If your OrganizationExamSource is only an association table, you can use a many-to-many between Organization and ExamSource (
http://www.hibernate.org/hib_docs/v3/reference/en/html/associations.html#assoc-bidirectional-join-m2m) and don't have to define a <class> for OrganizationExamSource.
But it looks like you have extra fields in the association table (e.g. 'noAccess'), so you probably want to set it up as two many-to-ones (
http://www.hibernate.org/hib_docs/v3/reference/en/html/associations.html#assoc-bidirectional-m21).
So your OrganizationExamSource would have two <many-to-one> associations (to Organization and ExamSource), and Organization and ExamSource would each have a matching inverse <set> association.
Hope that helps.