Document

2.Company, DocGo, Inc., a Delaware corporation, Manager, HH Merger Sub, LLC, a Delaware limited liability company (“MergerCo”), and Concord Innovation Fund II, LP, a Delaware limited partnership, have entered into that certain Agreement and Plan of Merger dated as of the date hereof (the “Merger Agreement”), providing for MergerCo to merge with and into Company, with Company surviving the merger, on the terms and conditions set forth therein (the “Transaction”). As set forth in the Merger Agreement, upon a closing after final satisfaction or waiver of all conditions set forth in the Merger Agreement, Manager will become the owner of all of the issued and outstanding capital stock of Company (the “Closing”).

2.Appointment of Manager; Nature of Agreement. Company hereby engages Manager as an independent contractor to perform the specifically enumerated day-to-day management activities of Company with respect to the services and activities contemplated herein, and Manager hereby accepts such appointment, subject to the terms and conditions set forth in this Agreement and the non-delegated authority of the Company.

a.Manager shall manage, direct, and supervise all persons employed by Company whose job duties do not require the performance of remote, telemedicine, or patient-facing services or a health care professional permit (“Non-Clinical Employees”). Subject to Company’s prior written approval, which shall not be unreasonably withheld or delayed, Manager may, on behalf of Company, hire, reassign, promote, and discipline Non-Clinical Employees of Company. In addition, Manager may, subject to Company’s prior written consent, which shall not be unreasonably withheld or delayed, set the wages and benefits of the Non-Clinical Employees of the Company. Manager’s services shall include supervision of payroll and payroll taxes. Manager shall not engage in any acts and/or omissions during the Term of this Agreement that may result in any non-compliance by the Company with any applicable federal, state and local laws governing employment, labor relations, payroll, wages and hours, leave practices, occupational safety, employee benefits, workers’ compensation, human rights, tax, unemployment, anti-discrimination, Americans with Disabilities Act laws or minimum compensation laws. Notwithstanding the foregoing, the Company retains independent authority to adopt, amend, and implement policies and procedures regarding its operation.

b.Manager shall assist Company in billing and collecting all accounts receivable and monies owed for services in connection with the operation of Company in the Company’s own name, including enforcing the rights of Company as creditor, payee or obligee under any contract or in connection with the rendering of any services. Any actions taken by Manager to assist Company in collecting said accounts receivable shall be in accordance with applicable laws governing the collection of accounts receivable. Manager may engage a collection agency on behalf of Company to collect delinquent accounts, and the fees and costs of such

d.Manager will assist Company in reviewing and preparing all customer agreements for the delivery of telemedicine services, and all contracts and other documents or agreements in connection with the operation of Company’s business. All agreements and disclosures shall conform with applicable law and shall be entered into in the name of Company or the name of a professional corporation managed by the Company.

e.Manager shall make and amend contracts for office space, electricity, gas, fuel, telephone, insurance, security protection, and all other utilities and services, as applicable, all in the name of Company, provided, however, that Manager shall not execute or otherwise bind Company to any contract or agreement without first (i) furnishing a copy of same to Company, and (ii) obtaining Company’s consent to such agreement or contract. Manager shall also purchase all supplies necessary to properly maintain and operate Company in accordance with the standards required by applicable governmental agencies.

g.Manager shall cause to be performed such acts and things to be done in or about Company’s business as may be necessary for the Company to comply with any and all orders, regulations or notices issued by any federal, state or municipal agency having jurisdiction over Company or its business, including taking any action necessary to maintain any licenses issued to Company. Manager shall recommend for Company’s approval, all matters related to the settlement of any administrative procedures or litigation affecting Company and shall at the direction of Company, carry out all matters necessary to resolve same. Manager

shall pay directly or administer, out of the revenues generated by Company, payments of all obligations, expenses and third party bills arising out of and in connection with the operations of Company, including all third party invoices and obligations based upon contracts (for services, indebtedness or otherwise), and all other out-of-pocket expenses, ordinary or extraordinary, relating to the operation of Company’s business (collectively, “Operating Expenses”), provided that the Parties acknowledge and agree that this provision shall not be deemed to modify the Parties’ respective obligations relating to expenses set forth in the Merger Agreement. Manager shall fund the activities and operations of Company from existing Company cash balances and with monies collected and deposited into the Operating Account held in Company’s name, provided, however, in the event that such existing balances and the revenues generated by Company are not sufficient to pay the Operating Expenses which have accrued as of the Effective Date of this Agreement or which accrue during the Term of this Agreement, Manager shall be responsible for, and shall promptly pay out of its own funds, unrelated to Company, all amounts necessary to pay the Operating Expenses (“Advanced Funds”). Manager may be reimbursed for Advanced Funds pursuant to Section 16.

h.Manager shall provide Company with unrestricted access to Manager’s books and records regarding the performance of services under this Agreement, as well as all Company’s books and records during regular business hours, and shall report quarterly to Company, and will provide quarterly operational reports, financial statements and supporting bank statements to Company, and year-end financial statements, including statements of income and loss necessary for Company to prepare its tax returns, and any other reports reasonably requested by the Company’s governing authority. Manager shall pay the cost of preparing Company’s income tax returns as well as any associated tax liabilities relating to revenues of Company collected by or on behalf of Company during the Term. Notwithstanding the foregoing, Company shall retain independent control of Company’s books and records.

i.Manager shall be permitted to open all mail addressed to Company, including all notices, reports and other correspondence received from any governmental authority. Manager shall review the contents of such mail, and the Manager shall take on behalf of Company (subject to Company’s prior written approval, which shall not be unreasonably withheld or delayed), or recommend for Company’s approval, any responsive action related thereto. Manager shall immediately

deliver copies of all mail to Company. In addition, Company shall provide copies of all such mailings, notices and other communication received by Company (other than any personal mail), relating to Manager’s duties, obligations and authority under this Agreement, or to the operations of Company’s business, to Manager promptly upon receipt. All services provided hereunder shall be in accordance with Company’s policies and protocols (which may be amended by Company upon the written approval of Manager (which shall not be unreasonably withheld or delayed) or otherwise), and in accordance with all applicable laws. In the absence of written direction from Company following a request and reasonable opportunity to respond to such request, Manager shall exercise the reasonable judgment of a company providing administrative and management services (“Agency Managers”) to a company engaged in the business of Company.

k.Retained Authority. Notwithstanding any provision contained in this Section 3, the Parties recognize that (i) the responsibilities of Company’s governing authority is in no way lessened by entering into this Agreement, (ii) the governing authority of the Company retains full legal authority over the operation of Company and ongoing oversight responsibility for compliance with all statutory and regulatory requirements and oversight of the services provided under this Agreement, and (iii) any powers not specifically delegated to Manager by this Agreement remain with the Company.

commercially reasonable manner. Manager shall perform its duties in accordance with all applicable federal, state and local laws, statutes, ordinances, rules and regulations, contractual requirements applicable to the services, as well as all applicable written policies, bylaws and procedures of Company and the material terms of the most recently Company-approved annual operating budgets prepared by Manager in accordance with this Agreement or with other express written authorization of Company.

m.Certain Actions of Manager Requiring Company Consent. Notwithstanding anything in this Agreement to the contrary, Manager shall not, without the prior written consent of Company, borrow money or incur any indebtedness on behalf of the Company, except in the ordinary course of business; or adjust or settle any claim under any insurance policy or litigation or other claim applicable to the Company. In addition, Manager may not eliminate or reduce the Company’s provision of any essential health care services to consumers or patients of any state or jurisdiction in which Company currently provides health care services, without the prior written approval of the Company, such approval not to be unreasonably withheld or delayed.

ii.Authority. The execution and delivery of this Agreement by Manager (A) has been duly authorized by all necessary action by its managers and officers and (B) does not violate the terms of any other agreements, written or oral, to which Manager is a party or by which it is bound. This Agreement constitutes a valid, legal and binding obligation of Manager, enforceable in accordance with its terms, except as such enforceability may be limited by (x) general principles of equity (regardless of whether such enforceability is considered in a proceeding in equity or at law) or (y) applicable bankruptcy, insolvency or other similar laws affecting the rights of creditors generally.

v.Conduct. The Manager shall conduct all operations of Company subject to this Agreement in accordance with all applicable law and in accordance with the requirements of all policies and contracts to which Company is a party. Manager shall promptly notify Company if any contract is breached, revoked, limited or if any review or investigation ensues by any regulatory, contracting, or prosecutorial authority.

4.No Prohibitions; Restrictions or Limitations. Each Party represents that it is not a party to, or bound by, any order, writ, or material agreement that would (a) prohibit or, in any material respect, restrict or limit such Party from entering into this Agreement; or (b) prohibit, restrict or limit such Party from exercising, in any material respect, such Party’s rights or performing its aggregate obligations under this Agreement.

5.Financial Accounts. Manager shall deposit all funds collected from the operation of Company into the Operating Account in the name of and owned by Company. Manager’s designees shall be named as additional signatories on such bank account(s). All Operating Expenses of Company shall be paid from the Operating Account, including the Management Fee as set forth in Section 17. Such accounts and records of such collections and disbursements shall be maintained in accordance with generally accepted accounting principles (“GAAP”), to be kept at the office of Manager or at an office of Company. Any amounts collected by Manager or the Company that relate to services rendered by Company prior to the Effective Date of this Agreement shall be deposited into the Operating Account.

6.Records and Reports. On or about the Effective Date of this Agreement, subject to applicable law, Company shall provide Manager with access to all records, reports, books, programs, contracts, agreements and vendor arrangements necessary for Manager to perform its responsibilities and exercise its rights under this Agreement, including but not limited to: (a) Company’s policies and procedures, (b) reports, audits or other correspondence with any governmental authority, (c) Company’s patient roster, (c) agreements for the delivery of patient care, (d) all records relating to patient care and services, and (e) personnel records. As further set forth in Section 7, Manager shall

b.Without limiting the generality of the foregoing, Company and Manager each agree and acknowledge that all books, manuals, documents, materials, or other business or technical information in any form whatsoever, which relate either to the Company or Manager’s organization and which were distributed or otherwise disclosed to the other, shall constitute Confidential Information under this Agreement, including, but not limited to, information relating to research and development, products, designs, methods, systems, trade secrets, formulas, processes, protocols, marketing, merchandising, selling, licensing, servicing, customer lists, records or financial information, or any other information concerning either Party’s business strategy or policies. Company and Manager each represent that its employees and agents shall not use any of the other’s Confidential Information for any purpose other than in connection with the business of Company, and shall not disclose, publish or disseminate Confidential Information to any third party without the express prior written consent of the other, except as may be required under state or federal law. Upon termination of this Agreement, Company and Manager shall retrieve and return to the other all materials containing Confidential Information of the other Party.

c.Notwithstanding the foregoing, neither Party will have any obligation with respect to any Confidential Information that (i) is now, or hereafter becomes, through no act or failure to act on the part of the receiving party, generally known or available to the public; (ii) was acquired by the receiving party before receiving such information from the disclosing party and without restriction as to use or disclosure; (iii) is hereafter rightfully furnished to the receiving party by a third party (other than to Manager in its capacity as Manager under this Agreement), without restriction as to use or disclosure; (iv) is information which the receiving party can document was independently developed by it or on its behalf without

d.Manager agrees to comply with and to cause Company to comply with the Health Insurance Portability and Accountability Act of 1996, as codified at 42 U.S.C. § 1320d (“HIPAA”) and the applicable provisions of the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”) and any current and future regulations promulgated thereunder including without limitation the federal security and privacy regulations contained in 45 C.F.R. parts 160 and 164, and the federal standards for electronic transactions contained in 45 C.F.R. Parts 160 and 162, all collectively referred to herein as “HIPAA Requirements.” Manager agrees not to use or further disclose, and to cause Company not to use or further disclose, any Protected Health Information (as defined in 45 C.F.R. § 160.103) or Individually Identifiable Health Information (as defined in 42 U.S.C. § 1320d), other than as permitted by HIPAA Requirements and the terms of this Agreement. Manager may not de-identify, nor use any de-identified, Protected Health Information or Individually Identifiable Health Information that Manager receives or creates arising from the services provided under this Agreement for its own business purposes. Manager may not use or disclose any Protected Health Information or Individually Identifiable Health Information created or received under this Agreement to contact any individuals regarding any services or items provided directly or indirectly by any party other than Company, including without limitation any affiliate of Manager. Manager may use and disclose Protected Health Information and Individually Identifiable Health Information created or received under this Agreement, or derived from any such Protected Health Information or Individually Identifiable Health Information, solely and exclusively to provide services to the Company under this Agreement. Manager agrees to acknowledge its compliance with the foregoing by executing the HIPAA Business Associate Addendum in the form attached hereto as Exhibit A.

8.Federal Requirements Relating to Access to Records. To the extent applicable under Section 1861(v)(1)(I)(i) of the Social Security Act, as amended, Manager agrees that, upon request made in accordance with applicable law and regulations, the Comptroller General of the United States, the United States Department of Health and Human Services and the duly authorized representatives of the foregoing shall be given access by Manager to all records, books, documents and other materials of Company that are

necessary to verify the nature and extent of the costs to Company of services rendered hereunder from the Effective Date of this Agreement until the expiration of four years after the furnishing of the services under this Agreement. In the event that any request for Manager’s books, documents and records is made pursuant to this Section, Manager shall promptly give notice of such request to Company and shall promptly provide it with a copy of such request and each book, document and record made available to one or more of the persons and agencies listed above or shall identify each such book, document and record to Company and shall grant it access thereto for review and copying. This provision shall survive termination of this Agreement.

9.Ownership of Records. The ownership and right of control of all reports, records, and documents prepared by Manager or its staff in connection with services rendered hereunder will vest exclusively in Company. Upon a termination of this Agreement, unless there is a Closing, Manager shall immediately surrender to Company all records in Manager’s possession or control to the extent relating to services rendered hereunder. Manager shall only be entitled to retain copies of its own work product in order to verify the work performed in the event of any future disputes.

10.No Disqualified Individuals. Each Party represents and warrants that neither it nor any member, manager, employee or agent of such Party: (a) has been convicted of a criminal offense related to healthcare (unless such individual has been officially reinstated into the federal healthcare programs by the Office of Inspector General (“OIG”) and provided proof of such reinstatement); (b) is under sanction, exclusion or, to the best of such Party’s knowledge, after reasonable due diligence, investigation (civil or criminal) related to healthcare by any federal or state enforcement, regulatory, administrative or licensing agency or is ineligible for federal or state program participation; or (c) is listed on the General Services Administration System for Award Management or OIG List of Excluded Individuals/Entities. Each Party shall immediately notify the other Party in writing of any such conviction, sanction, exclusion, investigation or listing of such Party or any member, manager, employee or agent of such Party.

11.Authorization. Company hereby authorizes Manager to perform any act or do anything necessary or desirable to carry out Manager’s duties and responsibilities contained in Section 3, provided that all actions taken by Manager pursuant to the provisions of Section 3 shall be done for the benefit of Company and consistent with the terms and conditions set forth in, and the Parties’ intentions under, this Agreement.

proceedings, fines, penalties, costs and expenses, including court costs and reasonable attorneys’ and other professional fees (“Losses”), (a) arising from or relating to any violation of law or material breach of this Agreement (including the HIPAA Business Associate Addendum) by Manager, or (b) to the extent caused by any act or omission of Manager on or after the Effective Date of this Agreement. Company agrees and shall indemnify and hold harmless Manager, its members, managers, officers and employees from any and all Losses, (y) arising from or relating to any violation of law or material breach of this Agreement by Company, or (z) to the extent caused by any act or omission of Company on or after the Effective Date of this Agreement (in each case, unless such violation, breach, act or omission is based upon the direct request of Manager). In connection with any indemnification demands hereunder, the Parties shall follow the procedures set forth in Article 7 of the Merger Agreement concerning notice and assumption of defense of such actions. This provision shall survive the termination of this Agreement, unless this Agreement is terminated pursuant to Section 14(a).

13.Insurance. Throughout the Term of this Agreement, Manager will ensure that Company maintains (i) a general liability insurance policy , (ii) a professional liability insurance policy, (iii) workers’ compensation insurance for so long as employees serving Company are employed by the Company, and (iv) an errors and omissions insurance policy, each in such coverage amounts as existing on the Effective Date, or such higher policy limits as may be required by law or by the landlord under any applicable facility premises lease. Each such insurance policy shall either name Manager as an additional insured or provide Manager with a certificate of insurance evidencing such coverage. Company shall provide to Manager written notice promptly following learning of any cancellation, change or amendment to such policies and, to the extent reasonably practicable, at least 30 days prior to such cancellation, change or amendment.

15.Events of Default and Termination. It shall be an “Event of Default” under this Agreement if either Party shall be in default under the terms of this Agreement and fails to cure such default within 45 days of the non-defaulting Party’s written notice of same, provided that such 45-day period shall be automatically extended if such default cannot be reasonably cured within such 45-day period and the defaulting Party has promptly commenced to cure same and diligently prosecutes such cure to completion, but in no event shall such period continue longer than 90 days. Furthermore, it shall be automatically an Event of Default with respect to a Party in the event that (a) such Party files a petition for bankruptcy, reorganization, or arrangement, (b) a petition for bankruptcy, reorganization or arrangement is filed against such Party and such petition is not dismissed within 30 days, (c) a receiver or trustee is appointed for all or a substantial portion of the assets of such Party, or (d) such Party makes an assignment for the benefit of its creditors. The non-defaulting Party shall have the right to terminate this Agreement on 30 days’ written notice if there is an Event of Default. Notwithstanding the foregoing, in the event there is a showing of fraud by a Party or, in the case of Manager (i) material malfeasance in the management of Company, (ii) Manager is charged with a felony crime, (iii) Manager commits a crime of moral turpitude, such as an act of fraud or other crime involving dishonesty, or (iv) Manager fails to effect the Closing pursuant to Section 2.1 of the Merger Agreement, with each of clauses (i)-(iv) deemed a breach of this Agreement by Manager, then, in such instance, the non-defaulting Party shall have the right to terminate this Agreement immediately upon notice to the other Party.

16.Effect of Termination. Upon termination of this Agreement for any reason other than a breach of this Agreement by Manager or the Closing, the Company’s obligations to Manager shall be limited to paying (a) any unpaid portion of the Management Fee (as defined in Section 17) accrued and owed to Manager through the effective date of termination, unless there are insufficient funds to pay such Management Fee from the Operating Account; and (b) any Advanced Funds paid by Manager, subject to the Adjustment defined below in this Section 16. Recognizing that the Management Fee, as defined in Section 17, affords the Manager the benefit of the upside of revenue over Operating Expenses, as more fully detailed therein, yet this Agreement provides Manager certain protection against the downside of Operating Expenses exceeding revenue, to the

17.Management Fee; Company Expenses. Manager will be compensated for its services under this Agreement by a Management Fee (as defined below) payable to Manager weekly within five days after the end of each week during the term hereof. The Management Fee for each period shall be payable to Manager in arrears. The “Management Fee” shall be an amount equal to gross revenue of Company, received by the Manager or the Company for each such week, reduced by the amount of the Operating Expenses of Company (as defined in Section 3(g)). If there are insufficient funds in the Operating Account to pay all or any part of the Management Fee for any period, after payment of all Operating Expenses, such deficiency in the Management Fee shall carry over and be added to the Management Fee payable for the following week (and, if applicable, the following periods thereafter) until there are sufficient funds to pay the cumulative Management Fee after payment of all Operating Expenses of Company. Furthermore, Manager agrees to advance to Company sufficient funds to pay any Operating Expenses which cannot be paid from the Operating Account that accrue or become due and owing following the Effective Date of this Agreement. Subject to the terms set forth in this Section 17, Company shall have no liability, and Manager shall have no recourse against Company, in the event that the available funds at any time are insufficient to pay the Management Fee or any part thereof, or to pay any Operating Expenses of Company subsequent to the Effective Date of this Agreement.

18.Company Bonus Plan. The Parties agree that the 2026 Management Bonus Plan adopted by Company as of June 15, 2026 shall remain in effect during calendar year 2026 and as otherwise set forth in the Merger Agreement. To the extent this Agreement has not expired or been terminated on or before December 31, 2026, Company shall adopt for calendar year 2027 an employee bonus plan for Company’s employees with the same terms and conditions as the employee bonus plan of Manager in effect for calendar year 2027.

22.Independent Contractor. Nothing contained in this Agreement shall constitute or be construed to be or to create a partnership, joint venture, employment, agency or other similar relationship between Company and Manager. The relationship of Manager to the Company under this Agreement is that of an independent contractor and, except as provided herein, neither Party hereto is or shall be construed to be the employee, employer, principal, or agent of the other.

23.Notice. Any notice which a Party is required or may desire to give the other Party shall be in writing and shall be sent by personal delivery or by mail (either [i] by United States registered or certified mail, return receipt requested, postage prepaid, or [ii] by Federal Express or similar generally recognized overnight carrier regularly providing proof of delivery), addressed as follows (subject to the right of a Party to designate a different domestic address for itself by notice similarly given at least five days in advance):

Any notice so given by mail shall be deemed to have been given to the respective Party (and not the Party’s designee authorized to receive a copy) as of the date of delivery (whether accepted or refused) established by U.S. Post Office return receipt or the overnight carrier’s proof of delivery, as the case maybe. Any such notice given by personal delivery shall be deemed given upon actual receipt of the same by the Party to whom the same is to be given. Notices may be given by facsimile transmission and shall be deemed given upon the actual receipt of the same by the individual to which they are addressed and shall be promptly followed by a hard copy notice by mail as provided above. All notices that are required or permitted to be given by either Party to the other under this Agreement may be given by such Party or its legal counsel who are hereby authorized to do so on the Party’s behalf.

a.Manager will have the right to assign its rights and obligations under this Agreement to an entity in which Manager owns at least 50% of the voting share capital, or over which Manager has the power to exercise control of such entity. Neither Manager nor Company may assign this Agreement to any other person or entity without the other Party’s prior written consent. This Agreement shall be binding upon and shall inure to the benefit of the Parties hereto, their successors and, where applicable, their assigns.

b.This Agreement represents the entire agreement and the sole agreement between the Parties for the purpose of managing the day-to-day activities of Company, or any portion thereof, within its approved geographic service area and supersedes in all respects any and all prior oral or written agreements or understandings between them pertaining to the subject matter of this Agreement. Notwithstanding the foregoing, if any provision of this Agreement conflicts with the Merger Agreement, the terms of the Merger Agreement shall govern. This Agreement cannot be modified or terminated, nor may any of its provisions be waived, except by a written instrument signed by the Party(ies) against which enforcement is sought. There are no intended third party beneficiaries of this Agreement. Any waiver by any Party of the strict performance of any of the terms, conditions and provisions of this Agreement shall not be construed as a waiver thereof for the

c.In the event any action be instituted by a Party to enforce this Agreement, or in the event of any litigation, claim or action whatsoever concerning the subject matter of this Agreement, the prevailing Party in such action (as determined by the court, agency or other authority before which such suit or proceeding is commenced), shall be entitled to such reasonable attorneys’ fees, costs and expenses as may be fixed by the decision maker. The foregoing includes, but is not limited to, reasonable attorneys’ fees, any poundage fees or other fees imposed by the court, expenses and costs incurred in (i) any appellate proceedings; (ii) any post-judgment proceedings to collect or enforce the judgment; (iii) establishing the right to indemnification; and (iv) any action or participation in, or in connection with, any case or proceeding under Chapter 7, 11 or 13 of the Bankruptcy Code (11 United States Code Sections 101 et seq.), or any successor statutes. This provision shall survive the termination of this Agreement.

d.THIS AGREEMENT SHALL BE CONSTRUED AND ENFORCED IN ACCORDANCE WITH THE INTERNAL LAWS OF THE STATE OF DELAWARE (WITHOUT REGARD TO CONFLICTS OF LAW). IN ADDITION, EACH PARTY CONSENTS AND AGREES THAT VENUE OF ANY ACTION INSTITUTED UNDER THIS AGREEMENT OR ANY AGREEMENT EXECUTED IN CONNECTION HEREWITH SHALL BE PROPER in any court, whether state or federal, located in the State of Delaware AND EACH PARTY HEREBY WAIVES ANY OBJECTION TO SUCH VENUE.

e.Words used in the singular shall include the plural, and vice versa, and any gender shall be deemed to include the other. Whenever the words “including”, “include” or “includes” are used in this Agreement, they should be interpreted in a non-exclusive manner. The captions and headings of the Sections of this Agreement are for convenience of reference only and shall not be deemed to define or limit the provisions hereof. Except as otherwise indicated, all Exhibit and Section references in this Agreement shall be deemed to refer to the Exhibits and Sections in this Agreement. Each Party acknowledges and agrees that this Agreement (i) has been reviewed by it and its counsel, (ii) is the product of negotiations between the Parties, and (iii) shall not be deemed prepared or drafted by any one Party. In the event of any dispute between the Parties concerning this Agreement, the

Entity and Associate agree that the parties incorporate this Addendum into the Agreement in order to comply with the requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”) and their implementing regulations set forth at 45 C.F.R. Parts 160 and Part 164 (the “HIPAA Rules”). To the extent Associate is acting as a Business Associate of Entity pursuant to the Agreement, the provisions of this Addendum shall apply, and Associate shall be subject to the penalty provisions of HIPAA as specified in 45 CFR Part 160.

2.Uses or Disclosures. Associate will neither use nor disclose PHI except as permitted or required by this Addendum, the Agreement or as Required By Law. To the extent Associate is to carry out an obligation of a Covered Entity under 45 CFR Part 164, Subparts A and E, Associate shall comply with the requirements of 45 CFR Part 164, Subparts A and E that apply to such Covered Entity in the performance of such obligation. Associate is permitted to use and disclose PHI as follows:

d.as necessary for Associate’ s proper management and administration and to carry out Associate’s legal responsibilities (collectively “Associate’s Operations”), provided that Associate may only disclose PHI for Associate’s Operations if the disclosure is Required By Law or Associate obtains reasonable assurance, evidenced by a written contract, from the recipient that the recipient will: (1) hold

4.Subcontractors. In accordance with 45 CFR §§ 164.308(b)(2) and 164.502(e)(1)(ii), Associate will ensure that all of its subcontractors that create, receive, maintain or transmit PHI on behalf of Associate agree by written contract to comply with the same restrictions and conditions that apply to Associate with respect to such PHI, including but not limited to the obligation to comply with applicable provisions of 45 CFR Part 164, Subpart C.

5.Minimum Necessary. Associate represents that the PHI requested, used or disclosed by Associate shall be the minimum amount necessary to carry out the purposes of the Agreement. Associate will limit its uses and disclosures of, and requests for, PHI (i) when practical, to the information making up a Limited Data Set; and (ii) in all other cases subject to the requirements of 45 CFR § 164.502(b), to the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or request.

6.Access and Amendment. In accordance with 45 CFR § 164.524, Associate shall, within three business days of such request, permit Entity or, at Entity’s request, an individual (or the individual’s designee) to inspect and obtain copies of any PHI about the individual that is in Associate’ s custody or control and that is maintained in a Designated Record Set. If an Individual makes a request for an amendment to PHI directly to Associate, Associate shall notify Entity of the request within three business days of such request and will cooperate with Entity and allow Entity to send the response to the Individual. If the requested PHI is maintained electronically, Associate must provide a copy of the PHI in the electronic form and format requested by the individual, if it is readily producible, or, if not, in a readable electronic form and format as agreed to by Entity and the individual. Associate will, upon receipt of notice from Entity, promptly, but in no more than three

7.Accounting. Except for disclosures excluded from the accounting obligation by the HIPAA Rules and regulations issued pursuant to HITECH, Associate will record for each disclosure that Associate makes of PHI the information necessary for Entity to make an accounting of disclosures pursuant to the HIPAA Rules. In the event the U.S. Department of Health and Human Services (“HHS”) finalizes regulations requiring Covered Entities to provide access reports, Associate shall also record such information with respect to electronic PHI held by Associate as would be required under the regulations for Covered Entities beginning on the effective date of such regulations. Associate will make information required to be recorded pursuant to this Section available to Entity promptly upon Entity’ s request, but in no event later than 20 days, for the period requested, but for no longer than required by the HIPAA Rules (except Associate need not have any information for disclosures occurring before the effective date of this Addendum). If an Individual makes a request for an accounting directly to Associate, Associate shall notify Entity of the request within three business days of such request and will cooperate with Entity and allow Entity to send the response to the Individual.

9.Reporting. To the extent Associate becomes aware or discovers any use or disclosure of PHI not permitted by this Addendum, any Security Incident involving electronic PHI or any Breach of Unsecured Protected Health Information, Associate shall report such use, disclosure, Security Incident or Breach to Entity as soon as possible but no later than five days after discovery of such Security Incident. Associate shall mitigate, to the extent practicable, any harmful effect known to it of a Security Incident, Breach or use or disclosure of PHI by Associate not permitted by this Addendum. Notwithstanding the foregoing, the parties acknowledge and agree that Associate shall not be required to report to Entity Unsuccessful Security Incidents (as defined below) for which no notice is required under any HIPAA provisions. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as such incident does not result, and is not reasonably likely to have resulted, in unauthorized access, use or disclosure of electronic PHI. All reports of Breaches shall be made in compliance with 45 CFR § 164.410.

10.Term. This Addendum shall be effective as of the Effective Date of the Agreement and shall remain in effect until termination of the Agreement. Either party may terminate this Addendum and the Agreement effective immediately if it determines that the other party has breached a material provision of this Addendum and failed to cure such breach within 30 days of being notified by the other party of the breach. If the non-breaching party determines that cure is not possible, such party may terminate this Addendum and the Agreement effective immediately upon written notice to other party. Upon termination of this Addendum for any reason, Associate will, if feasible, return to Entity or destroy all PHI maintained by Associate in any form or medium, including all copies of such PHI. Further, Associate shall recover any PHI in the possession of its agents and subcontractors and return to Entity or securely destroy all such PHI. Upon termination of this Addendum for any reason, all of Associate’s obligations under this Addendum shall survive termination and remain in effect until Associate has completed the return or destruction of PHI as required by this Section and to the extent Associate retains any PHI pursuant to this Section.

11.General Provisions. In the event that any final regulation or amendment to final regulations is promulgated by HHS or other government regulatory authority with respect to PHI, the parties shall negotiate in good faith to amend this Addendum to remain in compliance with such regulations. Any ambiguity in this Addendum shall be resolved to permit Entity and Associate to comply with the HIPAA Rules. Nothing in this Addendum shall be construed to create any rights or remedies in any third parties or any agency relationship between the parties. A reference in this Addendum to a section in the HIPAA Rules means the section as in effect or as amended. The terms and conditions of this Addendum override and control any conflicting term or condition of the Agreement and replace and supersede any prior business associate agreements in place between the parties. All non-conflicting terms and conditions of the Agreement remain in full force and effect.