Elaborate

As a trusted partner to healthcare organizations, we commit to the following security and privacy best practices : 1. Have a named individual responsible for information security 2. Maintain a documented information security training and awareness program 3. Have controls to prevent and/or detect malware in a timely manner 4. Have documented policies and procedures to ensure that information security is maintained 5. Implement effective encryption to protect confidential data in transit and at rest 6. Establish segregation of data and systems to limit access to sensitive and confidential data 7. Have a policy on account management to ensure appropriate access is granted 8. Secure mobile and portable devices with encryption and passwords 9. Require multifactor authentication (MFA) for remote access to systems 10. Require passwords are stored in a secure manner - hashed or encrypted 11. Implement controls to prevent the use of weak or insecure passwords 12. Address system vulnerabilities in a timely manner 13. Have policies and controls to address our use of mobile storage devices 14. Have policies and controls to address our use of cloud and hosting services 15. Have a defined policy and procedure for event and incident management 16. Have systems in place to detect system intrusion or data breach 17. Implement controls to physically secure systems and access to data We offer all prospective clients our security and privacy documentation, including our latest SOC2 Type2 report, upon request.

Your connection is encrypted with 256-bit encryption. The connection uses TLS 1.2. The connection is encrypted using AES\_256\_CBC, with SHA256 for message authentication and ECDHE\_RSA as the key exchange mechanism. The connection supports three encryption algorithms (RSA, DSA, and ECC) within the same SSL certificate. Our system is assessed for vulnerability and daily website malware scanning.

Elaborate is committed to complying with all applicable federal and state laws relating to Personal Health Information. Elaborate complies with all the rules outlined by Health Insurance Portability and Accountability Act (HIPAA), which prohibits unauthorized access to Protected Health Information (PHI). Elaborate uses patients' Personal Health Information to administer your Elaborate account and to improve the overall quality of the Elaborate algorithm. We may use de-identified data (sometimes called “anonymous data”) for research purposes. De-identified information is information that does not identify any persons and with respect to which there is no reasonable basis to believe that the information could be used to identify an individual. Because this information is anonymous, it is not protected under HIPAA and may be used without consent. Elaborate reserves the right to use, disclose and retain de-identified information without any restriction and in perpetuity. Elaborate will never share Personal Health Information. If you know of or suspect any violation of security, please send an email to sos@elaborate.com.

Sometimes, problems arise. When they do, your team can count on us to be there for you! Our team will respond to service-related incidents and requests within the following time frames. If you experience any issues with our service, we ask that you submit service requests with the priority level specified to your account manager (or implementation manager) and cc: [sos@elaborate.com](mailto:sos@elaborate.com). Our team will make all efforts to resolve all requests promptly, but cannot guarantee a time to resolution due to the inherent variability in effort and corresponding time required to resolve issues. However, rest assured we will communicate resolution efforts with you and keep you apprised of our progress. ###### Severe ###### Solution is unavailable or a substantial subset of platform functionality is unavailable without a workaround, security issues, or data integrity issues. *Response Time: 4 hours, 24x7x365* ###### High ###### Intermittent issues with Solution performance, and issues with available workarounds. *Response Time: 48 hours, 24x7x365* ###### Medium ###### Any other bugs and issues that are not considered Severe and High. *Response Time: 10 business days* ###### Low ###### Enhancements and tech questions. *Response Time: 30 business days*