EDI Trading Partner Agreement

01

Parties & Purpose

This Agreement is entered into between Constant Tech Systems, LLC, a California limited liability company with its principal place of business at 10950 Arrow Rte., PO Box 11, Rancho Cucamonga, CA 91730 ("CTS"), and the entity identified in the signature block of this Agreement ("Trading Partner"), collectively referred to as the "Parties."

The purpose of this Agreement is to establish the rules, responsibilities, and technical standards governing the electronic transmission and receipt of business documents between the Parties, replacing paper-based exchange for the transaction sets listed in Section 3.

02

Definitions

• "EDI" — Electronic Data Interchange; the structured computer-to-computer exchange of business documents in a standard electronic format between business partners.
• "ASC X12" — the Accredited Standards Committee X12, the ANSI-accredited standards body that develops and maintains EDI transaction standards used in the United States.
• "Transaction Set" — a specific EDI document type identified by a three-digit numeric code (e.g., 837 = Health Care Claim, 850 = Purchase Order).
• "Interchange" — the outermost EDI envelope, delimited by ISA and IEA segments, containing one or more functional groups.
• "Functional Group" — the mid-level EDI envelope, delimited by GS and GE segments, containing one or more transaction sets of the same type.
• "Acknowledgment" — a transaction set (997 Functional Acknowledgment or 999 Implementation Acknowledgment) confirming receipt and syntactic validity of an EDI transmission.
• "HIPAA Transactions" — those EDI transaction sets mandated by the Health Insurance Portability and Accountability Act of 1996 and implementing regulations at 45 CFR Parts 160 and 162.
• "PHI" — Protected Health Information as defined under HIPAA, 45 CFR § 160.103.
• "ePHI" — Electronic Protected Health Information; PHI created, received, maintained, or transmitted in electronic form.
• "Companion Guide" — a supplemental specification document published by CTS or the Trading Partner that further constrains the use of a standard transaction set to meet specific business requirements.
• "VAN" — Value-Added Network; a third-party communications network used to route EDI transmissions between trading partners.
• "AS2" — Applicability Statement 2; a specification for secure, reliable data transport over the internet using HTTP/HTTPS with digital certificates.
• "SFTP" — Secure File Transfer Protocol; a network protocol for secure file transfer over SSH.
• "Sender ID / Receiver ID" — the ISA06 and ISA08 interchange qualifier and identifier values that uniquely identify each party in an EDI transmission.
• "Production Environment" — the live operational EDI environment carrying actual business transactions, as distinguished from the Test Environment.
• "Test Environment" — an isolated environment used for certification and validation of EDI transactions prior to go-live.

03

EDI Standards & Authorized Transaction Sets

Governing Standard

All EDI transactions exchanged under this Agreement must conform to ASC X12 standards. For HIPAA-regulated transactions, the applicable Implementation Guides published by the Workgroup for Electronic Data Interchange (WEDI) and adopted by CMS (Centers for Medicare & Medicaid Services) govern format, code sets, and data requirements. The current mandated version is ASC X12 005010 for all HIPAA transactions unless a different version is mutually agreed in writing.

Authorized Transaction Sets

Only the transaction sets listed below are authorized for exchange under this Agreement. Transmission of any unlisted transaction set requires a written amendment signed by both Parties prior to go-live.

Companion Guides

CTS publishes Companion Guides for each supported transaction set. These guides specify CTS-specific data requirements, code values, segment usage, and business rules that supplement the ASC X12 Implementation Guide. The Trading Partner must obtain and follow the applicable Companion Guide(s) for each authorized transaction set. Companion Guides are available from the CTS EDI team at edi@constanttechsystems.com and supersede conflicting generic standard guidance where they apply.

Code Sets

The Trading Partner must use only the code sets mandated or permitted by the applicable ASC X12 Implementation Guide or CTS Companion Guide, including without limitation ICD-10-CM/PCS diagnosis and procedure codes, CPT/HCPCS procedure codes, NDC drug codes, and applicable place-of-service and type-of-bill codes for HIPAA transactions.

04

Communication & Connectivity

Approved Communication Methods

EDI transmissions must use one of the following methods as specified in Exhibit A:

• AS2 (Preferred) — direct HTTPS transmission with digital certificates. CTS AS2 ID, URL, and certificate details are provided in Exhibit A. Both parties must maintain valid, non-expired AS2 certificates and provide at least 30 days' advance notice before certificate renewal.
• SFTP — secure file transfer to the CTS SFTP server. Credentials, host key, and directory structure are provided in the onboarding package. Password rotation is required every 90 days.
• VAN / Clearinghouse — transmission through a mutually agreed third-party network. The Trading Partner's VAN ID and the applicable clearinghouse must be identified in Exhibit A. Clearinghouse-specific fees are the responsibility of each party for their own subscription.
• API / REST — for Trading Partners using the CTS EDI API gateway. OAuth 2.0 client credentials flow; token endpoint and API documentation provided separately. API keys must be rotated at least annually.

Interchange Control Parameters

The following ISA envelope values will be used for all transmissions and must match exactly as specified in Exhibit A:

Transmission Schedule

Unless otherwise specified in Exhibit A, transmissions may be sent at any time. Both parties should avoid concentrating large batches at day boundaries (midnight ± 30 minutes) to prevent processing bottlenecks. For high-volume trading partners, CTS will coordinate a mutually agreed batch schedule during onboarding.

Maximum File Size & Batching

Individual transmission files must not exceed 50 MB uncompressed. Trading Partners with higher volumes must split files into multiple transmissions. CTS supports gzip compression for SFTP and AS2 channels; compressed files must include the .gz extension.

05

Testing & Certification

Mandatory Testing Phase

All Trading Partners must successfully complete a structured testing phase in the CTS Test Environment before any Production transmissions are permitted. No exceptions are made, including for Trading Partners with prior EDI experience with other platforms.

Testing Process

1. Profile Setup — CTS provisions Test Environment credentials, Sender/Receiver IDs, and connectivity parameters within five (5) business days of TPA execution.
2. Connectivity Test — The Trading Partner sends a test ISA envelope (997 loop-back) to confirm communication channel integrity. CTS must acknowledge within one (1) business day.
3. Syntactic Test — The Trading Partner submits test transaction sets for each authorized transaction type using CTS-provided test data scenarios. CTS validates against the applicable Implementation Guide and Companion Guide.
4. Semantic / Business Rule Test — CTS validates that data content meets business requirements (e.g., valid NPI, TIN, member IDs, service codes, dates). Test results and error reports are returned within three (3) business days.
5. Acknowledgment Test — Both parties confirm correct generation and processing of 997/999 acknowledgments for accepted and rejected transactions.
6. End-to-End Test — A complete round-trip scenario (e.g., 837 claim → 999 ack → 277 status → 835 remittance) is executed and confirmed by both parties.
7. Certification Sign-Off — CTS issues a written Certification Notice confirming successful completion of all required tests. Production access is granted only after Certification Sign-Off.

Re-Testing Requirements

Re-testing is required when a Trading Partner: (a) changes EDI software, mapping engine, or communication method; (b) adds a new transaction set not previously certified; (c) changes their Sender ID or connectivity parameters; or (d) has had no Production transmissions for more than 12 consecutive months. CTS will notify the Trading Partner of re-testing requirements and coordinate scheduling.

06

Transaction Acknowledgment

Acknowledgment Obligations

Both parties must generate and transmit acknowledgments for every interchange received:

• 997 Functional Acknowledgment — must be sent for all non-HIPAA transaction sets within two (2) business hours of receipt during business hours, or by 10:00 AM PST the next business day for overnight transmissions.
• 999 Implementation Acknowledgment — must be sent for all HIPAA transaction sets within two (2) business hours of receipt. The 999 must accurately reflect accepted (A), rejected (R), or partially accepted (E) status at the transaction set level, with appropriate AK5/AK9 error codes for any rejections.

Acceptance vs. Rejection

An acknowledgment indicating "Accepted" (AK5/AK9 with value "A") means the interchange was syntactically valid and has been queued for business processing. It does not constitute agreement with, or confirmation of, the business content of the transaction (e.g., claim payment approval). A "Rejected" status means the interchange or transaction set failed syntactic or compliance validation and will not be processed; the sender must correct and retransmit.

Non-Receipt

If a sending party does not receive an acknowledgment within the timeframes above, it must notify the receiving party via the EDI support contact in Section 17. The receiving party must investigate and respond within two (2) business hours. Failure to receive an acknowledgment does not authorize the sender to retransmit without confirmation that the original was not received, as duplicate transmissions may result in duplicate processing.

07

Data Integrity & Error Handling

Data Quality Standards

Each party is responsible for the accuracy and completeness of all data it originates. Both parties agree to:

• Validate all outbound transactions against the applicable ASC X12 Implementation Guide and CTS Companion Guide before transmission.
• Ensure that all required data elements are present, all conditional elements are included when conditions are met, and all code values are valid and current.
• Not transmit test data using the Production ISA15 "P" indicator, and not transmit Production data using the Test "T" indicator.
• Maintain sequential, non-repeating control numbers (ISA13, GS06, ST02) within each production environment.

Error Notification & Correction

When a transaction is rejected (via 997/999) or identified as containing business-level errors (via 277 claim status or equivalent), the receiving party must:

1. Return a compliant acknowledgment or status response identifying the specific error code(s) and the affected transaction set control number(s).
2. Provide sufficient detail for the sending party to identify and correct the error without additional inquiry, where the standard error codes permit.

The sending party must correct and retransmit rejected transactions within two (2) business days of receiving the rejection, or notify CTS if a correction cannot be made within that window.

Catastrophic File Failure

If an entire interchange is unprocessable (e.g., corrupt file, invalid ISA header, encoding error), the receiving party must notify the sender via phone or email — not solely via EDI — within one (1) business hour. The sender must investigate and retransmit a corrected file within four (4) business hours of notification.

08

Security & Access Controls

Transmission Security

All EDI transmissions must be encrypted in transit using:

• AS2 — TLS 1.2 or higher for transport; S/MIME with AES-256 encryption and SHA-256 or stronger digital signatures are required. MDN (Message Disposition Notification) with signing is mandatory.
• SFTP — SSH-2 protocol with RSA or ECDSA key-based authentication (minimum 2048-bit RSA or 256-bit ECDSA). Password-only authentication is not permitted for Production environments.
• VAN — encryption standards are governed by the VAN's security policy; the Trading Partner is responsible for ensuring its VAN meets CTS minimum security requirements as communicated in writing.
• REST API — TLS 1.2 or higher; OAuth 2.0 with short-lived access tokens (maximum 1-hour TTL).

Credential Management

Each party is responsible for maintaining the security of its own credentials, certificates, and private keys. Specifically:

• Credentials must not be shared with unauthorized personnel or third parties without written approval from CTS.
• SFTP passwords must be rotated at least every 90 days and must meet complexity requirements: minimum 16 characters, including uppercase, lowercase, digits, and special characters.
• AS2 certificates must be renewed before expiration. CTS must be notified at least 15 business days before certificate expiration to allow coordinated update.
• Any suspected or confirmed compromise of credentials must be reported to CTS within one (1) hour via the security contact in Section 17, and the compromised credential must be revoked immediately.

Access Logging

Both parties must maintain access logs for all EDI transmissions, including timestamps, Sender/Receiver IDs, file sizes, and outcome (success/failure). Logs must be retained for a minimum of seven (7) years for HIPAA transactions and three (3) years for non-HIPAA transactions, and must be made available to the other party within five (5) business days upon written request for audit purposes.

IP Allowlisting

For SFTP and AS2 connections, Trading Partners must provide a list of authorized source IP addresses or CIDR ranges. CTS will configure allowlist rules accordingly. Any change to source IP addresses requires at least 24 hours' advance notice to avoid transmission failures.

09

HIPAA & PHI Obligations

Compliance with HIPAA Transaction Standards

Both parties must comply with the HIPAA Administrative Simplification transaction standards (45 CFR Part 162), including:

• Using only ASC X12 005010 (or the then-current mandated version) for all HIPAA transactions.
• Applying current valid code sets as mandated by 45 CFR § 162.1002 (ICD-10, NDC, CPT, HCPCS, etc.).
• Not requiring Trading Partners to send additional data elements beyond those permitted by the applicable Implementation Guide (the "no additional fields" rule under 45 CFR § 162.915).
• Accommodating all valid code values that the standard allows, even if not currently in use by the Trading Partner.

Minimum Necessary Standard

Each party must limit the PHI included in EDI transactions to the minimum necessary to accomplish the intended purpose of the transaction, consistent with 45 CFR § 164.502(b). Test transmissions must use de-identified or synthetic data and must never include real patient PHI.

Breach Notification

If either party discovers or reasonably suspects a breach of unsecured PHI transmitted under this Agreement, it must notify the other party within 24 hours of discovery, and provide a complete written incident report within five (5) calendar days. Notification obligations under the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D) remain the responsibility of the applicable Covered Entity.

Operating Rules

Both parties must comply with the CAQH CORE Operating Rules adopted by HHS under the ACA, including Phase I–IV CORE rules for eligibility, claim status, EFT/ERA, and prior authorization transactions where applicable.

10

Confidentiality

All EDI transaction data, Companion Guides, technical specifications, Sender/Receiver IDs, credentials, and business information exchanged under this Agreement is confidential. Each party agrees to:

• Hold the other party's confidential information in strict confidence using no less than reasonable care.
• Use confidential information only for the purposes of performing obligations under this Agreement.
• Limit access to confidential information to employees and contractors with a need to know who are bound by equivalent confidentiality obligations.
• Not disclose confidential information to any third party without prior written consent, except as required by applicable law or regulatory authority.

Confidentiality obligations survive termination of this Agreement for five (5) years, except with respect to PHI and trade secrets, which remain protected indefinitely or as required by applicable law.

11

Record Retention & Audit

Retention Requirements

Each party must retain complete records of all EDI transactions exchanged under this Agreement, including transmission logs, acknowledgments, and error reports, for the following minimum periods:

• HIPAA transactions — seven (7) years from the date of creation or the date last in effect, whichever is later, in compliance with 45 CFR § 164.530(j).
• Non-HIPAA transactions — five (5) years from the date of transmission.
• Security incident records — six (6) years from the date of the incident or resolution, whichever is later.

Records must be retained in a format that is retrievable and readable for the full retention period and must be protected against unauthorized alteration or deletion.

Audit Rights

Either party may, upon at least ten (10) business days' written notice, audit the other party's EDI records and processes to verify compliance with this Agreement, applicable HIPAA requirements, and ASC X12 standards. Audits must be conducted during normal business hours, must not unreasonably disrupt operations, and must be limited to records and processes directly related to transactions exchanged under this Agreement. Each party will bear its own costs for any audit it initiates.

Government Audits

Each party will promptly notify the other if it receives a government audit request or regulatory inquiry that relates to EDI transactions exchanged under this Agreement, and will cooperate as required by applicable law.

12

Legal Effect of EDI Documents

Binding Electronic Documents

The parties agree that EDI transaction sets exchanged under this Agreement and in compliance with its terms constitute valid, binding business communications and have the same legal force and effect as paper documents bearing original signatures, to the fullest extent permitted by applicable law, including the Electronic Signatures in Global and National Commerce Act (E-SIGN), 15 U.S.C. § 7001 et seq., and applicable state electronic transaction statutes.

Contract Formation

An EDI Purchase Order (850), Purchase Order Acknowledgment (855), or equivalent transaction set transmitted under this Agreement constitutes a legally binding offer and acceptance, respectively, subject to the terms of any applicable master purchase agreement between the parties. In the absence of a master purchase agreement, the terms of this TPA and the data content of the transaction set govern.

No Repudiation

Neither party will repudiate any properly formatted and acknowledged EDI transaction on the grounds that it was not in writing or was not signed, provided the transaction was transmitted using the authorized Sender ID and communication channel specified in Exhibit A. Each party is responsible for maintaining the security of its Sender ID and communication credentials to prevent unauthorized transmissions.

Conflict with Paper Documents

In the event of a conflict between an EDI transaction and a corresponding paper document, the EDI transaction will control unless: (a) the paper document was executed by an authorized representative with actual authority and postdates the EDI transaction; or (b) the parties have agreed in writing that the paper document governs.

13

Liability & Indemnification

Each Party's Liability

Each party is responsible for the accuracy, completeness, and timeliness of data it originates and transmits. CTS is not liable for errors or damages resulting from incorrect, incomplete, or untimely data submitted by the Trading Partner. The Trading Partner is not liable for delays or errors caused by CTS's processing systems.

Limitation of Liability

To the maximum extent permitted by applicable law, neither party is liable to the other for indirect, incidental, consequential, punitive, or exemplary damages arising from this Agreement, including loss of business, lost profits, or data loss, even if advised of the possibility of such damages. Each party's aggregate liability for direct damages under this Agreement is limited to the fees paid by the Trading Partner to CTS in the twelve (12) months preceding the event giving rise to the claim, or five thousand U.S. dollars ($5,000), whichever is greater.

Exceptions

The limitations above do not apply to: (a) damages arising from a party's willful misconduct or gross negligence; (b) breach of confidentiality obligations; (c) breach of HIPAA or other applicable law; or (d) a party's indemnification obligations.

Indemnification

Each party ("Indemnifying Party") agrees to defend, indemnify, and hold harmless the other party and its officers, directors, employees, and agents from and against third-party claims, losses, damages, and expenses (including reasonable attorneys' fees) arising from: (a) the Indemnifying Party's breach of this Agreement; (b) the Indemnifying Party's violation of applicable law, including HIPAA; (c) errors or omissions in EDI data originated by the Indemnifying Party; or (d) the Indemnifying Party's negligence or willful misconduct.

14

Term & Termination

Term

This Agreement is effective from the date of last signature and remains in effect for an initial term of one (1) year, after which it automatically renews for successive one-year periods unless either party provides written notice of non-renewal at least sixty (60) days before the end of the then-current term.

Termination for Convenience

Either party may terminate this Agreement for convenience upon sixty (60) days' written notice to the other party. During the notice period, both parties must continue to fulfill their EDI obligations and cooperate on transition activities, including providing the other party with an extract of pending transaction data.

Termination for Cause

Either party may terminate this Agreement immediately upon written notice if the other party:

• Materially breaches this Agreement and fails to cure the breach within fifteen (15) days of written notice;
• Experiences a confirmed breach of PHI or ePHI and fails to remediate within the period specified in Section 9;
• Repeatedly transmits malformed, duplicate, or non-compliant transactions after written warning;
• Becomes insolvent or ceases to conduct business in the ordinary course; or
• Violates applicable law in connection with EDI activities under this Agreement.

Effect of Termination

Upon termination: (a) all Production access credentials and certificates will be revoked within two (2) business days; (b) each party will return or securely destroy the other party's confidential information within thirty (30) days, except as required to be retained under Section 11; (c) any in-flight transactions in the communication queue at the time of termination will be processed and acknowledged; and (d) provisions that by their nature should survive termination (Sections 10, 11, 12, 13, 15, and 16) will survive.

15

Dispute Resolution

Informal Resolution

The parties agree to first attempt to resolve any dispute arising out of or related to this Agreement informally. Either party may escalate a dispute by providing written notice to the other party's designated contact identified in Section 17. The parties will attempt informal resolution within twenty (20) business days of such notice.

Mediation

If informal resolution fails, either party may request non-binding mediation administered by a mutually agreed mediator in San Bernardino County, California. Costs of mediation are shared equally. Mediation is a prerequisite to arbitration unless the matter involves imminent irreparable harm.

Binding Arbitration

If mediation does not resolve the dispute within forty-five (45) days of initiation, either party may submit the dispute to binding arbitration under the AAA Commercial Arbitration Rules, conducted in San Bernardino County, California. The arbitrator's award is final and may be entered as a judgment in any court of competent jurisdiction.

Governing Law

This Agreement is governed by the laws of the State of California, without regard to conflict-of-law principles. For matters not subject to arbitration, the parties consent to the exclusive jurisdiction of state and federal courts in San Bernardino County, California.

16

General Provisions

Entire Agreement

This TPA, together with all executed Exhibits and any associated BAA, constitutes the entire agreement between the parties with respect to EDI exchange and supersedes all prior agreements, representations, and understandings on the same subject matter.

Amendments

Amendments to this Agreement must be in writing and signed by authorized representatives of both parties. CTS may update technical specifications (Companion Guides, connectivity parameters) with 30 days' written notice; such updates do not require a formal amendment unless they alter the parties' material obligations.

Assignment

Neither party may assign this Agreement or its rights hereunder without the prior written consent of the other party, except that CTS may assign to an affiliate or successor entity in connection with a merger or acquisition, provided the successor assumes all CTS obligations hereunder.

Force Majeure

Neither party is liable for delays or failures caused by events outside its reasonable control, including natural disasters, power outages, internet backbone failures, or government-mandated shutdowns. The affected party must notify the other within four (4) hours of a qualifying force majeure event affecting EDI operations and resume performance as soon as reasonably practicable.

Severability

If any provision of this Agreement is found unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will continue in full force.

Waiver

Failure to enforce any provision of this Agreement is not a waiver of the right to enforce it in the future. Waivers must be in writing to be effective.

Notices

Legal notices under this Agreement must be in writing and delivered by certified mail, overnight courier, or email with confirmed receipt to the addresses in Section 17. Operational EDI notices may be delivered by email to the designated EDI contacts.

Counterparts & Electronic Signatures

This Agreement may be executed in counterparts, each of which is an original. Electronic signatures (including DocuSign, Adobe Sign, and typed names in PDF) are fully binding and have the same force and effect as handwritten signatures.

17

Contacts & Signatures

CTS Designated Contacts

Exhibit A — Trading Partner Profile

The following information must be completed by the Trading Partner and submitted to CTS with the signed Agreement. CTS will confirm all values in writing before testing begins.

Signatures

By signing below, each party's authorized representative confirms that they have read, understood, and agree to be bound by this EDI Trading Partner Agreement, including all Exhibits.

To request this agreement in PDF / DocuSign format, or to begin the EDI onboarding process, contact edi@constanttechsystems.com.