Data Rights Agreement - Healtheon/WebMD Corp. and Quintiles Transnational Corp.
DATA RIGHTS AGREEMENT THIS DATA RIGHTS AGREEMENT (the "AGREEMENT") is made and entered into as of May 26, 2000 by and between HEALTHEON/WEBMD CORPORATION, a Delaware corporation ("HEALTHEON"), and QUINTILES TRANSNATIONAL CORP., a North Carolina corporation ("QUINTILES"). References in this Agreement to "schedules" refer to the documents attached as schedules to this Agreement, all of which form part of this Agreement; and unless otherwise indicated, references to "articles" or "sections" refer to the corresponding numbered articles and sections of this Agreement. As used in the body of this Agreement, the term "Healtheon" shall be deemed to include Healtheon and all of its Affiliates (as defined in Article I below). BACKGROUND (a) Quintiles provides product development and commercialization solutions, healthcare informatics services, and healthcare policy consulting to the healthcare industry worldwide. (b) Healtheon is applying advanced Internet technology to enable healthcare providers and consumers to interact with each other and the institutions of healthcare online. (c) Healtheon and Quintiles are parties to an Agreement and Plan of Merger dated as of January 22, 2000 (the "MERGER AGREEMENT") pursuant to which they have agreed, among other things, for Quintiles' wholly owned subsidiary Envoy Corporation ("Envoy") to become a wholly owned subsidiary of Healtheon by merger (the "ENVOY MERGER"). (d) As a principal component of the transactions surrounding the Merger Agreement, Quintiles desires to secure the right and license from Healtheon, effective upon consummation of the Envoy Merger, to develop and commercialize Data Products based on data available to Healtheon by virtue of Healtheon's Transaction Business (including without limitation that acquired through Envoy) and other healthcare businesses, all as provided below. NOW, THEREFORE, in consideration of their respective agreements set forth in this Agreement and of other good and valuable consideration, the receipt and legal sufficiency of which they acknowledge, and intending to be legally bound, Healtheon and Quintiles agree as follows: ARTICLE I DEFINITIONS As used in this Agreement, the following capitalized terms shall have the respective meanings set forth below: <PAGE> 3 (a) "ACCESS SPECIFICATIONS" means the schedule, method, medium, format, structure, organization, archival, mapping, and other logistical, technical, legal, and other parameters by which Healtheon will provide Quintiles electronic access to and copies of the Licensed Data. The Access Specifications will be determined by the parties and may be modified from time to time pursuant to Section 2.2(a). (b) "AFFILIATE" of a Person means a Person controlling, controlled by or under common control with such Person at any time as of or after the date of this Agreement and, with respect to Healtheon, shall include WebMD International, LLC, Healtheon's international joint venture with an affiliate of The News Corporation Limited. (c) "CONFIDENTIAL INFORMATION" means and includes all information disclosed under this Agreement by either party to the other (subject to the exceptions defined below), including without limitation all business and product plans, marketing information, and other business information so disclosed; provided, however, that the Licensed Data shall constitute Confidential Information of Healtheon except as and to the extent reflected in Data Products commercialized by Quintiles under authority of this Agreement. Notwithstanding the foregoing, the following shall not constitute Confidential Information: information which (1) is known by the receiving party prior to disclosure by the disclosing party; (2) is or becomes available publicly other than as a result of a breach of this Agreement; (3) is developed independently by the receiving party without the use of or reliance on the disclosing party's Confidential Information; or (4) is provided to the receiving party by a third party under no duty of confidentiality to the disclosing party. (d) "DATA PRODUCT" means any product created for the purpose of sale or licensing to one or more third Persons which is based on the selective or strategic extraction, compilation, assimilation, manipulation, analysis, and/or presentation of aggregate De-Identified Data of the type that comprises the Licensed Data, with a view toward creation of a derivative compilation of data (or analytical conclusions thereon) having commercial utility. The term Data Product also shall include the sale or licensing of Licensed Data in a raw format data feed or any other form. (e) "DE-IDENTIFICATION" means the process of removing, coding, encrypting or otherwise eliminating or concealing the data elements that makes Licensed Data individually identifiable to a particular patient or consumer, and includes the removal or concealing of any data elements specifically required by Law or contractual obligation to be removed or concealed to make Licensed Data not individually identifiable as to the patient or consumer or other elements of the Licensed Data that are required by law to be de-identified. (f) "DE-IDENTIFIED DATA" means Licensed Data that has been through the De-Identification process. For the avoidance of doubt, De-Identified Data only de-identifies data elements that make the Licensed Data individually identifiable to a particular patient or consumer (unless other elements of the Licensed Data are required by Law to be de-identified), and those data elements (other than patient or consumer identifying data) of the Licensed Data that are not required to be de-identified constitute De-Identified Data notwithstanding their identifiable format. By way of example, and without limitation, specific identifiable data such as the names of specific pharmacies, physicians, hospitals and payors constitute De-Identified Data once the corresponding Licensed Data has been through the De-Identification process, provided that such items are not 2 <PAGE> 4 required by Law to be de-identified. Licensed Data will also be considered De-Identified Data for purposes of this Agreement if the particular data set does not contain patient or consumer identifying data or any data elements that require de-identification pursuant to applicable Law and, accordingly, such data set does not go through the De-Identification process. (g) "EFFECTIVE TIME" means the effective time of the Envoy Merger, determined according to the Merger Agreement. (h) "FIELD OF USE" means on a worldwide basis the development of Data Products based on or including Licensed Data and commercialization or delivery of such Data Products to (1) the pharmaceutical industry, including without limitation pharmaceutical, biotechnology, genomics, and other companies in the business of research, development, production, manufacturing, marketing, sale, distribution, or other commercialization of pharmaceutical products or medical devices, as well as to foundations, government agencies, universities, private individuals, or others engaged in research regarding drug efficacy, epidemiology, disease control, diagnostic patterns, and similar areas of inquiry that in each case are related to pharmaceutical use and medical outcomes, and (2) physicians, patients, hospitals, health maintenance organizations, governmental entities, and other healthcare consumers, providers, pharmacies, and payors. (i) "LAW" means any United States federal, state, local or foreign law, statute, regulation, ordinance, order, judgment, decree, rule or other applicable governmental or judicial restriction or requirement, and any judicial or administrative interpretation or determination with respect thereto. (j) "LICENSED DATA" means all of the following transmitted to, from, or through or otherwise received, possessed or controlled from time to time by or for the benefit of Healtheon to the extent Healtheon is not prohibited by applicable Law or contractual arrangement from providing such data to Quintiles under this Agreement, regardless of the medium of or circumstances giving rise to transmission: (1) Transaction Data and (2) other data concerning (A) the health, medical condition, or treatment of actual, specific people, (B) the behavior of actual, specific people intended to treat, maintain, or otherwise influence their health or medical conditions, or (C) the providing of health care or reimbursement or payment therefor with respect to actual, specific physicians, hospitals, health maintenance organizations, governmental entities, and other providers, pharmacies, and payors. (k) "PERSON" means any person or entity. (l) "STEERING COMMITTEE" means the oversight committee formed pursuant to Section 7.1. (m) "TRANSACTION BUSINESS" refers to the business of processing or facilitating the processing of transactions, of the following type: reimbursement, indemnity, or payment or other related claims or encounters by and among physicians, hospitals, health maintenance organizations, governmental entities, and other providers, pharmacies, and payors, as well as eligibility, adjudication, referrals, formulary checks, and similar transactions, irrespective of the manner, mode, communications method or platform through which such business is conducted from time to time, and giving effect to evolutionary or other developments in the scope of and manner in which such 3 <PAGE> 5 business generally is conducted going forward. Without limiting the foregoing, the term "Transaction Business" includes the business conducted as of the date of this Agreement (and evolutions thereof) by Envoy and by Healtheon's Affiliate MedeAmerica, Inc. (n) "TRANSACTION BUSINESS SERVICE AGREEMENT" means an agreement to render Transaction Business services for a customer. (o) "TRANSACTION DATA" means all data transmitted to, from, or through or otherwise received or possessed by or for the benefit of Healtheon from transactions processed or facilitated in the conduct of its Transaction Business. ARTICLE II DATA PRODUCTS 2.1 LICENSE. (a) Grant. Subject to the terms and conditions of this Agreement, Healtheon hereby grants Quintiles, effective as of the Effective Time, an irrevocable, perpetual, worldwide right and license to use the Licensed Data (after its De-Identification according to Section 2.2(a)(2)) to develop, license, sell, and otherwise commercialize Data Products, and in connection therewith to receive, collect, possess, process, combine, analyze, and transfer the Licensed Data to third parties. This license includes the right to sublicense, subject to Section 7.9 below. (b) Exclusivity. Subject to Section 2.1(d) below, Healtheon shall not (i) grant any right or license, whether exclusive or non-exclusive, to any Person to use the Licensed Data in the Field of Use, or (ii) engage directly or indirectly in the development or commercialization of Data Products in the Field of Use based on or including as a component thereof the Licensed Data. Nothing in this Agreement shall preclude Healtheon from using or analyzing Licensed Data solely for its internal purposes or for the development or marketing of products or services that do not themselves constitute Data Products. Nothing in this Agreement shall preclude Healtheon from providing to those Persons from whom Healtheon has acquired Licensed Data (or the Persons in the same transaction chain) the same Licensed Data that was acquired from such Persons, which may be processed, compiled or analyzed, but which shall not be aggregated with the Licensed Data acquired from any other Person. (c) Exclusivity and Royalty Dispute; Future Use of Licensed Data. The parties acknowledge and agree that there will be ambiguities concerning whether certain activities constitute Data Products or produce Gross Product Revenue or Operating Income from the sale or licensing of Data Products. Such ambiguities shall be resolved in good faith pursuant to the dispute resolution process set forth in Article V. If trends in the data product industry move toward a more significant use of patient or consumer identifiable data in informatics and other data products, Quintiles may request the Steering Committee to expand the definition of Data Products to include such patient or consumer identifiable data products. (d) Healtheon Affiliates. Healtheon and Quintiles acknowledge that Healtheon's Affiliates have or will have access to Licensed Data, and that Healtheon and Quintiles intend for all such Affiliates of Healtheon to be subject to and bound by this Agreement. In that regard, Healtheon 4 <PAGE> 6 agrees (1) that Healtheon's representations, warranties, and covenants made under this Agreement shall be deemed also to include Healtheon Affiliates; and (2) to cause each Affiliate to comply with Healtheon's obligations under this Agreement as if parties hereto with obligations coextensive with Healtheon's. (e) Limited Exceptions to Restrictive Covenant. At its election, at any time three years after the Effective Date and from time to time thereafter, Healtheon may propose Data Products for development by Quintiles based on the Licensed Data for internal use or commercialization by Healtheon. If Healtheon makes any such proposal in writing to Quintiles, including certification by Healtheon that Healtheon intends to develop the proposed product immediately if Quintiles elects not to do so, and Quintiles fails within the Notice Period (defined below) to confirm for Healtheon in writing that Quintiles has developed, is developing, or intends to develop a Data Product substantially functionally comparable to that proposed by Healtheon, or if Quintiles does not in fact so develop such a Data Product within one year from the date of Quintiles' confirmation, then in either case Healtheon may develop and commercialize such proposed Data Product (but no other) itself or with a party other than Quintiles, and Quintiles' restrictive covenant in subsection 2.1(b) above shall be deemed thereafter to except such development and commercialization for so long as (but no longer than) Healtheon's development, internal use, or commercialization effort for such Data Product continues. Healtheon agrees and acknowledges that its rights arising in this subsection are not intended to enable broad commercial participation by Healtheon in the Data Products market, but rather to enable Healtheon to pursue its discrete, isolated Data Product needs. When used herein, the term Notice Period shall mean (i) twenty (20) days after actual receipt of Healtheon's written proposal, followed by (ii) to the extent Quintiles does not respond to such notice in writing within the twenty-day period, ten (10) days after a follow-up written notice indicating that Healtheon has not received a response to the initial written proposal. 2.2 ACCESS TO LICENSED DATA. (a) Determination of Access Specifications; Costs. (1) Promptly after execution of this Agreement, the parties will determine the Access Specifications. Each of the parties will cooperate in good faith with the other to modify the Access Specifications thereafter upon request. If the parties are unable to promptly agree on the Access Specifications, or changes thereto from time to time, the matter shall be promptly submitted to the Steering Committee and if it is unable to agree, Quintiles shall have the right to establish or modify the Access Specifications in Quintiles' reasonable discretion, provided that the Access Specifications or changes thereto address Healtheon's reasonable business concerns and delivery of Licensed Data in accordance therewith does not violate applicable Law or contractual obligations, and Quintiles agrees to bear any incremental out-of-pocket expenses related to such changes. (2) The parties acknowledge and agree that the Licensed Data provided to Quintiles will be delivered as De-Identified Data. In this regard, Quintiles and its Affiliates have developed certain computer software useful for De-Identification of data (such software, as it may be modified or replaced through internal or third party development, the "Quintiles De-Identification Software"). Quintiles may require Healtheon to use the Quintiles De-Identification Software during the De-Identification process, provided that the use of such software causes the data as delivered 5 <PAGE> 7 hereunder to comply with applicable Law and contractual obligations. Quintiles will arrange for Healtheon to receive this software and a corresponding license at no charge, along with reasonable related technical support, solely for the purpose of fulfilling Healtheon's obligations under this Agreement. If the Access Specifications require De-Identification through other means, Quintiles shall pay Healtheon's related costs as provided in subsection (3) below. (3) Quintiles and Healtheon acknowledge that Healtheon is not primarily engaged in the business of collecting, preparing, selling or delivering data as contemplated in this Agreement. Accordingly, Quintiles shall pay to Healtheon all reasonable out-of-pocket expenses incurred by Healtheon in conforming the Licensed Data to the Access Specifications and delivering the Licensed Data under this Agreement to the extent such costs would not have been incurred by Healtheon but for this Agreement, including all such costs of satisfying the quality, accuracy and delivery criteria established in this Agreement and the Access Specifications. All such amounts shall be paid within thirty (30) days after invoicing by Healtheon, and all such amounts paid by Quintiles shall be deemed data acquisition costs for purposes of determining Quintiles' royalty obligations in Section 2.3. (b) Access to Licensed Data. (1) Healtheon will provide Quintiles access to and copies of the Licensed Data in compliance and conformity with the Access Specifications at all times as of and after the Effective Time; provided, however, that Healtheon will not be required to provide Licensed Data solely to the extent Healtheon is specifically prohibited from doing so by: (A) any Transaction Business Service Agreement in effect as of the Effective Time (including without limitation any acquired by Healtheon by virtue of the Envoy Merger), provided Healtheon complies with the procedures required by Section 2.4 with respect to securing data use rights in current service agreements; (B) any future Transaction Business Service Agreement (or any amendment to any existing Transaction Business Service Agreement) or any future request by any existing or future Transaction Business client to discontinue use of such client's data, provided Healtheon has complied with the procedures required by Section 2.4 with respect to securing data use rights in future service agreements; or (C) any applicable Law, provided Healtheon has complied with the procedures required by subsection (c) below concerning applicable Laws. For the avoidance of doubt, Healtheon shall not be entitled to withhold Licensed Data except as and to the extent specifically provided in subsections (1)(A) - (C) above or in subsection (d) below concerning defaults in Quintiles' payment obligations. (2) Quintiles and Healtheon agree to interpret the data rights provisions in all Envoy Transaction Business Service Agreements in effect as of the Effective Time in a manner consistent with Envoy's historical interpretation practices absent a breach of the warranty by Quintiles in Section 2.5(b)(2), developments in applicable Law or specific requests or challenges by clients, in which cases Section 2.2(c) or (d) shall apply, respectively. (c) Interruptions to Data Stream Due to Applicable Law. In the event Healtheon reasonably believes that developments to applicable Laws after the date of this Agreement prohibit or limit Healtheon from providing a material amount of data that would otherwise be Licensed Data but for the fact that provision of such data under this Agreement is prohibited by applicable Law, or that Quintiles breached its representation in Section 2.5(b)(2) below with respect to current Law such 6 <PAGE> 8 that provision of data hereunder violates current Law, Healtheon will notify Quintiles immediately in writing of the specific prohibition under applicable Law and the nature of the corresponding prohibition or limitation and cooperate in good faith with Quintiles to develop modifications to the Access Specifications (if appropriate) or take other actions to fulfill the intent of this Agreement without violating any such Law. Immediately upon such notice (or on the date such Law takes effect, if later), Healtheon shall be entitled to suspend providing the Licensed Data to Quintiles under this Agreement solely to the extent that Healtheon believes in good faith that doing so would violate such Law. Healtheon shall resume provision of the suspended Licensed Data within five (5) business days after receiving a reasoned opinion of counsel reasonably satisfactory to Healtheon, addressed to Quintiles and Healtheon, that providing such Licensed Data (in the same or in a modified format) would not be prohibited under applicable Law identified by Healtheon as the basis for suspension, along with a specific undertaking by Quintiles to indemnify Healtheon from and against any and all losses, claims, actions, damages, liabilities, costs, and expenses (including attorneys' fees and expenses) arising from providing such data. In the event the opinion of counsel provides that the Licensed Data must or should be provided in modified form, Healtheon shall, at Quintiles' cost, use its commercially reasonable efforts expeditiously to modify the data accordingly, and the time period by which Healtheon shall resume providing the data shall be extended until such modifications can be made. (d) Limited Remedy for Payment Default. Healtheon shall be excused from providing Licensed Data under this Agreement for any period during which Quintiles is in material default of Quintiles' payment obligations to Healtheon under this Agreement (including obligations to pay costs), provided that Healtheon will not effect any such interruption (1) without giving Quintiles at least thirty (30) days' prior written notice of Healtheon's intent to do so, and (2) if and for so long as Quintiles disputes the alleged default in good faith (as evidenced by written notice to that effect to Healtheon), pays any undisputed amounts to Healtheon, and pays any disputed amounts into escrow. Healtheon will resume providing Licensed Data immediately upon such cure of any such default and the payment of any reasonable related out-of-pocket expenses incurred by Healtheon in connection therewith. Healtheon agrees and acknowledges that the suspension of provision of Covered Data described in this subsection and recovery of amounts due and costs incurred in connection therewith is Healtheon's sole and exclusive remedy for any such payment default by Quintiles, and that no other type of default by Quintiles will entitle Healtheon to withhold Licensed Data (except with respect to Section 2.2(c) as it relates to Quintiles' breach of warranty under Section 2.5(b)(2)) or to terminate this Agreement. 2.3 ROYALTIES. (a) Definitions. As used in this Section 2.3, the following capitalized terms shall have the respective meanings set forth below: (1) "GROSS PRODUCT REVENUES" means Quintiles' gross recognized revenues through Quintiles' sale and licensing of Data Products that incorporate Licensed Data during the specified period, determined in accordance with generally accepted accounting principles consistently applied ("GAAP"), and includes (without limitation) revenues received by Quintiles from sublicenses. The use by Quintiles of Data Products solely for its internal purposes or for the development or marketing of products or services that do not themselves constitute Data Products shall not give rise to Gross Profit Revenue or Operating Income. 7 <PAGE> 9 (2) "OPERATING INCOME" means the operating income (before taxes and interest) generated through Quintiles' sale and licensing of Data Products that incorporate Licensed Data, determined in accordance with GAAP consistently applied. As soon as practicable after the Effective Time, the Steering Committee will determine the specific manner in which to calculate Operating Income. (b) Payments. (1) Quintiles will pay Healtheon a royalty in the range of 20% - 33% of Operating Income. The specific royalty amount shall be based upon Quintiles' Operating Income as a percentage of Gross Product Revenue, as set forth on Schedule 2.3(b). (2) Quintiles will make the payments required by subsection (1) above on a quarterly (calendar year) basis and accompany each payment with a statement of Quintiles' corresponding Gross Product Revenues and Operating Income for the applicable quarter, together with an explanation of Quintiles' calculation of the corresponding royalties due Healtheon. Quintiles will make such payments within forty-five (45) days after the end of each corresponding calendar quarter. (c) Audits. Quintiles will maintain records reasonably sufficient to document and record its Gross Product Revenues and Operating Income; and Healtheon shall have the right to audit Quintiles' books and records at Healtheon's expense on a confidential and otherwise commercially reasonable basis to confirm the accuracy of all of the foregoing. Quintiles and Healtheon will address any apparent payment discrepancy promptly and in good faith, and the affected party promptly will correct any confirmed mispayment. (d) Equitable Adjustments. In the event Quintiles pays Healtheon any royalty in respect of Licensed Data the parties later determine to have been provided by Healtheon to Quintiles improperly (such as in violation of applicable Law or any applicable Healtheon service agreement) and as a result Quintiles has not received or has refunded the related Gross Product Revenue, Quintiles and Healtheon will determine in good faith an appropriate corresponding royalty adjustment to be given effect as an offset against future royalties to or a refund from Healtheon. (e) Use of Licensed Data. Quintiles will use its commercially reasonable efforts to incorporate the Licensed Data in all Data Products that it develops that require the use of data of the type obtained from the conduct of a Transaction Business, or other data of the type constituting the Licensed Data. 2.4 DATA USE RIGHTS. (a) General. Healtheon will undertake or permit Quintiles to undertake, as the case may be, the procedures described in this Section relative to avoiding prohibitions or limitations on the provision of Licensed Data. (b) Current Service Agreements. Promptly after execution of this Agreement, Healtheon will identify for Quintiles in writing each of Healtheon's Transaction Business Service 8 <PAGE> 10 Agreements (other than any obtained by Healtheon as a result of the Envoy Merger) which prohibit or limit Healtheon's right to provide data of the type which otherwise would be Licensed Data to Quintiles in the manner and for the purposes contemplated by this Agreement. Healtheon further agrees to undertake the access procedures described in subsection (d) below with respect to all such Transaction Business Service Agreements requested by Quintiles (including any originating from Envoy), to the end of eliminating or mitigating the corresponding prohibitions or limitations. Healtheon also will undertake the procedures described in this subsection with respect to Transaction Business Service Agreements acquired by Healtheon by virtue of future transactions in which Persons become Affiliates of Quintiles. (c) Future Service Agreements. Going forward, Healtheon will endeavor to avoid including in its Transaction Business Service Agreements (including both new agreements and any renewals, extensions, or amendments of any in effect as of the date of this Agreement) any provisions which prohibit or limit Healtheon from providing data of the type which otherwise would be Licensed Data to Quintiles in the manner and for the purposes contemplated by this Agreement provided that doing so does not adversely affect Healtheon's Transaction Business or other business. Without limiting the foregoing, Healtheon will notify Quintiles of any Transaction Business Service Agreement (or related amendment) with an anticipated annual transaction volume in excess of 500,000 transactions entered into by Healtheon which includes any such prohibition or limitation and consult with Quintiles (if requested by Quintiles) to evaluate strategies for eliminating or minimizing the effect of any such provision. Healtheon will undertake the access procedures described in subsection (d) below with respect to any such agreement if so requested by Quintiles. Healtheon will consult with Quintiles concerning the format of Healtheon's customer proposals and proposed forms of agreement concerning data use and other strategic matters designed to enable Healtheon to obtain data suitable for use as Licensed Data without impairing Healtheon's Transaction Business. (d) Access Procedure. Whenever requested by Quintiles under subsection (b) or (c) above after the Effective Time, Healtheon will cooperate in good faith with Quintiles to enable Quintiles, at its cost and expense, to negotiate financial or other terms upon which the corresponding customer will agree not to include in its Transaction Business Service Agreement provisions prohibiting or limiting Healtheon's right to provide data to Quintiles in the manner or for the purposes contemplated by this Agreement; provided, however, that Healtheon shall not be obligated to take any such action prior to execution of any such agreement, nor to delay execution of any such agreement to accommodate negotiations by Quintiles with Healtheon's corresponding customer. Healtheon will provide Quintiles (in confidence) all relevant information to the extent Healtheon is permitted to do so under applicable Law and contractual obligations and permit Quintiles to correspond with the customer party to any such restrictive Transaction Business Service Agreement. 2.5 WARRANTIES. (a) Healtheon warrants and covenants to Quintiles that: (1) Healtheon is duly authorized to enter into and perform its obligations under this Agreement, and, other than with respect to any Law or contract which may prohibit or limit Healtheon's right to provide Licensed Data to Quintiles as contemplated by this Agreement, is free of any obligation or restriction that would prevent Healtheon from or impair or limit its right or ability to do so. 9 <PAGE> 11 (2) The collection and accumulation of the Licensed Data by Healtheon to the date of this Agreement has not violated applicable Law or any agreement to which Healtheon is a party or by which it is bound as of the date of this Agreement. (3) Subject to the effects of being conformed to the Access Specifications pursuant to Section 2.2(b)(1), the provision of the Licensed Data by Healtheon to Quintiles pursuant to this Agreement will not violate the corresponding agreement or arrangement pursuant to which Healtheon rendered the services giving rise to such item of Licensed Data. All Licensed Data shall be provided "as is" in the form resulting after Healtheon's Transaction Business processing, De-Identification, and application of the Access Specifications. (4) To Healtheon's actual knowledge, after general consultation with its legal advisors, but without conducting a comprehensive investigation, Quintiles' current practices regarding the collection and accumulation of data of the type comprising the Licensed Data and its use of such data in Data Products would not violate applicable Law. (b) Quintiles warrants and covenants to Healtheon that: (1) Quintiles is duly authorized to enter into and perform its obligations under this Agreement, and is free of any obligation or restriction that would prevent Quintiles from or impair or limit its right or ability to do so. (2) There is no applicable Law as of the date of this Agreement, or any material agreement to which Envoy or Quintiles is a party or by which either is bound as of the date of this Agreement, that will prohibit the collection and accumulation of data of the type that is Licensed Data under this Agreement or its use by Quintiles in Data Products,. (3) Provided that Healtheon's collection and accumulation of the Licensed Data does not violate applicable Law, the use of the Licensed Data by Quintiles after the date hereof will not violate applicable Law as in effect from time to time; and the use of the Licensed Data by Quintiles after the date hereof will not violate any agreement to which Quintiles is a party or by which it is bound. 2.6 PRIVACY RELATED ACTIVITIES. (a) Technical Consultation. Healtheon will cooperate in good faith with Quintiles, through modifications to the Access Specifications or otherwise (and subject to Quintiles' expense reimbursement obligations to Healtheon described in Section 2.2(a)(3)), to develop "best practices" through which to achieve availability of the Licensed Data to Quintiles, with a view toward (1) achieving efficient technical processes for the parties and (2) complying in all respects with applicable Laws concerning the privacy of healthcare data. Such efforts may include periodic privacy compliance audits upon the request of either party made no more frequently than once every thirty-six (36) months. (b) Public Policy and Public Relations Cooperation. Healtheon and Quintiles also will cooperate in good faith to evaluate applicable Laws concerning the privacy or collection of 10 <PAGE> 12 healthcare data or otherwise relevant to the transactions contemplated by this Agreement and, where appropriate and mutually beneficial, to influence the legislative process and public policy and perception on a coordinated basis through lawful and appropriate means determined from time to time, including without limitation public relations activities. Healtheon and Quintiles will determine in good faith how to allocate their respective expenses for these activities. (c) Ongoing Adaptation. Healtheon and Quintiles agree to cooperate in good faith on an ongoing basis to adapt the parties' arrangements under this Agreement to accommodate future changes in applicable Laws, relevant technology, or other changes in the Data Products industry or environment. 2.7 Distribution. Quintiles will not distribute Data Products on the Internet other than through Healtheon without mutual agreement, not to be unreasonably withheld. ARTICLE III INDEMNIFICATION 3.1 HEALTHEON. Healtheon shall defend, indemnify and hold Quintiles harmless, to the full extent permitted in law or equity, from and against any and all losses, claims, actions, damages, liabilities, costs and expenses (including reasonable attorneys' fees and expenses), net of any corresponding insurance proceeds received by any indemnified party (collectively, "LOSSES"), proximately caused by or resulting from (i) any misrepresentation or non-fulfillment of any representation, warranty, covenant, obligation or agreement by Healtheon contained in or made pursuant to this Agreement, (ii) the negligence or willful misconduct of Healtheon or any of its employees, agents, or representatives, and (iii) the enforcement by Quintiles of its rights pursuant to this Section 3.1, and any litigation, proceeding or investigation relating to any of the foregoing. 3.2 QUINTILES. Quintiles shall defend, indemnify and hold Healtheon harmless, to the full extent permitted in law or equity, from and against any and all Losses proximately caused by or resulting from (i) Quintiles' use of the Licensed Data, (ii) any misrepresentation or non-fulfillment of any representation, warranty, covenant, obligation or agreement by Quintiles contained in or made pursuant to this Agreement, (iii) the negligence or willful misconduct of Quintiles or any of its employees, agents, or representatives, and (iv) the enforcement by Healtheon of its rights pursuant to this Section 3.2, and any litigation, proceeding or investigation relating to any of the foregoing. 3.3 PROCEDURES. Whenever either party shall become aware that a claim by a third party has been asserted or threatened which, if valid, would subject the other party to an indemnity obligation under this Agreement, the indemnified party promptly shall notify the indemnifying party in writing of such claim in sufficient detail to enable the indemnifying party to evaluate the claim. The indemnifying party or its designee will have the right, but not the obligation, to assume the defense of such claim. If an indemnifying party fails to assume the defense of such claim within fifteen (15) days after receipt of notice of the claim, the indemnified party will (upon delivering written notice to such effect to the indemnifying party) have the right to undertake, at the indemnifying party's cost and expense, the defense, compromise or settlement of such claim, subject to the right of the indemnifying party to assume the defense of such claim at any time prior to settlement, compromise, or final determination thereof, and provided, however, that the indemnified 11 <PAGE> 13 party shall not enter into any such compromise or settlement without the written consent of the indemnifying party. In the event the indemnified party assumes the defense of the claim, the indemnified party will keep the indemnifying party reasonably informed of the progress of any such defense, compromise, or settlement. The indemnifying party shall not be liable for any settlement of any claim effected without its consent. ARTICLE IV CONFIDENTIALITY Each of Quintiles and Healtheon will hold the other party's Confidential Information in confidence and refrain from using any such Confidential Information other than for purposes of exercising its respective rights and performing its respective obligations under this Agreement. Notwithstanding the foregoing, each party will be permitted to disclose the other party's Confidential Information as and to the extent required by applicable law, provided the party required to make any such disclosure notifies the party whose Confidential Information is required to be disclosed as far in advance of the required disclosure as is reasonably practicable under the circumstances and cooperates with such party (if reasonably requested to do so, and at the requesting party's expense) to secure confidential treatment for the required disclosure. ARTICLE V RELATIONSHIP MANAGEMENT 5.1 STEERING COMMITTEE. Promptly after execution of this Agreement, the parties will organize a six-member Steering Committee comprised of three designees from each party to provide open lines of communication and facilitate, coordinate, and oversee the performance of the parties' respective obligations under this Agreement. The initial Steering Committee designees shall be Jim Bierman and John Russell and Connie Moreadith from Quintiles and Jack Dennison, Pavin Nigram and Steve Simpson from Healtheon and shall be the same Steering Committee under the Internet Product Development and Marketing Agreement between the parties. Each party shall be entitled to replace its designees to the Steering Committee by written notice to the other party. The Steering Committee shall convene on such schedule (but not less frequently than quarterly) and employ such procedures as it shall determine from time to time in good faith, and, except as otherwise specifically required by this Agreement, shall act by unanimous consent. 5.2 DISPUTE RESOLUTION. (a) Executive Review. Each party shall have the right, at any time after good faith efforts have failed to resolve any dispute, difference or question concerning this Agreement at the Steering Committee level, to request review of the matter by the chief executive officer of each party (an "EXECUTIVE REVIEW"). Either party shall exercise its right to request an Executive Review by delivering written notice to that effect to the other party. The chief executive officers of each party shall meet in person or by telephone within ten (10) days of the date such notice is given and shall engage in good faith efforts to resolve the dispute within ten (10) days after such meeting. 12 <PAGE> 14 (b) Mediation. In the event of a dispute which cannot be resolved by Executive Review, either party may commence a non-binding mediation to resolve the dispute by providing written notice to the other party (a "MEDIATION NOTICE") informing the other party of the dispute and the issues to be resolved and containing a list of five (5) recommended individuals to serve as the mediator. Within ten (10) business days after the receipt of a Mediation Notice, the other party shall respond by written notice to the party initiating mediation, providing a list of five (5) recommended individuals to serve as the mediator and which adds additional issues to be resolved. The recommended mediators shall be individuals with experience in the healthcare electronic data interchange industry and shall not be any employee, director, shareholder or agent of either party or an Affiliate of either party, or otherwise involved (whether by contract or otherwise) in the affairs of either party. If, within twenty (20) business days after receipt of the Mediation Notice, the parties shall have been unable to agree upon an individual to serve as mediator, or to the extent the mediator selected by the parties is unable to resolve the dispute, the dispute will be settled by final and binding arbitration conducted in the manner described in subsection (c) below. If, within twenty (20) business days after receipt of the Mediation Notice, the parties shall have agreed upon an individual to serve as mediator, the mediator shall conduct a mediation in an effort to resolve the dispute, employing commercially reasonable procedures selected by the mediator in consultation with the parties, completing such mediation no later than sixty (60) days after engagement. 5.3 REMEDIES. (a) Each of Healtheon and Quintiles acknowledges that its failure to abide by the provisions of this Agreement (and in particular Healtheon's obligations under Article II) would cause immediate and irreparable harm to the other, for which legal remedies would be inadequate. Therefore, in addition to any legal or other relief to which either party may be entitled by virtue of the other party's failure to abide by these provisions, the injured party shall be entitled to equitable relief, including but not limited to preliminary and permanent injunctive relief and specific performance, for the other party's actual or threatened failure to abide by these provisions. (b) Notwithstanding the procedures described in Section 5.2, each party shall be entitled to seek and obtain preliminary injunctive relief in any court of competent jurisdiction for the other party's actual or threatened breach of this Agreement, pending execution thereafter of the dispute resolution procedures described in Section 5.2. ARTICLE VI TERM AND TERMINATION TERM. The term of this Agreement shall be perpetual. This Agreement may not be terminated except by the mutual written agreement of Healtheon and Quintiles. 13 <PAGE> 15 ARTICLE VII MISCELLANEOUS 7.1 RELATIONSHIP OF PARTIES. Healtheon and Quintiles agree that their legal relationship to one another under this Agreement is as independent contractors. Nothing in this Agreement shall be deemed to create a joint venture, agency, partnership, or other relationship between Healtheon and Quintiles, and neither shall have any power by virtue of this Agreement to enter into any contract or commitment on behalf of the other or to bind the other in any respect whatsoever. 7.2 AMENDMENT AND MODIFICATION. This Agreement may be amended, modified or supplemented only by a written agreement (referring specifically to this Agreement) of Healtheon and Quintiles. 7.3 SEVERABILITY. In the event one or more of the provisions of this Agreement or the application thereof to any circumstance are found to be invalid or unenforceable to any extent by a court with jurisdiction, the remaining provisions shall continue in full force and effect. If any provision of this Agreement is found to be so broad as to be unenforceable, such provision shall be interpreted to be only as broad as is enforceable. 7.4 NOTICES. All notices and other communications hereunder shall be in writing and shall be delivered personally or by next-day courier or telecopied with confirmation of receipt, to the parties at the addresses specified below (or at such other address for a party as shall be specified by like notice; provided that notices of a change of address shall be effective only upon receipt thereof). Any such notice shall be effective upon receipt, if personally delivered or telecopied, or one day after delivery to a courier for next-day delivery. If to Quintiles, to: Quintiles Transnational Corp. 4709 Creekstone Drive Riverbirch Building, Suite 200 Durham, North Carolina 27703-8411 Telecopy Number: (919) 998-2177 Attention: John S. Russell, Senior Vice President, General Counsel with a copy to: Smith, Anderson, Blount, Dorsett, Mitchell & Jernigan, L.L.P. Post Office Box 2611 Raleigh, North Carolina 27602-2611 Telecopy Number: (919) 821-6800 Attention: Gerald F. Roach 14 <PAGE> 16 If to HWMD, to: Healtheon/WebMD Corporation 400 The Lenox Building 3399 Peachtree Road NE Atlanta, Georgia 30326 Telecopy Number: (404) 479-7603 Attention: Jack Dennison, Executive Vice President, General Counsel with a copy to: Alston & Bird, L.L.P. 1211 East Morehead Street P.O. Drawer 34009 Charlotte, North Carolina 28234-4009 Telecopy Number: (704) 334-2014 Attention: H. Bryan Ives III 7.5 DESCRIPTIVE HEADINGS. The headings contained in this Agreement are for reference purposes only and shall not affect in any way the meaning or interpretation of this Agreement. 7.6 ENTIRE AGREEMENT. This Agreement (including its various Schedules) constitutes the entire agreement and supersedes all other prior agreements and understandings, both written and oral, among the parties with respect to its subject matter. 7.7 GOVERNING LAW; JURISDICTION. This Agreement shall be governed by and construed in accordance with the laws of the State of North Carolina, without giving effect to the provisions thereof relating to conflicts of law. 7.8 COUNTERPARTS. This Agreement may be executed in two or more counterparts, each of which shall be deemed to be an original, but all of which together shall constitute one and the same agreement. 7.9 ASSIGNMENT. This Agreement and the rights, interests and obligations hereunder shall be binding upon, inure to the benefit of and be enforceable by the parties hereto and their respective successors and permitted assigns. Quintiles may not assign, sublicense, or otherwise transfer its rights, interests or obligations under this Agreement without Healtheon's prior written consent (not to be withheld or delayed unreasonably), except (a) as a part of the sale or other disposition of all or a substantial portion of its Data Products business; (b) to make Data Products available to customers in the ordinary course of business; (c) in connection with any joint venture or strategic relationship with one or more pharmaceutical companies for the development or commercialization of Data Products; or (d) to any Affiliate of Quintiles. Healtheon may not assign or otherwise transfer its rights, interests or obligations under this Agreement without Quintiles' prior written consent (not to be withheld or delayed unreasonably), except in connection with the sale, transfer, or other disposition of all or any portion of its business or assets (other than in the ordinary 15 <PAGE> 17 course of business) in a transaction in which the transferee or successor to such business or assets assumes Healtheon's corresponding obligations under this Agreement. 7.10 PUBLICITY. Except as otherwise required by applicable law, neither party shall refer to the other party in advertising, promotional activities, or other public disclosures or announcements without such other party's prior written consent, which shall not be withheld unreasonably. 7.11 LIMITATION OF LIABILITY. EXCEPT IN THE CASE THAT REDWOOD WILLFULLY REFUSES TO PROVIDE MAPLE ACCESS TO LICENSED DATA AS CONTEMPLATED HEREIN (UNLESS REDWOOD'S REFUSAL IS BASED ON GOOD FAITH ASSERTION OF ITS RIGHTS UNDER SECTIONS 2.2(C) OR (D)), NEITHER PARTY SHALL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, PUNITIVE, OR SPECIAL DAMAGES ARISING OUT OF OR RELATED TO SUCH ACTION OR OMISSION, INCLUDING WITHOUT LIMITATION DAMAGES FOR LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, AND THE LIKE, EVEN IF SUCH PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 7.12 FORCE MAJEURE. Neither party will be responsible for any failure to perform its obligations under this Agreement due to causes beyond its reasonable control, including without limitation acts of God, war, riot, embargoes, acts of civil or military authorities, fire, floods, earthquakes, accidents, strikes, or fuel crises, provided that such party gives prompt written notice of such cause to the other party. The affected party's time for performance will be extended for a period equal to the duration of the force majeure. 7.13 TIME IS OF THE ESSENCE. Time is of the essence in the performance of both parties obligations hereunder. * * * * * * * * * * 16 <PAGE> 18 [signature page to Data Rights Agreement] In witness whereof, each of Healtheon and Quintiles has caused this Agreement to be executed on its behalf by its respective officer duly authorized to do so, all as of the date specified above in the preamble. HEALTHEON/WEBMD CORPORATION By: /s/ Jeff Arnold ----------------------------------------- Its: Chief Executive Officer ----------------------------------------- QUINTILES TRANSNATIONAL CORP. By: /s/ John S. Russell ----------------------------------------- John S. Russell Senior Vice President, General Counsel and Corporate Secretary 17 <PAGE> 19 SCHEDULE 2.3(B) <TABLE> <CAPTION> Ranges of Operating Income Healtheon as a percentage of Royalty Gross Product Revenue Percentage --------------------------- ---------- <S> <C> <C> 0.00% 20.00% 20.00% 20.00% 21.00% 25.00% 21.00% 22.00% 25.80% 22.00% 23.00% 26.60% 23.00% 24.00% 27.40% 24.00% 25.00% 28.20% 25.00% 26.00% 29.00% 26.00% 27.00% 29.80% 27.00% 28.00% 30.60% 28.00% 29.00% 31.40% 29.00% 30.00% 32.20% 30.00% 100.00% 33.00% </TABLE> <PAGE> 20 TEMPORARY ADDENDUM TO DATA RIGHTS AGREEMENT This Temporary Addendum to Data Rights Agreement (this "Addendum") is an agreement between Quintiles Transnational Corp. ("Quintiles") and Healtheon/WebMD Corporation ("Healtheon"). 1. BACKGROUND Quintiles and Healtheon are parties to an Agreement and Plan of Merger dated January 22, 2000 (the Acquisition Agreement"). The Acquisition Agreement calls for Quintiles' subsidiary known as Envoy Corporation ("Envoy") to be acquired by Healtheon. Envoy's primary business is to act as a clearinghouse for electronic data transmissions between health care providers and the institutions that pay for or manage payment for health care services. The Acquisition Agreement calls for Quintiles and Healtheon to be parties to a Data Rights Agreement to be dated as of the date that Healtheon's acquisition of Envoy is complete (the "Data Rights Agreement"). The Data Rights Agreement calls for Healtheon to provide Quintiles certain De-Identified Data (as defined in the Data Rights Agreement). Envoy's business is intended to be a source of the De-Identified Data. Envoy has, as part of its operations, been providing certain data that has not yet been De-Identified (the "Identifiable Data") to Synergy Healthcare, Inc. ("Synergy"), an affiliate of Envoy that will be retained by Quintiles after Healtheon's acquisition of Envoy. The parties are agreeing to this Addendum for the purpose of De-Identifying the Identifiable Data previously supplied to Synergy. The statements made in this Section 1 are only intended as background for the reader of this Addendum and do not constitute representations of fact, warranties, or contractual promises. 2. PROJECT DESCRIPTION 2.1. PURPOSE The parties will cooperate to De-Identifying the Identifiable Data. The parties will specify, develop, test, and implement software for De-Identifying the data regularly provided by Healtheon and Envoy to Quintiles and Synergy and will use the software to create a De-Identified version of the previously delivered Identifiable Data. 2.2. HASHING PROGRAM Envoy and Synergy have jointly created a computer program, (the "Hashing Program") that creates a unique alphanumeric code to identify individuals (the "Identifier"). The purpose of the Identifier is to enable Quintiles to determine that two pieces of data relate to the same 1 <PAGE> 21 individual (for example, two prescriptions for the same patient). The Hashing Program creates each Identifier by encrypting a concatenation of: (a) information about the individual, determined by Synergy to be sufficient to identify the individual uniquely (for example, gender, last name, and date of birth), and (b) a long number, determined by Envoy, that is constant across individuals but is meaningless (the "Initialization Vector"). The Hashing Program encrypts information using a method that cannot be readily decrypted called a one-way hashing algorithm. The Initialization Vector shall be retained in confidence by Envoy until delivered to Quintiles as stated in Section 2.8. 2.3. DATA FEEDS Envoy and Synergy will jointly create a set of documents describing the data elements to be included in separate sets of De-Identified Data from pharmacy, hospital, medical, and dental data (the "Data Specifications"). Individuals will be identified in such De-Identified Data only by the Identifier, and other personally identifiable information will be removed. Using its existing systems, Envoy will produce the required data elements for subsequent De-Identification using the Hashing Program and transmission to Synergy using existing telecommunications processes. As of the Effective Date of this Addendum, Envoy and Synergy have implemented the process described in this Section 2.3 (the "De-Identified Feeds") for pharmacy data. Envoy and Synergy plan to implement these processes for hospital, medical, and dental data no later than May 31, 2000. 2.4. DATA CONVERSION Envoy is developing a suite of programs (the "Bulk Conversion Programs") capable of converting Identifiable Data to De-Identified Data using the Hashing Program. The Bulk Conversion Programs address the conversion of each type of data (such as pharmacy data, medical data, hospital data, and dental data). As of the Effective Date of the Addendum, the parties have arranged for a contractor to use the pharmacy Bulk Conversion Program to convert the pharmacy data that had previously been delivered by Envoy to Synergy as Identifiable Data. As of the Effective Date of this Addendum, Envoy is developing the Bulk Conversion Programs to address hospital, medical, and dental data. When this development is complete, expected to be no later than May 31, 2000, Envoy will deliver the Bulk Conversion Programs to Synergy and Synergy will use the Bulk Conversion Programs to convert the hospital, medical, and dental Identifiable Data in its possession to De-Identified Data. As Synergy confirms that the Bulk Conversion Programs correctly De-Identified Identifiable Data, Synergy shall (a) at Synergy's option, deliver to Envoy the Identifiable Data in Envoy's proprietary format, (b) erase the Identifiable Data from all of its computers in an irretrievable manner, and (c) destroy all other 2 <PAGE> 22 copies of the Identifiable Data. The parties anticipate that this conversion will be complete no later than July 17, 2000 (resulting in the purging of Identifiable Data in Synergy's data warehouse), and the purging of all other Identifiable Data will be complete no later than December 31, 2000. Upon completion of the conversion, Synergy shall provide a sworn certificate of one of its officers with personal knowledge that Synergy retains no further copies or methods of re-creating the Identifiable Data. 2.5. INTERIM DATA MAP (a) Between the time that the De-Identified Feeds are implemented as set out in Section 2.3 and the time that the conversion is complete as set out in Section 2.4 (the "Conversion Period"), Synergy will require a method of relating De-Identified Data delivered through the De-Identified Feeds and Identifiable Data to unique individuals. Envoy has delivered to Synergy a program (the "Mapping Program") to create a table (the "Map") that cross-indexes the identifiers with the data used to identify unique individuals (the "Keys") in Synergy's own databases containing Identifiable Data (Synergy's "Data Warehouse"). Synergy has created the Map and is using it to cross-index its data. (b) During the Conversion Period, Synergy shall undertake the heightened precautions set out in this paragraph (b) with respect to the Map, the Mapping Program, and the Bulk Conversion Programs. Synergy shall treat the Map, the Mapping Program, and Bulk Conversion Programs with the highest level of care and security given to any of Synergy's own trade secrets. In particular, Synergy shall ensure that the only persons able to access the Map, the Mapping Program and the Bulk Conversion Programs are its own employees who have a documented need to know information contained in the Map, the Mapping Program, or the Bulk Conversion Programs and who have signed written confidentiality agreements prior to being given access to the Map, the Mapping Program or the Bulk Conversion Programs. No copies of the Map, the Mapping Program or the Bulk Conversion Programs shall be made, except for a single backup copy and except for transitory copies made by the internal operations of databases. Except for Healtheon, Quintiles and its Affiliates, no third parties whatsoever shall be permitted to have access to the Map, the Mapping Program, or the Bulk Conversion Programs in any manner whatsoever. Upon completion of the Conversion Period, Synergy shall (i) erase the Map, the Mapping Program, and the Bulk Conversion Programs from all of its computers in an irretrievable manner, shall destroy all other copies of the Map, the Mapping Program, and the Bulk Conversion Programs and shall provide a sworn certificate of one of its officers with personal knowledge that Synergy retains no further copies or methods of re-creating the Map, the Mapping Program, or the Bulk Conversion Programs, and (i) make no further use of the Identifiable Data during the purging of such data as contemplated in this Addendum. (c) Without prejudice to any other remedies that may be available at law or equity, Synergy agrees that its responsibilities under Section 2.5(b) shall be enforceable by way of injunction and specific performance. In the event that any party to this Addendum seeks an injunction or specific performance in connection with Section 2.5(b), Synergy shall waive the 3 <PAGE> 23 requirement of any showing other than its breach or threatened of this section and shall not oppose the entry of an injunction or specific performance if breach or threatened breach is found. 2.6. TESTING Envoy and Synergy will cooperate in testing the De-identified Feeds, Hashing Software, Mapping Program, Bulk Conversion Programs, and all other processes to be used by the parties hereunder. During the tests, Envoy or Synergy may make temporary changes to the Data Specifications. The tests will be handled outside of the normal production process, and all data used for the tests will be destroyed at the end of the test process. Envoy will correct problems discovered during the testing process. The parties will re-test any corrections as they are completed. Because the parties desire to expedite the completion of the implementation of the De-Identified Data Feeds, the parties will not employ a formal acceptance process, but will cooperate to ensure that the processes are adequately tested. 2.7. ACCESS SPECIFICATIONS The Data Specifications and Hashing Program shall constitute a portion of the Access Specifications (as such term is defined in the Data Rights Agreement) until such time as the Access Specifications are formalized by agreement of Quintiles and Healtheon. 2.8. DELIVERY OF SOFTWARE Promptly after completion of the Conversion Period, Envoy shall deliver to Quintiles a copy of the Hashing Program, and the Initialization Vector (the "Software"). The Software shall be delivered in source code and with such documentation as Envoy shall have prepared. Quintiles recognizes that Envoy will not have developed the Software to the level of quality required for commercialization. Quintiles shall accept delivery of the Software "AS IS" and without warranty. Healtheon recognizes that during the term of the Conversion Period, Quintiles may enter into data agreements with third parties pursuant to which Quintiles would receive De-Identified Data, and performance of which would benefit from the third party's use of the Hashing Program and the Initialization Vector. Healtheon agrees to promptly make such items available to such third parties upon Quintiles' request, provided that such third party agrees to keep the Initialization Vector confidential during the term of the Conversion Period to a degree commensurate with the restrictions set out above in Section 2.5. Further, Healtheon agrees, upon Quintiles' request, to enter into a technology escrow agreement (such escrow to be maintained at Quintiles' expense) with Data Securities International, Fort Knox Escrow Services, or such other technology escrow company mutually agreed by the parties which would make the Initialization Vector and the Hashing Program available to such third parties under the terms contemplated in this Section 2.8. 4 <PAGE> 24 2.9. EXCLUDED SOURCES Portions of the data previously received by Synergy from Envoy may include data that Envoy agreed to exclude from use in Data Products (as defined in the Data Rights Agreement) ("Excluded Data"). The parties shall co-operate in identifying such data for Synergy to purge, and in connection with such efforts the parties plan to identify and compile a mutually agreed list of Excluded Data sources which shall become the basis for Synergy's efforts to purge Excluded Data hereunder. It is recognized that the Data Feed in Section 2.3, and the De-Identified Data produced by the Bulk Conversion Programs, excludes the Excluded Data to the best of the parties' knowledge. Therefore, at the end of the Conversion Period, Synergy should not have Excluded Data in its primary data warehouse. However, some of the data derivatives previously produced by Synergy from the primary data warehouse may contain such Excluded Data. To the extent possible, Synergy will identify the Excluded Data in all sources, including its data warehouse and data derivatives, and purge it by December 31, 2000. In addition, Envoy shall maintain complete copies of all such data, including such Excluded Data, for a reasonable period of time not to exceed two years from Envoy's receipt of the data, subject to any legal requirements to the contrary. Envoy shall provide extracts from this data to Quintiles in order to provide Excluded Data if Quintiles obtains the agreement of the parties with whom Envoy agreed to exclude the data. 2.10. DATA TO BE PURGED IF PROHIBITED BY PRIVACY RULES As of the date of this Addendum, the Department of Health and Human Services is considering a proposed rule known as Standards for Privacy of Individually Identifiable Health Information (the "HIPAA Rule"). Promptly after the HIPAA Rule is promulgated and no later than the date it becomes effective and requires compliance by Envoy, Quintiles and Synergy shall purge from its computers data received from Envoy or Healtheon that is personally identifiable as defined in the HIPAA Rule. Until such rule is promulgated, Envoy and Healtheon may include in the De-Identified Data certain information, the treatment of which under the final HIPAA Rule is not yet certain (for example, zip code, city, and date of birth). The parties agree that, if this data is delivered, it will be maintained in a manner determined by Synergy so that it can be readily purged if required. 2.11. PURGING OF DATA Where this Addendum requires the purging of data or destruction of copies of data, it is the intent of the parties that such purging or destruction be carried out without regard to where the data resides (such as in Synergy's primary data warehouse, Data Products, data derivatives, data extracts, or interim data). 5 <PAGE> 25 3. TERM This Addendum shall become effective upon its signature by both parties (the "Effective Date of this Addendum") and shall continue in force until the obligations of each party under Section 2 have been completed, which in any event shall not extend beyond the later of (a) two (2) years after the Effective Date of this Addendum, or (b) the date at which the HIPAA Rule becomes effective and requires compliance by Envoy. The provisions of Sections 3 through 7.4 shall survive the expiration or termination of this Addendum. 4. AUDITS In addition to the audits permitted by Section 2.6(a) of the Data Rights Agreement, Healtheon may audit the performance of the obligations of Quintiles and its subsidiaries under this Addendum no more than once per calendar quarter (a) during the term of this Addendum, and (b) after the term of this Addendum and for up to two (2) years thereafter, in all events with the conduct and timing of such audit to be commercially reasonable. 5. OWNERSHIP OF WORK PRODUCT Quintiles shall own the Software as described in the Assignment Agreement dated as of the Effective Date of this Addendum. Healtheon shall have a license to use the Software as described in the Software License Agreement dated as of the Effective Date of this Addendum. 6. COSTS For Envoy's efforts hereunder, Quintiles shall pay Envoy at Envoy's "fully-loaded" cost for personnel assigned to the effort (determined as a function of salary and an overhead allotment agreed to by the Steering Committee as defined in the Data Rights Agreement) and actual, reasonable costs and expenses otherwise incurred in supporting or carrying out the project described above ("Costs"). Envoy shall provide to Quintiles monthly invoices for Costs which shall provide all information reasonably necessary for the computation or confirmation of the payments described in the invoices. Any payments for Costs will be paid by Quintiles to Envoy within thirty (30) days after Quintiles' receipt of such invoice. Quintiles will pay interest of 1% per month on amounts not paid within such 30 day period, unless Quintiles delivers, in good faith, notice to Envoy disputing such payment in reasonable detail. Quintiles will be responsible for its own costs incurred hereunder. 7. WARRANTEES 7.1. NO ATTEMPTS TO REVERSE ENGINEER Quintiles warrants that neither it nor its subsidiaries, agents or subcontractors will attempt to (a) re-identify De-Identified Data (including without limitation, the use of the Map to 6 <PAGE> 26 re-identify De-Identified Data after the Conversion Period), (b) reverse engineer any process used to De-Identify Data, or (c) determine the value of the Initialization Vector prior to the completion of the Conversion Period. 7.2. IDENTIFIABLE DATA Quintiles warrants that its use of the Identifiable Data shall (a) be treated the same as Licensed Data as set forth in the Data Rights Agreement, (b) not include any dissemination of the Identifiable Data to third parties except in aggregate or summary form, and (c) comply with all limitations on use of which Quintiles or its subsidiary becomes aware and which arise from contracts between Envoy and one of its customers. 7.3. PERFORMANCE BY SUBSIDIARIES The parties warrant that they shall each cause their respective subsidiaries to carry out the responsibilities assigned to them in this Addendum. 7.4. CHAIN OF TRUST Until the HIPAA Rule becomes effective and requires compliance by Envoy, Quintiles warrants that whenever it makes Licensed Data received from Healtheon or its subsidiaries (including the De-Identified Data, compilations of data other than in aggregate or summary form, and data received through the Data Feeds) available to third parties, it shall enter into agreements with such parties that require that the third party (a) not attempt to re-identify such Licensed Data (as applicable), and (b) appropriately safeguard the Licensed Data through applicable use and confidentiality protections, at least to the degree described in the most current draft of the HIPAA Rule published by way of Notice of Rule Making by the Department of Health and Human Services. 8. INTERPRETATION This Addendum shall incorporate and be subject to Articles I, III, IV, V, and VII of the Data Rights Agreement as if such Articles were set out fully herein. In any interpretation of this Addendum, in the event of any inconsistency between the terms of this Addendum and the Data Rights Agreement, the terms of this Addendum shall control. In all events, the parties expressly agree that this Addendum shall not serve to amend or modify the terms of the Data Rights Agreement in any manner. 7 <PAGE> 27 <TABLE> <CAPTION> Quintiles Transnational Corp. Healtheon/WebMD Corporation <S> <C> By: /s/ John Russell By: /s/ K. Robert Draughon -------------------------------------------- ----------------------------------------- (authorized signature) (authorized signature) Name: John Russell Name: K. Robert Draughon ------------------------------------------ --------------------------------------- (printed) (printed) Title: Senior Vice President, Corporate Counsel ----------------------------------------- Title: Executive Vice President -------------------------------------- Date: 5/22/00 Date: 5/22/00 ------------------------------------------ --------------------------------------- </TABLE> 8