COBRA Administration Service Terms

These COBRA Administration Service Terms (these “COBRA Terms”), together with the Terms of Service Agreement available at https://asuresoftware.com/terms (the “Universal Terms” and, together with these COBRA Terms, the “COBRA Agreement”), set forth the terms and conditions under which Asure Customer & IP HoldCo LLC (including any applicable affiliate, “Provider”) will grant User a limited non-transferable license to access Provider’s proprietary software to assist User in complying with its obligations under the Consolidated Omnibus Budget Reconciliation Act of 1985, as enacted April 7, 1986, and as may be amended (“COBRA”), and state benefit continuation laws, and to receive other related services as set forth on the applicable Sales Order (the “COBRA Service”).

These COBRA Terms are “Service Terms” under the Universal Terms. Capitalized terms used but not otherwise defined in these COBRA Terms shall have the meanings ascribed to them in the Universal Terms. If User is agreeing to these COBRA Terms on behalf of a business or individual other than User, User represents and warrants that it has authority to bind that business or individual, and User’s agreement to these terms will be treated as that business’s or individual’s agreement. In that event, “User” also refers to that business or individual. By (i) executing the applicable Sales Order for COBRA Service or (ii) accessing or using the COBRA Service, User accepts the COBRA Agreement and agrees, effective as of the date of such action, to be bound by it.

These Service Terms are issued by Asure Benefits Management LLC for clients receiving COBRA Administration Services.

1. Definitions

“Administrative Fee” means the 2% COBRA administrative fee, or other fees chargeable by statute, that User authorizes Provider to charge Participants in excess of the regular monthly insurance carrier premium.

“Carrier Reconciliation” means the process of verifying an insurance carrier’s monthly invoice to confirm that Participants and their associated Coverage and costs are accurately matched to corresponding records within the Service.

“Coverage” means the Participant’s selection of insurance carrier plan type, which determines premium cost and scope of protection (e.g., family, employee only, employee plus spouse, employee plus children).

“Participant” means a beneficiary or individual defined as a Qualified Beneficiary under federal COBRA, Department of Labor regulations, or state benefit continuation laws who is eligible to elect, or has elected to be managed under, the Service.

“Provider” refers to Asure Benefits Management LLC, a Delaware limited liability company and affiliate of Asure Customer & IP HoldCo LLC, which will provide COBRA Administration services under these COBRA Terms.

“Qualifying Event” means any event under federal COBRA, Department of Labor regulations, or state benefit continuation laws that triggers benefit continuation coverage, including but not limited to termination of a User employee or a reduction in hours of employment.

“User Deposit Account” means the designated bank account for which User authorizes Provider to deposit funds (net of Administrative Fees) collected from Participants.

2. COBRA Terms Governed by Universal Terms

The terms and conditions of the Universal Terms, including all representations, warranties, covenants, disclaimers, limitations on liability, agreements, and indemnities relating to the Services, are incorporated herein by reference. User acknowledges and agrees that those provisions remain in full force and effect to the full extent provided therein.

If the terms of these COBRA Terms conflict with the Universal Terms, these COBRA Terms shall control with respect to the provision of the COBRA Service.

THE UNIVERSAL TERMS, AVAILABLE AT ASURESOFTWARE.COM/TERMS, CONTAIN IMPORTANT INFORMATION REGARDING LIMITATIONS OF PROVIDER’S LIABILITY, WARRANTY DISCLAIMERS, USER’S INDEMNIFICATION OBLIGATIONS, USER’S DUTY TO MITIGATE DAMAGES, THE LAW GOVERNING THE COBRA AGREEMENT, AND DISPUTE RESOLUTION PROCEDURES. USER IS DIRECTED IN PARTICULAR TO SECTIONS 15 (WARRANTIES AND LIMITATIONS OF LIABILITY), 14 (INDEMNIFICATION), 16 (DUTY TO MITIGATE), AND 24 (GOVERNING LAW; JURY TRIAL WAIVER) OF THE UNIVERSAL TERMS.

3. Obligations Under Universal Terms

In addition to the obligations specified in these COBRA Terms, User has certain obligations under the Universal Terms, including but not limited to: (i) designating Authorized User(s); (ii) accepting responsibility for actions taken under User’s account; (iii) providing accurate, timely, and complete information required for Provider to perform the COBRA Services and maintaining the accuracy of that information; (iv) notifying Provider of third-party notices from government agencies such as the IRS and the Department of Labor that could affect Provider’s ability to effectively provide the COBRA Services or increase the likelihood of a Claim; (v) refraining from prohibited actions as described in the Universal Terms; and (vi) complying with the Data Processing Addendum incorporated into the Universal Terms. User acknowledges that Participant Personal Data (as that term is used in Section 4.5 of the Data Processing Addendum) is subject to the additional obligations set forth in that section and in the Participant Data Processing provision of these COBRA Terms.

4. COBRA Services

Subject to User’s fulfillment of the responsibilities set forth herein, the Services shall allow User to: (i) monitor election periods for Participants; (ii) monitor premium due dates, track payments made, and monitor grace periods; (iii) receive alerts and notifications regarding Participant enrollments and terminations; (iv) enter and report on employee and Participant information; and (v) enter Qualifying Events. User shall have sole responsibility for compliance with its policies and procedures as they relate to applicable federal, state, and local laws. The Services do not provide for COBRA Participant-level access.

User shall ensure the accuracy of its employee data, Participant information, insurance carrier rates, coverages, and all User data uploaded to the Services. User is responsible for uploading and entering all employee, Participant, and Qualifying Event data, and for continued maintenance and updating of all changes to that information. User agrees to notify Provider within thirty (30) days of any newly enrolled Participant or Qualifying Event by submitting the information through the Services. Provider is not responsible for penalties associated with the failure to deliver an initial COBRA notice to new hires or an election notice to Participants if User fails to notify Provider as required by this section.

Upon the Contract Effective Date, User shall deliver to Provider an implementation and/or renewal information file specifying revised employee counts and changes in insurance carriers, eligibility, group numbers, plans, rates, and relevant banking information. Any modifications must be communicated to Provider within five (5) business days.

User is responsible, within thirty (30) days, to review reports provided by the Service for the purpose of Carrier Reconciliation, and to review to ensuring the accuracy of insurance carrier benefit plan rates and Participant Coverage assignments. User, not Provider, is responsible for all Carrier Reconciliations.

User is responsible for ensuring the accuracy of the plan sponsor reports and communicating any changes within fifteen (15) days of receipt.

Provider will not provide benefits advice to Participants, insurance brokers, representatives of health care providers, or insurance carriers, and will refer all such inquiries to User.

5. Additional Services

If elected by User and set forth on the applicable Sales Order, Provider will provide the following additional services:

Carrier Eligibility Service

Provider will provide notice to the insurance carrier of Participant Coverage elections and changes to previous elections, at Provider’s sole discretion, via electronic interchange, fax, email, or the insurance carrier’s designated website. User must provide written permission to the applicable insurance carrier designating Provider as an authorized third party. If User fails to perform monthly Carrier Reconciliation in a timely manner, Provider shall have no liability for any failure of its Carrier Eligibility Services.

Mailing Service

Provider will prepare, print, and deliver: (i) COBRA and state health care continuation general rights notices for new hires or Participants experiencing a Qualifying Event; (ii) courtesy coupon payment books to Participants; (iii) benefit enrollment packages to Participants; (iv) reports; (v) COBRA unavailability notices, insufficient payment notices, termination notices, conversion notices, and plan change and rate renewal notices, as applicable; and (vi) other special letters and correspondence to User, User’s employees, or Participants. User is responsible for all fees incurred for shipping, courier, or mailing. Customized mailing packages for new plans or plan changes are subject to additional fees. Provider uses standard templated forms. User must communicate any changes to Provider’s standard communications at least ten (10) days prior to the first mailing date. Any modifications will be at User’s cost. Provider shall provide first-class mailing of required notices unless a Participant has elected in writing to receive notices electronically. User acknowledges and agrees that the record of sent notices included in the Service is sufficient proof of mailing.

Participant Call Center Service

Provider shall provide toll-free inbound telephone support via live operators for Participants during normal business hours. User authorizes Provider to originate calls to Participants. The Provider call center facility will be equipped with telephone systems, computer systems, and appropriate support and call-monitoring tools.

Payment Services

In the event that a Participant elects coverage, Provider will provide payment services consisting of billing the Participant, collecting insurance premiums and the Administrative Fee, and crediting premiums to the User Deposit Account (net of the Administrative Fee). Provider shall not be liable for losses to User resulting from insufficient funds, stop-payment orders, or dishonored negotiable instruments received for premium payments that are subsequently not paid by the maker, and User shall reimburse Provider for any fees it incurs in processing such payments. Provider shall only be obligated to deposit to the User Deposit Account funds it actually receives from Participants, net of Administrative Fees. User shall use reasonable best efforts to assist Provider in recovering funds erroneously credited to a Participant account. User is solely responsible for reviewing setup policies, Participant payment reports, and coupons to ensure accuracy of premium billing and corresponding payments to insurance carriers. User is solely responsible for any claims, penalties, fines, Administrative Fees, late charges, interest, and taxes arising from incorrect setup policies or failure to review records as required. User acknowledges that: (i) COBRA prevents Participant Coverage from cancellation due to underpayment under certain circumstances; (ii) User is solely responsible for any underpayment of insurance premiums by Participants; and (iii) User shall reimburse Provider within two (2) business days of notice from Provider for any advancement of underpayment amounts on Participants’ behalf.

6. Additional Agreements

Administrative Fee Retention

User agrees that Provider shall retain the Administrative Fee billed to Participants as compensation. Provider may receive bank credits and/or earnings from premiums received, which will fluctuate based on the average monthly balance of premiums. User acknowledges that Provider may retain such earnings as additional compensation for the provision of the Services.

Fiduciary Responsibility

Provider holds in a fiduciary capacity all premiums and contributions it receives on behalf of User. Such funds are deposited promptly into a fiduciary bank account maintained by Provider. Where that account holds funds collected on behalf of more than one User, Provider maintains records clearly identifying deposits and withdrawals attributable to each User’s premiums, and will furnish User with copies of such records upon request. Withdrawals from the fiduciary account are limited to: (a) remittance to User or the insurer entitled to the funds; (b) transfer to and deposit in a claims-paying account; (c) payment to Provider of its earned Administrative Fee and any bank credits or investment earnings retained as additional compensation as described in the Administrative Fee Retention provision; and (d) remittance of return premiums to the person entitled to them. Provider will not pay any claim by withdrawal from the fiduciary account.

HIPAA Business Associate Agreement

If Provider determines, in its sole discretion, that the Services performed hereunder are subject to the Federal Health Insurance Portability and Accountability Act or related rules, including if Provider determines it is a “business associate” of User, the parties agree to execute Provider’s form of business associate agreement.

API and Electronic Data Exchange

In the event that User elects to use an application programming interface (“API”) or other electronic data exchange service to provide, or requests that Provider provide, any User data, employee data, or Participant information to a third party, User represents that it has obtained all required consents and provided any required notices in connection with such transfer and that the transfer does not violate any applicable laws. Provider is not responsible for such transfers or for any services or data provided to or by any such third party. User agrees to execute any data exchange documentation, including security documentation, required by Provider.

Support

User acknowledges that all support requests must be properly documented and submitted through Provider’s customer relationship management system during normal business hours and in accordance with Provider’s current support policy.

Participant Data Processing

The parties acknowledge that Personal Information processed by Provider in connection with the Services may include data of individuals who are not current employees of User, including former employees and their spouses, domestic partners, and dependent children (“Participants” as defined herein). To the extent applicable data privacy laws treat such Participants as consumers — including pursuant to the California Consumer Privacy Act of 2018, as amended (“CCPA”), and equivalent state privacy laws — the following terms apply.

Purpose Limitation and No Sale. Provider shall process Participant Personal Data solely for the purpose of performing the Services, including sending required COBRA notices, managing premium billing and collection, maintaining Participant enrollment records, and complying with applicable insurance and benefits regulations. Provider shall not use Participant Personal Data for any secondary commercial purpose, including targeted advertising or cross-context behavioral advertising. Provider shall not sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate Participant Personal Data to any third party for monetary or other valuable consideration, nor share it for cross-context behavioral advertising purposes. Provider acknowledges that this restriction is consistent with the strictest applicable state standard, including Maryland’s prohibition on the sale of sensitive personal data.

Consumer Rights. Where a Participant submits a request to exercise rights under applicable data privacy laws — including rights of access, correction, deletion, or opt-out of sale or sharing — Provider will notify User of the request and may inform the Participant that their request should be directed to User as the responsible party. Provider will cooperate with User in responding to such requests to the extent required by applicable law.

Automated Decision-Making. Where Provider uses automated decision-making technology to make or substantially replace human decision-making with respect to Participant data in connection with significant decisions (including eligibility determinations or coverage calculations), Provider will, beginning no later than January 1, 2027, comply with applicable automated decision-making requirements under the CCPA regulations and equivalent state law requirements, including providing required pre-use notices and opt-out mechanisms where applicable. Provider will notify User in advance of any such automated decision-making use affecting Participants.

HIPAA Coordination. To the extent any Participant Personal Data constitutes protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”), such data is governed by HIPAA and the applicable Business Associate Agreement between the parties. This Participant Data Processing section applies to Participant Personal Data that does not constitute PHI, including contact, financial, and eligibility data.

Maintenance and Retention of Records

Provider shall maintain, at its principal administrative office, complete books and records of all transactions performed in connection with the Services, in accordance with prudent standards of insurance recordkeeping. Provider shall retain such books and records, and a copy of this Agreement, for the duration of the Agreement and for ten (10) years following its termination or expiration.

Notwithstanding the Universal Terms’ provisions regarding User Data upon termination, Provider shall retain, for the period set forth in this Records provision, all records pertaining to premiums or contributions collected, disbursements made, and Participant eligibility and enrollment data in connection with User’s Plan — whether such records constitute User Data or are otherwise generated or maintained by Provider or its subcontractors in providing the Services — and shall not delete or dispose of such records prior to the expiration of that period.

Access to Records

Provider will permit User, and the insurance commissioner or other insurance regulatory authority of any state having jurisdiction over the Services (or such authority’s designee), to examine Provider’s books and records relating to the Services upon reasonable request, for purposes of examination, audit, and inspection. Provider will furnish User with copies of records pertaining to User upon User’s request. Any trade secrets or proprietary information contained in such books and records, including the identity and addresses of Participants, shall be treated as confidential, except that such information may be used by a regulatory authority in any proceeding instituted against Provider.

Insurance Coverage

Provider will maintain commercial insurance coverage, including errors and omissions and/or crime/fidelity coverage, appropriate to the Services provided under this Agreement, and will provide evidence of such coverage to User upon reasonable request.

Notice to Participants

When the Services are utilized, Provider will provide a written notice, approved by User in advance, to Participants advising them of: Provider’s identity and the relationship among Provider, User, and any applicable insurer.

Provider will include in each written notice a reference to User’s privacy policy (or, if User does not maintain a separate privacy policy, to Provider’s Privacy Policy at asuresoftware.com/legal/privacy-policy) and contact information for User’s designated privacy contact or plan administrator. User shall provide Provider with the applicable privacy policy URL and contact information prior to the first issuance of notices to Participants.

7. Fees

As consideration for the Services provided under these Service Terms, Provider is entitled to retain certain administrative fees and/or receive compensation as further described herein and in the applicable Sales Order.

Appendix A: State-Specific Customizations

These Terms are intended to apply nationally. The following state-specific customizations are included solely to ensure compliance with applicable state regulations and do not materially alter the Services unless explicitly stated. Provider may update this appendix from time to time to reflect changes in law or regulation.

State	State-Specific Legal Provision
California	These Terms are intended to satisfy the requirements of California Insurance Code Section 1759.1.
Florida	These Terms are intended to satisfy the requirements of Florida Statutes Section 626.88. Any required compensation disclosures are incorporated by reference.
Georgia	Provider shall maintain E&O insurance in compliance with Georgia Code Section 33-23-102. This agreement satisfies the written agreement requirement under Ga. Comp. R. & Regs. r. 120-2-49-.02(1).
Michigan	These Terms are intended to satisfy the requirements of MCL 550.932(1) for a written administrative services agreement. User agrees to provide written notice to each individual covered by the plan as required under MCL 550.932(1), as applicable.
Nevada	This agreement is intended to demonstrate compliance with Nevada Administrative Code Section 683A.092.
New Jersey	This agreement is intended to satisfy the requirements of N.J. Stat. Section 17B:27B-1 et seq. and N.J.A.C. 11:2-25.4.
Ohio	Provider maintains a fidelity bond covering its operations in connection with the Services, consistent with the requirements of R.C. 3959.11 and OAC 3901-8-05. Provider does not procure, arrange, or otherwise participate in the placement of stop-loss or excess-loss insurance on behalf of User; any such insurance, if obtained by User, is procured directly by User and is not part of the Services. Neither Provider nor its affiliates has any ownership interest in, or material business relationship with, any insurer, reinsurer, or other risk-bearing entity with which Provider deals on User’s behalf.
North Carolina	These Terms are intended to satisfy the written agreement requirement of N.C. Gen. Stat. Section 58-56-26.
Texas	These Terms are designed to comply with the written agreement requirement in 28 Tex. Admin. Code Section 7.1602.
Utah	Provider affirms that this agreement is consistent with Utah Admin. Code R590-266 for administrators.
Vermont	Provider will ensure that communications between Provider and Participants avoid deceptive statements regarding the respective responsibilities of Provider and User.
Wisconsin	These Terms are designed to meet the requirements of Wis. Stat. Section 633.11 and include the required compensation disclosure.
All Other States	No additional customizations at this time. These Terms are intended to satisfy written agreement requirements where applicable.