BROKER AGREEMENT. Wherein it is mutually agreed as follows:

This Broker Agreement (the Agreement ) made effective (the Effective Date ) between with an address of (hereinafter referred to as We, Our, Us or MGA ), Trustmark Life Insurance Company with an address of 400 Field Drive, Lake Forest, IL 60045 ( Trustmark Life ) and (hereinafter referred to as You, Your or Broker ). Wherein it is mutually agreed as follows: 1. General. While You are properly, validly and currently Licensed and appointed under applicable state or other law for the sale of Insurance Products (as hereinafter defined) (each a License and to acquire such License, to be Licensed )), You are authorized to solicit, procure and transmit to MGA, applications and deposits toward initial costs for insurance products ( Insurance Products ) issued by Trustmark Life and administered by Star Marketing and Administration, Inc. ( Starmark ), subject to Starmark s and Trustmark Life s rules and regulations now or hereafter in effect. Each application and deposit towards initial costs for Insurance Products shall be submitted to Us immediately following the date the application is signed by the applicant or proposed insured. 2. Representations and Warranties. a. MGA and Broker each represent and warrant to the other that it has full power and authority to enter into this Agreement. b. Broker represents and warrants to MGA and Trustmark Life that it and, if applicable, its employed agents, is Licensed under all applicable state and other laws to the extent required by this Agreement, is or will be duly appointed to solicit, sell and/or negotiate Insurance Products as required or appropriate under all applicable state or other laws and is entitled and authorized to receive compensation for the sale of Insurance Products. c. Broker represents and warrants to MGA and Trustmark Life that it and, if applicable, its employed agents, has never been the subject of any arrest, warrant for arrest, indictment, charge of any kind, conviction for any felony or any crime or offense involving fraudulent or dishonest practices, or breach of a fiduciary duty. d. Broker represents and warrants to MGA and Trustmark Life that it and, if applicable, its employed agents, to the best of its knowledge, is not currently the subject of any disciplinary proceedings by any federal, state or other governmental authority which could result in a decision, determination or judgment adverse to Broker such that Broker s ability to perform its obligations under this Agreement could be affected materially or could prevent Broker, or any employed agent, from doing business in the same manner as being done presently or as contemplated under this Agreement. e. Broker acknowledges and agrees that Broker has a continuing obligation to notify MGA, Starmark and Trustmark Life in writing within five (5) days if any of the above representations change during the term of this Agreement. 3. Express Conditions and Agreements. a. Broker and, if applicable, its employed agents, shall maintain in full force and effect any and all required Licenses as required or appropriate under applicable state or other laws. b. At all times during the term of this Agreement, Broker agrees to comply with applicable state and other governmental authority requirements relative to financial responsibility by maintaining either a bond or Errors & Omissions insurance as required by the applicable state department of insurance or other governmental authority. c. Broker shall be responsible for the payment of all resident and non-resident state insurance License fees and any renewals thereof as shall be necessary for the Broker to sell or solicit the sale of Insurance Products or receive compensation from the sale of Insurance Products. d. In the event that any state or federal regulatory authority determines, or MGA, Starmark or Trustmark Life reasonably determine, that the terms of this Agreement violate any state or federal law or regulation, this Agreement shall be amended to comply with that law or regulation as set forth herein. MK11BA HIPAA/MegaReg 8-2013/TL DD (2/17) Page 1 of 12

4. Duties of the Broker: a. Broker shall be responsible for offering Insurance Products for sale in accordance with the terms of this Agreement. b. All applications for Insurance Products shall be made on the appropriate application forms supplied by MGA and Broker shall ensure the accuracy, completeness and correctness of such application. Broker shall promptly forward to MGA all applications found complete together with the amount of all deposits toward initial costs it received with the applications. Broker acknowledges that MGA, Starmark and Trustmark Life reserve the right to decline any application for any lawful purpose and return any payment in connection with an application that is declined. Broker further agrees to inform every applicant that MGA, Starmark and Trustmark Life will rely upon the representations made in the application in the underwriting process, and that the subsequent discovery of any fraud or intentional misrepresentation of material facts known to the applicant may result in the rescission of any Insurance Product, coverage or policy issued by Trustmark Life. Broker shall also inform the applicant that in no event shall the applicant have any coverage unless and until the application is reviewed and approved by Trustmark Life and an Insurance Product is issued. c. Broker shall keep thorough, current and correct records, books of accounts and transactions covered by this Agreement and shall preserve and hold all documents, correspondence and records that come into its possession or under its control relating to Insurance Products for a period of not less than seven (7) years. All books of accounts, documents, correspondence and records of the Broker shall belong to the Broker but shall be subject to reasonable inspection by an authorized representative of any of MGA, Starmark or Trustmark Life during normal business hours during the term of this Agreement and for seven (7) years after termination of this Agreement. Upon termination of this Agreement, Broker shall return or destroy all marketing materials, applications, enrollment forms and all other supplies provided by Starmark or Trustmark Life. d. Broker shall promptly notify MGA, Starmark and Trustmark Life of any material complaint or inquiry that may involve MGA, Starmark or Trustmark Life or this Agreement. e. Broker agrees to furnish MGA, Starmark and Trustmark Life with all information available to Broker necessary to enable each of them to comply with their obligations under this Agreement and applicable law, including, but not limited to, licensing information and information regarding Brokers and, if applicable, Broker s employed agents, and Broker s status with customers. f. Broker agrees that all groups enrolled under this Agreement shall be billed directly by Starmark and/or Trustmark Life, and not through an intermediary, including the Broker, unless expressly authorized otherwise by Starmark and Trustmark Life. g. Broker agrees that this Agreement does not give Broker any power or authority other than expressly set forth or granted herein and no other or greater power shall be implied from the grant or denial of powers specifically mentioned herein. h. Broker shall forward to an applicant or groups in a timely manner all policies, riders, contracts, quotes, proposals, notices, caveats, disclosures, reports, and other information and materials from MGA, Starmark or Trustmark Life that relate to or may affect coverage or services provided or proposed to be provided to an applicant or group by MGA, Starmark or Trustmark Life or that any of them may request to be forwarded to such applicant or group. 5. Limitations on Broker s Authority Except as otherwise specifically approved by MGA, Starmark and Trustmark Life in writing, Broker is not authorized to: a. accept any risk on behalf of MGA, Starmark or Trustmark Life; b. make any promise or agreement on behalf of MGA, Starmark or Trustmark Life; c. bind or commit MGA, Starmark or Trustmark Life in any way; d. incur any expense, indebtedness or liability in the name of MGA, Starmark or Trustmark Life; MK11BA HIPAA/MegaReg 8-2013/TL DD (2/17) Page 2 of 12

e. make, alter, waive or discharge any of the terms, costs, rates, proposals, limitations or conditions of any application or Insurance Product issued, or to be issued by Trustmark Life; f. receive any monies or funds due or to become due to MGA, Starmark or Trustmark Life, except deposits toward initial costs; g. waive any forfeiture or extend the time for making of any payments for Insurance Products; h. adjust or settle any claims; or i. enter into any proceeding in a court of law or before a government authority in the name of or on behalf of MGA, Starmark or Trustmark Life, including the acceptance of legal process on behalf of MGA, Starmark or Trustmark Life, but where Broker is named with MGA, Starmark or Trustmark Life, Broker must retain its own counsel. When a Broker receives deposits toward initial costs for Insurance Products under this Agreement, the Broker shall not use those deposits for any purpose other than as set forth in this Agreement. At all times while the Broker retains control over such deposits (i) it shall not co-mingle those deposits with its own funds or with the deposits of any other applicant or insured or any other person or entity and (ii) it shall hold such deposits in a fiduciary capacity on behalf of the applicant or insured until such time as they are remitted to Us in accordance with this Agreement. 6. Appointment Fees Trustmark Life will pay for any initial appointment fees and any renewal fees for Your appointment by or through Trustmark Life that are due and payable to the state(s) in which You will solicit, sell and/or negotiate Insurance Products and in which you are properly Licensed so long as You: (i) complete all paperwork, forms and documentation in a time and manner as required by applicable law, (ii) a background investigation of You is satisfactory to Us, Starmark and Trustmark Life, and (iii) We have received a copy of proper, valid and current License and any required renewals. The first completed application for Insurance Products must result in issued Insurance Products by Starmark or Trustmark Life within 18 months of your initial appointment. If (i) no new applications taken by You result in issued Insurance Products within such 18-month period or (ii) You are no longer properly Licensed in accordance with the terms of this Agreement, Trustmark Life will not have any obligation to pay any of Your appointment fees, unless otherwise required by law. In such event, You must remit all necessary fees to renew Your appointment by or through Trustmark Life immediately when due, otherwise Your appointment by or through Trustmark Life will be canceled. Trustmark may terminate its obligation to pay any initial or renewal appointment fees at any time upon notice to You. 7. Background Investigations. You hereby authorize Us to conduct an investigation into your background, including, without limitation, criminal matters, financial matters, education and qualifications. You understand that such investigation may include, but is not limited to, contact with Your employers (past and present), verification of residence, review of state insurance records, review of Your character, and Your general reputation. You hereby authorize all persons and entities to release all written and verbal information about yourself, and agree to hold each harmless from all liability and responsibility for doing so. This release, in original or copy form, is valid now and any time in the future, and You acknowledge that You have been given a copy of this Agreement. Upon written request, a complete and accurate disclosure of the nature and scope of the investigative background report will be provided to You. 8. Compensation. a. In consideration of the services performed by You under this Agreement, but subject to Your compliance with the terms and conditions of this Agreement, the compensation to which you will be entitled for each policy year will be as set forth in Starmark s compensation schedules and guides (the Broker Compensation Schedule ), which can be found at www.starmarkinc.com, as may be amended, updated, restated or discontinued in its entirety from time-to-time. In the event of any conflict between the terms of this Agreement and the Broker Compensation Schedule, the terms of this Agreement shall control. MK11BA HIPAA/MegaReg 8-2013/TL DD (2/17) Page 3 of 12

b. Compensation will be paid no later than the end of the calendar month following the calendar month during which the applicable costs are paid. c. No compensation shall be payable to an individual Broker or a Broker firm that is a sole proprietorship after the death of such Broker. d. MGA, Starmark and Trustmark Life shall have the right to offset against and recoup from any sums due to Broker any indebtedness, matured or unmatured, absolute or contingent, of Broker or its affiliates, to MGA, Starmark or Trustmark Life or their respective affiliates, whether or not arising under this Agreement, including, without limitation, any fees, fines or penalties that MGA, Starmark or Trustmark may incur as a result of Broker s non-compliance with this Agreement. e. Brokers may not share any portion of any compensation paid under this Agreement with any applicant or insured, whether directly or indirectly. 9. General Provisions Relating to Compensation. Notwithstanding anything to the contrary herein, Compensation Schedules, compensation calculations or the method for calculating compensation may be amended, updated, restated or discontinued on any new or existing Insurance Products from time-to-time in Starmark s sole discretion or as may be required by applicable law or any state or federal regulatory authority. Current Compensation Schedules and compensation calculations may be found at www.starmarkinc.com. 10. Broker of Record Changes If, for any reason, MGA, Starmark or Trustmark Life receives a written request to remove You as broker of record from any group, insured or Insurance Product, You will have thirty (30) days in which to dispute this change in writing. Notwithstanding anything in this section to the contrary, the newly named broker of record may represent the group on the date specified in the written request from the group. Compensation will be directed to the newly named broker of record effective on the first day of the first billing cycle following thirty (30) days after receipt of the request, unless MGA, Starmark or Trustmark Life determine, in their reasonable discretion, that the request should not be granted. Compensation will be paid to You only for those full billing cycles for which You are named the broker of record, otherwise compensation will be paid to the newly named broker of record for all other cycles; provided that if a broker of record change is made during the first twelve (12) months that a group, insured or Insurance Product becomes effective, compensation will be paid to the new broker of record only after the end of this twelve (12) month period. 11. Term and Termination. This Agreement takes effect on the Effective Date and shall remain in effect thereafter unless terminated in accordance with the terms of this Agreement. This Agreement may be terminated after the Effective Date as follows: a. by the mutual written consent of the parties; b. by Starmark or Trustmark at any time for any reason upon written notice to Broker; c. Upon thirty (30) days prior written notice by Broker to Starmark and Trustmark Life (unless additional time for notice is required by applicable law); d. Immediately upon Broker s death or disability (physical or mental) or adjudication of incompetence, if Broker is an individual or a sole proprietorship; or e. Immediately upon the Broker s dissolution if Broker is a legal entity. This Agreement shall not be effective in any state where any of the Broker s Licenses are revoked, suspended or otherwise made invalid. Termination shall not be MGA s, Starmark s or Trustmark Life s sole or exclusive remedy, but shall be cumulative with all other remedies available at law or in equity. Failure to terminate this Agreement shall not be a waiver with respect to any past, current or future events. MK11BA HIPAA/MegaReg 8-2013/TL DD (2/17) Page 4 of 12

12. Advertising; Sales and Promotional Materials In representing MGA, Starmark or Trustmark Life, Broker shall utilize only sales materials previously authorized in writing by Starmark or Trustmark Life and shall adhere to all MGA, Starmark and Trustmark Life policies, rules and regulations in regard to sales and enrollment, and shall in no way misrepresent MGA, Starmark or Trustmark Life or the Insurance Products or related products or services. No party shall use the name, trademark or logo of any other party in any way or manner without the other party s prior written consent and then only as specifically authorized in writing by the other party. 13. Relationship You will act as an independent contractor of Us and nothing contained in this Agreement shall create, or be construed as creating, an employer-employee, master and servant, partnership, joint venture or other relationship between You and Us or between You and Trustmark Life or Starmark. 14. Confidentiality Starmark, Trustmark Life, MGA, and You acknowledge that in fulfilling the responsibilities set forth in this Agreement, Starmark, Trustmark Life, MGA, and You may exchange confidential and proprietary information concerning their, Our or Your business affairs, customer listings, financial information and any other information considered private and confidential by such party, including, but not limited to, personal information contained in applications, medical records and/or claim forms, and their business and financial information (collectively, Confidential Information ). Starmark, Trustmark Life, MGA, and You agree not to disclose any such Confidential information at any time, except as necessary to employees or agents of the parties, and only then to the degree necessary for them to perform their obligations under this Agreement, or as required by law, rule regulation, or as required by court, administrative agency or other government body. Notwithstanding anything in this Agreement to the contrary, it is expressly understood and agreed that no party shall be liable for the disclosure of Confidential Information if it (1) is in the public domain at the time it is disclosed; (2) was known prior to the time of its initial receipt; (3) is disclosed with the other party s prior written approval; and/or (4) is disclosed with prior written approval of the party owning such Confidential Information. Starmark, Trustmark Life, MGA, and You also agree to take those actions reasonably necessary to ensure that none of their employees or agents make unauthorized disclosure of such Confidential Information to any third party or parties. Starmark, Trustmark Life, MGA, and You agree that this obligation shall survive the termination of this Agreement. 15. HIPAA Security and Privacy Business Associate/Independent Contractor You agree to comply with all security and privacy requirements set forth on Exhibit A hereto. 16. Direct Deposit Your compensation will be deposited directly into Your bank account as specified by You to Us in writing, and You will assume responsibility for all bank service charges, all other charges associated with such account or the direct deposit of compensation into such account. 17. Cost Refunds Costs will be refunded to applicants, and insureds at times in accordance with Starmark s usual business practices and applicable laws and regulations. Amounts equal to compensation paid to You on refunded costs will, at Starmark s discretion, be either deducted from amounts otherwise payable to You and/or demanded from You and recovered by any other legal means required. 18. Amendments; Assignment In the event that a state or federal law or regulation, or any regulatory or any enforcement action should require that this Agreement be changed, altered or modified, then Starmark or Trustmark Life will provide Broker with written notice of required amendments to this Agreement, which shall become effective upon sending such notification to Broker. Starmark or Trustmark Life may otherwise amend or amend and restate this Agreement by providing prior written notice of such amendment to Broker. Failure of Broker to object in writing to such proposed amendment within thirty (30) days following receipt thereof shall constitute Broker s acceptance of such amendment. Any notification of rejection of an amendment to this Agreement shall not impact the effectiveness of this Agreement. Starmark or Trustmark Life may assign this agreement without the consent of any other party to this Agreement. Neither MGA nor Broker may assign or amend this agreement without the written consent of all other parties to this Agreement. MK11BA HIPAA/MegaReg 8-2013/TL DD (2/17) Page 5 of 12

19. Indemnification Broker agrees to indemnify and hold harmless MGA, Starmark and Trustmark Life, their respective affiliates and subsidiaries and their respective officers, directors, employees, agents and representatives from any damage and from or against any liability for loss, cost, expenses, fines, penalties, including punitive or exemplary damages, and all costs of defense, including reasonable attorneys fees: (i) resulting from any act, error or omission whether intentional or unintentional, by Broker and its officers, directors, employees, agents or representatives related to or that arise out of the matters covered by this Agreement, (ii) resulting from any obligation, act or transaction created or performed by Broker in violation of or in excess of, or in contravention of the duties, obligations, power, or authority of the Broker set forth in this Agreement, or (iii) arising out of or in connection with any unauthorized use or disclosure of Confidential Information or protected health information or any failure in security measures affecting Confidential Information or protected health information or any other breach of the terms of this Agreement by Broker or any person or entity under Broker s direct or indirect control. Broker s indemnification obligation shall survive expiration or termination of this Agreement. The indemnified party may, at its option, conduct any defense or settlement of any such action arising as described herein, and each party shall fully cooperate with such defense. Broker expressly authorizes each of MGA, Starmark and Trustmark Life, without limiting any other remedy each of them may have, to charge against all compensation or other amounts due or to become due to Broker under this Agreement any monies paid or liabilities incurred by any of them by reason of an occurrence described in this Section. 20. Indebtedness You promise to pay indebtedness incurred by You to Trustmark Life, Starmark, or Us on demand. Indebtedness means all advances, loans, charge-backs and other customary account charges. As security for payment of indebtedness, We, Starmark and Trustmark Life shall have a prior lien on any other compensation earned under this Agreement and may off set any such indebtedness against any compensation earned under this Agreement. 21. Agreement with Starmark or Trustmark Life This Agreement is subject to the terms and conditions of that certain Managing General Agent Agreement between Us and Starmark and Trustmark Life (the MGA Agreement ). In the event that MGA Agreement terminates, and compensation is due from Trustmark Life or Starmark to Us, and compensation is due in the same month to be paid by Us to You under this Agreement, then Trustmark Life or Starmark may pay directly to You on Our behalf the compensation which is due according to Starmark s records. A copy of the Broker Compensation Schedule will be maintained at www.starmarkinc.com and the applicable Compensation Schedule will be conclusive in the determination of all amounts payable. Starmark is an intended third party beneficiary of the Agreement. 22. Notices. Except as otherwise provided in this Agreement, all notices or other communications hereunder shall be deemed to have been duly given when made in writing and either (i) delivered in person or via facsimile (confirmation receipt received), (ii) delivered during normal business hours (or the next business day if delivered after normal business hour) via email (with no notification of transmission error received) or (iii) when received, if sent by an overnight courier delivery service, or sent registered or certified mail in the United States Mail; postage prepaid, return receipt requested, and addressed as set forth on the signature page to this Agreement. 23. Prior Contracts This Agreement and the Broker Compensation Schedule constitutes the entire contract between Us and You concerning the matters described herein and therein and supercedes all previous agreements entered into between the parties regarding the solicitation and sale of Insurance Products. In the event of a direct conflict between the terms of this Agreement and the Broker Compensation Schedule, this Agreement shall control. 24. Severability If any provision of this Agreement shall be held to be invalid, void or otherwise unenforceable, the parties agree that it shall in no way effect, impair or invalidate any other provision hereof, and such other provisions shall remain in full force and effect. MK11BA HIPAA/MegaReg 8-2013/TL DD (2/17) Page 6 of 12

25. Non-Waiver Failure of any party to require performance of any provision of this Agreement shall not constitute a waiver of the right to enforce such provision at a later time for preceding or succeeding events. Waiver of any breach of any provision of this Agreement must be in writing and shall not constitute a waiver of any succeeding breach. 26. Survival In addition to those provisions, which by their terms, survive expiration or termination of this Agreement, any other provision of this Agreement capable of surviving expiration or termination of this Agreement shall survive expiration or termination of this Agreement. Termination or expiration does not affect rights and obligations that arose or accrued prior to such expiration or termination. 27. Governing Law. This Agreement shall be governed by, and shall be construed in accordance with, the internal laws of the State of Illinois. 28. Compliance with Laws All parties shall comply with all applicable state and federal laws, rules, regulations and judicial and administrative orders. Further, this Agreement will be subject to applicable provisions of U.S. Department of Health & Human Services Administrative Simplification Regulations, including Electronic Transactions, Privacy and Security. Specific provisions of this Agreement may be renegotiated at a later date to accommodate those regulations. ACCEPTED Effective Date Broker Managing General Agent License No.: State: Address: Trustmark Life Insurance Company Senior Vice President Address: 400 Field Drive Lake Forest, IL 60045 MK11BA HIPAA/MegaReg 8-2013/TL DD (2/17) Page 7 of 12

Exhibit A I. PREAMBLE WHEREAS, in accordance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 and any amendments thereto including the Final Rule at 78 Fed. Reg. 5565 (Jan. 25, 2013) known as the Mega Rule )( HIPAA ), the HIPAA Security rule at, 45 C.F.R. Part 160 and Part164 (the Security Rule ) and the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Part 160 and Part 164 (the Privacy Rule ) and, together with the Security Rule the HIPAA Security and Privacy Rules ), You, as an independent contractor, understand that the Broker Agreement between You and Us in connection with Insurance Products (the Agreement ) insured by Trustmark Life and administered by Starmark, address Your obligations under the HIPAA Security and Privacy Rule. II. GENERAL TERMS AND CONDITIONS A. All capitalized terms used in this Exhibit A shall have the meanings ascribed to such terms in the HIPAA Security and Privacy Rules, unless otherwise defined herein. B. You agree to establish and implement appropriate safeguards (including certain administrative requirements) for Protected Health Information ( PHI ) as defined by HIPAA in any form or medium, including electronic, You may create, receive, maintain, transmit, use, or disclose in connection with certain functions, activities, or services (collectively services ) to be provided by You to or on behalf of MGA or Trustmark Life. C. Where provisions of this Exhibit A are different from those mandated by the HIPAA Security and Privacy Rule, but are nonetheless permitted by the Rule, the provisions of this Exhibit A shall control. D. Nothing express or implied in this Exhibit A is intended to confer, nor shall anything herein confer, upon any person other than the You and your respective successors or assigns any rights, remedies, obligations, or liabilities whatsoever. E. As used in this Exhibit, the term PHI (as defined below) does not include summary health information or information that has been de-identified in accordance with the standards for de-identification provided for in the HIPAA Security and Privacy Rules. III. OBLIGATIONS OF YOU A. Compliance with Law. You acknowledges that you are required by law to comply with all applicable requirements of the HIPAA Security and Privacy Rules, and all additional security requirements of the Health Information Technology for Economic and Clinical Health Act (the HITECH Act ), Title XIII of the American Recovery and Reinvestment Act of 2009 (ARRA), that are applicable to you. You further acknowledges that you are required by law to comply with the use and disclosure requirements of Section 162.504(e) of the HIPAA Security and Privacy Rules and that all other privacy requirements of Subtitle D of the HITECH Act that are applicable to you. B. Permissible Uses and Disclosures. 1. You shall create, receive, maintain, transmit, use or disclose PHI only in a manner that is consistent with this Exhibit and the HIPAA Security and Privacy Rules and only in connection with the provision and delivery of the Services to or on behalf of Trustmark pursuant to the terms and conditions of the Agreement. Accordingly, in providing the Services to or on behalf of Trustmark, you, for example, may use and disclose PHI for Treatment, Payment and Healthcare Operations consistent with the HIPAA Security and Privacy Rules, without obtaining prior authorization for such use or disclosure. 2. Except as otherwise limited in this Exhibit, you may disclose PHI to other business associates (as defined in the HIPAA Security and Privacy Rules) of Trustmark to perform duties specifically authorized under the Agreement. 3. As permitted by 45 C.F.R. 164.504(e)(4), you may also use or disclose PHI that it receives in its capacity as an Independent Contractor if: MK11BA HIPAA/MegaReg 8-2013/TL DD (2/17) Page 8 of 12

a. the use relates to (1) the proper management and administration of the you or the carrying out of your legal responsibilities or (2) data aggregation services relating to the health care operations of Trustmark; or b. the disclosure of PHI received in such capacity is made in connection with a function, responsibility or service identified in Section II.B.3.a(1) above, and (1) such disclosure is required by law or (2) you obtain reasonable assurances from the person to whom such PHI is disclosed that it will be held confidentially and such person agrees to notify you of any breaches of such confidentiality. 4. You may disclose PHI to report violations of law to appropriate Federal or State authorities, consistent with 45 C.F.R. 164.502. 5. Your use, disclosure or request of PHI shall utilize a Limited Data Set as described in 45 C.F.R. 164.514(e)(i) to the extent practicable. In performing its obligations under this Exhibit and the Agreement, you shall use, disclose or request only the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or request as determined in your reasonable discretion, unless Trustmark has notified you of or provided you with minimum necessary policies of Trustmark or the applicable Covered Entity(ies) that apply to such PHI. C. Recipients of PHI. 1. You shall obtain reasonable written assurances from any person or entity to whom it discloses PHI that such PHI will be held confidentially and used or further disclosed only as required and permitted under the HIPAA Security and Privacy Rules and other applicable laws. Prior to receiving PHI from you, each person or entity receiving PHI from you must agree to be governed by the same restrictions and conditions contained in this Exhibit, including your limitations on uses and disclosures of PHI. 2. You shall enter into an agreement with each of your subcontractors pursuant to 45 C.F.R. 164.308(b)(1) and 13401 of the HITECH Act that is appropriate and sufficient to require each such subcontractor to protect PHI to the same extent required by you hereunder. 3. Any person or entity who receives PHI from you must notify you of any potential breaches of confidentiality of such PHI within three (3) days of such potential breach. 4. You and your agents and subcontractors shall comply with applicable requirements of the Standards for Electronic Transactions (45 C.F.R. 160 and 162). D. Safeguards. 1. You shall establish, implement and maintain administrative, physical and technical safeguards that (a) reasonably protect the confidentiality, integrity and availability of all PHI (whether in electronic or other format) that you creates, receives, maintains or transmits on behalf of Trustmark as required by the HIPAA Security and Privacy Rules and (b) ensure that no PHI (whether in electronic or other format) created, received, maintained, transmitted, used or disclosed by you in connection with the performance and delivery of the Services is used or disclosed except as permitted by this Exhibit, including safeguards that satisfy the requirements of the Security Rule with respect to electronic PHI. 2. You shall ensure that each agent, including a subcontractor, to whom you provide PHI, agrees to implement reasonable and appropriate safeguards to protect such PHI. E. Reporting Requirements. 1. You shall report to Trustmark any potential use or disclosure of PHI that may be in violation of this Exhibit and not permitted under the HIPAA Security and Privacy Rules within five (5) calendar days of becoming aware of such potential use or disclosure. MK11BA HIPAA/MegaReg 8-2013/TL DD (2/17) Page 9 of 12

2. Pursuant to 45 C.F.R. 164.410, in the event of a breach or potential breach by you of unsecured PHI, as the terms breach and unsecured PHI are defined in 45 C.F.R. 164.402, you shall report such breach or potential breach to Trustmark within five (5) calendar days of becoming aware of such breach or potential breach. Your report shall include the identity of each individual whose PHI was or may have been breached, such individual s contact information, the information disclosed, the nature/cause of the breach or potential breach (including the recipient of the PHI), the date or period of time during which the breach or potential breach occurred, any corrective action taken to limit or further mitigate the current breach and future breaches and any other information required to allow Trustmark to provide a notification of the breach consistent with 45 C.F.R. 164.404. You are responsible for any and all costs related to notification for any security or privacy breach reported by you to Trustmark. 3. You shall report to Trustmark each potential security incident, as defined in 45 C.F.R. 164.304, within five (5) calendar days of becoming aware of such incident. For the avoidance of doubt and notwithstanding the foregoing, Trustmark and you acknowledge and agree that information systems are the frequent target of probes, scans, pings and other activities that may not indicate threats, whose sources may be difficult or impossible to identify and whose motives are unknown and that do not result in access or risk to any information system or PHI (each, an Access Attempt ). Although Access Attempts generally do not result in any unauthorized access to or modification or disclosure of PHI, Access Attempts do constitute security incidents, as defined in 45 C.F.R. 164.304, and, accordingly, you are required to report each Access Attempt to Trustmark. Trustmark agrees to accept this Exhibit as the notification required under 45 C.F.R. 164.304 and not require you to provide any additional notification so long as you (a) ensures that all Access Attempts are recorded in the your information technology records, (b) regularly reviews its information technology records to determine whether any Access Attempt resulted in unauthorized access to or modification or disclosure of PHI and (c) in the event that you are unable to make the determination described in clause (b) following review of its information technology logs, takes all steps reasonably designed to determine whether an Access Attempt resulted in unauthorized access to or modification or disclosure of PHI. 4. You shall report to Trustmark a request for access to PHI provided for in 45 C.F.R. 164.524 within five (5) calendar days of receipt of such request. You shall not respond to such request without written authorization of Trustmark. 5. You shall report to Trustmark within five (5) calendar days of receipt of a request to amend PHI. You shall not alter or amend PHI that it receives from Trustmark without specific written authorization of Trustmark, as provided for in 45 C.F.R. 164.526. 6. If an individual submits to you a request for restriction or a request for confidential communications as provided for in 45 C.F.R. 164.522, then you shall report such request to Trustmark within five (5) business days of receipt. You shall not respond to such requests without written authorization of Trustmark. F. Accounting of Disclosures. You shall respond to Trustmark within five (5) calendar days of receipt of a request for information that would be necessary for an accounting of disclosures of PHI as provided for in 45 C.F.R. 164.528. Such accounting shall include, but not be limited to, the date of the disclosure, the name and, if known, the address of the recipient of the PHI, the name of the individual who is the subject of the PHI, a brief description of the PHI disclosed and the purpose of the disclosure. Upon Trustmark s instruction, you shall include disclosures made on or after the date that is up to six (6) years prior to the request. You shall not be required to maintain a record of disclosures of PHI (1) made for the purpose of Treatment, Payment or Healthcare Operations, (2) made to an individual who is the subject of the PHI or (3) made pursuant to an authorization that is valid under HIPAA. G. Other Obligations. 1. To the extent that you perform any obligations of a Covered Entity under the Privacy Rule, you shall comply with the requirements of the Privacy Rule applicable to such Covered Entity in performing such obligations; provided, that unless Trustmark has notified you of obligations specifically applicable to such Covered Entity, you shall determine the extent and scope of such obligations in its reasonable judgment. MK11BA HIPAA/MegaReg 8-2013/TL DD (2/17) Page 10 of 12

2. You shall make available to Trustmark, the Secretary of Health and Human Services or its agents, your internal practices, books and records relating to the use and disclosure of PHI as required in 45 C.F.R. 164.504. 3. You acknowledges and agrees that from time to time the Department of Health and Human Services may modify the standard transactions now identified in 45 C.F.R. 162.1101 162.1802. You and your agents and subcontractors agree to abide by any changes to such standard transactions that are applicable to the Services. 4. You shall cooperate with Trustmark to comply with the HIPAA Security and Privacy Rules. 5. Of the actions that you perform in your role as Independent Contractor of Trustmark, you and your agents and subcontractors shall: a. be prepared to transmit and accept transactions electronically in the Standard Formats identified in 45 C.F.R. 162.1101 162.1802; (if applicable) b. adapt implementation plans and standards pursuant to applicable Implementation Guides; (if applicable) c. implement contingencies for non-compliant transactions as necessary to facilitate timely acceptance and payment of claims, particularly in light of state claim payment laws; (if applicable) and d. to the extent practicable, communicate with those providers, agents or subcontractors who are submitting or receiving transactions electronically in order to facilitate compliant transactions. (if applicable) III. OBLIGATIONS OF TRUSTMARK A. Trustmark shall notify you of any limitation in the notice of privacy practices of the applicable Covered Entity under 45 C.F.R. 164.520 to the extent that such limitation may affect your use or disclosure of PHI. B. Trustmark shall obtain all consents or authorizations necessary for your access to or creation, maintenance, use or disclosure of PHI subject to this Exhibit. C. Trustmark shall notify you of any restrictions applicable to the your use or disclosure of PHI that the applicable Covered Entity has accepted and that apply to any access to or use or disclosure of PHI subject to this Exhibit. D. Trustmark shall notify you of any restriction on the use or disclosure of PHI that Trustmark has agreed to in accordance with 45 C.F.R. 164.522. E. Trustmark shall not request that you use or disclose PHI in a manner that would not be permissible under Subpart E of 45 C.F.R. Part 1764 if so disclosed by the applicable Covered Entity. F. Trustmark shall notify you of any specific obligations of a Covered Entity applicable to any obligations of such Covered Entity that you perform under this Exhibit. G. Trustmark shall be solely responsible for compliance with the Security Rule and the implementation of reasonable and appropriate safeguards with respect to PHI that is subject to this Exhibit and that it provides to or receives from you, prior to its receipt by you, and upon and following its receipt by Trustmark from you. H. Trustmark shall be responsible for reporting security incidents, unauthorized uses and disclosures of PHI, and breaches to any applicable Covered Entity or other business associate. I. Trustmark shall provide you with any changes in, or revocation of, or authorization by Individual to use or disclose PHI, if such changes affect your permitted or required uses and disclosures. MK11BA HIPAA/MegaReg 8-2013/TL DD (2/17) Page 11 of 12

J. Trustmark shall notify you of any restriction on the use or disclosure of PHI that Trustmark has agreed to in accordance with 45 C.F.R. 164.522. IV. TERMINATION A. Termination. This Exhibit may be terminated in accordance with the termination rights set forth in the Agreement. In addition, this Exhibit shall automatically terminate when all PHI previously provided by Trustmark to you, or created or received by you on behalf of Trustmark, is destroyed or returned to Trustmark. B. Termination for Cause. Upon either party s knowledge or reasonable belief that the other party is in or has committed a breach or violation of any material obligation set forth in this Exhibit that is required pursuant to 45 C.F.R. 164.314(a)(2)(i) or 45 C.F.R. 164.504(e)(2), the non-breaching party may: 1. if the non-breaching party reasonably believes that such breach is or was due to the breaching party s willful neglect (as defined in the HIPAA Security and Privacy Rules), terminate this Exhibit with immediate effect by delivering written notice of such termination to the breaching party regardless of whether such breach is continuing at the time the non-breaching party delivers such notice; 2. if the non-breaching party reasonably believes that such breach was due to reasonable cause (as defined in the HIPAA Security and Privacy Rules) and such breach was not continuing at the time the non-breaching party became aware of such breach, require the breaching party to demonstrate that it has taken appropriate steps (including an independent assessment, at the breaching party s expense, of the breaching party s compliance with the obligation in question) that are, in the non-breaching party s sole discretion, reasonably designed to prevent a recurrence of such breach; or 3. if the non-breaching party reasonably believes that such breach is due to reasonable cause (as defined in the HIPAA Security and Privacy Rules) and such breach was continuing at the time the non-breaching party became aware of such breach, notify the breaching party of such breach and grant to the breaching party thirty (30) days following the breaching party s receipt of such notice in which to cure such breach; provided, that such thirty (30) day period shall be extended to the extent reasonably necessary to permit the breaching party to cure such breach so long as the breaching party takes all steps reasonably designed to cure such breach during such initial thirty (30) day period; provided, further, that if such thirty (30) day period is extended, the non-breaching party may require the breaching party to engage an independent third party to conduct an independent assessment, at the breaching party s expense, of the breaching party s efforts if such breach has not been cured within a reasonable period of time after expiration of the initial thirty (30) day period. C. Obligations of you upon Termination. Upon termination of the Agreement or this Exhibit, you shall promptly return to Trustmark, or, if agreed to by Trustmark, destroy, all PHI previously created, maintained or received by you on behalf of Trustmark that you maintained in any form. You shall retain no copies of such PHI. D. Retention of PHI. You may retain PHI to the extent reasonably necessary to permit you to comply with applicable laws and so long as you extend the protections of Exhibit to all such PHI and takes all actions necessary to limit further uses and disclosures of such PHI for so long as you retains such PHI. In addition, if Trustmark and you determine in good faith that termination of this Exhibit and the return or destruction of all PHI previously provided by Trustmark or the Health Plan to you would cause irreparable business interruption or harm to customers of Trustmark, or if termination of this Exhibit is otherwise not feasible, then (1) Trustmark and you shall take all commercially reasonable actions to mitigate the effects of such situation, (2) Trustmark or you may report such situation to the Secretary of Health and Human Services and (3) you shall extend the protections of this Exhibit to all such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as you maintain such PHI. Upon termination of the condition that makes retention of PHI by you necessary for your compliance with law or that makes return or destruction of PHI infeasible, you shall return or destroy such PHI as instructed by Trustmark. E. Survival. The obligations of you under this Section IV shall survive the termination of this Exhibit and the termination of the Agreement. MK11BA HIPAA/MegaReg 8-2013/TL DD (2/17) Page 12 of 12