Contract analysis

1. GENERAL OBLIGATIONS AND STANDARDS 1.1 Security Program. AHT shall establish, implement, and maintain a comprehensive written information security program (the "Security Program") that includes administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of the Licensed Data. The Security Program shall be aligned with and meet or exceed the requirements of

2. ENCRYPTION STANDARDS 2.1 Encryption at Rest. All Licensed Data stored on AHT's systems, including primary databases, backup media, removable storage devices, and cloud storage environments, shall be encrypted using the Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256). Encryption shall be applied at the storage volume level, at the database level, or at the file level, as appropria

3. ACCESS CONTROLS 3.1 Role-Based Access Control (RBAC). AHT shall implement role-based access controls that limit access to Licensed Data to only those AHT personnel whose job functions require such access for the Permitted Uses set forth in the Agreement, namely internal analytics, model training, product development, and integration into AHT's SaaS platform. Access rights shall be assigned based on the principle o

4. NETWORK SECURITY AND SYSTEM HARDENING 4.1 Network Segmentation. AHT shall logically segregate systems and network segments that store or process Licensed Data from general-purpose corporate networks, development environments that do not require access to Licensed Data, and guest or public-facing network segments. Firewalls, intrusion detection/prevention systems (IDS/IPS), and network access control lists shall be

5. LOGGING AND AUDIT TRAIL REQUIREMENTS 5.1 Audit Logging. AHT shall enable and maintain comprehensive audit logs for all systems that store, process, or transmit Licensed Data. Logs shall capture, at a minimum, the following information for each logged event: (a) user identity (unique user identifier); (b) type of event (e.g., access, modification, deletion, export, query, login, logout, privilege change); (c) date

6. PHYSICAL SECURITY 6.1 Facility Controls. Any AHT facility (including co-located data centers and cloud provider facilities) where Licensed Data is stored or processed shall employ physical access controls including, at a minimum: (a) controlled entry points with electronic access badges, proximity cards, biometric readers, or equivalent authentication mechanisms, with access rights assigned based on job function a

7. PERSONNEL SECURITY 7.1 Background Checks. AHT shall conduct background checks on all personnel with access to Licensed Data, to the extent permitted by applicable law, prior to granting such access. Background checks shall include, at a minimum, verification of identity, criminal history review, and verification of employment history. AHT shall maintain records confirming that background checks have been completed

8. INCIDENT RESPONSE PROCEDURES 8.1 Incident Response Plan. AHT shall maintain a written incident response plan (the "IRP") that addresses the identification, containment, eradication, recovery, and post-incident review of Security Incidents. A "Security Incident" means any actual or reasonably suspected unauthorized access, acquisition, use, disclosure, modification, or destruction of Licensed Data, or any breach of

9. COMPLIANCE AUDITS 9.1 Annual Audit Right. Licensor may audit AHT's compliance with these Data Security Requirements once per calendar year upon no less than thirty (30) days' prior written notice. Such notice shall specify the proposed scope and approximate duration of the audit. Audits shall be conducted by an independent third party mutually agreed upon by the parties. The default auditor, absent mutual agreemen

10. DATA RETENTION AND DESTRUCTION 10.1 Retention During Term. AHT may retain Licensed Data throughout the term of the Agreement (initial term of five (5) years from the Effective Date, July 1, 2024, through June 30, 2029, plus any renewal terms) solely for the Permitted Uses specified in the Agreement. AHT shall not retain Licensed Data beyond the term of the Agreement except as expressly permitted under Section 10.

11. SUBCONTRACTORS AND THIRD-PARTY ACCESS 11.1 Restrictions. AHT shall not provide access to Licensed Data to any subcontractor, contractor, consultant, or other third party without the prior written consent of Licensor. Any request for such consent shall be submitted to Licensor in writing and shall identify the proposed third party, the scope and purpose of the access, the duration of the access, and the security m

12. BUSINESS CONTINUITY AND DISASTER RECOVERY 12.1 BCP/DR Plans. AHT shall maintain business continuity and disaster recovery plans ("BCP/DR Plans") that address the protection and recovery of Licensed Data in the event of a natural disaster, system failure, cyberattack, pandemic, or other disruptive event. The BCP/DR Plans shall identify critical systems and data, establish recovery priorities, define roles and resp

13. SPECIFIC PROHIBITIONS 13.1 Re-Identification. Consistent with AHT's covenant in the Agreement, AHT shall not, and shall not permit any personnel, contractor, or third party to, use the Licensed Data, alone or in combination with any other information, data set, or technique, to identify, contact, or re-identify any individual whose data is included in the Licensed Data. This prohibition extends to any attempt, wh

14. INSURANCE 14.1 AHT Coverage. AHT shall maintain cyber liability insurance coverage with limits of not less than Ten Million Dollars ($10,000,000) per occurrence and in the aggregate throughout the term of the Agreement, including coverage for data breach response costs, regulatory fines and penalties (to the extent insurable), business interruption, and third-party liability arising from unauthorized access to or

15. UPDATES AND MODIFICATIONS 15.1 Evolving Standards. AHT acknowledges that security threats and industry standards evolve over time, and that the security measures described in this Exhibit C represent minimum requirements as of the Effective Date. AHT shall update its Security Program as necessary to maintain alignment with the then-current version of NIST SP 800-171 and industry best practices for the protection

16. DEFINITIONS For purposes of this Exhibit C, the following terms shall have the meanings set forth below: "Licensed Data" means the data licensed to AHT under the Agreement, as defined therein and further described in Exhibit A to the Agreement, consisting of de-identified healthcare claims data sourced from Licensor's proprietary databases. "Permitted Uses" means the uses of Licensed Data authorized under the Agr