On the agenda: Lancaster County meeting — data center (Apr 1)

LANCASTER COUNTY COMMISSIONERS’ MEETING AGENDA
WEDNESDAY, APRIL 1, 2026
9:15 a.m. – Conference Room #701, 7th Floor
The Commissioners’ Meeting is being video recorded for public viewing and is available on the County’s website.

1. Meeting Called to Order: This morning’s meeting will be conducted by Commissioner Ray D’Agostino.
2. Pledge of Allegiance
3. Minutes as Distributed: Approval of the March 25, 2026 Commissioners’ Meeting Minutes.
4. Reannouncement: An Evening Commissioners’ Meeting is scheduled for Wednesday, April 8, 2026 at 7:00
p.m. at the East Cocalico Township Municipal Building, 100 Hill Road, Denver, PA. There is no
Commissioners’ Meeting scheduled for Wednesday, April 8, 2026 at 9:15 a

5. Old Business:
6. New Business:
a. Juvenile Probation – Application for Reimbursement from the Juvenile Court Judges’
Commission
Cheri Modene, Director
b. Behavioral Health and Developmental Services – Amended Agreement with Robert Half, Inc.
Kerby Keller, Deputy Director of Administration
c. Human Resources – Agreement with HealthEquity
Christina Peddigree, Director
d. Purchasing Department – Corrected Motion for Pool Chemical Contracts
James Catigano, Buyer II
e. General Services – Amended Agreement with RETTEW
Carmen Simone, Deputy Director
7. Business from Guests
8. Adjourn

On motion of Commissioner _____, seconded by Commissioner _____, it was agreed for
the County of Lancaster, acting on behalf of Juvenile Probation, to approve the following:
Reimbursement Application With: Juvenile Court Judges’ Commission (JCJC)
Harrisburg, PA

4/1/26

Purpose:

To apply for reimbursement through the JCJC Grant
in Aid to be used for salaries.

Amount/Term:

$659,433.00 for the period July 1 2025 through
June 30, 2026.

Funding:

100% State funding.

Note:

The paperwork must be signed by Lawrence M.
George, County Administrator/Chief Clerk and the
Commissioners, and submitted to JCJC before
application for reimbursement is received.

Date: _________________________

Mr. Robert J. Tomassini
Executive Director
Juvenile Court Judges’ Commission
Pennsylvania Judicial Center
601 Commonwealth Ave., Suite 4600
P.O. Box 62425
Harrisburg, PA 17106-2425
Dear Mr. Tomassini:
Please be advised that the compensation provided to juvenile probation officers including salaries, salary
increases and bonuses, provided to Lancaster County’s juvenile probation personnel is equitable to the
compensation provided to other county and court personnel, in accordance with subsection 200.1003 (a) of Title
37 of the Pennsylvania Code.

Sincerely,
3/17/26
____________________________________________________
President Judge
Date

____________________________________________________
Chairman/County Executive
Date
____________________________________________________
County Commissioner
Date
____________________________________________________
County Commissioner
Date

Juvenile Court Judges’ Commission
Pennsylvania Judicial Center | 601 Commonwealth Avenue, Suite 4600 | PO Box 62425 | Harrisburg, PA 17106 | 717.787.6910 | F. 717.783.6266
www.pa.gov/agencies/jcjc

FY 2024-2025 FINANCIAL STATEMENT

FUNDS EXPENDED UNDER JUVENILE PROBATION SERVICES GRANT
BUDGET PERIOD COVERED: JULY 1, 2024 TO JUNE 30, 2025
COUNTY:

LANCASTER

AMOUNT OF GRANT RECEIVED:

$659,433.00

INTEREST EARNED FROM JULY 1, 2024 TO JUNE 30, 2025:

$0.00

FY 2023-2024 Approved Amount Carried Forward to FY 2024-2025:

$0.00

JUVENILE PROBATION PERSONNEL
Last Name

First Name

Total Annual Salary
(rounded to nearest
dollar)

MI

TOTAL:

$659,433.00

% FT
Employment

% of Time
Amount of Grant
in
Expenditure Used to
Juvenile
Support Salary

Avery

Heather

$

92,371.50

100%

100% $

65,341.77

Flowers

Makeda

$

79,287.00

100%

100% $

65,341.77

Glass

Virginia (Ginger)

$

95,963.00

100%

100% $

65,341.77

Trostle

Carole

$

96,763.00

100%

100% $

65,341.77

Koser

Ryan

$

91,563.00

100%

100% $

65,341.77

McComsey

Karen

$

91,963.00

100%

100% $

65,341.77

McGill

Shana

$

94,360.00

100%

100% $

65,341.77

Mitchell

Josephine

$

95,569.00

100%

100% $

65,341.77

Mozeliak-Gardner

Traceylyn

$

93,563.00

100%

100% $

65,341.77

Roberts-McComosey

Erin

$

88,140.00

100%

100% $

65,341.77

Juvenile Probation Personnel amount transferred from Page 2 (if entered) $
JUVENILE PROBATION PERSONNEL TOTAL $

653,417.70

FY 2024-2025 EXPENDED OPERATIONS COSTS Amount of Grant
Expenditure used for
General Description
Vendor
Qty
Operations

Expense Type

Operations: Drug testingRedwood Toxiclogy
Operations: Printing
Brennneman Printing

Drug Testing Supplies/Confirmations
Family Guides - English/Spanish

$

534.30

$

5,481.00

$

-

$

-

$

-

$

-

$

-

$

-

Operations costs transferred from Page 3 (if entered) $
OPERATIONS TOTAL $

6,015.30

FY 2024-2025 Requested Amount Carried Forward to FY 2025-2026

TOTAL EXPENDITURES $ 659,433.00
We certify that the information given above is true and correct to the best of our knowledge and belief.
SIGNATURE:

County Comptroller / Treasurer

DATE:

SIGNATURE:

Chairman / County Executive
Page 1

DATE:

On motion of Commissioner _______, seconded by Commissioner _____, it was agreed
for the County of Lancaster, acting on behalf of Behavioral Health and Developmental Services
(BHDS), to approve the following:
Amended Agreement With:

Robert Half, Inc.
San Ramon, CA

Purpose:

To extend the end date of the contract due to the
vacancy in the senior accounting position.
Robert Half, Inc. provides professional level
temporary staffing.

4/1/26

Amount/Term:

$40,616.16 for the period April 3, 2026 through
December 31, 2026.

Funding:

Human Services Block Grant.

On motion of Commissioner _____, seconded by Commissioner _____, it was agreed for
the County of Lancaster, acting on behalf of Human Resources, to approve the following:

4/1/26

Agreement with:

HealthEquity
Draper, UT

Purpose:

To change the vendor that administers the
County’s Health Savings Account (HSA), Health
Reimbursement Account (HRA), and Flexible
Spending Account (FSA) to reduce costs.

Amount/Term:

$5,500.00 for the HRA/FSA for the period January
1, 2027 through December 31, 2031.
There is no cost for the HSA – term is from July 1,
2026 through June 30, 2031.
Savings of $50,000/year.

Funding:

County health insurance portion of General Fund.

General Terms and Conditions
These General Terms and Conditions govern the provision of services to you, and your Affiliates designated in writing
(individually and collectively, “Employer”) and are an integral part of the agreement between Employer and HealthEquity, Inc.,
(“HQY”), which enters this agreement on its own behalf and on behalf of its Affiliates. HQY and Employer each may be referred
to as “Party” or collectively as “Parties”. An “Affiliate” is defined as any business entity or enterprise, which controls, is controlled
by, or is under common control with, a Party. These General Terms and Conditions must be read in conjunction with all
Schedules and Order Forms (collectively, the “Agreement”). BY SIGNING THE ORDER FORM REFERENCING THESE
GENERAL TERMS AND CONDITIONS OR ACCESSING HQY’S EMPLOYER PORTAL OR USING ANY SERVICES,
EMPLOYER AGREES THAT IT HAS READ THESE GENERAL TERMS AND CONDITIONS AND AGREES TO BE BOUND
BY THE AGREEMENT. Notwithstanding anything to the contrary contained herein, if Employer has a relationship with a health
plan or other administrative entity governing the provision of any Services, such Services (including any fees associated in
connection therewith) will be governed and controlled by the terms of such relationship, and nothing herein shall be intended to
conflict in any manner with such relationship.
1

General.

1.1

Services. Employer engages HQY, and HQY agrees to be so engaged, on the terms and conditions set forth in this
Agreement to provide certain services (the “Services”) as selected on Employer’s online application or other mutually
agreed to order form or documentation (each an “Order Form”). The Parties agree that HQY may provide the Services
using different technology platforms and may also modify or change technology platforms in its discretion so long as
the Services are provided, and HQY shall remain responsible to provide the Services, in accordance with the applicable
Schedule(s).

1.2

Schedules. “Schedule” refers to each of the schedules attached to these General Terms and Conditions. Each
Schedule will: (i) describe the tasks to be performed by the Parties in connection with the Services outlined in that
Schedule and (ii) include the fees and expenses associated with the Services outlined in that Schedule (to the extent
not otherwise listed in the Order Form). The Order Form selecting the Services to be provided hereunder will designate
the applicability of the Schedules (meaning that, if a particular Service is not identified on an Order Form between the
Parties, that corresponding Schedule shall not apply for purposes of this Agreement). Employer shall cooperate on a
timely basis with HQY and perform the activities reasonably required by HQY to enable HQY to fulfill its obligations and
responsibilities under this Agreement. In the event of any conflict between these General Terms and Conditions and
any Schedule or Order Form to this Agreement, the applicable Order Form shall control with respect to these General
Terms and Conditions and any Schedule, and any Schedule shall control with respect to these General Terms and
Conditions for the specific Services provided in that Schedule only.

1.3

Employer Responsibility. Employer has exclusive responsibility for providing HQY with timely and accurate information
and data as necessary for HQY to provide the Services.

1.4

Plan Administrator; Fiduciary. With respect to employee benefit plans and programs subject to the Employee
Retirement Income Security Act of 1974, as amended ("ERISA"), Employer acknowledges and agrees that it is the
"plan administrator" and "fiduciary" within the meaning of ERISA of such employee benefit plans or programs (each a
"Plan" or, collectively, the "Plans") sponsored by Employer, and that HQY is an independent contractor engaged to
perform the agreed upon Services in a non-fiduciary capacity. Employer must obtain the prior written consent of HQY
to all references to HQY, or to its products or services, in all communications or documents pertaining to the Plan(s)
prepared by Employer, or on Employer’s behalf, unless the reference identifies HQY only as a service provider or the
reference is required in an IRS Form 5500 or similar filing or document required by ERISA or the Internal Revenue
Code of 1986, as amended (the “Code”). Without limiting the foregoing, in no event may Employer identify or refer to
HQY as "administrator," "plan administrator," "plan sponsor," "fiduciary," "plan fiduciary," or any similar title. It is
understood and agreed between HQY and Employer that any such written consent of HQY shall not be considered a
representation that HQY has reviewed or approved the content of such communication or document except as to those
matters set forth in this Subsection 1.4 for which consent is required. Employer has the responsibility to pay all fees or
penalties arising from the Plans that are assessed by the Internal Revenue Service, the Department of Labor, and/or
other federal, state, or local governmental agencies.

1.5

Implementation. HQY will provide Employer with an implementation plan and the Parties will work in good faith to
implement the Services and other arrangements contemplated by this Agreement in accordance with the terms hereof
and applicable laws and regulations. Each of the Parties will designate an employee to facilitate and manage the
implementation in order to provide services to employees of Employer. If Employer makes changes to its eligibility file

General Terms and Conditions (v 20260226) - Confidential

Page 1 of 42

after implementation has already been performed by HQY, thus requiring implementation to be reperformed, then HQY
may charge a fee as specified in on the Order Form.
2

Term.
The term of this Agreement shall begin on the date set forth in the applicable Order Form or, in the event that a date is
not specified in an applicable Order Form, the date that HQY receives eligibility or contribution information related to
Employer’s employees (the “Effective Date”) and continue until the expiration or earlier termination of all Schedules.

3

Communications and Relationship Management.

3.1

HQY contact designation. HQY will designate a contact or team responsible for responding to inquiries and requests
made by Employer.

3.2

Employer communications. Employer will provide HQY with a list of personnel duly authorized to receive and furnish
information or instructions (“Employer Communication”) and HQY may, without further review or verification, honor or
act upon any Employer Communication.

3.3

Notices. Except for invoices and billing-related communications, any notices required or permitted to be given by one
Party to the other under this Agreement shall be deemed given when (i) hand delivered and acknowledged, (ii) sent by
certified or registered mail, or (iii) sent by overnight carrier, as listed below:
If to HQY:

If to Employer:

HealthEquity, Inc.

The address as listed on the Order Form

Attention: General Counsel
121 West Scenic Pointe Drive
Draper, UT 84020
Email communications are also acceptable so long as (A) the notice is signed and provided as a letter attachment to
the email (not just as text in the email, unless otherwise permitted for a particular notice under this Agreement) and (B)
the written communication is subsequently and timely delivered in accordance with subsections (i)-(iii) of this Section.
Either Party may update its contact information or address for receipt of notices under this Section by providing prior
written notice of such change(s) to the other Party.
4

Representations and Warranties; Disclaimer.

4.1

Applicable Laws. For purposes of this Agreement, “Applicable Law” means laws, regulations, rules or orders of the
applicable government agency or jurisdiction to the extent such laws, regulations, rules or orders apply to the relevant
Party in the performance of its obligations under the Agreement. Additionally, “Data Privacy Law” means all laws, rules,
regulations, governmental requirements, codes as well as international, federal, state, and provincial laws applicable
to Personal Information, and “Personal Information” means any information related to an identified or identifiable
person.

4.2

Full Power and Authority. Each Party represents and warrants to the other Party that (i) it has the full right, power, and
authority to enter into and perform its obligations under this Agreement, and (ii) no other contractual obligation exists
that would prevent Employer from entering into this Agreement or performing its obligations under this Agreement.

4.3

HQY Warranties. HQY represents and warrants that (i) it will perform the Services in a workmanlike manner, using
reasonable skill and care; (ii) it has all material permits and licenses required for it to operate its business and to perform
the Services; and (iii) it can and shall comply in all material respects with Applicable Law performing its obligations
under this Agreement.

4.4

Employer Warranties. Employer represents and warrants that (i) it has complied and will continue to comply with
Applicable Law, including applicable Data Privacy Law, in performing its obligations under the Agreement; (ii) all
information provided by Employer to HQY has been, and will continue to be, collected and processed in accordance
with notice, consent and other requirements of applicable Data Privacy Law; (iii) all information provided by Employer
to HQY is accurate, complete and up-to-date; and (iv) it has, and will continue to have, the right to collect and transfer,
or provide access to, the Personal Information to HQY and its subprocessors, for processing consistent with the
purposes contemplated in the Agreement and such processing will not breach applicable Data Privacy Law.

4.5

DISCLAIMER. NEITHER PARTY MAKES ANY REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED,
OTHER THAN THE REPRESENTATIONS AND WARRANTIES SET FORTH IN THIS SECTION 4, AND, EXCEPT AS
SET FORTH HEREIN, EACH PARTY DISCLAIMS ANY IMPLIED OR STATUTORY WARRANTIES OF ANY KIND,
INCLUDING WITHOUT LIMITATION, WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.

General Terms and Conditions (v 20260226) - Confidential

Page 2 of 42

5

Termination and Survival.

5.1

Termination. Either Party may terminate this Agreement immediately upon written notice delivered to the other Party,
if at any time (i) the other Party fails to comply with any of its obligations under this Agreement in any material respect,
and such Party does not cure such non-compliance within 30 days of receiving written notice of such failure; (ii) the
other Party has appointed for it a receiver, a general assignment is made for the benefit of the other Party’s creditors,
or a bankruptcy proceeding has been commenced with respect to the other Party, or (iii) any representation made or
information provided by the other Party is false or misleading in any material respect when made or provided.

5.2

Termination for Convenience. Any Schedule to this Agreement can be terminated for convenience and without cause
in accordance with the Termination for Convenience Provision set forth in each Schedule, as applicable. The Parties
acknowledge that attempting to terminate a Schedule or the Agreement for convenience prior to the time permitted in
the applicable Schedule shall be a breach of the Agreement.

5.3

Effect of Termination; Survival. If this Agreement is terminated, then each Schedule then in effect will also terminate.
Notwithstanding anything to the contrary contained herein, Sections 1 (General), 6 (Invoicing; Fees), 7 (Confidentiality),
9 (Intellectual Property), 10 (Indemnification; limitation of liability), and 11 (Miscellaneous provisions) of these General
Terms and Conditions will continue to apply after the expiration or termination of this Agreement or any Schedule
hereto.

6

Invoicing and Fees.

6.1

Fees and Expenses. Employer shall pay all fees and expenses that are set forth in each Order Form or Schedule.

6.2

Taxes. The fees set forth in this Agreement are exclusive of applicable taxes. Each Party shall be responsible for its
own income and gross receipt taxes. Employer shall be responsible for and shall promptly pay or reimburse HQY for
the payment of all sales, use, excise, ad valorem, value-added and other similar taxes, assessments or duties imposed
by any government agency (including any interest and penalties imposed thereon if HQY has provided Employer
reasonable notice, of such applicable taxes prior to any assessment or accruing of interest or penalties) that are based
on any Services provided by HQY pursuant to this Agreement.

6.3

Invoices and Payment. HQY shall invoice Employer for all amounts due under this Agreement on a monthly basis.
Payment for invoices shall be due and payable by Employer as set forth on the Order Form. Any amounts not paid on
or before their due date shall incur interest until paid at the rate equal to the lesser of the rate specified on the Order
Form or the maximum amount allowed by law, prorated for any partial month. Notwithstanding anything to the contrary
in the Agreement, if Employer disputes any amount on an invoice, Employer must notify HQY in writing of such dispute
and provide supporting documentation to HQY within 45 days from the date of the invoice.

7

Confidentiality.

7.1

In the general course of implementing this Agreement and providing the Services, each Party may disclose information
that is considered confidential and proprietary to such Party (“Confidential Information”). Unless permitted in writing by
the Party whose Confidential Information is disclosed, all Confidential Information disclosed by a Party is to be
considered strictly confidential and the receiving Party shall use reasonable commercial efforts to maintain the
disclosing Party’s Confidential Information as strictly confidential and to require their respective officers, directors,
employees and agents to maintain the confidentiality of such information. These obligations shall not apply, however,
to any information which (i) is already in the public domain at the time of disclosure or later becomes available to the
public through no breach of this provision; (ii) was, as between the recipient and the disclosing Party, lawfully in the
recipient’s possession prior to receipt from the disclosing Party without obligation of confidentiality; (iii) is received by
the recipient independently from a third party free to lawfully disclose such information to the recipient; or (iv) is
subsequently independently developed by the recipient as evidenced by its business records.

7.2

Notwithstanding the foregoing, each Party shall have the right to disclose and disseminate Confidential Information to
third parties as required by law or by a court order, provided that prior to any such disclosure or dissemination, the
Party disclosing or disseminating the confidential information shall notify the other Party and the other shall have the
opportunity, at its own cost, to contest such disclosure or dissemination by appropriate proceedings. HQY shall also
have the right to disclose Confidential Information to its service providers as allowed by law and to the extent necessary
to provide the Services, offer Service enhancements or education to Employer, or otherwise fulfill the terms of this
Agreement. This provision supersedes all prior non-disclosure or confidentiality agreements entered into between the
Parties, which are hereby terminated and of no further force or effect.

8

Data Security and Business Continuity.
Safeguards. At all times that HQY has access to Personal Information received from or on behalf of Employer, HQY
will maintain reasonable safeguards, including a business continuity and disaster recovery plan, in accordance with the
Data Security Addendum, attached hereto as Annex 1. Except to the extent caused by HQY’s failure to maintain the
controls set forth in the Data Security Addendum, HQY shall not be responsible for liabilities or Losses resulting from
any fraud perpetrated by a third party with respect to the Services provided under this Agreement.

9

Intellectual Property.

General Terms and Conditions (v 20260226) - Confidential

Page 3 of 42

9.1

No Waiver of Rights. By entering into this Agreement, neither Party in any way agrees or implies that it is waiving any
property rights it has in software, processes or other intellectual property belonging to it, its subsidiaries or Affiliates,
including but not limited to rights accruing by virtue of applicable federal, state, or common law protections for copyright,
patent, trade secret, trademark and/or service mark rights. In the event either Party discovers a violation of such
proprietary rights, that Party, for itself and on behalf of its subsidiaries and Affiliates, expressly reserves the right to
seek or pursue in an appropriate state or federal court all available remedies for the infringement of such rights.

9.2

HQY’s Materials. HQY may provide to Employer material related to the Services. Any materials provided by HQY to
Employer or its agents are copyrighted property of HQY and shall not be reproduced or modified by Employer without
the prior written consent of HQY. Employer recognizes that HQY owns certain trademarks, service marks, logos and
trade names (“HQY Marks”) that identify HQY’s products and services. Employer acknowledges that it has no
ownership right or interest in the HQY Marks and that it will not use the HQY Marks without prior written permission.

9.3

Retention of Ownership. HQY retains ownership in all intellectual property of HQY used in the provision of Services.
Furthermore, Employer agrees that any newly developed intellectual property by HQY, whether or not for use by
Employer or its employees, as well as full right, title and interest in any jointly developed intellectual property by the
Parties, shall be the intellectual property of HQY. To avoid doubt, any intellectual property that is developed by HQY
that includes any assistance of Employer (i.e. concepts, ideas, feedback, testing, etc.) in connection with this
Agreement or any services of HQY (whether or not in connection with Services provided to Employer by HQY), shall
be the intellectual property of HQY and owned solely by HQY unless such ownership is otherwise agreed in a written
amendment to this Agreement, signed by authorized personnel of both Parties.

9.4

Permission to Use. HQY recognizes that Employer owns certain trademarks, service marks, logos and trade names
(“Employer Marks”) that identify Employer’s products and services. HQY acknowledges that it has no ownership right
or interest in Employer Marks and that it will not use Employer Marks except as expressly contemplated by this Section
9.4 or otherwise with Employer’s prior written consent. Employer hereby grants permission to HQY to use Employer’s
Marks in connection with Services provided pursuant to this Agreement. HQY may also, with the prior written consent
of Employer, use Employer Marks for marketing and promotional materials. Employer will provide or make available to
HQY approved formats and any guidelines for use of Employer’s Marks, and the trademarks shall be used only
consistent with the supplied formats and guidelines.

10

Indemnification; Limitation of Liability.

10.1

HQY Indemnity. HQY shall defend, indemnify and hold harmless Employer, Employer’s Affiliates and all of Employer’s
(and Employer’s Affiliates’) directors, officers, employees and agents (the “Employer Group”) from and against all
claims, liabilities, losses, damages and expenses, including attorneys’ fees (collectively “Losses”) asserted by any party
who is not a Party to this Agreement to the extent caused by HQY’s breach of this Agreement, negligence or willful
misconduct; provided, however, that HQY shall not defend, indemnify or hold the Employer Group harmless for Losses,
in each case to the extent arising out of Employer’s breach of this Agreement, negligence, or willful misconduct.
Notwithstanding any other provision of the Agreement, HQY will not be responsible for claims, Losses or liabilities
resulting from: (i) acts or omissions based on instructions or directions received from Employer and its agents,
representatives, or employees; (ii) errors caused by incomplete, inaccurate or untimely information provided by
Employer and its agents, representatives or employees; or (iii) failure of Employer to perform its obligations as required
by this Agreement.

10.2

Employer Indemnity. Employer shall indemnify and hold harmless HQY, its Affiliates and all directors, officers,
employees and agents of HQY and its affiliates (the “HQY Group”) from and against all Losses asserted by any party
who is not a Party to this Agreement, tp the extent caused by Employer, its breach of this Agreement, negligence or
willful misconduct or arising out of any other cause related to this Agreement; provided, however, Employer shall not
be obligated to defend, indemnify or hold the HQY Group harmless for Losses to the extent such losses are caused by
HQY’s breach of this Agreement, negligence or willful misconduct.

10.3

Notification and Defense. The Party seeking indemnification under this Agreement (the “Indemnified Party”) shall give
the Party responsible for indemnification (the “Indemnifying Party”) written notice of each claim, if any, promptly after
the Indemnified Party’s first knowledge thereof. The Indemnifying Party may direct the defense of its interests; provided,
however, the Indemnified Party is entitled to retain counsel to provide for its own defense unless or until provided
reasonable notice by the Indemnifying Party of its intent to direct the defense.

10.4

Limitation of Liability. Except for damages incurred or arising out of or due to gross negligence, willful misconduct or
fraud of a Party, the aggregate liability of either Party to the other Party from any and all actions relating to the subject
matter of this Agreement shall not exceed fees actually paid by Employer to HQY under this Agreement in the twelve
months preceding the date on which the cause of action arose. NEITHER PARTY SHALL BE LIABLE FOR ANY
INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES OF ANY KIND, EVEN IN THE EVENT THAT
IT IS ADVISED OF THE POSSIBILITY THAT SUCH DAMAGE MAY ARISE, OCCUR OR RESULT.

11
11.1

Miscellaneous Provisions.
Entire Agreement. This Agreement, including any Order Forms, Schedules, annexes, and attachments hereto, sets

General Terms and Conditions (v 20260226) - Confidential

Page 4 of 42

forth the entire understanding of the Parties and supersedes any and all other agreements, either oral or written,
between the Parties with respect to the subject matter hereof (including any non-disclosure or confidentiality
agreements entered into between the Parties), and no other agreement, statement or promise relating to the subject
matter of this Agreement will be valid or binding. Unless otherwise indicated, this Agreement supersedes and replaces
any prior agreement between the Parties (including participating Affiliates of the Parties.
11.2

Headings. The section headings contained in this Agreement are supplied for convenience and reference purposes
only and shall not affect the meaning or interpretation of the terms.

11.3

Amendments. Amendments. Except as otherwise set forth in this Section, all amendments to this Agreement may only
be made in writing and signed by authorized personnel of the Parties. Notwithstanding the foregoing, to the extent
specifically required to comply with prospective changes in applicable laws, regulations, rules, or guidance, or when
specifically required by the Internal Revenue Service (“IRS”), Department of Labor (“DOL”), or other regulatory
authority, HQY may amend the Agreement by providing written notice of such amendment to Employer (an
“Amendment Notice”). Such amendment shall be effective upon receipt of the Amendment Notice or such other date
specified in the Amendment Notice.

11.4

Waiver. The failure by a Party to exercise any right or obligation shall not be deemed to be a waiver of such right or
obligation.

11.5

Severability. If any portion of this Agreement shall, for any reason, be invalid or unenforceable, such portion or portions
shall be ineffective only to the extent of such invalidity or unenforceability, and the remaining portion or portions shall
nevertheless be valid, enforceable and of full force and effect.

11.6

Third Party Sender. To the extent applicable as a Third Party Sender under National Automated Clearing House
Association ("NACHA") rules and regulations, Employer acknowledges and agrees that HQY must perform a certain
level of due diligence on Employer and that part of such diligence requires that Employer make certain representations
and warranties in order for HQY to be able to originate ACH transactions on Employer’s behalf. Accordingly, Employer
(i) authorizes HQY to originate transactions on Employer’s behalf, (ii) agrees to be bound by applicable NACHA rules,
(iii) agrees not to originate transactions that violate U.S. laws, and (iv) agrees to provide written notice to HQY if there
are any restrictions on the type of transactions that may be originated and, if there are, to describe such restrictions.
Employer further acknowledges and agrees that in addition to other termination rights outlined herein, HQY has the
right to terminate or suspend the Services if Employer violates any applicable NACHA rules. Employer additionally
acknowledges and agrees that HQY and the originating depository financial institution have the right to audit Employer’s
compliance with the NACHA Rules and the terms of this provision with reasonable notice, during normal business
hours.

11.7

Professional Advice. Although HQY may provide technical or other assistance on issues related to this Agreement, or
to health savings accounts, flexible spending accounts, healthcare reimbursement arrangements and other services in
general, HQY is not providing and cannot give Employer or any employee thereof legal, tax, financial, or other
professional advice. Employer agrees that it is not relying on HQY or any of its Affiliates for any such advice and is not
expecting HQY to provide professional advice to its employees. Employer is solely responsible for the selection and
engagement of HQY to provide services on its behalf and for ensuring Employer’s compliance with applicable law.

11.8

Assignment. Either Party may assign this Agreement (or any applicable Schedule) to any Affiliate or as part of the sale
of any substantial portion of its assets, or pursuant to any merger, consolidation or other reorganization, without the
other Party’s prior written consent. Otherwise, neither Party may assign its rights and responsibilities under this
Agreement without the prior written consent of the other Party, which consent shall not be unreasonably withheld.

11.9

Force Majeure. Neither Party shall be liable for any damages or have the right to terminate this Agreement for any
delay or default in performing hereunder if such delay or default is caused by conditions beyond its control including,
but not limited to acts of God, government restrictions (including the denial or cancellation of any necessary license),
wars, strikes, insurrections, infectious disease outbreaks and/or any other cause beyond the reasonable control of the
Party whose performance is affected.

11.10

Beneficiaries. No third parties shall have the benefit of or any rights under any of the provisions of this Agreement.

11.11

Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of Utah
without giving effect to its conflicts of law provisions, to the extent not governed or interpreted in accordance with federal
law or regulations. Each Party irrevocably and unconditionally submits to the exclusive jurisdiction of, and venue in, the
federal and/or state courts in the State of Utah, and the appropriate courts of appeal from such courts, for determining
any dispute concerning the Agreement. EACH PARTY, TO THE EXTENT PERMITTED BY LAW, KNOWINGLY,
VOLUNTARILY, UNCONDITIONALLY AND INTENTIONALLY WAIVES ITS RIGHT TO A TRIAL BY JURY IN ANY
ACTION OR LEGAL PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT. EACH PARTY
ACKNOWLEDGES THAT IT HAS RECEIVED THE ADVICE OF COMPETENT COUNSEL.

General Terms and Conditions (v 20260226) - Confidential

Page 5 of 42

Schedule A

Health Savings Accounts (HSAs)
This HSA Schedule is incorporated into and made a part of the Agreement. Capitalized terms used in this HSA Schedule, but
not defined herein, shall have the meanings ascribed to them in the Terms and Conditions to the Agreement.
1

Clarification of roles, relationships, and applicable law.

1.1

Roles and Relationships. Employer is the sponsor of a high deductible health plan (“HDHP”) that is compatible with
health savings accounts (“HSAs”), as defined in §223 of the Internal Revenue Code (“Code”). Employer, as permitted
by DOL FAB 2004-01 and 2006-02, desires to (i) facilitate the opening of HSAs for or on behalf of eligible employees
(each, an “Account Holder”), (ii) make Employer contributions and forward employee payroll reduction contributions to
HSAs owned by Account Holders, and (iii) pay certain fees related to HSA implementation and maintenance. HQY is
an IRS authorized non-bank trustee operating as a custodian of HSAs in accordance with the provisions of Code
§223(d)(1)(B) and Employer has selected HQY as its preferred custodian for Account Holders.
ERISA. It is the intent of the Parties that HSAs will (i) not be administered as, or otherwise considered, an employee
benefit plan subject to the Employee Retirement Income Security Act of 1974 as amended (“ERISA”), and (ii) not be a
part of the HDHP. The assets held in custody by HQY in HSAs, or in connection with HSAs, shall not be plan assets
subject to the provisions of ERISA. In order to avoid the implication that Employer has fiduciary obligations with regard
to HSAs and other ERISA implications, Employer agrees to limit its involvement with HSAs in accordance with DOL
FAB 2006-02, and Employer will take no action that will or could arguably cause an HSA to become subject to ERISA.
Direct relationship with Account Holders. HQY provides HSA custodial services directly to Account Holders, subject to
applicable federal and state laws and regulations, and pursuant to the terms of a Custodial Agreement that governs
the relationship between HQY and each Account Holder. Custodial services are overseen by the IRS and other
regulatory authorities, and are not subject to Employer’s oversight. Employer is not a party to the Custodial Agreement
or a third-party beneficiary thereof, and nothing in this Agreement will affect, modify, or amend the terms governing the
services provided by HQY to Account Holders or to account holders in general.
GLBA. HQY and HSAs are subject to the privacy and security protections of the Gramm-Leach-Bliley Act and applicable
state laws (collectively, “GLBA”) and HQY is required by GLBA to safeguard each Account Holder’s nonpublic personal
information (“NPI”), which includes information HQY collects or generates in the course of offering custodial services
to an Account Holder, including Account Holder information collected by Employer and transmitted to HQY pursuant to
the Agreement. HQY may disclose NPI to Employer only when permitted under GLBA. For the avoidance of doubt,
Personal Information provided by or through an employer, health plan or health insurer to HQY (in its capacity as an
HSA custodian) for HSA-related purposes is not provided as a plan service under the BAA (as defined below). Rather
such Personal Information constitutes account information subject to GLBA and is not considered HIPAA protected
health information (“PHI”).
HIPAA and integrated claims. Account Holders often desire to view and use adjudicated medical, dental, vision,
pharmacy, and/or behavioral health claim information (including data that would constitute protected health information
in the hands of a covered entity or business associate) (“Claims Data”) in connection with their HSAs for convenient
payment, reimbursement, current and long-term distribution substantiation, and other tax or personal recordkeeping
purposes. Likewise, employers often seek to facilitate the sharing of such information with HSAs to enhance the value
of HSAs for their employees. If Employer elects the optional feature whereby Claims Data are integrated with HSAs,
HQY, operating as a business associate under the Health Insurance Portability and Accountability Act of 1996, as
amended by the Health Information Technology for Economic and Clinical Health Act, and the regulations promulgated
thereunder (together, “HIPAA”) (and not in its capacity as a custodian of HSAs) and in accordance with the Business
Associate Agreement that is linked and incorporated into the Agreement (the “Business Associate Agreement”), will (i)
receive and maintain Claims Data from Employer’s health plan, health insurer, or third party administrator; (ii) receive
and process individual authorizations from Account Holders which permit disclosure of Claims Data to their respective
HSAs; and (iii) disclose to the appropriate HSAs the Claims Data of Account Holders who have executed authorizations
permitting such disclosure. Any Claims Data displayed on the HQY Portal for HSA related purposes are displayed
pursuant to an authorization, not as a plan service subject to the terms of the Business Associate Agreement.
HIPAA and custodial services. Except as set forth in Section 1.5, data received by HQY in connection with its
administration of HSAs will be received by HQY in its capacity as a custodian, and not as a business associate. Such
data will be subject to the privacy and security protections of GLBA.

1.2

1.3

1.4

1.5

1.6

2
2.1

HSA opening and maintenance.
Eligibility file. From time to time, Employer will (directly or through an agent) either send an electronic file or upload to

General Terms and Conditions (v 20260226) - Confidential

Page 6 of 42

2.2
2.3

2.4

2.5

3
3.1

3.2

3.3
3.4

4
4.1

4.2

5

HQY’s website (each, an “Eligibility File”) information pertaining to: (i) employees who have submitted HSA applications
through Employer’s benefits enrollment system and instructed Employer to open HSAs on their behalf, or (ii) employees
for whom Employer is requesting that HSAs be opened without the employees’ affirmative consent.
HSA opening and maintenance. Based on the information provided in an Eligibility File, and subject to federal customer
identification and “know your customer” requirements and restrictions (as defined by the USA PATRIOT Act), HQY will
open and maintain HSAs for Account Holders under the terms of the Custodial Agreement.
Employee disassociation. Employer will include on the Eligibility File the name and termination date of any Account
Holder who (i) has terminated employment with Employer, or (ii) is no longer eligible to contribute to an HSA. Upon
receipt and processing of such updated Eligibility File, or a notice provided by an Account Holder, HQY will promptly
disassociate the Account Holder from Employer in its systems.
Non-Discrimination Testing. If Employer elects this service, HQY will run the test using the data provided by Employer.
HQY will provide the test results and basic recommendations for high-level plan adjustments to be made in order to
keep the program from being discriminatory. Employer considers the feedback and alters the program accordingly.
Employer is responsible for program design and compliance. HQY does not monitor program compliance matters.
Employer is responsible for submitting all required data for testing sufficiently, as determined by HQY in its sole
discretion, in advance of applicable end dates to allow for processing and production of any recommended program
adjustments that may be required before applicable deadlines. Employer acknowledges and agrees that if such data is
provided late, HQY cannot guarantee any specific turnaround time or that recommended program adjustments can be
completed before applicable deadlines. For clarity, the test provided under this Section is performed for HSAs offered
under a cafeteria plan and does not include comparability checks (for example, the test would be limited to eligibility,
contributions and benefits, and key employee concentration under a cafeteria plan).
Escheatment. HQY will be responsible to the Account Holder for HSA related escheatment as part of its custodial
obligations.
Contributions.
Sending of funds. Employer will forward Employer contributions, Account Holder payroll reduction contributions, and
other contributions (such as those associated with a wellness program) to HQY as soon as administratively feasible
and in a form and format agreed upon by the Parties. During the term of the Agreement, HQY shall be the exclusive
administrator and custodian of HSAs to which Employer makes payroll reduction contributions.
Allocation file. Simultaneously with (or prior to) funds transmission, Employer will send information to HQY via an
electronic file or through HQY’s website that indicates how contributions should be allocated to Account Holders’ HSAs,
and will cooperate promptly and fully with HQY in connection with all required reconciliations or error corrections. HQY
will have no liability for any file or funds not received by HQY, for any delay in transmitting funds, or for any error in
allocating contributions to HSAs in reliance on data or instructions provided by Employer.
Posting to HSAs. HQY will post contributions to HSAs within a commercially reasonable time after receipt of the
allocation file and good funds.
Non-forfeitability of Employer contributions. Employer contributions to HSAs are non-forfeitable and subject to rules
restricting recoupment described in IRS Notice 2008-59, Q/A 23-25 and any relevant letters or guidance provided by
the IRS.
Term; Termination for convenience.
Term. The term of this Schedule shall begin on the Order Form Effective Date and continue through and including the
Order Form Term (the “Initial Term”). This Schedule will thereafter automatically renew for additional 12 month terms
unless either Party terminates this Schedule in accordance with Section 4.2. HQY may, in its sole discretion, continue
to provide health savings account services to Account Holders if this Schedule is terminated for any reason.
Notwithstanding the foregoing, if the entire Agreement is terminated at any time, the term of this Schedule shall
terminate as of the date on which the entire Agreement is terminated.
Termination for convenience. Following the Initial Term, either Party may terminate this Schedule at any time, subject
to providing 90 days’ prior written notice.
Fees.
Employer agrees to pay the fees set forth below, except to the extent that Employer instructs HQY to charge the fees
to Account Holders. The fees described in this Section 5 are in addition to fees charged directly to HSAs and other
compensation that HQY receives on account of HSAs, as further described in the Custodial Agreement.

5.1

One-time implementation fee.

General Terms and Conditions (v 20260226) - Confidential

Page 7 of 42

Item
Project management; Creation and execution of test plan;
Coordination of marketing materials (not-including customization);
Sales support and training
5.2

Fee
Set forth in Order Form or provided by health plan,
retirement plan recordkeeper, or other administrative
entity

HSA maintenance fees.
If Employer undertakes to pay account maintenance or other fees for Account Holders, it will remain obligated to pay
such fees so long as such Account Holder is not disassociated from Employer. Account Holders are the primary obligor
for the payment of fees, and if Employer ceases to pay such fees, they will be charged to Account Holders. The monthly
maintenance/administration fees for the Services under this Schedule shall be as set forth in the Order Form.

5.3

Fees charged to Employer for atypical transactions.

Item
Non-Discrimination Testing
Insufficient Funds for Contribution
(e.g., failed ACH; bounced check)
Employer Contribution Refund
Request
Manual Contribution Processing
Funding via ACH debit, PPD/direct
deposit, checks
Funding via Wire/ACH push
Premium-only plans
5.4

Fee
$600/ test
$20/ transaction
$20/ transaction
$20 per event (no fee if instructions are submitted online or via electronic file)
Free
$350 per year (unless Employer has 1,000 eligible employees or 500 accounts, in
which case, the $350 fee is waived)
$250

File integration fees.
File integration enhances the overall experience through automating the way data is passed to HQY in connection with
eligibility, payroll, and claim integration. File integration is available only if the applicable minimum threshold is met.

File types
HSA contribution file
Eligibility file
Claims file
•

•

•
•
5.5

Benefit eligible employee minimum threshold
per file
0
1,000
1,000

Implementation fee per file
None
None
None

Pre-approved files which meet a specific criteria as outlined on the integrated file list will not incur an
implementation fee. Custom files may incur an implementation fee not to exceed $2,500 per file. Employer's
Implementation Manager or Account Manager can discuss exceptions.
All data sources must be engaged 90 days prior to the requested file’s go-live date. Employer is responsible for
introducing HQY to the data source contact. HQY will confirm the data source is able to pass the file in either
HQY’s standard format or an existing format HQY already receives from that data source. If a new mapping is
required or an existing mapping has to be altered, the scope must be estimated and all applicable costs must be
agreed upon before HQY will proceed.
HQY must have clean test files with valid test data from the data source a minimum of 30 days prior to the date
the file is expected to be live in production (60 days prior to plan year start).
Benefit eligible employees are determined by taking total benefit eligible population minus any population that will
not have access to choose a HQY product (e.g., any excluded employee locations).

Custom communications and materials.
With respect to any communications or materials that are customized from, or different than, HQY’s standard
communications and materials, the Parties will agree to the form and contents of any such communications or materials.
HQY may charge a fee of $250/hr for such customization work, unless authorized personnel of the Parties agree to a
different fee in writing.

General Terms and Conditions (v 20260226) - Confidential

Page 8 of 42

Schedule B

Reimbursement Arrangements (RAs)
This Reimbursement Arrangements (RAs) Schedule to the Agreement sets forth the services provided for HRAs, FSAs, and
DCRAs (each defined below), and is incorporated into and made a part of the Agreement. Capitalized terms used in this RA
Schedule, but not defined herein, shall have the meanings ascribed to them in the Terms and Conditions to the Agreement.
1

Clarification of roles, relationships, and applicable law.

1.1

Roles and Relationships. Employer, operating as the sponsor of a health plan, “plan administrator” and “fiduciary” within
the meaning of the Employee Retirement Income Security Act of 1974, as amended, desires to provide certain health
related reimbursement arrangements and/or other work-related benefits to its eligible employees (“Participants”). HQY
provides third party administration (“TPA”) services for health reimbursement arrangements as defined in IRS Notice
2002-45 (“HRAs”), health flexible spending arrangements as defined in 26 USC § 125 and the regulations thereunder
(“FSAs”), dependent care assistance programs as defined in 26 USC § 129 and the regulations thereunder (“DCRA”),
and limited-purpose FSAs and post-deductible HRAs (each within the meaning of Rev. Rul. 2004-45).

1.2

Directed TPA. HQY shall operate as a directed third party administrator (“TPA”) under the Agreement and this
Schedule, and not as a plan administrator, plan fiduciary, or claims fiduciary. As such, Employer shall be responsible
for the proper administration of the plan, the direction of HQY’s activities in accordance with the plan documents,
compliance with legal requirements applicable to the plan and its administration, and ensuring that the TPA services
are accurately reflected in the plan documents.

1.3

HIPAA. Unless otherwise indicated, Participant data disclosed to or held by HQY under this Schedule is governed by
or subject to the administrative simplification provisions of the Health Insurance Portability and Accountability Act of
1996, as amended by the Health Information Technology for Economic and Clinical Health Act, and the regulations
promulgated thereunder (together, “HIPAA”). As such, HQY shall operate as a business associate (as defined by
HIPAA) to Employer or its health plan in the provision of TPA services to the plan. Participant data is considered HIPAA
protected health information (“PHI”) and subject to the protections set forth in the Business Associate Agreement
entered between HQY and Employer, limited by applicable record retention requirements imposed by the IRS for tax
advantaged accounts and arrangements.

2

Term; Termination for Convenience.

2.1

Term. The term of this Schedule shall begin on the Order Form Effective Date and continue through and including the
Order Form Term (the “Initial Term”). This Schedule will thereafter automatically renew for additional 12 month terms
unless either Party terminates this Schedule in accordance with Section 2.2. Notwithstanding the foregoing, if the entire
Agreement is terminated at any time, the term of this Schedule shall terminate as of the date on which the entire
Agreement is terminated.

2.2

Termination for Convenience. Following the Initial Term, either Party may terminate this Schedule at any time, subject
to providing 90 days’ prior written notice.

2.3

Suspension of Performance; Other Termination. The Parties acknowledge and agree that Employer’s failure to pay the
Fees for the TPA services when such Fees are due shall constitute a material breach of this Agreement and in addition
to any other rights HQY has when such amount is due HQY may at its election, and without waiving its right to payment,
cease performing services under this Schedule until such Fees are paid or terminate the Agreement or this Schedule.

3

HQY duties.
Plan setup

•

Provide a plan setup worksheet for Employer to choose among certain features and
options, subject to availability on HQY’s system.

•

For HRAs, provide a Summary of Benefits and Coverage (SBC) template to Employer,
along with sample language.

•

Optional: Provide a basic plan document template to Employer, based on, among others,
the features and options chosen. Such template is not customizable.

Limitations

•

Employer is responsible for legal review and adoption of the plan in accordance to the

General Terms and Conditions (v 20260226) - Confidential

Page 9 of 42

requirements of applicable law.

Enrollment

Recording contributions

Individual account
management / Member
Services

Distribution and use of plan
funds

•

HQY will not provide legal advice as to which options or features Employer may wish to
implement or with respect to compliance with applicable law.

•

HQY will instruct Employer on how to provide timely accurate and complete enrollment
information (via file or portal).

•

Once such information is received, HQY shall send the welcome kit and debit card (if
elected and available). The debit card may be sent under separate cover (if elected).

•

HQY is not responsible for sending privacy policies or notices related to reimbursement
arrangements.

•

If DCRA is elected as a service, Employer shall provide HQY with each Participant’s
DCRA elections, the corresponding payroll data, and any Employer contributions, so that
HQY can create a proper account balance for the DCRA. DCRA payments are not
released until funds are credited to the account.

•

For FSAs, HQY can record payroll contributions based on the payroll frequency provided
by Employer.

•

HQY shall host a Participant accessible website to help Participants manage their
Reimbursement Account online where they can, among other activities:
a.

access their account balance, distribution history, and transaction activities;

b.

review, enter and pay claims;

c.

update their email preferences; and

d.

download account servicing (e.g., distribution request) forms.

•

The website shall be made available 24/7 except for routine maintenance. Participants
must have a computing device that is capable of using secure HTTP (HTTPS) to use the
Participants-only area of the website.

•

HQY shall make available to Participants a 24/7 toll-free number (in the US) to access
HQY Member Services Specialists.

•

HQY shall make available monthly statements to Participants to view and download from
the website. There shall be a charge to Participants for paper statements.

•

If the Employer elected, HQY shall send to Participants debit cards (debit cards optional),
available with health FSAs and limited set of HRA plans) to access Reimbursement
Account funds at merchants offering medical-related (including pharmacy, dental, and
vision) qualified products and services. Whether the debit card can be used at any
particular merchant depends on the merchant’s coding under the debit card processing
system.

•

HQY shall make available a directed payment mechanism on the website whereby
Participants can direct their funds to be paid to one or more service providers.
Participants are solely responsible to:

•

a.

provide complete and accurate payee and identification so that payment can be
properly credited by the provider; and

b.

ensure sufficient funds and time for HQY to make such directed payments.

Participants may request distribution of their funds by completing a claim form, together
with the documentation required by law.
a.

All claim forms and supporting documents must be in English, or if not in English,

General Terms and Conditions (v 20260226) - Confidential

Page 10 of 42

accompanied by an English translation. HQY does not provide translation services.
b.

•

If applicable thresholds are met, HQY shall provide a mechanism to securely receive
adjudicated claims files from Employer’s health plan(s). HQY shall populate Participants
accounts with the claim data so that Participants may pay the patient responsibility
portion of adjudicated claims directly from the account.

•

If Participant’s account balance is insufficient to pay all claims, debit card transactions
will take priority over the competing demand for funds, followed by directed payments.

•

HQY will attempt to auto-substantiate card transactions using IRS approved methods. If
auto-substantiation cannot be achieved, HQY will send a notice to Participant at 30 and
90 days after debit card use asking for documentation.

•

HQY does not turn off debit cards for failure to substantiate transactions, without a prior
written directive from Employer. Employer is responsible for determining how to handle
collection from Participants of any amounts that the Participant has not substantiated.

Participant education

•

HQY shall make information available, either directly or through the health plan, to help
Participants save and spend their account balances. This may include Employer specific
educational programs and e-mail based messaging (subject to HQY having accurate email addresses for e-mail distribution).

Reports to Employer

•

HQY shall make reports available to Employer that include a summary roll-up of account
transactions, a funding ledger, and claims detail, including overpayments.

Escheatment

•

HQY will return unassociatable or unused funds related to plan or program services to
Employer who shall be responsible for compliance with escheatment obligations (if any).
If Employer is not able to, or declines to, accept returned funds, then Employer agrees
that HQY will be entitled to the funds as part of its overall compensation for services. If
HQY is not able to locate Employer, then HQY (the holder) will comply with applicable
state unclaimed property laws regarding the funds, which may require HQY to escheat
funds in the name of Employer (the owner) to the relevant state.
If Employer elects this service by providing written notice to HQY, HQY will run the test
using the data provided by Employer. HQY will provide the test results and basic
recommendations for high-level plan adjustments to be made in order to keep the plan
from being discriminatory. Employer considers the feedback and alters the plan
accordingly. Employer is responsible for plan design and compliance. HQY does not
monitor plan compliance matters. Employer is responsible for submitting all required
data for testing sufficiently, as determined by HQY in its sole discretion, in advance of
applicable plan end dates to allow for processing and production of any recommended
plan adjustments that may be required before applicable deadlines. Employer
acknowledges and agrees that if such data is provided late in the plan or calendar year,
HQY cannot guarantee any specific turnaround time or that recommended plan
adjustments can be completed before applicable deadlines.

Non-discrimination testing

4

Participants shall receive distributions via electronic means at no cost to the
Participants. Participants who request paper checks will be charged a fee per
check.

Employer duties.
Program setup

•

Complete a plan setup worksheet for Employer to choose among certain features and
options, subject to availability on HQY’s system.

Designate contact

•

Designate at least one employee as the primary contact who has familiarity with the
Employer’s benefits offering; the contact shall provide HQY with advance notice before
any changes to the Employer’s benefits offering become effective; the contact shall also
be available to consult with HQY from time to time as reasonably necessary for HQY to
provide the services described herein. For the avoidance of doubt, no change shall
become effective unless and until accepted and programmed by HQY.

General Terms and Conditions (v 20260226) - Confidential

Page 11 of 42

Prepare and distribute
materials

•

Ensure compliance with all requirements of ERISA, the Internal Revenue Code, and
other applicable law, including maintaining plan documents and the preparation,
distribution, and review of Summary Plan Description, Summary of Benefits and
Coverage, and any other program materials to Participants.

Eligibility and contribution
Data

•

Ensure that all eligibility and contribution data files that are sent to HQY or data entries
made on HQY’s system are timely, accurate, complete, and free of errors.

•

HQY will not be responsible for any liabilities, penalties, or losses due to data or
information that is untimely, inaccurate, otherwise invalid. Employer shall pay HQY for all
costs due to any inaccurate, incomplete or erroneous data. For example, if Employer
enrolls individuals who are not eligible to participate in a Reimbursement Account,
Employer shall pay HQY for (i) time and materials to collect any disbursements already
made to such individuals (if legally permitted); (ii) notifications to affected individuals; and
(iii) debit card cancellation fees. The monthly fees for such ineligible individuals are (a)
still payable if not already paid, or (b) if paid, are not refundable or creditable against
future invoices.

•

Ensure that its health plan(s) provide claim files that are timely, accurate, complete, and
free of errors.

•

If disbursements are made because Employer or its delegates have provided information
that is untimely, inaccurate, incomplete, or otherwise erroneous, Employer agrees that
HQY is not responsible for recovering the funds from any payee.

•

Employer is responsible for paying claim invoices.

•

If Employer does not pay an invoice, then HQY may take appropriate remediation efforts,
such as (i) deactivating cards or (ii) terminating services.

•

Employer and/or Participant shall notify HQY of any suspicious or fraudulent activity with
respect to the account(s) or claims within sixty (60) days of the processing of the
applicable claim. Failure of Employer or the Participant to notify HQY within the 60-day
timeframe shall indicate Employer’s approval of the claim or expenditure.

•

Employer shall timely provide to HQY all benefit claims funding amounts (including any
pre-funding needed). Employer acknowledges and agrees that all benefits claim prefunding amounts submitted by Employer to HQY: (i) shall be comprised of Employer’s
general assets; (ii) does not consist of Plan assets within the meaning of ERISA, without
regard to whether ERISA applies, and is not otherwise subject to any restrictions; and (iii)
shall not be segregated or set aside in a trust or escrow account by HQY. Employer agrees
to pay HQY the entire amount delivered, or deliverable, to participants in all Plans or
programs, regardless of whether Employer collects sufficient payroll deductions from
Employer’s participants.

•

Employer shall be solely responsible to ensure proper funding under the Agreement.

•

If it is determined that the amount of prefunding requested from the Employer is not
sufficient, HQY may request additional prefunding.

•

Employer is responsible for compliance of its Plan with Applicable Law,
including, without limitation, the review and approval of HQY’s form documents
and templates, and HQY’s administration process as they relate to the Services
provided with respect to the Plan.

Claim data

Payment of claims invoices
and Reporting

Funding

Legal compliance

5

Fees. Unless otherwise set forth herein, the fees for the Services under this Schedule shall be as set forth in the Order
Form. Employer has reviewed the fees and the compensation that HQY receives for these Services and determined

General Terms and Conditions (v 20260226) - Confidential

Page 12 of 42

that the compensation HQY receives is reasonable for the services it provides. Employer has further determined that
each of the services is necessary for the establishment and maintenance of the RAs.

5.1

•

PPPM means per participant per month. HQY may give volume discounts based on Employer’s account total. Fees
are set at initial enrollment based on account volume. The Monthly Administration PPPM may be reset annually
each February based on its ending January account volume.

•

HQY charges only one PPPM fee even if a Participant has more than one FSA and/or HRA. This does not apply
to an LPFSA coupled with an HSA.

•

For FSAs and HRAs, Employer will provide HQY with enrollment and full health plan claims data for the groups
electronically on a regular basis. This provision does not apply to non-integrated FSA / HRA / DCRA.

•

All plan or account related fees, surcharges, or taxes imposed by law on the operation of the plan (e.g., MA Health
Safety Net) will be invoiced to the Employer (i.e., plan sponsor). Timely payment of this amount is a condition
precedent to services.

•

With respect to provision of cards, if Participants are provided with cards by HQY in the provision of the Services,
the first three (3) cards are provided at no charge and any additional cards are provided at a charge of $5 each
card.

Implementation Fees.
Fees, if any, for implementation, project management, creation and execution of test plan, coordination of marketing
materials (not-including customization), and sales support and training, shall be specified on the Order Form.

5.2

File integration fees.
File integration enhances the overall experience through automating the way data is passed to HQY in connection with
eligibility, payroll, and claim integration.

File types

Benefit eligible employee threshold per file

Implementation fee per file

FSA deduction file

0

None

Eligibility file

1,000

None

5.3

Custom communications and materials.
The Parties will agree to the form and contents of any custom communications or marketing materials and the fees
associated therewith, which may change from time to time.

5.4

Other compensation.
Employer funds associated with the administration of HRA/FSA services (including pre-funding) are deposited in an
omnibus processing account with a federally insured financial institution, titled “HealthEquity Omnibus Account for the
Benefit of Employers” (or similar title). The account is not treated as a plan asset and is subdivided as HQY determines
appropriate to maintain separate records for each employer. Funds deposited in the omnibus account are held in that
account until benefit payments are made and the payments clear. Omnibus account balances earn interest at a rate
determined by the depository institution (such earnings are referred to as “float earnings”). Float earnings are used first
to pay fees associated with the account. HQY will retain any float earnings that remain after such fees are paid as part
of its compensation for Services. If fees associated with the account exceed float earnings, HQY will be solely
responsible for paying the excess over float earnings. HQY will provide information regarding float earnings as the
Employer may reasonably request for the purpose of evaluating the reasonableness of HQY’s compensation.

6

Debit Cards. If Employer elects to offer a card program in connection with its Plan, HQY will administer the debit card
as follows:

6.1

Provision of Cards. HQY will provide debit cards (“Card” or “Cards”) to each participant. Depending on the program,
additional Cards may be provided upon request for use by the participant’s spouse and/or dependents who are over
18 years of age, subject to charges (if any) set forth in the Agreement.

6.2

Card Services. HQY will update participant records, maintain account balance and deposit information, activate and
deactivate Cards, respond to participant inquiries and provide appropriate notices of actions taken with respect to the
Card.

6.3

Payments. Card transactions will be withdrawn against a participant’s account and Employer shall reimburse HQY
according to terms of Employer’s funding arrangement or as otherwise agreed, as applicable.

General Terms and Conditions (v 20260226) - Confidential

Page 13 of 42

6.4

Improper Card Usage/Fraud. Employer shall notify HQY immediately if Employer suspects or confirms any
inappropriate or fraudulent Card usage. HQY will take reasonable action to investigate and resolve improper Card
transactions that it becomes aware of in accordance with applicable law and regulations (e.g., by offsetting the ineligible
expense against a proper expense). HQY may suspend a participant’s Card until such issue is resolved. If HQY cannot
correct the improper use, it will notify Employer and Employer shall be responsible to correct the transaction by adopting
such measures as are required by applicable law and regulations.

6.5

Lost or Stolen Cards. HQY agrees to cancel, as soon as reasonably practicable, a participant's Card when the Card
is reported as lost or stolen. HQY is not responsible for any transactions that occur prior to the request to cancel is
received unless otherwise required in the applicable cardholder agreement.

6.6

Termination or Ineligibility. HQY will deactivate a participant’s Card as soon as reasonably practicable after receipt
of notice from Employer that a participant has been terminated or is no longer eligible to participate under the Plan.
HQY is not responsible for any transactions that occur prior to the request to terminate is received.

6.7

Data Hosting; Right to Use Data. All Card data resides on servers owned by or operated on behalf of HQY’s service
providers. Employer grants HQY and its service providers the right to receive, process and use such data to administer
the Card program and provide related services to Employer and its participants, as well as the right to derive and use
aggregate and statistical de-identified data obtained therefrom.

6.8

Grant of License. If applicable per the service agreement, Employer grants HQY and its service providers a nonexclusive, non-transferable, royalty-free license to use Employer’s trademarks in connection with the Card program, in
the forms and formats approved by Employer in connection with (i) the Card, (ii) periodic statements and (iii) participant
communications regarding their accounts. The name of the financial institution that issues the Card, a website Uniform
Resource Locator (URL) and a customer service phone number will be printed on each Card.

General Terms and Conditions (v 20260226) - Confidential

Page 14 of 42

Schedule C

Commuter Benefits
HQY provides commuter benefits services through HQY’s Affiliate, HealthEquity Commuter Services, Inc. (“HCS”). This
Commuter Benefits Schedule to the Agreement sets forth the terms pursuant to which HCS will provide administration services
for qualified transportation fringe benefits (as described in 26 USC 132(f)) that Employer offers to its eligible employees (the
“Commuter Benefits”) and is incorporated into and made a part of the Agreement. Notwithstanding anything in this Schedule to
the contrary, HQY (or any of its other Affiliates) may provide any portion of the Commuter Services in place of HCS.
1

HCS Duties.

Plan setup

•

Provide an implementation questionnaire plan for Employer to choose among certain
features and options, subject to availability on HCS’s system.

•

Complete all required setup on the applicable platforms.

Limitations

Eligibility

Ongoing administration

Customer service

•

Employer is responsible for the review and compliance of the Commuter Benefits with
applicable law.

•

HCS will not provide legal advice as to which options or features Employer may wish to
implement or with respect to compliance with applicable law.

•

Instruct Employer on how to provide timely accurate and complete eligibility information.

•

Employer must provide eligibility according to the standard file specification for
Commuter Benefits.

•

HCS shall administer the Commuter Benefits using the applicable platform.

•

As part of the monthly services, HCS will:
a.

Provide a website through which members may place orders and review account
details.

b.

Process eligibility files.

c.

Process and fulfill monthly commuter orders.

d.

Prepare payroll export file and monthly funding report.

e.

Process eligible reimbursement payments for cash reimbursement accounts.

•

HCS shall make available to members and staff a toll-free number (in the US) to access
its Commuter Benefits service center.

•

Provide standard member communication materials in electronic format.

Management reports

•

HCS shall provide online downloadable management reporting to Employer.

Escheatment

•

HCS will return unassociatable or unused funds related to plan or program services to
Employer who shall be responsible for compliance with escheatment obligations (if any).
If Employer is not able to, or declines to, accept returned funds, then Employer agrees
that HCS will be entitled to the funds as part of its overall compensation for services. If
HCS is not able to locate Employer, then HCS (the holder) will comply with applicable
state unclaimed property laws regarding the funds, which may require HCS to escheat

General Terms and Conditions (v 20260226) - Confidential

Page 15 of 42

funds in the name of Employer (the owner) to the relevant state.

2

Employer Duties.
Plan setup

•

Employer to complete an implementation questionnaire plan for Employer to choose
among certain features and options, subject to availability on HCS’s system.

Designate contact

•

Employer shall designate at least one employee as the primary contact.

•

The contact must have familiarity with Employer’s commuter benefits offering; the contact
shall provide HCS with advance notice before any changes to the Employer’s commuter
benefits offering become effective; the contact shall also be available to consult with HCS
from time to time as reasonably necessary for HCS to provide the services described
herein. For the avoidance of doubt, no change shall become effective unless and until
accepted and programmed by HCS.

•

Employer shall be responsible for providing accurate, complete and timely data, including
delivery addresses for fulfillment of fare media if Employer has assumed sole
responsibility for control of addresses.

•

HCS shall not be responsible for transit or other orders mailed to Employer-provided
addresses that are inaccurate or otherwise invalid.

•

Employer shall notify HCS, or its designate, of new and terminated eligible employees
according to the standard file specification.

•

A custom setup fee may apply if Employer cannot provide the data in the standard file
specification required by HCS, or its designate.

•

Employer is responsible for maintaining appropriate funding in a designated checking
account from which HCS will pull on a monthly basis to cover monthly orders.

•

Employer hereby authorizes and directs HCS to pull the funds via ACH to cover the
monthly orders and cash reimbursement payments contemplated herein.

•

Employer shall timely provide to HCS all funding amounts (including any pre-funding
needed). Employer acknowledges and agrees that all benefits claim pre-funding amounts
submitted by Employer to HCS: (i) shall be comprised of Employer’s general assets; (ii)
does not consist of Plan assets; and (iii) shall not be segregated or set aside in a trust or
escrow account by HCS. Employer agrees to pay HCS the entire amount delivered, or
deliverable regardless of whether Employer collects sufficient payroll deductions from
Employer’s participants.

•

Employer shall be solely responsible to ensure proper funding under the Agreement.

•

If it is determined that the amount of prefunding requested from the Employer is not
sufficient, HCS may request additional prefunding.

•

Employer shall have sole responsibility for ensuring that the Commuter Benefits are
provided in accordance with applicable law, including the accuracy and sufficiency of
documents and notices concerning the Commuter Benefits.

Provide data

Eligible employees

Funding

Legal compliance

3

Fees. Unless otherwise set forth herein, the fees for the Services under this Schedule shall be as set forth in the Order
Form. Notwithstanding the foregoing, upon termination of this Schedule (or the Agreement) by Employer, or upon closure of a
commuter account by Employer, HCS (or HQY) may charge an account closure fee of up to $25 per account.
Item
If Employer makes changes to its eligibility file after implementation has already
been performed by HCS, thus requiring implementation to be reperformed, then
HCS may charge a fee as specified in this table.

General Terms and Conditions (v 20260226) - Confidential

Fee
Up to $1,000 if the Employer has 500
benefit eligible employees or fewer at
the time of the requested changes

Page 16 of 42

OR
Up to $5,000 if the Employer has >500
benefit eligible employees at the time of
the requested changes.
4

Term and Termination.

4.1
Term. The term of this Schedule shall begin on the Order Form Effective Date and continue through and including
the Order Form Term (the “Initial Term”). This Schedule will thereafter automatically renew for additional 12-month terms
unless either Party terminates this Schedule in accordance with Section 4.2.
4.2
Termination for convenience. Following the Initial Term, either Party may terminate this Schedule at any time,
subject to providing 90 days’ prior written notice.
5

Debit Card.

If Employer elects to offer a card program in connection with its Plan, HCS will administer the debit card as follows:
5.1

Provision of Cards. HCS will provide one debit card (“Card””) to each participant.

5.2
Card Services. HCS will update participant records, maintain account balance and deposit information, activate and
deactivate Cards, respond to participant inquiries and provide appropriate notices of actions taken with respect to the Card.
5.3
Payments. Card transactions will be withdrawn against a participant’s account and Employer shall reimburse HCS
according to terms of Employer’s funding arrangement or as otherwise agreed, as applicable.
5.4
Improper Card Usage/Fraud. Employer shall notify HCS immediately if Employer suspects or confirms any
inappropriate or fraudulent Card usage. HCS will take reasonable action to investigate and resolve improper Card transactions
that it becomes aware of in accordance with applicable law and regulations (e.g., by offsetting the ineligible expense against a
proper expense). HCS may suspend a participant’s Card until such issue is resolved. If HCS cannot correct the improper use,
it will notify Employer and Employer shall be responsible to correct the transaction by adopting such measures as are required
by applicable law and regulations.
5.5
Lost or Stolen Cards. HCS agrees to cancel, as soon as reasonably practicable, a participant's Card when the Card
is reported as lost or stolen. HCS is not responsible for any transactions that occur prior to the request to cancel is received
unless otherwise required in the applicable cardholder agreement.
5.6
Termination or Ineligibility. HCS will deactivate a participant’s Card as soon as reasonably practicable after receipt
of notice from Employer that a participant has been terminated or is no longer eligible to participate under the Plan. HCS is not
responsible for any transactions that occur prior to the request to terminate is received.
5.7
Data Hosting; Right to Use Data. All Card data resides on servers owned by or operated on behalf of HCS’s service
providers. Employer grants HCS and its service providers the right to receive, process and use such data to administer the Card
program and provide related services to Employer and its participants, as well as the right to derive and use aggregate and
statistical de-identified data obtained therefrom.
5.8
Grant of License. If applicable per the service agreement, Employer grants HCS and its service providers a nonexclusive, non-transferable, royalty-free license to use Employer’s trademarks in connection with the Card program, in the forms
and formats approved by Employer in connection with (i) the Card, (ii) periodic statements and (iii) participant communications
regarding their accounts. The name of the financial institution that issues the Card, a website Uniform Resource Locator (URL)
and a customer service phone number will be printed on each Card.

General Terms and Conditions (v 20260226) - Confidential

Page 17 of 42

Schedule D

Lifestyle Accounts (LSAs)
1.

Employer’s Responsibilities.

Employer is the benefit program sponsor and administrator. As such, only Employer has the power to waive, alter, breach
or modify any of the terms and conditions of the program (“Program”), and Employer exercises all discretion, control or
authority with respect to the disposition of the available benefits. As such, Employer shall:
a.

Ensure that the summary Program descriptions, Program documents and any other documentation relating to the
Program are appropriately completed, are in compliance with all applicable laws, and are appropriately and timely
adopted;

b.

Provide HQY with a complete copy of all summary Program descriptions and Program documents for our reference in
connection with the provision of Services, which shall, among other things:
•

Designate what expenses are eligible for reimbursement under the Program;

•

Specify what information must be included on a receipt and/or claim form submitted by a participant to verify
whether an expense is eligible under the Program; and

•

Designate the frequency of reimbursements made to participants under the Program (e.g., monthly, quarterly,
annually).

c.

Distribute summary Program descriptions, summaries of material modifications and any other Program documentation
to participants on a timely basis;

d.

Determine which individuals are eligible to participate in Employer’s Program and provide HQY with accurate eligibility
data in the prescribed electronic data file format;

e.

Provide accurate and timely changes to participant eligibility data, including, but not limited to, information that modifies
a participant’s eligibility or status (e.g., leaves of absence, termination), in the prescribed electronic data file format;

f.

Confirm the initial payroll claim reimbursement test file provided by HQY in a mutually agreed upon file format is
compatible with Employer’s designated payroll system. If multiple payroll claim reimbursement files are required (e.g.,
one file per Program if you have multiple Programs), additional fees may apply;

g.

Timely retrieve and process the data files made available by HQY from either the HQY website or a designated FTP
site;

h.

Correct all errors in any data, files or other materials provided to us by you or on your behalf by your third party service
providers. HQY do not audit data, files or other information provided by Employer or its third party service providers;

i.

Report any reimbursements made under the Program as taxable income for each participant;

j.

Timely pay all service fees;

k.

Provide participants with any required information if Employer elects to offer Run-Out under its Program. “Run-Out” is
the period after the close of the Program period during which a participant may submit claims for eligible expenses
incurred during the immediately preceding Program period;

l.

Manage access to the employer portal of HQY’s website by Employer personnel based upon Employer’s internal
confidentiality and HIPAA privacy policies and procedures; and

m. Comply with all applicable laws with respect to Employer’s Program and make any required filings with the appropriate
governmental agencies, including the IRS.
2.

Term and Termination.

a.

Term. The term of this Schedule shall begin on the Order Form Effective Date and continue through and including the
Order Form Term (the “Initial Term”). This Schedule will thereafter automatically renew for additional 12-month terms
unless either Party terminates this Schedule in accordance with Section 2(b). Notwithstanding the foregoing, if the

General Terms and Conditions (v 20260226) - Confidential

Page 18 of 42

entire Agreement is terminated at any time, the term of this Schedule shall terminate as of the date on which the entire
Agreement is terminated.
b.

Termination for Convenience. Following the Initial Term, either Party may terminate this Schedule at any time, subject
to providing 90 days’ prior written notice.

3.

HQY’s Responsibilities.

HQY has been engaged by Employer to provide certain administration services in connection with Employer’s Program(s).
Accordingly, Employer have authorized HQY to use its standard procedures for the provision of Services. HQY shall provide
its Services in accordance with the framework of policies, interpretations, rules, practices and procedures as set forth in the
Program documents, and as otherwise mutually agreed upon or as directed by Employer. HQY shall:

4.

a.

Provide Employer with a set of electronic file specifications for the delivery of data to HQY;

b.

Process initial and ongoing eligibility data files submitted by Employer or on Employer’s behalf by a third party service
provider (e.g., payroll provider) in the prescribed electronic data file format;

c.

Make a payroll claims reimbursement file available to Employer for download from HQY’s website or, if applicable,
via a designated FTP site, in a mutually agreed upon electronic data file format on the frequency (e.g., weekly, biweekly, monthly) determined by Employer;

d.

Process claims received from participants;

e.

Administer Run-Out, if applicable, subject to ongoing payment of service fees;

f.

Provide Employer with access to HQY’s website where Employer may:
•

View, access and download standard reports (e.g., eligibility reports, claims activity reports and payroll claims
reimbursement reports);

•

View individual participant transactions; and

•

Access to HQY’s online communications gateway and download standard electronic communication material at
no additional charge. Customized items may be provided for an additional fee, plus charges for applicable bulk
sales, taxes, shipping and handling;

g.

Provide client service representatives who are available to answer participant phone calls during HQY’s normal
customer service hours;

h.

Provide participants with 24/7 access (excluding scheduled maintenance) to HQY’s website and interactive phone
system, where participants can access information regarding their account;

i.

Participate in employee education meetings and benefits fairs for an additional charge; and

j.

Add Employer’s logo and/or name on the participant website upon request.

k.

Escheatment. To the extent applicable, HQY will return unassociatable or unused funds related to plan or program
services to Employer who shall be responsible for compliance with escheatment obligations (if any). If Employer is
not able to, or declines to, accept returned funds, then Employer agrees that HQY will be entitled to the funds as part
of its overall compensation for services. If HQY is not able to locate Employer, then HQY (the holder) will comply with
applicable state unclaimed property laws regarding the funds, which may require HQY to escheat funds in the name
of Employer (the owner) to the relevant state.
Fees. Except as otherwise specified in this Section 4, the fees for the Services under this Schedule shall be as set
forth in the Order Form.

General Terms and Conditions (v 20260226) - Confidential

Page 19 of 42

Schedule E

COBRA Administration Services
HQY provides COBRA administration services through HQY’s Affiliate, WageWorks, Inc. (“WW”). This Schedule sets forth the
COBRA administration services to be provided by WW to Employer and are incorporated into the Agreement. Capitalized terms
used in this Schedule, but not defined herein, shall have the meanings ascribed to them in the Terms and Conditions to the
Agreement. Notwithstanding anything in this Schedule to the contrary, HQY (or any of its other Affiliates) may provide COBRA
Services in place of WW.
Employer has independently concluded that one or more of its group health plans are subject to the provisions of COBRA.
1

2

3

Definitions. For purposes of this Schedule, the following definitions are included in addition to those in the Agreement:
1.1

“Administrative User” means an employee of Employer who is authorized to access and use the COBRA Portal to
administer COBRA benefits established by or on behalf of Employer.

1.2

“COBRA” means the Consolidated Omnibus Budget Reconciliation Act of 1985, as amended, and its associated
regulations.

1.3

“COBRA Continuant” is a Qualified Beneficiary, or other individual, who has elected COBRA continuation coverage.

1.4

“COBRA Portal” means the WW web-based software applications to which Employer and/or Qualified Beneficiaries
are granted access.

1.5

“Covered Employee” means an employee of Employer who is eligible for group coverage under an Employer group
health plan.

1.6

“Party” or “Parties” shall have the meaning given to it in the Agreement but shall also specifically include WageWorks,
Inc.

1.7

“Qualified Beneficiary” means any individual specified in COBRA who is identified or confirmed by Employer as
eligible to receive COBRA continuation coverage under an Employer group health plan.

1.8

“Services” means processing and administration of COBRA benefits by WW for Employer under this Schedule.

Relationship.
2.1

The Parties acknowledge and agree that this Schedule is solely between WW and Employer, and is independent of
any relationship that either WW or Employer may have with an insurance carrier, third party administrator, benefits
administrator, or any other third party. For purposes of this Schedule, the term “Employer” shall mean Employer in
its capacity as plan sponsor of one or more group health plans or employee welfare benefit plans.

2.2

The Parties also acknowledge and agree that WW shall have no responsibility for the funding of COBRA premium
payments, or the payment of any claims under any of the Employer’s group health plans and WW’s hereunder are
solely those duties specifically undertaken in this Schedule. WW’s obligations hereunder are subject to, and
contingent upon, Employer’s accurate and timely compliance with the duties set forth in Section 4. In all events,
Employer is responsible for compliance with COBRA, state-specific continuation laws and all other applicable law,
including with respect to all notices, communications, and other documents prepared and distributed by WW, and
WW’s COBRA administration and state-specific continuation administration processes.

WW Duties.
a. Conduct a welcome and implementation phone call with Employer to complete a program
election questionnaire that includes Employer’s COBRA program elections and desired
COBRA Portal configurations.

Program setup

b. After all necessary information is received by WW, WW shall complete all required
COBRA Portal configuration to match Employer’s elections, provided, however, that WW
will identify all elections that it cannot configure and work with Employer to resolve the
configuration.
c.

Employer file integration

Provide Administrative Users with training on how to use the COBRA Portal.

d. Educate Administrative User on available methods for Employer to submit data or files to
the COBRA Portal, e.g., qualifying event files, Covered Employee files, etc. Available
options are: (i) manual entry on the COBRA Portal, (ii) upload a file in an approved format
(.csv, .txt, or .xlsx), and (iii) have a third-party benefits administrator send WW a file in an
approved format (.csv, .txt, or .xlsx).

General Terms and Conditions (v 20260226) - Confidential

Page 21 of 42

Takeover of existing
COBRA Continuants

e. Support transition from prior administrator of existing COBRA Continuants who have
elected COBRA continuation coverage.
f.

Send a welcome letter to COBRA Continuants explaining the transition of services to WW,
and payment coupons or invoices to COBRA Continuants.

Open Enrollment Services, generally. During implementation, Employer will be set up with the
Partial Open Enrollment service, unless Employer otherwise elects the ‘standard’ or ‘custom’
options. If Employer elects the ‘standard’ or ‘custom Open Enrollment service, Employer shall
provide written notification to WW of its choice.
g. Partial:

Open Enrollment (“OE”)

i.

Partial service applies to Employers that mail their own OE materials and process
their own OE elections.

ii.

Employer must advise WW of any required updates utilizing a mutually agreed
method (i.e., WW’s standard format or an existing format WW already receives).

iii.

WW will manage adding, updating or terminating plans; carrier and billing
updates; and will produce and mail a rate change notice with the updated rates to
Qualified Beneficiaries and COBRA Continuants (which, for clarity, includes
pending COBRA Continuants) providing the applicable COBRA premium change
for the Employer’s plan(s)’ next determination period.

iv.

Postage and additional printing fees may apply in some situations and will be
disclosed to the Employer.

v.

For clarity, the Partial service does not include the fulfillment of the OE materials
or processing of election forms.

h. Standard: Standard OE shall include part (iii) of the Partial OE offering as well as the
following:

i.

j.

Ongoing monthly
administration

i.

WW updates, prints, and mails OE notifications on behalf of the Employer, up to 7
sheets of paper (double-sided), to Qualified Beneficiaries and COBRA
Continuants (which, for clarity, includes pending COBRA Continuants). WW will
provide carrier and billing updates.

ii.

Postage and additional printing fees may apply in some situations and will be
disclosed to the Employer.

Custom: Custom OE shall include part (iii) of the Partial OE offering as well as the
following:
i.

WW updates, prints, and mails OE notifications on behalf of the Employer, up to
30 sheets of paper (double-sided), to Qualified Beneficiaries and COBRA
Continuants (which, for clarity, includes pending COBRA Continuants). WW will
provide carrier and billing updates.

ii.

Special handling for division-based communications and/or custom inserts.
Postage and additional printing fees may apply in some situations and will be
disclosed to Employer.

WW shall provide the following ongoing monthly administration Services, as applicable:
1.

Provide a website (the COBRA Portal) through which Qualified Beneficiaries may
view program communications, make benefit elections, and process COBRA
premium payments;

2.

Provide a website (the COBRA Portal) through which Employer may view program
information, access reports, and take the following actions:
•

Allow Employer to manually enter qualifying events; and

•

View Qualified Beneficiary information, e.g., COBRA election status,
communications mailed to the Qualified Beneficiary, and payment history;

General Terms and Conditions (v 20260226) - Confidential

Page 22 of 42

3.

Receive and process qualifying event files and, if elected by Employer, GeneralNotice-of-COBRA-Continuation-Coverage-Rights file;

4.

Provide general communications to Qualified Beneficiaries, and provide required
notices to Qualified Beneficiaries (subject to receipt of timely and accurate
information from Employer);

5.

Process COBRA elections received by mail from Qualified Beneficiaries and
elections entered by Qualified Beneficiaries on the COBRA Portal, and send COBRA
premium payment coupons to COBRA Continuants;

6.

Process monthly COBRA premium payments received via mail or via the COBRA
Portal;

7.

Remit COBRA premium payments monthly to the Employer (or Employer’s
insurance carrier, if such additional service is elected by Employer);

8.

Process COBRA terminations (process includes applicable conversion notifications if
Employer’s plan allows a conversion policy);

9.

Work with Employer and carriers to resolve any escalated issues;

10.

Notify Employer of elections, terminations and coverage changes (and Employer’s
insurance carrier, if such additional service is elected by Employer); and

Unless expressly stated otherwise in an addendum to this Schedule, WW shall not administer
any plan-specific rules that WW determines deviate from the minimum requirements under
COBRA.
k.

State-Specific Services

Notwithstanding the foregoing, WW reserves the ability to reject requests to comply with
any plan-specific or state-specific requirements if the request would not be reasonably
administrable within the parameters of WW’s COBRA administration system, as
determined by WW in its sole discretion.
l.

Customer service

If Employer requests for WW to provide state-specific continuation coverage notices, other
state-specific continuation services or wishes to offer COBRA benefits to non-qualified
beneficiary populations (i.e. domestic partners, parents), Employer will notify WW in
writing and, if such state-specific services are offered by WW, a separate, additional,
schedule may be provided with additional fees applicable to such schedule.

WW shall make available to Qualified Beneficiaries a toll-free number (in the US) to
access its COBRA service center.
As an accommodation and on a case-by-case basis, and unless otherwise directed by the
Employer, WW shall provide reasonable levels of assistance to Qualified Beneficiaries
who have questions about or difficulties in obtaining coverage instated or reinstated by
calling the applicable Plan or the applicable Plan’s insurer. However, in all such cases,
Employer is ultimately responsible for the instatement or reinstatement of coverage and for
the terms of its Plan(s). WW reserves the right to refer Qualified Beneficiaries to Employer
at any time for all questions related to coverage, including instatement or reinstatement of
coverage by any insurer of any Plan(s).

m. WW shall make available to Qualified Beneficiaries a toll-free fax number (in the US).

Escheatment

4

n. To the extent applicable, WW will return unassociatable or unused funds related to plan or
program services to Employer who shall be responsible for compliance with escheatment
obligations (if any). If Employer is not able to, or declines to, accept returned funds, then
Employer agrees that WW will be entitled to the funds as part of its overall compensation
for services. If WW is not able to locate Employer, then WW (the holder) will comply with
applicable state unclaimed property laws regarding the funds, which may require WW to
escheat funds in the name of Employer (the owner) to the relevant state.

Employer Duties.

General Terms and Conditions (v 20260226) - Confidential

Page 23 of 42

Program setup

a.

Employer to provide all necessary information that includes Employer’s COBRA program
elections and desired COBRA Portal configurations, including open enrollment in
accordance with Section 3.

b.

Employer shall designate at least one employee as the primary contact who has
familiarity with the Employer’s COBRA benefits program. The contact shall provide WW
with advance notice before any changes to the Employer’s COBRA benefits program
become effective and shall be available to consult with WW from time to time as
reasonably necessary for WW to provide the COBRA administration services described
herein. For the avoidance of doubt, no change shall become effective unless and until
accepted and programmed by WW.

c.

Employer shall be responsible for providing WW with accurate, complete and timely data.
WW’s responsibility for sending required notifications to Qualified Beneficiaries and
Covered Employees (if elected) is contingent upon Employer providing WW with
accurate, complete, and timely information. Employer is responsible for correcting errors
in all data sent to WW.

d.

To the extent that Protected Health Information (“PHI”) (as defined in the HIPAA
Regulations) is transmitted by Employer to WW or the COBRA Portal, Employer shall
make any such transmission in a secure and encrypted manner, and in accordance with
HIPAA, and other applicable privacy rules and regulations.

e.

For any notice required by COBRA to be given to Covered Employees, or Qualified
Beneficiaries, Employer shall provide all information required for WW to send the notices
on behalf of Employer at least 7 business days prior to the date on which the notice is
required to be given under COBRA. All such information must be provided to WW by
manually entering the information into the COBRA Portal or by uploading an appropriate
file using the required file format (.csv, .txt, or .xlsx).

f.

Provide plan and rate information for the new plan year at least 60 days in advance of
the date on which the updates will become effective.

g.

WW will not be responsible for any liabilities, penalties, or losses due to data or
information that is untimely, inaccurate or otherwise invalid and Employer’s
indemnification obligations set forth in Section 10.2 of the Agreement shall apply with
respect to any Losses asserted or arising from Employer’s failure to provide WW with
accurate, complete and timely data.

h.

At least once annually, or more frequently if requested by WW, Employer will provide
WW with its then current number of Covered Employees.

i.

Employer shall: (i) notify WW when an Administrative User’s access is terminated (i.e.
termination of employment; (ii) keep Employer and Employer’s Administrative Users’
passwords used to access the COBRA Portal confidential and secure; (iii) prohibit
Employer and Employer Administrative Users from attempting to gain unauthorized
access to the COBRA Portal and all related systems or networks; and (iv) implement
prudent management controls with respect to Employer and Employer’s Administrative
Users’ access to and use of the COBRA Portal, which include segregation of duties
among multiple Administrative Users and dual approvals for key activities.

Designate contact

Provide data

Covered Employees

Employer access

5

Fees. Unless otherwise set forth herein, the fees for the Services under this Schedule shall be as set forth in the Order
Form and shall be paid by the Employer. WW will invoice Employer directly on a monthly basis.
5.1

Implementation Fees.
Item
Initial implementation fee

General Terms and Conditions (v 20260226) - Confidential

Fee
$0 (fee waived)

Page 24 of 42

Employer shall provide a good faith estimate of the total number of COBRA eligibles, which is equivalent to covered lives,
during each plan year’s open enrollment period and shall, prior to commencement of each plan year, submit a copy of the
health insurance invoices (e.g., medical, dental, vision and/or EAP, if applicable) to substantiate the COBRA eligible
(covered lives) count. If Employer does not substantiate the COBRA eligible count prior to the commencement of a plan
year, the COBRA eligible count shall be increased by 20% over the prior plan year. If the COBRA eligible count changes
by more than 20% during a plan year, Employer shall promptly notify WW and provide documentation necessary to
substantiate such change. WW shall adjust the COBRA eligible count as of the first benefit month following receipt of
substantiation of the change in COBRA eligible count for calculation of fees.
5.2 COBRA Premium Payment Fee; Other Compensation.
a.

b.

WW shall be entitled to collect an additional fee equal to 2% of the full COBRA premium amount, or 50% in the
event that a COBRA Continuant’s COBRA coverage is extended due to a disability determination (“COBRA
Premium Surcharge”), for each COBRA Continuant each month. To the extent COBRA premium payments are
processed via the COBRA Portal or via mail, WW shall retain the COBRA Premium Surcharge. To the extent the
Employer pays or subsidizes all or a portion of the COBRA premium payment, Employer shall pay WW the COBRA
Premium Surcharge for all amounts paid or subsidized by Employer.
COBRA premium payments are collected and deposited in an omnibus processing account with a federally insured
financial institution, titled “WageWorks Omnibus Account for the Benefit of Employers” (or similar title). The account
is not treated as a plan asset and is subdivided as WW determines appropriate to maintain separate records for
each employer. Funds deposited in the omnibus account are held in that account until COBRA premium payments
are either sent to the Employer or remitted to the carrier (if Employer has elected to receive and pay for carrier
remission services) and the payments clear. Omnibus account balances earn interest at a rate determined by the
depository institution (such earnings are referred to as “float earnings”). Float earnings are used first to pay fees
associated with the account. WW will retain any float earnings that remain after such fees are paid as part of its
compensation for Services. If fees associated with the account exceed float earnings, WW will be solely
responsible for paying the excess over float earnings. WW will provide information regarding float earnings as the
Employer may reasonably request for the purpose of evaluating the reasonableness of WW’s compensation.

5.3 Open Enrollment Fees. Fees for Open Enrollment Services are as follows:
Open Enrollment (“OE”)
Partial

Fee
$8 per rate change notice mailed
Plus the applicable annual set up fee set forth in the Order Form.

Standard

$15 per OE packet mailed
Plus the applicable annual set up fee set forth in the Order Form.

Custom

$22 per OE packet mailed
Plus the applicable annual set up fee set forth in the Order Form.

5.4

Optional Services.
Item
General Notice of COBRA Continuation Coverage Rights
(new hire letter) on form approved by Employer*
State-specific Continuation Coverage Notices on form
approved by Employer
Premium remittance to insurance carriers**

Fee
$3.00 per notice
As set forth in the applicable schedule referenced
for State-specific services in Section 3.
$50 per carrier per month

*If Employer does not opt in to purchase the General-Notice-of-COBRA-Continuation-Coverage-Rights service, but
still accesses it and sends it via the COBRA Portal, Employer will be charged a $3.00 fee for each such General
Notice of COBRA Continuation Coverage Rights (new hire letter) sent.

General Terms and Conditions (v 20260226) - Confidential

Page 25 of 42

All program customizations or special requests (e.g., custom qualifying event file, custom General-Notice-of-COBRAContinuation-Coverage-Rights file, additional communications, custom reports, special mailings outside of HQY standard
communications, etc.) requested by Employer will be evaluated and quoted on a case-by-case basis. Such program
customizations and special requests will only be provided after Employer has accepted the quote.
All requests to pull generated materials to prevent mailing will be subject to an additional fee of $7.00 per envelope.
WW reserves the right to pass through increased costs associated with USPS postal rate increases. All costs
associated with requests to mail notices overnight or via express mail will be passed on to Employer in addition to cost of
time incurred at $250/hour.
5.5

6

IRS and/or Department of Labor Audits. In the event of an audit by the U.S. Internal Revenue Service or U.S.
Department of Labor, all associated time, copying, postage or other costs will be charged to the Employer on a time
and expense basis, with time billed at the rate of $150/hour.

Term and Termination.
6.1

Term. The term of this Schedule shall begin on the Order Form Effective Date and continue through and including
the Order Form Term (the “Initial Term”). This Schedule will thereafter automatically renew for additional 12-month
terms unless either Party terminates this Schedule in accordance with Section 6.2. Notwithstanding the foregoing,
if the entire Agreement is terminated at any time, the term of this Schedule shall terminate as of the date on which
the entire Agreement is terminated.

6.2

Termination for convenience. Following the Initial Term, either Party may terminate this Schedule at any time, subject
to providing 90 days’ advance written notice.

6.3

In addition to the termination rights set forth in the Agreement, WW may terminate this Schedule upon the occurrence
of any of the following:
6.3.1

Misuse of the COBRA Portal;

6.3.2

Failure by Employer to pay fees when due; and

6.3.3

Failure to provide timely, accurate, and complete data in the agreed upon-format.

General Terms and Conditions (v 20260226) - Confidential

Page 26 of 42

Schedule F

Direct Billing Services
HQY provides direct billing services through HQY’s Affiliate, WageWorks, Inc. (“WW”). This direct billing Services Schedule
sets forth the direct billing services to be provided by WW to Employer and is incorporated into and made part of the Agreement.
Capitalized terms used in this Direct Billing Services Schedule, but not defined herein, shall have the meanings ascribed to them
in the Terms and Conditions to the Agreement. Notwithstanding anything in this Schedule to the contrary, HQY (or any of its
other Affiliates) may provide direct billing Services in place of WW.
1

2

3

Definitions.
1.1

“DB Administrative User” means an employee of Employer who is authorized to access and use the Direct Billing
Portal to manage direct billing benefits established by or on behalf of Employer.

1.2

“DB Participant” is an employee or former employee of Employer who Employer has indicated to WW is eligible for
direct billing services.

1.3

“Direct Billing Portal” means all web-based software applications to which Employer and/or DB Participant are
granted access in connection with the direct billing Services.

1.4

“Services” means direct billing related benefits administered by WW for Employer under this Direct Billing Schedule.

Relationship.
2.1

The Parties acknowledge and agree that this Schedule is solely between WW and Employer, and is independent of
any relationship that either WW or Employer may have with any insurance carrier, third party administrator, benefits
administrator, or any other third party. For purposes of this Schedule, the term “Employer” shall include Employer in
its capacity as plan sponsor of one or more group health plans or employee welfare benefit plans.

2.2

Employer acknowledges and agrees that WW’s obligations hereunder are subject to, and contingent upon,
Employer’s accurate and timely compliance with the duties set forth in Section 4. In all events, Employer is
responsible for compliance with applicable law (including the Consolidated Omnibus Reconciliation Act of 1985, as
amended) and the review and approval of WW’s Direct Billing documents and templates, and WW’s Direct Billing
administration process.

2.3

The Parties also acknowledge and agree that WW shall have no responsibility for the funding of any premium
payments on behalf of DB Participants.

WW Duties.
a.

Program setup

b. After the completed and executed program election questionnaire is received by WW,
WW shall complete all required Direct Billing Portal configuration to match Employer’s
elections, provided, however, that WW will identify all elections that it cannot configure
and work with Employer to resolve the configuration.
c.

Employer file integration

Conduct a welcome and implementation phone call with Employer to complete a
program election questionnaire that includes Employer’s Direct Billing program elections
and desired Direct Billing Portal configurations.

Provide DB Administrative Users with training on how to use the Direct Billing Portal.

d. Educate DB Administrative User(s) on available methods for Employer to submit data or
files to the Direct Billing Portal, e.g., Direct Bill Import & Changes Specification files. The
available options for data submission are: (i) manual entry on the Direct Billing Portal, (ii)
upload a file in an approved format (.csv, .txt, or .xlsx), and (iii) have a third-party benefits
administrator send WW a file in an approved format (.csv, .txt, or .xlsx).
e. Support transition from prior administrator of existing DB Participants.
f.

Takeover of existing DB
Participants

Send a welcome letter to existing DB Participants explaining the transition of services to
WW.

g. Send payment coupons to existing DB Participants.
Direct Bill Open

Direct Bill Open Enrollment Services, generally. During implementation, Employer will be set

General Terms and Conditions (v 20260226) - Confidential

Page 27 of 42

Enrollment (“DBOE”)

up with the Standard Open Enrollment service, unless Employer otherwise elects the
‘custom’ option. During plan and rate renewal or such other time as directed by Employer, if
Employer elects the ‘standard’ or ‘custom’ OE Services, Employer shall provide written
notification to WW of such election.
h.

Partial:

i.

i.

Partial service applies to Employers that mail their own DBOE materials and
process their own DBOE elections.

ii.

Employer must advise WW of any required updates utilizing a mutually agreed
method (i.e., WW’s standard format or an existing format WW already receives).

iii.

WW will manage adding, updating or terminating plans; carrier and billing
updates; and will produce and mail an updated rate change notice and/or
premium statement to the DB Participants providing the applicable premium
changes for the Employer’s plan(s)’ next determination period.

iv.

Postage and additional printing fees may apply in some situations and will be
disclosed to the Employer.

v.

For clarity, the Partial service does not include the fulfillment of the DBOE
materials or processing of election forms.

Standard: Standard DBOE shall include part (iii) of the Partial DBOE offering as well as
the following:

j.

i.

WW will manage adding, updating or terminating plans, carrier billing updates,
and will produce an updated premium statement to DB Participants announcing
the applicable Direct Bill premium change for the Employer’s plan(s)’ next
determination period.

ii.

WW updates, prints, and mails DBOE notifications on behalf of the Employer, up
to 7 sheets of paper (double-sided), to DB Participants. WW will provide carrier
and billing updates.

iii.

Postage and additional printing fees may apply in some situations and will be
disclosed to the Employer.

Custom: Custom OE shall include part (iii) of the Partial DBOE offering as well as the
following:

k.

i.

WW will manage adding, updating or terminating plans, carrier billing updates,
and will produce an updated premium statement to DB Participants announcing
the applicable Direct Bill premium change for the Employer’s plan(s)’ next
determination period.

ii.

WW updates, prints, and mails DBOE notifications on behalf of the Employer, up
to 30 sheets of paper (double-sided), to DB Participants. WW will provide carrier
and billing updates.

iii.

Special handling for division-based communications and/or custom inserts.
Postage and additional printing fees may apply in some situations and will be
disclosed to Employer.

WW shall provide the following ongoing monthly administration Services, as applicable:
1. Provide a website (the Direct Billing Portal) through which DB Participants may view
program communications, and process direct billing payments;

Ongoing monthly
administration

2. Provide a website (the Direct Billing Portal) through which Employer may view
program information, access reports, and take the following actions:

3.

•

Upload Direct Bill Import & Changes Specification files, or manually enter
information about DB Participants; and

•

View DB Participant information, e.g., communications mailed to the DB
Participant, and payment history;

Receive and process Direct Bill Import & Changes Specification files;

General Terms and Conditions (v 20260226) - Confidential

Page 28 of 42

Customer service

Escheatment

4

4.

Provide general communications to DB Participants;

5.

Send direct billing payment coupons to DB Participants;

6.

Process direct billing payments received via mail or via the Direct Billing Portal;

7.

Remit direct billing payments monthly to the Employer; and

8.

Work with Employer to resolve any escalated issues.

WW shall make available to DB Participants a toll-free number (in the US) to access its direct
billing service center.
To the extent applicable, WW will return unassociatable or unused funds related to plan or
program services to Employer who shall be responsible for compliance with escheatment
obligations (if any). If Employer is not able to, or declines to, accept returned funds, then
Employer agrees that WW will be entitled to the funds as part of its overall compensation for
services. If WW is not able to locate Employer, then WW (the holder) will comply with
applicable state unclaimed property laws regarding the funds, which may require WW to
escheat funds in the name of Employer (the owner) to the relevant state.

Employer Duties.

Program setup

a.

Employer to complete a program election questionnaire that includes Employer’s Direct
Billing program elections and desired Direct Billing Portal configurations.

b.

Employer shall designate at least one employee as the primary contact who has
familiarity with the Employer’s Direct Billing program; the contact shall provide WW with
advance notice before any changes to the Employer’s Direct Billing program become
effective and be available consult with WW from time to time as reasonably necessary
for WW to provide the Direct Billing services described herein. For the avoidance of
doubt, no change shall become effective unless and until accepted and programmed by
WW.

c.

Employer shall have sole responsibility for providing WW with accurate, complete and
timely data. WW’s responsibility for sending communications and payment coupons to
DB Participants is contingent upon Employer providing WW with accurate, complete,
and timely information. Employer is responsible for correcting errors in any data sent to
WW. WW is not responsible for any liabilities, penalties, or losses due to data or
information that is untimely, inaccurate or otherwise invalid.
To the extent that Protected Health Information (“PHI”) (as defined in the HIPAA
Regulations) is transmitted by Employer to WW or the Direct Billing Portal, Employer
shall make any such transmission in a secure and encrypted manner, and in
accordance with all applicable HIPAA privacy rules and requirements.

d.

In the event of rate or plan changes for DB Participants, Employer will provide updated
rate information 60 days in advance of effective date.

e.

Employer shall: (i) keep its and its DB Administrative Users’ passwords used to access
the Direct Billing Portal confidential and secure; (ii) prohibit its DB Administrative Users
from attempting to gain unauthorized access to the Direct Billing Portal and any related
systems or networks; and (iii) implement prudent management controls with respect to
Employer and Employer’s DB Administrative Users’ access to and use of the Direct
Billing Portal, which include segregation of duties among multiple DB Administrative
Users and dual approvals for key activities.

Designate contact

Provide data

Employer access

5

Fees. Unless otherwise set forth herein, the fees for the Services under this Schedule shall be as set forth in the Order

General Terms and Conditions (v 20260226) - Confidential

Page 29 of 42

Form, including any OE fees, as applicable.
5.1

Implementation fees shall be as specified on the Order Form.

5.2

Annual Set-up Fee. For each year that Employer requests WW to update rates or update information or
costs of DB Participants, WW shall be entitled to charge Employer a fee of $150.

5.3

Any program customizations or special requests (e.g., custom file types, additional communications,
custom reports, special mailings outside of HQY standard communications, etc.) requested by Employer
will be evaluated and quoted on a case-by-case basis. Such program customizations and special
requests will only be provided after Employer has accepted the quote.

5.4

Any requests to pull generated materials to prevent mailing will be subject to an additional fee of $7 per envelope.

5.5

WW reserves the right to pass through increased costs associated with USPS postal rate increases. All
costs associated with requests to mail notices overnight or via express mail will be passed on to Employer in addition
to cost of time incurred at $250/hour.

5.6

Open Enrollment Fees. Fees for Direct Bill Open Enrollment Services are as follows:

5.7

6

Direct Bill Open
Enrollment (“DBOE”)
Partial

Fee

Standard

$15 per DBOE packet mailed

Custom

$22 per DBOE packet mailed

The fee for the Partial offering for DBOE is included in the annual set up
fee specified in Section 5.2

Other Compensation. Direct billing payments are collected and deposited in an omnibus processing account with a
federally insured financial institution, titled “WageWorks Omnibus Account for the Benefit of Employers” (or similar
title). The account is not treated as a plan asset and is subdivided as WW determines appropriate to maintain
separate records for each employer. Funds deposited in the omnibus account are held in that account until the direct
billing payments are either sent to the Employer or remitted to the carrier (if Employer has elected to receive and pay
for carrier remission services) and the payments clear. Omnibus account balances earn interest at a rate determined
by the depository institution (such earnings are referred to as “float earnings”). Float earnings are used first to pay
fees associated with the account. WW will retain any float earnings that remain after such fees are paid as part of its
compensation for Services. If fees associated with the account exceed float earnings, WW will be solely responsible
for paying the excess over float earnings. WW will provide information regarding float earnings as the Employer may
reasonably request for the purpose of evaluating the reasonableness of WW’s compensation.

Term and Termination.
6.1

Term. The term of this Schedule shall begin on the Order Form Effective Date and continue through and including
the Order Form Term (the “Initial Term”). This Schedule will thereafter automatically renew for additional 12-month
terms unless either Party has terminated this Schedule in accordance with Section 6.2. Notwithstanding the

foregoing, if the entire Agreement is terminated at any time, the term of this Schedule shall terminate as
of the date on which the entire Agreement is terminated.

6.2

Termination for convenience. Following the Initial Term, either Party may terminate this Schedule at any time, subject
to providing 90 days’ advance written notice.

6.3

In addition to the termination rights set forth in the Agreement, WW may terminate this Schedule upon the occurrence
of any of the following:
6.3.1

Misuse of the Direct Billing Portal;

6.3.2

Failure by Employer to pay fees when due; and

6.3.3

Failure to provide timely, accurate, and complete data in the agreed upon-format.

General Terms and Conditions (v 20260226) - Confidential

Page 30 of 42

Annex 1

Data Security Addendum (DSA)
This Data Security Addendum (“DSA”) supplements the Agreement between Employer and HQY and is hereby incorporated by
reference into the Agreement. Capitalized terms not defined in this DSA shall have the meaning ascribed to them in the
Agreement. In the event of a conflict between this DSA and the Agreement, this DSA will govern. This DSA will survive
termination or expiration of the Agreement.
1.

General. To provide Employer with the services contemplated under the Agreement (collectively referred to as
“Services”), HQY may have access to certain Employer information and systems, including Covered Information.

2.

Compliance.
A.

HQY will comply with applicable Data Protection Laws. HQY is responsible for understanding which Data
Protection Laws apply to the Services and the data in scope and agrees to provide the same, or stronger,
level of protection required under Data Protection Laws, and to implement the security procedures and
practices set forth herein to protect Covered Information from unauthorized or illegal access, destruction, use,
modification, or disclosure.

B.

HQY is responsible for its subcontractor’s compliance with Data Protection Laws and this DSA. For
subcontractors who collect, transmit, share, store, control, process, manage or access Covered Information,
HQY is responsible for assessing and monitoring subcontractor control environments for compliance with Data
Protection Laws and Company’s standards as documented in this DSA. HQY shall ensure that any of its
subcontractors having access to Covered Information shall be contractually bound to meet or exceed these
information security provisions.

C.

HQY shall cooperate with Employer in responding to and complying with valid, verified requests from Data
Subjects submitted pursuant to applicable Data Protection Laws.

D.

HQY and Employer agree that, regarding any Covered Information HQY receives or obtains in connection
with the Agreement(s), Employer is not Selling or Sharing such Covered Information to HQY and HQY is not
providing, and shall not provide, any monetary or other valuable consideration to Employer for such Covered
Information. Additionally, HQY shall not Sell or Share Covered Information it receives from, or on behalf of,
Employer.

E.

If HQY is processing Personal Information within the scope of Data Protection Laws, without limiting any
obligations under the Agreements, HQY acknowledges that Employer is disclosing Personal Information to
HQY and/or HQY is collecting Personal Information on Employer’s behalf according to Employer’s written
instructions for the limited business purpose of Supplier providing the Services (the “Business Purpose”), and
HQY shall not retain, use, process, or disclose said Personal Information: (a) for any purpose, commercial or
otherwise, other than the Business Purpose, (b) in combination with any other Personal Information Supplier
collects, except as permitted by Data Protection Laws or (c) outside of the direct business relationship between
HQY and Employer. If HQY Processes Employer Personal Information that is considered “Sensitive” under
Data Protection Laws, HQY shall assist Employer, upon reasonable request, to limit the use of such Sensitive
Personal Information.

F.

Without limiting Employer’s rights or HQY’s obligations under the Agreements, Employer shall: (i) take
reasonable and appropriate steps to ensure that HQY uses the Personal Information that it receives from, or
on behalf of, Employer in a manner consistent with Data Protection Laws, (ii) take reasonable and appropriate
measures to monitor HQY’s compliance with Data Protection Laws and this addendum, and (iii) upon notice
to HQY, take reasonable and appropriate steps to stop and remediate any unauthorized collection, use,
processing or retention of Covered Information.

G. If HQY becomes aware that it can no longer meet its obligations under Data Protection Laws, HQY shall notify
Employer no later than five (5) business days after it becomes aware of such situation.
3.

Usage, Integrity, and Security Requirements.
A.

HQY may only access, collect, process, disclose, store, transfer, amend, or destroy Covered Information as
necessary to perform its obligations under the Agreement and otherwise as permitted by Employer or
applicable Data Protection Laws.

B.

HQY shall take reasonable steps and implement industry standard measures (such as passkey) to prevent
the unauthorized collection, access, use, modification, transfer, processing, inspection, perusal, destruction,

General Terms and Conditions (v 20260226) - Confidential

Page 31 of 42

or recording of Covered Information that is stored with, provided to, or collected by or on behalf of HQY under
the Agreement. At a minimum, HQY shall implement industry standard measures regarding the following
controls:
i.

logical segregation of Covered Information from other third-party data;

ii.

integrity controls to prevent the unauthorized alteration, modification, or destruction of Covered
Information;

iii.

access controls to ensure only authorized personnel have access to the Covered Information and such
access is limited to the minimum amount and level required for such authorized personnel to provide the
Services;

iv.

only collect and store Covered Information within the United States;

v.

prevent disclosure of Covered Information to any third party unless:

vi.

i.

such disclosure is reasonably required to be made in the performance of the Services or other
HQY obligations under the Agreement; and

ii.

HQY imposes (or has imposed) contractual restrictions substantially similar to the Agreement
on the recipient third party;

ensure the reliability of any individuals that have access to Covered Information, including without
limitation, by performing background checks upon such employees (where permissible under applicable
law).
Notwithstanding the foregoing, HQY is not responsible for any data (or identity) breaches within Employer’s
systems or for failures of Employer to secure employee data security systems, controls or measures, either
directly, or through Employer’s vendors or subcontractors.

C.

4.

5.

Within 30 days after a written request by Employer, the termination or expiration of the Agreement, or when
HQY no longer needs the Covered Information, or a portion thereof, to fulfill its obligations under the
Agreement, Data Privacy Laws, or other applicable law, HQY shall: (a) provide Employer (or a third-party
designee selected by Employer) with a copy of all Covered Information in HQY’s possession through an
approved secure transmission and in a format that is acceptable to Employer; (b) upon Employer’s request,
HQY shall securely destroy all Covered Information (in any format) and all copies and records thereof in a
manner that makes such Covered Information non-readable and non-retrievable; provided that HQY may
retain an electronic copy to comply with applicable law and archival purposes; and (c) provide Employer with
written notification of such destruction or disposal.

Governance and Program Management.
A.

HQY will assign an individual who is responsible for the information security program at HQY.

B.

HQY has and shall maintain an established and formal information security program that addresses the
management of security and the controls employed within the organization. HQY will maintain and enforce
security policies consistent with an industry-recognized framework (e.g. NIST Cyber Security Framework)
and all applicable regulatory and legal security requirements.

C.

HQY will maintain and enforce a written privacy policy to ensure proper access, use or disclosure by HQY
of Covered Information.

D.

HQY shall document its information security policy and procedures addressing all the activities relating to
the handling and management of Covered Information.

Safeguards. To ensure the confidentiality, security, and integrity of Covered Information, HQY shall implement and
maintain during the Term information security policies, procedures, and controls, which are compliant with applicable
law, Data Privacy Laws, applicable Information Security Standards, and the requirements set forth in this DSA. While
HQY has access to or maintains Covered Information HQY will maintain reasonable safeguards, including
administrative, technical, and physical controls designed to ensure the privacy, security, integrity, and confidentiality
of the Covered Information, Standards including the following:
A.

Physical Access. HQY will maintain physical access and environmental controls designed to secure relevant
facilities, infrastructure, data centers, hard copy files, servers, backup systems, and equipment (including
mobile devices) used to access Covered Information, including controls to prevent, detect, and respond to
attacks, intrusions, or other system failures.

B.

User Authentication. HQY will maintain commercially reasonable user authentication and access controls
within operating systems, applications, equipment, and media.

C.

Personnel Security. HQY will maintain personnel policies and practices restricting access to Covered

General Terms and Conditions (v 20260226) - Confidential

Page 32 of 42

Information, including having confidentiality agreements with and performing background checks in
accordance with applicable laws on all personnel who access Covered Information or who maintain,
implement, or administer HQY’s information security program and safeguards.
D.

Logging and Monitoring. HQY will log and monitor the details of access to Covered Information on networks,
systems, and devices operated by HQY.

E.

Malware Controls. HQY will maintain reasonable and up-to-date controls to protect all networks, systems,
and devices that access Covered Information from malware and unauthorized software.

F.

Security Patches. HQY will maintain controls and processes designed to ensure that networks, systems,
and devices (including operating systems and applications) that access Covered Information are up to date,
including prompt implementation of security patches categorized as critical and high when issued.

G. User Account Management. HQY will implement reasonable user account management procedures to
securely create, amend, and remove user accounts on networks, systems, and devices through which HQY
accesses Covered Information, including monitoring redundant accounts and ensuring that all account
requests are properly authorized.
H.

I.

6.

Vulnerability and Patch Management. HQY shall keep abreast of new security threats and vulnerabilities
and use such information to mitigate the risk by applying patches. At a minimum, HQY Shall:
i.

Conduct internal and external vulnerability assessments by a qualified individual on information
systems and networked environments performed at least every thirty (30) days, after any significant
change in the information systems (e.g., new system component installations, changes in network
topology, firewall rule modifications, product upgrades, when new vulnerabilities potentially
affecting the systems and networked environments are identified and reported), and upon
significant external security vulnerability release (e.g., Microsoft zero-day is identified). These tests
shall include both network- and application-layer tests.

ii.

Employ automated mechanisms monthly to determine the state of information system components
with regard to flaw remediation. Vulnerability scanning tools shall be updated regularly with all
relevant information system vulnerabilities.

iii.

Define and establish the roles and responsibilities associated with technical vulnerability
management, including vulnerability monitoring, vulnerability risk assessment, patching, asset
tracking, and any coordination responsibilities required.

Patches shall be tested, evaluated, and installed in a timely manner and evaluated before they are installed.
Patches installed in the production environment shall also installed in the HQY’s disaster recovery
environment in a timely manner.

Access Controls. HQY will:
A.

maintain reasonable controls to ensure that only individuals who have a legitimate need to access Covered
Information access;

B.

promptly terminate an individual’s access to Covered Information when such access is no longer required;

C.

log the appropriate details of access to Covered Information on HQY’s systems and equipment; and

D.

be responsible for any unauthorized access to Covered Information.

7.

Encryption Requirements. HQY will encrypt all Covered Information, using a NIST approved encryption standard,
including those required by applicable law or applicable standards (example: FIPS 140-2) that is (a) stored on portable
devices or portable electronic media; (b) maintained outside of HQY’s facilities, excluding hard copy documents; or
(c) transferred across any public network.

8.

Training and Supervision. HQY will provide reasonable ongoing privacy and information protection training and
supervision for all HQY’s personnel who access Covered Information (and require third party subcontractors to
provide similar).
A.

HQY shall:
i.

utilize qualified security and privacy personnel sufficient to manage the HQY’s security and privacy
risks.

ii.

provide security and privacy personnel with security and privacy updates and training sufficient to
address relevant security and privacy risks; and

iii.

verify that key security and privacy personnel take steps to maintain current knowledge of changing
cybersecurity threats and countermeasures.

General Terms and Conditions (v 20260226) - Confidential

Page 33 of 42

9.

Software Development Security. HQY will maintain a written Software Development Life Cycle program based on
industry best practices that also incorporates security and privacy by design principles based on OWASP, the
Microsoft Security Development Lifecycle, or substantially similar and industry recognized practices The program
must be designed to ensure the use of security development practices and procedures for evaluating or testing the
security of externally developed applications utilized by HQY to provide services to Employer.

10. Business Continuity and Disaster Recovery.
HQY will maintain a business continuity plan and disaster recovery plan. These plans will be tested by HQY at least
annually. Upon request, but not more than once annually, HQY will provide executive summaries of annual testing.
11. Third Party Providers. HQY will contractually require each third-party provider that accesses Covered Information to
protect the privacy, confidentiality, integrity, and security of Covered Information using at least the same level of
protection and confidentiality obligations that apply to HQY. HQY will regularly assess, based on a risk ranking,
HQY’s third-party providers’ compliance with those contractual requirements.
12. HQY’s Penetration Testing.
A.

HQY will have an accredited third party perform annual manual and automated vulnerability testing (including
penetration testing based on recognized industry best practices) on HQY’s networks, systems, software,
and devices used to provide the Services.

B.

With thirty (30) days upon receipt of the penetration test report, HQY will provide Employer with a summary
of the results of the vulnerability and penetration testing performed and the status of the remediation in any
finding. Employer will treat these results as HQY’s confidential information.

13. Audits, Certifications, and Reports.
A.

HQY agrees to have an annual NIST CSF, SOC 1 Type 2, or SOC 2 Type 2 security assessment performed
by an accredited third-party.

B.

Upon request, HQY agrees to provide to Employer, at no cost to Employer, within ninety (90) days after the
end of each calendar year, a copy of either, that years SSAE18 SOC 1 or 2 Type II report (with accompanying
bridge letter if appropriate). If no SOC 2 assessment was conducted, then Employer agrees to provide a
summary of the NIST CSF assessment report.

14. Incident Response. HQY will maintain an Incident response and crisis communication program reasonably designed
to detect, contain, respond, and recover from an Incident.
15. Security Flaw Notification and Resolution. In the event of a known or suspected Security Flaw involving Covered
Information, HQY shall (at HQY’s cost): (a) provide Employer prompt, written notice of such Security Flaw to
Employer’s Infosec Contact; and (b) work to respond to and remediate such Security Flaw.
16. Incident Notification and Resolution. In the event of an Incident involving Covered Information HQY shall (at HQY’s
cost): (i) provide Employer prompt, written notice of such Incident, (ii) remediate and correct the Incident within a
reasonable time, and (iii) and provide updates to Employer on a mutually agreeable timetable.
A.

To the extent known, said notification shall include reasonable information about the Incident, including:
•

a description of the Covered Information subject to the Incident (the categories and number of data
records concerned);

•

the date and time of the Incident;

•

a description of the likely consequences of the Incident;

•

a description of the circumstances that led to the Incident (e.g., loss, theft, copying);

•

a description of immediate measures being taken to remediate any adverse effects of the Incident;
and

•

a description of the measures HQY propose to implement to prevent the same or similar Incident
from occurring again.

•

a summary of the status and results of the investigation.

B.

HQY shall cooperate with Employer, and any reputable third party selected by Employer and any applicable
law enforcement or regulatory authority in the event of a regulatory inquiry, litigation, or other legal process
concerning the Incident.

C.

HQY shall not notify any affected Employer client (both current and past), account holder (both current and
past), participant (both current and past), partner (both current and past), (both current and past), personnel
(both current and past), or other entities other than Employer (collectively, “Impacted Parties”), relevant law

General Terms and Conditions (v 20260226) - Confidential

Page 34 of 42

enforcement agencies, and HQY’s outside counsel, unless required under applicable law or agreed to in
advance by Employer in writing. If a notification is provided, HQY shall bear all expenses associated with such
notification, including any credit monitoring and/or call center services. The timing, method, and content of any
notification to Impacted Parties shall be approved in writing by Employer prior to sending.

17. No Unauthorized Statements. Except as required by applicable law, HQY will not make (or permit any third party to
make) any statement concerning the Security Incident that directly or indirectly references Employer, unless Employer
provides its explicit written authorization.

18. Definitions: The following terms shall have the meanings ascribed to them below for this Annex:
“Approved Encryption” means industry standard encryptions or algorithms as described in Section 7 of this Annex,
which encryptions or algorithms may be updated or enhanced by HQY over time due to changes in Data Security
Law or industry standards.
“Breach” means collectively or individually an Incident or System Breach.
“Covered Information” means any Personal Data or Sensitive Personal Data (or equivalent or similar terms defined
in Data Protection Laws) from or about Employer and Employer’s members, account holders, or participants (both
existing and expired), in physical or electronic form, that is accessed, collected, stored, transmitted, processed,
hosted, used, handled, or disposed of by HQY under the Agreement.
“Data Protection Law(s)” means all applicable privacy, AI, consumer data rights, data security laws, and data
protection laws, regulations, rules and guidance in effect currently or at any time hereafter, including, without limitation,
the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Gramm-Leach-Bliley Act (GLBA), the
Fair Credit Reporting Act (FCRA), the Payment Card Industry Data Security Standards (PCI-DSS), the California
Privacy Rights Act of 2020 (including its implementing regulations, collectively, the “CPRA”), the Colorado Privacy
Act (CPA), the Virginia Consumer Data Protection Act (VCDPA), the Connecticut Data Privacy Act (CTDPA), and the
Utah Consumer Privacy Act (UCPA).
“Data Subject” means any individual employee, consumer, customer, member, account holder, or participant whose
Covered Information is accessed, collected, stored, transmitted, processed, hosted, used, handled, or disposed of by
HQY under the Agreement.
“HQY Systems” means any network, systems, infrastructure, or devices used to access, process, display, or store
information by HQY in the provision of the Services.
“Incident” means an actual unauthorized access, possession, manipulation, transmission, disclosure, viewing,
perusal, destruction, or use of Covered Information.
“Information Security Standards” means then-current industry standard practices relating to information and
infrastructure security and privacy, provided that such standards shall be consistent with NIST, SSAE 16, or ISO/IEC
27001 (and all applicable successor provisions) and PCI-DSS.
“Personal Data” means any information related to an identified or identifiable individual.
“Security Flaw” means any vulnerability or flaw that may materially jeopardize the integrity, privacy, confidentiality
and/or security of any Covered Information or HQY System/network.
“Sensitive Personal Data” means any Personal Data that is: (a) protected under the (i) Health Insurance Portability
and Accountability Act of 1996 (HIPAA), (ii) Gramm-Leach-Bliley Act, (iii) Fair Credit Reporting Act (FCRA), or (d)
Payment Card Industry Data Security Standards (PCI-DSS); (b) defined as sensitive under any applicable state or
federal law, rule, or regulation; or (c) any data that if disclosed to an unauthorized party would likely cause serious
harm to the data subject, including without limitation, government issued identifiers (e.g., SSN and passport numbers)
and biometric information.
“System Breach” means any attempted or actual unauthorized access to or manipulation of any HQY Systems.

General Terms and Conditions (v 20260226) - Confidential

Page 35 of 42

Annex 2

Business Associate Agreement (BAA)
1

Scope.
This Business Associate Agreement (“BAA”) shall only apply to those services provided by Business Associate to
Covered Entity (each defined below) as described in the Master Services Agreement (“Agreement”).

2

Definitions.

2.1

Catch-all definition. The following terms, when used in this BAA, shall have the meaning given in the Health Insurance
Portability and Accountability Act of 1986 (“HIPAA”), as amended by the Health Information Technology for Economic and
Clinical Health Act, and the regulations thereunder: Attestation, Breach, Data Aggregation, Designated Record Set,
Disclosure, Final Rule, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected
Health Information, Reproductive Health Care, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured
Protected Health Information, and Use.

2.2

Specific definitions.

3
3.1

•

“Business Associate” shall generally have the same meaning as the term “business associate” at 45 CFR
160.103, and in reference to the party to this BAA, shall mean HealthEquity, Inc.

•

“Covered Entity” shall have the same meaning as the term “Covered Entity” at 45 CFR 160.103, and in reference
to the party to this BAA, shall mean the Employer.

•

“HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160
and Part 164.

Obligations and Activities of Business Associate.
Business Associate agrees to:
(a)

Not use or disclose Protected Health Information other than as permitted or required by the Agreement or as
Required By Law;

(b)

Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic
Protected Health Information, to prevent use or disclosure of Protected Health Information other than as
provided for by the Agreement;

(c)

Report to Covered Entity any use or disclosure of Protected Health Information not provided for by the
Agreement of which it becomes aware, including Breaches of Unsecured Protected Health Information as
required at 45 CFR 164.410, and any Security Incident of which it becomes aware. For this purpose, a Breach
is reportable to Covered Entity without regard to whether, in Business Associate’s determination, any harm
will result from the Breach;

(d)

In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any Subcontractors
that create, receive, maintain, or transmit Protected Health Information on behalf of Business Associate agree
to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such
information;

(e)

Make available Protected Health Information in a Designated Record Set to the Individual or the Individual’s
designee as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524;

(f)

Make any amendment(s) to Protected Health Information in a designated record set as directed or agreed to
by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered
Entity’s obligations under 45 CFR 164.526. If the Business Associate receives directly from the Individual a
request to amend the Protected Health Information that is within the Business Associates’ control, the
Business Associate shall make such amendments within 30 days of the written request to the extent such
request is not inconsistent with the existing designated record sets (e.g., change of an Individual’s identifiers
such as Date of Birth will be considered inconsistent.) Any inconsistent request will be forwarded to Covered
Entity for Covered Entity’s determination of whether to amend the Individual’s record;

(g)

Maintain and make available the information required to provide an accounting of disclosures to the Covered
Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.528. If Business Associate
receives a request for an accounting of disclosures directly from the Individual, Business Associate shall
promptly forward that request to the Covered Entity and make available the requested records to Covered
Entity within 30 days from the receipt;

(h)

To the extent Business Associate is to carry out one or more of Covered Entity's obligation(s) under Subpart

General Terms and Conditions (v 20260226) - Confidential

Page 36 of 42

E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Covered Entity in the
performance of such obligation(s);

3.2

4

(i)

If applicable to the services performed by Business Associate, relating to the use or disclosure of PHI for
specific purposes connected to Reproductive Health Care, notify Covered Entity in the event of any use or
request to use such PHI that is for a prohibited purpose as set forth in the Final Rule. Covered Entity and
Business Associate shall work together to provide the Attestation required by the Final Rule, if necessary;
and,

(j)

Make its internal practices, books, and records available to the Secretary for purposes of determining
compliance with the HIPAA Rules.

The Parties acknowledge that probes and reconnaissance scans are commonplace in the industry and, as such, the
Parties acknowledge and agree that, to the extent such probes and reconnaissance scans constitute Security Incidents,
this section constitutes notice by Business Associate to the Covered Entity of the ongoing existence and occurrence of
such Security Incidents for which no additional notice to the Covered Entity shall be required. Probes and
reconnaissance scans include, without limitation, pings and other broadcast attacks on Business Associate's firewall,
port scans, and unsuccessful log-on attempts, as long as such probes and reconnaissance scans do not result in
unauthorized access, use or disclosure of Protected Health Information.
Permitted Uses and Disclosures by Business Associate.

4.1

Business Associate may only use or disclose Protected Health Information as necessary to perform the services
described in the Agreement.

4.2

In addition to other permissible purposes, the Business Associate is authorized to use Protected Health Information to
de-identify the information in accordance with 45 CFR 164.514(a)-(c) for internal analysis of operational efficiencies,
and to determine if additional services should be developed or offered to users.

4.3

Business Associate may use or disclose Protected Health Information as Required By Law.

4.4

Business Associate agrees to make Uses and Disclosures and requests for only the Minimum Necessary Protected
Health Information to accomplish the purpose of the Use, Disclosure or request.

4.5

Business Associate may not use or disclose Protected Health Information in a manner that would violate Subpart E of
45 CFR Part 164 if done by Covered Entity except for the specific Uses and Disclosures set forth below.

4.6

Business Associate may use Protected Health Information as necessary for the proper management and administration
of its business or to carry out its legal responsibilities, provided the disclosures are Required By Law, or Business
Associate obtains reasonable assurances from the person to whom the information is disclosed that the information
will remain confidential and used or further disclosed only as Required By Law or for the purposes for which it was
disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the
confidentiality of the information has been breached.

4.7

Business Associate may provide data aggregation services relating to the Health Care Operations of Covered Entity.

5

Responsibilities of Covered Entity.

5.1

Covered Entity shall notify Business Associate of any limitation(s) in the Notice of Privacy Practices of Covered Entity
under 45 CFR 164.520, to the extent that such limitation may affect Business Associate’s Use or Disclosure of Protected
Health Information.

5.2

Covered Entity shall notify Business Associate of any changes in, or revocation of, the permission by an Individual to
use or disclose his or her Protected Health Information, to the extent that such changes may affect Business Associate’s
Use or Disclosure of Protected Health Information.

5.3

Covered Entity shall notify Business Associate of any restriction on the Use or Disclosure of Protected Health
Information that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such
restriction may affect Business Associate’s Use or Disclosure of Protected Health Information.

5.4

Covered Entity shall use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to
electronic Protected Health Information that it may access from Business Associate’s system, and to ensure that the
Use or Disclosure of such Protected Health Information comply with the HIPAA Rules. Business Associate shall not be
responsible for enforcing such Covered Entity-developed safeguards.

5.5

Covered Entity shall ensure that the data it transmits, or direct another entity to transmit, to Business Associate, is
timely, complete, and accurate, and will not cause a Security Incident or commit a Breach.

5.6

If applicable to the services performed by Business Associate, Covered Entity may disclose to Business Associate, and
Business Associate may use, certain patient identifying information regarding the treatment, diagnosis and/or referral
for treatment of substance use disorder (“Patient Identifying Information”). The parties acknowledge and agree that
Patient Identifying Information is subject to additional protections and safeguards pursuant to 42 CFR Part 2, which

General Terms and Conditions (v 20260226) - Confidential

Page 37 of 42

information is a subset of PHI. Business Associate agrees, upon receipt of any Patient Identifying Information and a
copy of the patient’s consent, to comply with all applicable provisions of the Part 2 Regulations. Without limitation,
Business Associate agrees to (i) use such information in accordance with the patient’s consent; (ii) use such information
solely to carry out payment and/or health care operations activities on behalf of Covered Entity; and (iii) not disclose
(or re-disclose) any Patient Identifying Information to a third party, unless such third party is a contracted agent of
Business Associate and has agreed to only further disclose the information back to Business Associate or Covered
Entity or as otherwise permitted by Applicable Law;
5.7

6

To the extent Covered Entity releases or transmits Patient Identifying Information to Business Associate, it agrees to
comply with the requirements of the 42 CFR Part 2 with respect to all Patient Identifying Information it transmits, or
instructs another party to transmit, including 1) not transmitting any Patient Identifying Information without having first
obtained the patient consent required by 42 C.F.R. § 2.31, 2) not transmitting any Patient Identifying Information without
including the notice required by 42 C.F.R. § 2.32 and a copy of the consent for each individual whose Patient Identifying
Information is being transmitted, 3) transmitting all Part 2 Information to Business Associate in an agreed upon file
format, and 4) notifying Business Associate of any revocation of the patient’s consent to disclose.
Permissible Requests by Covered Entity.
Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner
that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity, except for data
aggregation or management and administration and legal responsibilities of Business Associate in accordance with the
Agreement.

7

Term and Termination.

7.1

Term. The Term of this BAA shall be effective no later than the effective date of the Agreement (“Effective Date”) and,
except as provided in section 7.3, shall terminate coincident with the termination of the Agreement, or on the date
Covered Entity terminates for cause as authorized in section 7.2, whichever is sooner.

7.2

Termination for Cause. Business Associate authorizes the termination of this BAA by Covered Entity, if Covered Entity
determines Business Associate has violated a material term of this BAA and Business Associate has not cured the
Breach or ended the violation within the time specified by Covered Entity.

7.3

Obligations of Business Associate upon Termination. Upon termination of this BAA for any reason, Business Associate,
with respect to Protected Health Information received from Covered Entity, or created, maintained, or received by
Business Associate on behalf of Covered Entity, shall:

7.4
8

(a)

Retain only that Protected Health Information which is necessary for Business Associate to continue its proper
management and administration or to carry out its legal responsibilities;

(b)

Destroy physical embodiment or delete electronic embodiment of the remaining Protected Health Information
that the Business Associate still maintains in any form;

(c)

Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to
electronic Protected Health Information to prevent use or disclosure of the Protected Health Information, other
than as provided for in this Section, for as long as Business Associate retains the Protected Health Information;

(d)

Not use or disclose the Protected Health Information retained by Business Associate other than for the
purposes for which such Protected Health Information was retained and subject to the same conditions set
out in sections 3.1(e) and 3.1(f) above which applied prior to termination; and

(e)

Destroy or delete the Protected Health Information retained by Business Associate when it is no longer needed
by Business Associate for its proper management and administration or to carry out its legal responsibilities.
Data on backups will be destroyed through attrition.

Survival. The obligations of Business Associate under this Section will survive termination of the BAA or the Agreement.
Miscellaneous.

8.1

Amendment. The Parties agree to take such action as is necessary to amend this BAA from time to time as is necessary
for compliance with the requirements of the HIPAA Rules and any other applicable law.

8.2

Interpretation. Any ambiguity in this BAA shall be interpreted to permit compliance with the HIPAA Rules.

8.3

No Third Party Beneficiary Rights. This BAA is between Covered Entity and Business Associate and shall not be
construed, interpreted, or deemed to confer any rights whatsoever to any third party or parties.

8.4

Indemnification. The Parties agree that if the Agreement provides for indemnification under specified terms and
conditions, then such indemnification shall extend to the same terms and conditions with reference to the duties and
obligations set forth in this BAA.

8.5

Notices. The contact information provided in the Agreement shall be used for any notices under this BAA.

General Terms and Conditions (v 20260226) - Confidential

Page 38 of 42

Rider

Luum Services
This Rider sets forth the following terms and conditions that are incorporated into the Agreement to which they are attached for
the provision of Luum commuter services. This Rider is entered into between Employer (as defined in the Agreement) and Fort
Effect Corp, dba Luum (“Luum”). The terms and conditions in this Rider do not replace any of the terms and conditions contained
in the Agreement, but in the event of a conflict between this Rider and the Agreement, this Rider shall control with respect to
Employer and Luum and the Luum commuter services provided herein. This Rider shall form a separate agreement, between
Luum and Employer, incorporating the general terms and conditions of the Agreement.

1.

Employer has selected either Luum Complete or Luum Core Services, as specified on the Order Form, and as generally
listed below in this Section 1:
Luum Complete:
�
�
�
�
�
�
�
�
�
�
�
�

Communication Tools
Commute Logging
Gamification & Rewards
Pre-Tax Commuter Cards
Ride Matching
Guaranteed Ride Home
Real-Time Parking Availability
Transit Card Administration
Parking Charges
Parking Reservations
Expense Reimbursements
Commute Bonus

Luum Core:
�
�
�
�
�
�
�
�
�
2.

Communication Tools
Commute Logging
Gamification & Rewards
Pre-Tax Commuter Cards
Ride Matching
Guaranteed Ride Home
Real-Time Parking Availability
Transit Card Administration
Parking Application and Waitlist

Services.
2.1. Provision of Commute Hub. Luum will host the Employer private instance of the Luum Commute Hub (the “Commute
Hub”) and provide the implementation services in connection with Employer’s transit and/or parking plan(s) (collectively,
the ”Services”), as described in the applicable Ordering Documents. The Commute Hub is provided on a subscription
basis for a set term designated in the applicable Ordering Document. Services exclude Non-Luum Applications. The
Agreement permits the Parties to enter into order forms referencing the Agreement and this Rider (“Ordering
Document(s)”), which set forth the Luum Services ordered by Employer, specify the fees payable by Customer and may
contain other terms and conditions as mutually agreed upon by the Parties.
2.2. Access to Commute Hub. Subject to the terms and conditions of the Agreement and any applicable Ordering
Document, Luum hereby grants to Employer a non-exclusive, non-transferable right during the Initial Term (as defined
below) and any subsequent renewal terms (collectively, the “Subscription Term” for purposes of this Rider) to access

General Terms and Conditions (v 20260226) - Confidential

Page 39 of 42

and use the Commute Hub solely for Employer’s business purposes and pursuant to the Documentation and any
restrictions designated in the applicable Ordering Document. "Documentation" means all generally available
documentation relating to the Commute Hub and the Services, including all user guides, operating manuals and other
instructions, specifications, documents and materials, in any form or media, that describe any component, feature,
requirement or other aspect of the Commute Hub or the Services.
2.3. Eligible Users. Employer will provide and update during the Subscription Term a file (the ”Roster Feed”).containing
all of the eligible users of the Commute Hub (each eligible user, with the administrative user(s), the “Eligible Users”).
The Eligible Users will access the Commute Hub via their corporate single-sign-on or username and password. These
credentials are granted to individual, named persons and may not be shared. Employer will ensure that all Eligible
Users keep these credentials strictly confidential. Employer is responsible for any and all actions taken by Eligible
Users or by anyone using Employer’s accounts and passwords, and will require that Eligible Users complete any
applicable commuter elections prior to the election deadline in the relevant election system. Subject to the terms and
conditions of this Agreement, in addition to Employer’s employees, Employer may permit (a) its independent contractors
and consultants who are not competitors of Luum and (b) employees, independent contractors and consultants of any
(i) Employer Affiliate or (ii) vendor, service provider, or customer of Employer, to serve as Eligible Users. Employer will
remain responsible for compliance by each of its Eligible Users with all of the terms and conditions of this Agreement,
and any use of the Commute Hub by Eligible Users must be for the sole benefit of Employer. Use of the Commute Hub
by all Eligible Users in the aggregate must be within the restrictions in the applicable Ordering Document. “Affiliate”
means each legal entity that is directly or indirectly controlled by Employer on or after the Effective Date, for so long as
such entity remains directly or indirectly controlled by Employer (where “controlled” means the ownership of, or the
power to vote, directly or indirectly, a majority of any class of voting securities of a corporation or limited liability
company, or the ownership of any general partnership interest in any general or limited partnership).
2.4. Third-Party Code. The software incorporated in the Commute Hub may contain or be provided with components which
are licensed from third parties, including components subject to the terms and conditions of “open source” software
licenses (“Open Source Software”). Open Source Software may be identified in the Documentation, or in a list of the
Open Source Software provided to Employer upon written request. To the extent required by the license that
accompanies the Open Source Software, the terms of such license will apply in lieu of the terms of this Agreement with
respect to such Open Source Software, including, without limitation, any provisions governing access to source code,
modification or reverse engineering.
2.5. General Restrictions. Employer shall not: (a) rent, lease, copy, sell, provide access to or sublicense the Commute
Hub to a third party, (b) reverse engineer, decompile, disassemble, or otherwise seek to obtain the source code or APIs
to the Commute Hub, except to the extent expressly permitted by applicable law (and then only upon advance notice
to Luum), (c) modify the Commute Hub or any Documentation, or create any derivative product from any of the
foregoing, (d) remove or obscure any product identification, proprietary, copyright or other notices contained in the
Commute Hub (including any reports or data printed via the use of the Commute Hub), (e) incorporate the Commute
Hub into any other offering (whether software as a service or otherwise), (f) use the Commute Hub to develop a product
which is competitive with any Luum product offering or (g) publicly disseminate information or analysis regarding the
performance of the Commute Hub. Except as may be expressly agreed by Luum in an applicable Ordering Document,
the Commute Hub is only intended for use with persons residing within the United States.
2.6. Employer Responsibilities. Employer will (a) be responsible for Eligible Users’ compliance with this Agreement,
Documentation and Ordering Documents, including supplemental terms of use of any tools, features or services
provided through Commute Hub, (b) be responsible for the accuracy, quality and legality of Employer Data, as defined
below, the means by which Employer acquired Employer Data, Employer’s use of Employer Data with the Services,
and the interoperation of any Non-Luum Applications with which Employer uses Services, (c) use commercially
reasonable efforts to prevent unauthorized access to or use of Services, and notify Luum promptly of any such
unauthorized access or use, (d) use Services only in accordance with this Agreement, Documentation, Ordering
Documents and applicable Laws, and (e) comply with terms of service of any Non-Luum Applications with which
Employer uses Services. Any use of the Services in breach of the foregoing by Employer or Eligible Users that in
Luum’s judgment threatens the security, integrity or availability of Luum’s services, may result in Luum’s immediate
suspension of the Services, however Luum will use commercially reasonable efforts under the circumstances to provide
Employer with notice and an opportunity to remedy such violation or threat prior to any such suspension. For purposes
of this Rider, “Employer Data” means any business information or other data which Employer or an Eligible User inputs,
or provides to Luum for inputting, into the Commute Hub.
2.7. Changes. Luum reserves the right, in its sole discretion, to make any changes to the Commute Hub and
Documentation that it deems necessary or useful to: (a) maintain or enhance the quality or delivery of Luum's services
to its customers or performance; or (b) to comply with applicable laws and regulations; provided, however, Luum
changes to the Commute Hub will not result in a material reduction in the level of performance or availability of the
applicable Services provided to Employer for the duration of the term of any applicable Ordering Document.
2.8. Project Managers and Personnel. Employer will identify a project manager in each Ordering Document to facilitate
and coordinate the Commute Hub implementation and any additional Services to be provided under such Ordering
Document.
3.

Non-Luum Products and Services.

General Terms and Conditions (v 20260226) - Confidential

Page 40 of 42

3.1. Non-Luum Products and Services. Luum or third parties may make available third-party products or services,
including, for example, Non-Luum Applications or virtual or physical charge cards. Any acquisition by Employer of such
products or services, and any exchange of data between Employer and any Non-Luum provider, product or service is
solely between Employer and the applicable Non-Luum provider. Luum does not warrant or support Non-Luum
Applications or other Non-Luum products or services, whether or not they are designated by Luum as “certified” or
otherwise, unless expressly provided otherwise in an Order Form. Luum is not responsible for any disclosure,
modification or deletion of Employer Data resulting from access by such Non-Luum Application or its provider. A “NonLuum Application” means a web-based, mobile, offline or other software application functionality that interoperates
with Luum Service, that is provided by Employer or a third party.
3.2. Integration with Non-Luum Applications. The Services may contain features designed to interoperate with NonLuum Applications. Luum cannot guarantee the continued availability of such Service features, and may cease
providing them without entitling Employer to any refund, credit, or other compensation, if for example and without
limitation, the provider of a Non-Luum Application ceases to make the Non-Luum Application available for interoperation
with the corresponding Service features in a manner acceptable to Luum.
4.

Ownership.
4.1. Luum Technology. This is a subscription agreement for use of Commute Hub and not an agreement for sale. Employer
acknowledges that it is obtaining only a limited right to use the Commute Hub on a hosted basis and that irrespective
of any use of the words “purchase”, “sale” or like terms hereunder no ownership rights are being conveyed to Employer.
Employer agrees that Luum or its suppliers retain all right, title and interest (including all patent, copyright, trade secret
and other intellectual property rights) in and to Commute Hub, the Documentation, any other Luum deliverables and
any and all related and underlying software (including interfaces), databases (including data models, structures,
Aggregated Anonymous Data and any other non-Employer specific data and statistical data), technology, reports and
documentation and all copies, modifications and derivative works thereof (including any changes which incorporate any
Feedback) (collectively, “Luum Technology”). Further, Employer acknowledges that Commute Hub is offered as an
online, hosted solution, and that Employer has no right to obtain a copy of the Commute Hub code itself. Nothing in
this Section 4.1 shall be deemed as granting Luum ownership of Employer Data or in any way impacting Employer’s
ownership of Employer Data.
4.2. Feedback. Employer, from time to time, may submit comments, information, questions, data, ideas, descriptions of
processes, or other information to Luum (“Feedback”). Luum may in connection with any of its products or services
freely use, copy, disclose, license, distribute and exploit any Feedback in any manner without any obligation, royalty or
restriction based on intellectual property rights or otherwise, provided Employer shall not be identified in connection
with any such Feedback without Employer’s consent in its sole discretion.

5.

Fees.

Employer agrees to pay the fees set forth below as well as those set forth in the Order Form. Luum (or its designee) will invoice
Employer directly on a monthly basis.
Any program customizations (e.g., eligibility file, payroll file, communications) requested by Employer will be considered and
quoted on a case-by-case basis.
5.1. The setup fee is invoiced at time of Agreement execution.
5.2. The Luum Complete Subscription Fees commence on the earlier of (i) configuration of the Commute Hub or (ii) 60 days
following Agreement execution.
5.3. An Engaged User is an eligible user that does any of the following during a particular contract month:

6.

•

Has a session in Luum’s web or mobile app;

•

Has a transit card, parking permit, commuter prepaid card or other service managed by Luum;

•

Receives a commuter bonus, expense reimbursement or a parking charge managed by Luum; or

•

Whose commute trip data through third-party integrations (e.g., parking data, connected account, shuttle data
services, etc.) is transferred to Luum.

Escheatment. To the extent applicable, Luum will return unassociatable or unused funds related to plan or program
services to Employer who shall be responsible for compliance with escheatment obligations (if any). If Employer is not
able to, or declines to, accept returned funds, then Employer agrees that Luum will be entitled to the funds as part of its
overall compensation for services. If Luum is not able to locate Employer, then Luum (the holder) will comply with

General Terms and Conditions (v 20260226) - Confidential

Page 41 of 42

applicable state unclaimed property laws regarding the funds, which may require Luum to escheat funds in the name of
Employer (the owner) to the relevant state.
7.

Term and Termination.
7.1. Term. The term of this Rider shall begin on the Order Form Effective Date and continue through and including the
Order Form Term (the “Initial Term”). This Rider will thereafter automatically renew for additional 12-month terms
unless either Party has terminated this Rider in accordance with Section 7.2.
7.2. Termination for convenience. Following the Initial Term, either Party may terminate this Rider at any time, subject to
providing 90 days' prior written notice.

General Terms and Conditions (v 20260226) - Confidential

Page 42 of 42

On motion of Commissioner ______, seconded by Commissioner _______, it was agreed
for the County of Lancaster, acting on behalf of the Purchasing Department, to correct the total
amount of the Water, Pool and Sewage Treatment Contract awards that were approved on
March 25, 2026 from $5,403,187.23 to $5,414,638.59.

4/1/26

On motion of Commissioner ______, seconded by Commissioner ______, it was agreed
for the County of Lancaster, acting on behalf of General Services, to approve the following:

4/1/26

Amended Agreement With:

RETTEW
Lancaster, PA

Purpose:

To approve Addendum #2 for the finalization of the
design documents for the Buchmiller Park parking
lot expansion, bathroom replacement, playground
replacement and public sewer connection.

Original Amount:

$88,500.00

Addendum #1: (8/27/2025)

$10,500.00

Addendum #2:

$32,500.00

Final Contract:

$131,500.00

Funding:

Buchmiller Park Capital Reserve Funds.

We answer to you.
3020 Columbia Avenue, Lancaster, PA 17603● Phone: (800) 738-8395
E-mail: [email protected] ● Web site: rettew.com

PROJECT CHANGE ORDER/ADDENDUM
DATE:

Revised March 6, 2026

PROJECT NAME:

Buchmiller Park
Mr. Carmen Simone, Deputy Director
WORK/CHANGE
General Services
REQUESTED BY:
County of Lancaster
WORK/CHANGE REQUESTED:
A.

PROJECT #:

038302060A

ADDENDUM #:

2

WORK/CHANGE
RECEIVED BY:

David Miller, PE
RETTEW Associates, Inc.

STORMWATER MANAGEMENT PLANS (PHASE 730) (BUMP-UP)
RETTEW will:
1.
Update the stormwater management design, plans, report, and applications, changing from an MRC basin
to an infiltration basin based on LCCD comments and results of the additional infiltration testing.
Total Proposed Bump Up for Phase 730 (Time & Expense)....................................................................... $16,000.00

B.

PLAN REVIEW COMMENTS AND REVISIONS (PHASE 710) (BUMP-UP)
To include the playground area in the project, RETTEW will:
1.
Update plans conceptually to include the playground area; update the probable cost opinion for the
County’s use in its grant application.
2.
Field-survey the perimeter of the playground, and the sidewalk leading to it. Review the sidewalk grades
for ADA compliance.
3.
Update the Stormwater Management Plans and Erosion & Sediment Control Plans to include the
playground area. Update stormwater management calculations and report.
4.
Update the NPDES and E&S applications and documents.
5.
Submit revised plans to West Lampeter Township and Lancaster County Conservation District.
6.
The fee bump-up includes a budgetary figure to address future agency comments.
Total Proposed Bump Up for Phase 710 (Time & Expense)....................................................................... $16,500.00
Assumptions:
1.
The new playground footprint will match the existing footprint.
2.
The additional earth disturbance will not require detention basin re-design.
3.
Additional survey is not required, other than as noted.
4.
Selection and design of playground equipment is not included.
5.
Application fees will be paid by the County.

Page 2 of 2
Addendum #2
Revised March 6, 2026
RETTEW Project No. 038302060A

$32,500.00 T&E

TOTAL FOR THIS ADDENDUM:
ORIGINAL AGREEMENT AMOUNT
DATED: April 19, 2024

$88,500.00 LS/T&E

TOTAL OF PREVIOUS ADDENDUM(A):

$10,500.00 LS/T&E

AMENDED AGREEMENT AMOUNT:

$131,500.00 LS/T&E

If this addendum is satisfactory and acceptable and fully sets forth all the items of our understanding, please signify your
acceptance by signing below. Please return a fully executed copy and retain a copy for your records. This document will
then constitute our completed agreement.
This addendum will be subject to all the terms and conditions of our previous proposal and agreement dated 4/19/24.
BY:

BY:
(CLIENT SIGNATURE)

(RETTEW SIGNATURE)

Lawrence M. George

David D. Miller, PE

(PRINTED NAME)

(PRINTED NAME)

TITLE:

TITLE:

Team Lead, Land Development

DATE:

March 6, 2026
DATE:

Z:\Shared\Projects\03830\038302060A - Buchmiller Park Design\00 Contracts\02 Addenda\Add 02\Addendum 02.docx