Extract to table

Fenwick DCA recommended that the DPA specify a sixty (60) day data-export window during which Quorum may retrieve all Customer Data in usable formats, followed by a thirty (30) day period within which Clearpoint must certify the complete destruction of all Customer Data in its possession or control, including data held by subprocessors

Under HIPAA, a covered entity such as Quorum is required to obtain satisfactory assurances from any business associate that processes PHI on its behalf, and those assurances must be documented in a written BAA that includes specific provisions mandated by the HIPAA Privacy Rule and Security Rule

Clearpoint is required to remain fully liable for Cobalt Cloud's acts and omissions as if they were Clearpoint's own

• Any use of Aggregated Data beyond product improvement requires Quorum's prior written consent, which shall not be unreasonably withheld

Clearpoint is required to provide certified destruction of all Customer Data within thirty (30) days of the completion of the data-export period

Clearpoint is required to maintain and deliver an annual SOC 2 Type II audit report, conducted by an independent third-party audit firm (current auditor: Hawthorne & Ellers, CPAs LLP)