Business Associate Agreement are for convenience only. They form no part of this Business Associate Agreement and shall not affect its interpretations.
  8. Notice. Any notice required by the Business Associate under the terms of this Business Associate Agreement, including notifications of breach, should be made in writing and without unreasonable delay to the following:
  • Covered Entity: the Legal Entity, primary contact and mailing address shown on the Order, or such other notice contact as Covered Entity designates in writing (including any parent or management company Covered Entity designates to receive a copy).
  • Business Associate: RFX Solutions, Inc., Attn: Billing Department, 4200 Perimeter Center, Ste 100, Oklahoma City, OK 73112, or billing@rfxsolutions.com.

VII. Indemnification

Each Party (the "Indemnifying Party") agrees to indemnify, defend and hold harmless the other Party and such other Party's parent corporation, affiliates, employees, directors, officers, subcontractors, agents or other members of such other Party's workforce (collectively referred to as the "Indemnified Party"), against all costs suffered by the Indemnified Party, including but not limited to any and all actual and direct losses, liabilities, fines, penalties, costs or expenses (including reasonable attorneys' fees), arising from or in connection with a material breach of this Business Associate Agreement by the Indemnifying Party. This provision shall survive the expiration or termination of this Business Associate Agreement.

Execution. Where Covered Entity is a covered entity under HIPAA, Covered Entity's execution of an Order that references the Master Services Agreement constitutes execution of this Business Associate Agreement by Covered Entity, and RFX's acceptance of that Order constitutes execution by Business Associate, each effective as of the Effective Date. At Covered Entity's request, the Parties will also execute a countersigned copy of this Business Associate Agreement on Covered Entity's or RFX's standard form for Covered Entity's records.

Exhibit B – RFX Service Terms

These Service Terms describe the services RFX Solutions, Inc. ("RFX") delivers under the Master Services Agreement (the "Agreement") and each Order, and what RFX needs from the Client to deliver them. Capitalized terms not defined here have the meanings given in the Agreement. These Service Terms are incorporated into the Agreement and each Order. Fees for the services described here are set out on the Order.

1. Platform Implementation

RFX implements each purchased Platform module on a project roadmap that RFX and the Client agree on at the Project Kickoff Call. Implementations typically take 12 to 24 weeks, depending on scheduling and how quickly the Client completes its objectives, particularly digitizing and uploading documents into the Platform.

1.1 What RFX provides
  • A dedicated implementation project manager who leads the project roadmap and is the Client's primary contact through go-live.
  • A dedicated implementation support team for each module in scope.
  • Scheduled virtual meetings and virtual training sessions, as set out in the project roadmap. Meetings are typically weekly at the start of each module, taper after go-live to periodic check-ins, and conclude when the Client transitions to Client Support.
  • Modules are implemented in RFX's standard sequence: Binders, Contracts, Employees, Learning, Logs, then Medical Staff. The Client may request a different order where a business need requires it, subject to agreement with the implementation project manager. Modules may go live at different points in the project.
1.2 What RFX needs from the Client
  • A primary point of contact and one or more designees for each module who are responsible for coordinating set-up, attending scheduled calls, completing assigned tasks, and receiving training.
  • Timely completion of Client tasks on the project roadmap, including document digitization and upload.
  • Confirmation, within a reasonable time after each module is implemented, that the implementation is complete and acceptable. If the Client does not raise an issue within 30 days of RFX notifying the Client that a module is implemented, that module is deemed accepted.
1.3 Implementation timeline

The Client is expected to complete implementation within six (6) months of the originally scheduled Project Kickoff Call. If implementation extends beyond that date for reasons other than RFX's delay, and the parties have not agreed otherwise in writing, implementation may be deemed complete at RFX’s sole discretion.

RFX may pause or reschedule implementation work if the Client does not complete its tasks on time. Resumption depends on RFX personnel availability.

2. Set-up and Training Deliverables

During implementation RFX configures the Platform and trains the Client's designees as described below, for the modules on the Order. After implementation, the Client is responsible for ongoing configuration and user management, with help from Client Support.

Area RFX configures RFX trains Client designees on
Users and permissions Initial users, roles, and permissions Adding, removing, and maintaining user access
Medical Staff and Employees modules Category tabs, document types, checklists, and fillable form templates, as applicable Using the module, building forms, managing the document library and checklists, and processing provider credentialing electronically
Medical Staff and Employees portals Portal set-up for document submission Using the portals to request and receive documents from Medical Staff and Employees
Compliance Logs Log categories and the Client's current compliance logs Maintaining the module, creating and modifying logs, and accessing log data
Electronic Binders Binder structure, as applicable Building binders and using binder functionality
Contracts module Module set-up, as applicable Using the Contracts module

Additional set-up guidance or assistance beyond this table may be provided if RFX and the Client agree in writing, and may be subject to additional fees. Training is delivered virtually to the Client's named designees; the Client is responsible for training its other users.

3. White Glove Onboarding

White Glove Onboarding is an optional service in which RFX uploads the Client's existing documents into the Platform on the Client's behalf. It is delivered in four stages: the Client organizes and scans its documents; the Client approves the Platform set-up; RFX and the Client complete a quality review of sample uploads; and, once the Client has uploaded all of its documents, RFX performs the build.

3.1 Client responsibilities
  • Scan all documents in an organized manner into the secure, cloud-based drive RFX provides, following RFX's naming and folder instructions.
  • Upload documents on the schedule set in the implementation timeline agreed with RFX.
  • Review and approve the Platform set-up for each module in scope, including module categories, tabs, document library structure, document naming conventions, and dataset requirements, before RFX begins uploading.
  • Participate in the quality review call and verify and approve up to two sample file uploads before the build begins.
  • Respond promptly to RFX questions about documents or upload issues, so the project stays on schedule.
  • Review uploaded documents for accuracy and completeness and confirm they meet the Client's regulatory requirements.
3.2 RFX responsibilities
  • Provide and maintain the secure cloud-based drive used to collect the Client's documents.
  • Schedule and lead the quality review call once the Client has approved the Platform set-up.
  • Upload the documents the Client has provided to the Platform, in the structure the Client approved, using reasonable care.
3.3 Correction period

The Client has 30 days after RFX notifies the Client that the upload is complete to identify any discrepancies caused by the White Glove Onboarding and request correction. RFX will correct those discrepancies at no additional charge. Requests received after the 30-day period, and corrections to documents as the Client supplied them, may be subject to additional fees.

3.4 Limitations
  • RFX uploads documents as the Client provides them. RFX does not review documents for content, verify their accuracy, or confirm that they satisfy any accreditation, licensing, or regulatory standard. The Client remains solely responsible for the content of its documents and for its own compliance.
  • RFX is not responsible for documents the Client did not provide, provided after the agreed deadline, or provided in a disorganized, illegible, or mislabeled form.
  • If the Client misses agreed upload deadlines, RFX may reschedule the remaining onboarding work based on personnel availability, and completion may be delayed.
3.5 Upload window

White Glove Onboarding works best when it moves quickly and all at once. To make sure everything lands in the Platform in a consistent, organized structure, RFX begins the build only after the Client has uploaded all of its documents to the RFX-provided drive and let its implementation project manager know the upload is complete. We ask the Client to finish uploading within thirty (30) days after the Project Kickoff Call. If the Client needs more time, it only needs to let its implementation project manager know; RFX will work with the Client on a revised schedule wherever it reasonably can. If uploads have not been completed within a 60-day window and the Client has not arranged a revised schedule with RFX, RFX may, after giving the Client written notice and at least fifteen (15) days to finish uploading, begin the build using the documents received to date and treat the White Glove Onboarding service as complete once those documents are uploaded. Any documents supplied afterward can be added by the Client using the Platform’s standard tools or, if the Client prefers, under a new White Glove Onboarding Order. Fees paid for White Glove Onboarding are not refunded for documents the Client did not supply within the window.

4. CVO Services

RFX's Credentials Verification Organization ("CVO") Services perform primary source verification of practitioner credentials on the Client's behalf and deliver the results in the Platform. RFX verifies; the Client decides. All credentialing, privileging, and appointment decisions remain the Client's, made by its medical staff and governing body under its own bylaws and policies.

4.1 Scope of verification

The Client determines which elements must be verified, and by what method, to satisfy its accrediting body (for example, AAAHC, The Joint Commission, or the CMS Conditions for Coverage) and any state-specific requirements, and records those elements on its Order or its CVO Verification Checklist. For each practitioner the Client submits, RFX performs primary source verification of the elements so identified, which may include:

  • State professional license(s), including current status and any disciplinary history displayed on the state licensing board's primary source verification site. Where a state publishes disciplinary or profile information only in a separate, state-specific report, RFX obtains that report only if it is listed on the Client's checklist with instructions for obtaining it.
  • DEA registration and, where applicable, state controlled-substance registration.
  • Board certification.
  • Education and post-graduate training.
  • Hospital and ASC affiliations, as reported by the practitioner on the application. RFX verifies the affiliations the practitioner discloses; RFX does not use third-party databases to discover affiliations the practitioner has not reported.
  • Work history, as reported by the practitioner on the application. RFX reviews the application for completeness and unexplained gaps and requests clarification where needed. RFX does not independently verify employment history other than hospital and ASC affiliations verified under the preceding item.
  • Malpractice insurance coverage and claims history.
  • National Practitioner Data Bank (NPDB) query. NPDB queries require the Client to complete its NPDB entity registration and designate RFX as its Authorized Agent before RFX can run the query; RFX cannot query the NPDB until the Client has completed this set-up.
  • OIG List of Excluded Individuals/Entities and SAM.gov exclusion checks. State Medicaid exclusion list checks are performed only where the Client has added them to its checklist and identified the state(s) and source(s) to be checked.
  • Peer references.

RFX will use commercially reasonable efforts to perform verifications using methods and sources customarily used in credentialing, but does not warrant any particular method, source or result. Elements not identified on the Client's Order or CVO Verification Checklist are not verified, and RFX does not independently determine which elements the Client's accrediting body or state requires.

4.2 What RFX provides
  • Verification documents for each practitioner, stored in the Platform, with source documentation, verification dates, and any flagged findings.
  • A completed verification packet for each practitioner showing the results of all verifications performed. RFX will notify the Client's named contact of any required item and any adverse, sanction or exclusion finding that RFX identifies in the course of performing the verifications on the Client's checklist. Results are presented without judgment on the practitioner's qualifications.
  • Automated Platform reminders of upcoming expirables, generated from the Client's document library set-up and sent to the facility administrator, the practitioner, and any designated delegate. RFX separately notifies the facility administrator by email when a sanction or exclusion finding is identified.
  • Communication with the practitioner, at the Client's direction, to obtain missing items.
4.3 What RFX needs from the Client
  • A completed application and a signed release/authorization for each practitioner, in the form RFX specifies, together with the supporting items on the Client's CVO Verification Checklist. RFX cannot begin verification without the signed release. RFX can complete most verifications from an accurately and fully completed application, without unexplained gaps, even where supporting documents follow later; verification of any element that depends on a missing document begins when that document is received.
  • Authorization for RFX to query sources that require it, including completion of the Client's NPDB entity registration and designation of RFX as its NPDB Authorized Agent.
  • A named Client contact for questions about the practitioner or the verification packet.
  • Prompt review of the completed verification packet and notice to RFX of any discrepancies within 30 days of delivery.
4.4 Timing

For reappointment and re-privileging, RFX initiates reverification and sends the practitioner packet at least 90 days before the end of the practitioner's current privilege period, provided the Client's records in the Platform reflect the current privilege dates. For initial appointments, RFX begins verification when it receives the completed application and signed release and works each packet to completion as promptly as primary sources, the practitioner, and the Client allow. Turnaround depends on the responsiveness of primary sources, the practitioner, and the Client, and is not guaranteed. RFX will notify the Client when a packet is delayed and why. The Client remains responsible for monitoring practitioner privilege and expirable dates and for taking action to prevent a lapse. RFX is not liable for any lapse of a practitioner's appointment, privileges, license, certification or coverage, or for any consequence of such a lapse, whether or not a packet was delayed.

Requests that require completion in fewer than 30 days are treated as expedited and are subject to the expedited request fee set out on the Client's Order. RFX will use reasonable efforts to meet an expedited request but cannot guarantee completion within the requested period.

4.5 Limitations
  • RFX relies on information supplied by the practitioner, primary sources, and third-party databases. RFX does not guarantee that information is accurate, complete, or current, and is not responsible for errors or omissions originating from those sources.
  • Primary sources, including state licensing boards, certifying bodies, and other verification websites, may be unavailable, delayed, or may change the information or methods they make available. RFX is not responsible for delays or for an inability to verify an element caused by the unavailability or limitations of a primary source, and will document the attempts made.
  • RFX does not evaluate competence, recommend credentialing or privileging decisions, or determine compliance with the Client's bylaws, payer requirements, or accreditation standards. The Client is solely responsible for reviewing verification results and making credentialing decisions.
  • RFX does not provide payer enrollment services as part of CVO Services.
  • Verification results are current as of the verification date. Ongoing screening of practitioners after verification is provided through the Sanctions Monitoring tool in the Medical Staff module (Section 8.4), not as part of CVO Services.
  • The Client is responsible for maintaining its own credentialing policies, committee processes, and records required by its accreditor and applicable law.
4.6 Confidentiality and data handling

RFX treats practitioner information obtained under CVO Services as Confidential Information under the Agreement, uses it solely to perform the CVO Services, and retains verification records for the term of the applicable Order and three (3) years thereafter, or such other period stated on the Order. The Client is responsible for determining and satisfying its own record-retention requirements and for exporting verification records it must retain. NPDB query results are handled in accordance with NPDB confidentiality requirements.

4.7 No Guarantee; Exclusive Remedy; Survey Outcomes

CVO Services are an administrative verification service and are not a guarantee of any kind. RFX does not guarantee, warrant or represent that any verification is complete, accurate, current or error-free, that any practitioner is qualified, competent, or eligible for appointment or privileges, or that the Client's credentialing files, processes or decisions will satisfy any accrediting body, CMS, state agency, payer, or other third party. The Client acknowledges that accreditation surveys, licensure inspections, payer audits and similar reviews evaluate the Client's own program, policies and decisions, and RFX shall have no liability for any survey deficiency, citation, finding, corrective action, fine, penalty, loss or suspension of accreditation, certification, licensure or payer participation, claim denial, or other consequence of any such review, regardless of cause. Where RFX makes an error in performing a verification, the Client's sole and exclusive remedy, and RFX's entire liability, is for RFX to re-perform the affected verification at no additional charge, provided the Client notifies RFX of the error in writing within thirty (30) days after delivery of the verification packet. A verification packet not disputed within that period is deemed accepted. Client acknowledges and agrees that, to the maximum extent permitted by Laws, this Section 4.7 applies notwithstanding, and supersedes, any other provisions in the Agreement or the applicable Order, including without limitation those regarding performance, warranties, allocation of liability, and remedies.

5. General Terms for All Services

  • Client delays. Timelines in these Service Terms assume the Client completes its responsibilities on schedule. Where the Client's delay causes rescheduling, RFX will resume work as personnel availability allows and is not responsible for the resulting delay.
  • Scope changes. Work outside the scope described here or on the Order requires written agreement from both parties and may carry additional fees.
  • No compliance warranty. RFX's services support the Client's credentialing and compliance programs but do not replace them. RFX does not warrant that the Client's documents, processes, or decisions comply with any law, regulation, payer requirement, or accreditation standard. The Client is responsible for its own compliance.
  • Client data. The Client is responsible for the accuracy and lawfulness of the documents and information it provides and confirms it has the right to provide them to RFX.
  • Personnel. RFX may assign and reassign personnel at its discretion while maintaining continuity of service where reasonably practicable.
  • Updates. RFX may revise these Service Terms as provided in the Agreement. Changes do not reduce the scope of services purchased under an Order in effect at the time of the change.
  • Fees. Fees for the services described here, including any extended-implementation, expedited-request, or out-of-scope fees, are set out in the Client's Order or the Agreement.

6. Client Support

Once a module goes live and the implementation project manager transitions the Client to Client Support, RFX provides ongoing support for the Platform as described below. Client Support covers the use and operation of the Platform. It does not include implementation work, document upload, or other services described elsewhere in these Service Terms, which are available by separate agreement.

6.1 What RFX provides
  • Access to Client Support by email, in-app request, and phone during 6 a.m.-7 p.m. CST, Monday through Friday, excluding RFX-observed holidays.
  • Assistance with Platform features, troubleshooting of errors, and answers to how-to questions from the Client's named designees.
  • A self-service knowledge base and product release notes, available to all Client users.
  • Platform maintenance, updates, and bug fixes, delivered as part of the Client's subscription at no additional charge.
6.2 Response targets

RFX prioritizes support requests by their effect on the Client's operations and targets an initial response within the times below. These are targets, not guarantees, and resolution time depends on the nature of the issue.

Priority Description Target initial response
Critical The Platform is unavailable or a core function is unusable for all Client users, with no workaround 4 business hours
High A core function is impaired for multiple users, or a workaround exists but is impractical 1 business day
Normal A feature is not working as expected for some users, or a how-to question 2 business days
Low Enhancement requests and general feedback Acknowledged; no resolution commitment

RFX will keep the Client informed of the status of Critical and High priority requests until resolved.

6.3 What RFX needs from the Client
  • Named support designees, as described in Section 1.2, who submit requests on behalf of the Client. RFX may direct other Client users to the Client's designees.
  • Sufficient detail to understand and reproduce the issue, including the affected user, module, steps taken, and any error messages.
  • Prompt response to RFX requests for additional information. RFX may close a request if the Client does not respond within 4 business days.
  • Use of supported devices as published in RFX's knowledge base.
6.4 Scope limits

The following are not included in Client Support and may be provided by separate agreement, subject to additional fees: training of users beyond the Client's named designees; bulk document upload, data entry, data clean-up, or re-organization of the Client's records; custom reports, integrations, or configuration work performed by RFX on the Client's behalf; re-implementation or rebuilding of configuration the Client has changed or removed; and support for the Client's own hardware, network, email, or third-party systems.

6.5 Maintenance

RFX may perform scheduled maintenance that makes the Platform temporarily unavailable. RFX will provide at least 48 hours' notice of scheduled maintenance that is expected to affect availability during business hours, and will schedule it outside business hours where practicable. RFX may perform emergency maintenance without advance notice to protect the security or integrity of the Platform.

7. Customer Success

Following go-live, RFX assigns the Client a Customer Success Manager who serves as the Client's ongoing relationship contact and helps the Client get continued value from the Platform. Customer Success is distinct from Client Support: Client Support resolves specific issues and questions as described in Section 6, while Customer Success focuses on the Client's overall adoption, outcomes, and account.

7.1 What RFX provides
  • A named Customer Success Manager who is the Client's primary contact for account matters, adoption, and planning after the implementation project manager transitions the account.
  • Periodic account reviews, typically semi-annually, covering Platform usage and adoption, open items, upcoming regulatory or survey dates the Client has shared, and recommendations for using the Platform more effectively. Review frequency may vary based on the Client's subscription and preferences.
  • Guidance on best practices for the Client's credentialing, compliance, and document-management workflows within the Platform, drawn from RFX's experience across its client base.
  • Proactive notice of significant Platform changes, new modules and features, and changes to these Service Terms that affect the Client.
  • Coordination of requests that fall outside Client Support, including scope changes, additional modules or services, user growth, and renewal discussions, and introduction to the appropriate RFX team for each.
  • An escalation path for concerns the Client believes have not been adequately addressed through Client Support.
7.2 What RFX needs from the Client
  • An executive or administrative sponsor who is accountable for the Client's use of the Platform and participates in account reviews.
  • Reasonable availability for scheduled account reviews and timely response to scheduling requests.
  • Notice of changes that affect the account, including changes in Client leadership or designees, facility additions or closures, ownership changes, accreditation body changes, and upcoming surveys or audits where the Client would like RFX's assistance preparing.
  • Candid feedback on the Platform and RFX's services so RFX can address concerns before they affect the Client's outcomes.
7.3 Scope limits

Customer Success provides guidance and coordination. It does not include hands-on configuration, data work, training, or issue resolution, which are delivered through Client Support, implementation, or separately agreed services as described elsewhere in these Service Terms.

Recommendations from Customer Success are advisory. The Client remains responsible for its own compliance decisions as described in Section 5.

RFX may adjust the Customer Success model, including review cadence and the method of contact, based on the Client's subscription level and may assign or reassign Customer Success Managers.

8. Platform Packages, Modules and Products

This Section 8 describes the subscription packages, modules, add-ons and one-time services that may be listed on an Order. An Order lists the package, add-ons and quantities purchased and the Fees for each; the descriptions below govern what each item includes. Any item not listed on the Client's Order is not included and may be purchased separately.

8.1 Platform modules

The Platform is made up of the following modules. A Client's package determines which modules are enabled.

  • Medical Staff. Provider credentialing, privileging and reappointment records, document library, checklists, sanctions monitoring, fillable form templates, expirables tracking and the practitioner portal.
  • Employees. Staff records, document library, checklists, competencies and expirables tracking, sanctions monitoring, and the employee portal.
  • Compliance Logs. Configurable logs for recurring compliance activities, with reminders and reporting.
  • Variance Reporting. Capture, routing and tracking of incident and event reports.
  • Electronic Binders. Digital binders for organizing policies, documents and survey-readiness materials.
  • Contracts. Contract repository with key dates, renewal reminders and document storage.
  • Learning. Learning management: course assignment, completion tracking and records for the Client's own training content. Licensed course content is a separate add-on (Section 8.3).
  • VendorCheck. Vendor check-in and credential tracking described in Section 8.5.

RFX may add, rename, combine, enhance or retire modules over time. Updates and enhancements to modules included in the Client's package are provided as part of the Subscription Fee under Article II(b) of the Agreement. A new module that RFX offers as a separately priced add-on is not included in an existing package unless the Order says so.

8.2 Subscription packages

Subscription Fees are priced per facility and, unless the Order states otherwise, by the facility's number of operating and procedure rooms (OR/PR) as reported by the Client on the Order. If the Client's OR/PR count increases during an Order term, the Subscription Fee adjusts to the corresponding tier at the start of the next billing period after the Client notifies RFX or RFX becomes aware of the change.

  • Full Platform. All modules listed in Section 8.1, for one facility, with unlimited Authorized Users.
  • CVO Platform Only. The Medical Staff module for one facility, for use with CVO Services purchased under Section 4. Does not include implementation of the Employees, Compliance Logs, Variance Reporting, Contracts, or Learning modules.
  • Learning Platform Only. The Learning module for one facility together with the Employees roster needed to assign and track training. Does not include implementation of other modules.
  • Clinic Platform. The Full Platform configured for a clinic or other non-ASC facility, priced per facility.

Pricing under an enterprise or management-company agreement may differ from RFX's standard price list, but the package contents and these Service Terms are the same unless the enterprise agreement says otherwise.

8.3 RFX Learning Add-On (licensed course content)

The Learning Add-On is a licensed library of healthcare compliance and competency courses delivered through the Learning module. It is priced in tiers by the number of the Client's employees who have access to the content, as stated on the Order. The Client is responsible for reporting its staff count accurately; the tier is reviewed at each renewal and adjusted to the Client's then-current staff count. Course content is provided for general education and is updated by RFX from time to time. The Client remains responsible for determining which training its accreditor, state or policies require and for assigning it; RFX does not warrant that any course satisfies a particular regulatory, accreditation or payer requirement. Content may not be copied, downloaded or used outside the Platform.

8.4 Sanctions Monitoring

Sanctions Monitoring is a tool within the Medical Staff and Employees modules, not a separate module. It screens the practitioners maintained in the Medical Staff module and the employees maintained in the Employees module against the OIG List of Excluded Individuals/Entities, SAM.gov, state licensing boards (when available) and the DEA registration database. Sanctions Monitoring relies on the availability and accuracy of the third-party sources listed above, and the limitations in Section 4.5 and the no-guarantee provisions of Section 4.7 apply to it. Sanctions Monitoring is provided as part of each of the Medical Staff and Employees modules included in the Client's package: practitioners are screened only where the Medical Staff module is enabled, and employees only where the Employees module is enabled. It is not sold separately.

8.5 Vendor Check

Vendor Check provides mobile, GPS-verified check-in and check-out for vendor representatives visiting the Client's facility, a live view of vendors on site, tracking of vendor credential, insurance and training documents with expiration alerts, and exportable activity logs. Vendors register and upload their own documents; the Client sets the requirements vendors must meet and decides whether a vendor is permitted on site. RFX does not verify vendor documents unless verification services are purchased separately. GPS check-in depends on the vendor's device and location services and is not guaranteed. Non-GPS check-in functionality is always available. Vendor Check is purchased by vendor representatives, not by the Client.

8.6 Data Migration

Data Migration is a one-time service in which RFX imports structured data from the Client's prior system into the Platform, such as practitioner and employee rosters, user lists and expirable dates. The Client exports its data and supplies it in the import template RFX provides; RFX imports the data as supplied. Data Migration does not include scanning or uploading documents (see White Glove Onboarding, Section 3), data clean-up, de-duplication or reformatting, or migration from systems that cannot export to the template. The correction period and limitations in Sections 3.3 and 3.4 apply to Data Migration as if it were White Glove Onboarding.

8.7 Implementation packages

Implementation is purchased once per facility and is scoped to the modules in the Client's package: Full Platform Implementation, CVO Platform Only Implementation, Learning Platform Only Implementation and Clinic Implementation each cover the set-up and training deliverables in Sections 1 and 2 for the modules in the corresponding package. Sister Facility Implementation is a reduced-scope implementation for an additional facility under common ownership or management with a facility RFX has already implemented; it applies the existing facility's configuration as a starting point. Implementation Fees are priced by OR/PR count unless the Order states otherwise.

8.8 Expedited CVO request fee

A CVO request requiring completion in fewer than thirty (30) days is an expedited request under Section 4.4 and incurs the expedited request fee stated on the Client's Order, or, if none is stated, $250 per practitioner, in addition to the standard CVO Services fee.

8.9 Functional add-ons

Any module, content library, service or capacity not included in the Client's package under this Section 8 is a functional add-on that must be listed on an Order to be included. RFX may introduce new add-ons from time to time; these Service Terms will be updated under Article II(c) of the Agreement to describe them.