5.1 Indemnification by Us. We will defend You against any claim, demand, suit or proceeding made or brought against You by a third party alleging that the use of the Services in accordance with this Agreement infringes or misappropriates such third party’s intellectual property rights (a “Claim Against You”), and will indemnify You from any damages, attorney fees and costs finally awarded against You as a result of a Claim Against You, provided You (a) promptly give Us written notice of the Claim Against You, (b) give Us sole control of the defense and settlement of the Claim Against You, and (c) give Us all reasonable assistance, at Our expense. The above defense and indemnification obligations do not apply to the extent a Claim Against You arises from Your use of the Services in a manner contrary to the instructions given to You by Us, or Your breach of this Agreement. In addition, Imbio shall not be responsible for any compromise or settlement made without its written consent. THE FOREGOING STATES THE ENTIRE LIABILITY OF IMBIO FOR INFRINGEMENT AND SHALL BE CUSTOMER’S SOLE AND EXCLUSIVE REMEDY AND IMBIO’S SOLE OBLIGATOIN AND LIABILITY FOR ANY ALLEGED INFRINGEMENT.

5.2 Indemnification by You. Except as is specified in Section 5.1, You will defend us and hold us harmless against any claim, demand, suit or proceeding made or brought against us by a third party resulting from Your use of the Services under the terms of this Agreement, including indemnifying us against any damages, costs or attorney fees as a result of any such claim.

5.3 Limitation of Liability. IMBIO ACCEPTS NO LIABILITY WITH RESPECT TO ANY INCIDENT ARISING OUT OF OR RELATED TO THIS AGREEMENT EXCEPT FOR LIABILITY ARISING DIRECTLY FROM INFRINGEMENT OR MISAPPROPRIATION OF A THIRD PARTY’S INTELLECTUAL PROPERTY RIGHTS BY IMBIO.

5.4 Exclusion of Consequential and Related Damages. IN NO EVENT WILL EITHER PARTY HAVE ANY LIABILITY TO THE OTHER PARTY FOR ANY LOST PROFITS, REVENUES OR INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, COVER OR PUNITIVE DAMAGES. THIS DISCLAIMER WILL NOT APPLY TO THE EXTENT PROHIBITED BY LAW.

Business Associate agrees to:
(a) Not use or disclose protected health information other than as permitted or required by this Agreement or by law;
(b) Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by the Agreement;
(c) Report to Covered Entity any use or disclosure of protected health information not provided for by the Agreement of which it becomes aware, including breaches of unsecured protected health information as required at 45 CFR 164.410, and any security incident of which it becomes aware within seventy-two (72) hours. Covered Entity shall be responsible for any required notifications to individuals, regulatory bodies or government agencies as required by law on behalf of Covered Entity;
(d) In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information;
(e) Make available protected health information in a designated record set to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.524. Should Business Associate receive a request for protected health information from any individual, Business Associate shall forward such request to Covered Entity, and Covered Entity shall, in its sole discretion fulfill such requests as required by applicable law and regulations;
(f) Make any amendment(s) to protected health information in a designated record set as directed or agreed to by the Covered Entity pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.526;
(g) Maintain and make available the information required to provide an accounting of disclosures to the Covered Entity” as necessary to satisfy Covered Entity’s obligations under 45 CFR 164.528. Should Business Associate receive a request for an accounting of disclosures from any individual, Business Associate shall forward such request to Covered Entity, and Covered Entity shall, in its sole discretion fulfill such requests as required by applicable law and regulations;
(h) To the extent the Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s); and
(i) Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.