2023/11/29 Council Agenda Packet

1 BUSINESS ASSOCIATE AGREEMENT Regarding DATA PRIVACY AND SECURITY This Business Associate Agreement (the “Agreement”), is made as of the 1 day of January, 2024 (the “Effective Date”), by and between Business Associate and Covered Entity (collectively the “Parties”) to comply with privacy standards adopted by the U.S. Department of Health and Human Services as they may be amended from time to time, 45 CFR parts 160 and 164 (“the Privacy Rule”) and security standards adopted by the U.S. Department of Health and Human Services as they may be amended from time to time, 45 CFR parts 160, 162 and 164, subpart C (“the Security Rule”), and the Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 and regulations promulgated thereunder and any applicable state confidentiality laws. RECITALS WHEREAS, Business Associate provides certain plan related services to or on behalf of Covered Entity; WHEREAS, in connection with these services, Covered Entity discloses to Business Associate certain PHI that is subject to protection under the HIPAA Rules; and WHEREAS, the HIPAA Rules require that Covered Entity receive adequate assurances that Business Associate will comply with certain obligations with respect to the PHI received in the course of providing services to or on behalf of Covered Entity. NOW THEREFORE, in consideration of the mutual promises and covenants herein, and for other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties agree as follows: SECTION 1 DEFINITIONS The terms used in this Agreement but not otherwise defined in this Agreement have the same meaning ascribed in the HIPAA Rules: A. Breach. “Breach” will have the same meaning as the term “breach” in 45 CFR §§ 164.402. B. Breach of Security. “Breach of Security,” as that term is defined in 45 CFR §164.402, and which includes the unauthorized acquisition, access, use, or disclosure of PHI which compromises the security or privacy of the PHI, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.