Limited Data Use Approval Notice-340B ESP (Michigan and Ohio only)

In response to drug manufacturers’ policies that require Covered Entities to submit claims to 340B ESP related to their existing 340B Pharmacy Services Agreement (“Agreement”), Rite Aid Hdqtrs. Corp. (“Rite Aid”) hereby grants, as of the signature date notated below (“Effective Date”), limited data to be shared solely to 340B ESP (“limited data use approval”) and limited to pharmacies located in Ohio and Michigan provided that the Covered Entity adheres to the parameters and guidelines as denoted below.

Rite Aid agrees that the following data fields can be shared to 340B ESP provided that the elements asterisked below are appropriately de-identified (“Hashed”) pursuant to 45 CFR § 164.514 prior to submission or usage by 340B ESP. The required de-identified Data Fields are Date of Service, Date Prescribed, and RX Number.

APPROVED DATA FIELDS

• Contracted Entity ID
• Date of Service*-De-Identified
• Date Prescribed*-De-Identified
• NDC
• Prescriber ID (NPI or DEA)
• Prescriber ID Qualifier (“01” for NPI or “12” for DEA)
• Quantity
• Rx Number*-De-Identified
• Service Provider ID (Pharmacy NPI or DEA)
• Service Provider ID Qualifier (“01” for NPI or “12” for DEA)
• Wholesaler Invoice Number

The Covered Entity usage of this limited data use approval shall be restricted to the Approved Data Fields and is to be used solely for replenished claims for participating manufacturers, registered contract pharmacies, and applicable NDCs that require utilization of the 340B ESP platform in order to obtain 340B pricing. It is further noted that Covered Entity shall be solely responsible for the accuracy and completeness of such discretionary uploads.

TheCovered Entity shall treat thislimited data use approval and the data provided under the Approved Data Fields as “Confidential Information” as defined in the Agreement, and that except as specified herein, that non-essential disclosure is strictly prohibited. It is further noted that the sharing of the Approved Data Fields shall comply with all federal and state laws, rules and regulations regarding the confidentiality of patient information, including, but not limited to the Health Insurance Portability and Accountability Act of 1996 as amended, including applicable rules, regulations and official guidance promulgated thereunder (collectively, “HIPAA”).

This limited data use approval is subject to immediate revocation if the required data elements change or if the Covered Entity is unable or has failed to comply as noted herein and Covered Entity shall immediately cease providing data and immediately notify Rite Aid that the data is no longer being transmitted to 340B ESP. Notwithstanding the foregoing, Rite Aid reserves the right to discontinue this limited data use approval at any time and without cause upon written notice from Rite Aid or Rite Aid’s Gateway Processor to Covered Entity and Covered Entity agrees to acknowledge and to cease disclosure within one (1) business day of receipt if such notice.