This AGREEMENT is entered into by and between the Commonwealth of Massachusetts, Executive Office of Health and Human Services (“EOHHS”) and the undersigned organizational entity (“Entity”) of the Commonwealth’s EOHHS Virtual Gateway Services (“Virtual Gateway”). 

1.	This Agreement states certain terms that apply to Entity’s access to the EOHHS Virtual Gateway Services. Entity agrees to comply with, and be bound by, this Agreement and to use the EOHHS Virtual Gateway Services only for authorized purposes.  

2.	Entity agrees to ensure that its employees, contractors, and agents that use the Virtual Gateway are aware of, and comply with, this Agreement (including any Riders, Attachments, and Amendments) and applicable state and federal laws concerning the confidentiality and security of information that is created, modified, accessed or received through the Virtual Gateway.  Entity is responsible for ensuring that its employees, contractors, and agents comply with all instructions and requirements regarding online application forms, tools, and services available through the EOHHS Virtual Gateway, and use such online application forms, tools, and services only for the purposes for which they are intended.  EOHHS agrees to provide Entity with timely information and updates regarding the use of the Virtual Gateway for which the Entity has been authorized, including but not limited to changes in forms, tools and services.   

3.	Entity must designate one or more individuals to serve as its Access Administrator(s).  The Access Administrator must be a member of the Entity’s staff in the direct control of the Entity.  The Access Administrator shall be responsible for communicating to the EOHHS Virtual Gateway the identity of the individual end users (including employees, contractors, agents, and Business Associates) authorized to access the Virtual Gateway on Entity’s behalf (each, "End User" and collectively, the "End Users"). The Access Administrator shall: (1) provide EOHHS with such information as it may require for each End User; (2) ensure that all information submitted to EOHHS about each End User is current, accurate, and complete; (3) notify EOHHS promptly of any End User whose access rights must be terminated, for example when an End User leaves the employment of the User; and (4) take such actions as EOHHS may direct or require to ensure the security of the EOHHS Virtual Gateway.  Upon receipt from the Access Administrator of all End User information required by this Agreement and any exhibits or amendments thereto, and any additional information that EOHHS may deem necessary to assign such access rights to End Users, the EOHHS Virtual Gateway shall assign individual account information and access instructions directly to each End User within 5-7 business days.  Information regarding End Users shall be maintained in secure files at EOHHS.  Nothing in this Agreement shall be construed to limit EOHHS's right to deny access rights to any End User for any reason provided EOHHS serves notice within 5-7 business days to Entity of such actions, unless in view of the Virtual Gateway security requires immediate termination.  If End User access rights are terminated without notice for security reasons, EOHHS will notify the Entity of such action within 5-7 business days. 

	EOHHS will allow Users with multiple divisions, departments, and/or facilities to designate such additional Access Administrators as EOHHS deems appropriate.  Entity must notify EOHHS in writing of any change in status of any Access Administrator within 5-7 business days of the change. The Entity must execute a new “Designation of Access Administrator” form for each new Access Administrator.  EOHHS will provide to the Entity, within 5 business days of receipt of the new Access Administrator’s designation form, any information needed related to the change in Access Administrators. 

	EOHHS reserves the right to terminate any Entity’s or End User's right to access the EOHHS Virtual Gateway Services, or to terminate the Access Administrator designation, at any time, with or without cause, without notice and without penalty. None of the foregoing shall be construed: (1) to relieve Entity of responsibility for the acts and omissions of its End Users; (2) to relieve Entity of any of the responsibilities imposed by this Agreement or by applicable law; or (3) to waive any rights or remedies that EOHHS possesses in the event of unauthorized access to or use of the EOHHS Virtual Gateway Services. 

4.	EOHHS and the organizations and individuals that use the Virtual Gateway are required by law to protect the privacy and security of personal information in the Virtual Gateway. Any use of the EOHHS Virtual Gateway Services to create, modify or access or receive information about an identifiable individual, for example by querying, may make Entity a “Holder” of “Personal Data” as those terms are defined in the Massachusetts Fair Information Practices Act (M.G.L. c. 66A) (“FIPA”). To the extent Entity becomes a Holder of Personal Data, Entity agrees to comply with FIPA and with all other applicable state and federal laws, including, if applicable and without limitation, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). All Personal Data that Entity creates, modifies, accesses or receives from the Virtual Gateway is the exclusive property of EOHHS.  EOHHS reserves all of its rights to exercise complete control over the access, use, disclosure, and disposition of Personal Data.  Entity agrees to certify to EOHHS, upon request, that in its use of Personal Data it is in compliance with this Agreement.  Entity is responsible for limiting access to Personal Data obtained from the Virtual Gateway to those employees, contractors, and agents that need such information in furtherance of the purposes for which EOHHS intends the Virtual Gateway to be used or as permitted by appropriate applicant consent documented in the manner directed by EOHHS.

5.	Each party is solely responsible for the preservation, privacy, and security of information in its possession, including information in transactions received from the other party and other persons. If either party receives from the other information not intended for it, the receiving party will immediately notify the sender to arrange for its return, re-transmission, or destruction.  Both parties agree: (a) to use their best efforts and to take all steps reasonably necessary to prevent unauthorized access to, use of, or disclosure of Personal Data; and (b) to take such measures as are reasonably necessary to mitigate or address any unauthorized access to, use of, or disclosure of Personal Data. None of the foregoing shall be construed to waive any rights or remedies that either party may possess in the event of unauthorized access to, use of, or disclosure of Personal Data 

6.	Any actions arising out of this agreement shall be governed by the laws of Massachusetts and shall be brought and maintained in a state or federal court in Massachusetts which shall have exclusive jurisdiction thereof. 

7.	It is specifically agreed between the parties that failure of any of the parties to insist upon compliance of any provisions herein at any time shall not waive such compliance with such provision at any other time.  No waiver by any party of any default or breach hereunder by the other shall constitute a waiver of any subsequent default or breach.   

8.	The parties do not intend by this Agreement to create any enforceable rights in debtors, third parties or other similarly situated persons.  Any benefits flowing to debtors, third parties or others as a result of this Agreement are merely incidental, and all rights, obligations, benefits and duties are enforceable solely by the parties hereto.   

9.	This Agreement is in addition to, and not in place of, other agreements that entity has entered into with EOHHS or its agencies.

10. 	Unless otherwise specified, any notice required by this agreement or other documents related to the use of the Virtual Gateway shall be in writing and shall be deemed given when delivered to either party or deposited in the U.S. Mail, first class, postage pre-paid, and when addressed as follows:

To EOHHS: 

EOHHS Virtual Gateway Operations – IDM Operations
100 Hancock Street, 5th Floor
Quincy, MA 02171

To Entity (Legal Organization Name & Address): 

	

11. This Agreement shall commence and shall continue in effect until terminated by either party by written notice given to the other party thirty days prior to the intended termination date.  EOHHS may discontinue or suspend the provisions of this Agreement immediately without notice if it determines that any term of this Agreement has been violated

IN WITNESS WHEREOF, the parties have caused their authorized representatives to sign below to indicate their acceptance of the terms and conditions of this Agreement. 

Entity/Organization (to be completed by an authorized representative)

Entity Name (Legal Organization Name)

Doing Business As (DBA)

Entity (Legal Organization) FEIN or Tax ID#	
	
Authorized Representative  Signature	
	
Authorized Representative Print Name	
	
Authorized  Representative Print Title

Date