10-04 Attachment B - BAA Qualified Service Agreement - rev 2026 with protection.docx

BUSINESS ASSOCIATE AGREEMENT WITH BROWARD COUNTY, FLORIDA

This Business Associate Agreement (“BAA”) is between the undersigned entity (“Business Associate”) and Broward County, Florida (“County”) (collectively, the “Parties”).

RECITALS

A. Business Associate performs functions or activities on behalf of County, or provides services to County, that involve the use or disclosure of Protected Health Information (in any form, including electronic, collectively “PHI”). Those functions, activities, or services are subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and 42 C.F.R. Part 2.

B. HIPAA, HITECH, and 42 C.F.R. Part 2 mandate that certain responsibilities of contractors with access to PHI be documented in a written agreement. The Parties desire to comply with the requirements of HIPAA, HITECH, and 42 C.F.R. Part 2 and acknowledge their respective responsibilities.

Now, therefore, for good and valuable consideration, the receipt and sufficiency of which are acknowledged, the Parties agree as follows:

ARTICLE 1. Definitions

1.1 All terms used in this BAA not otherwise defined herein shall have the meanings stated in the Privacy and Security Rules, 45 C.F.R. Parts 160, 162, 164, 42 U.S.C. § 17921, and 42 C.F.R. Part 2.

1.2 “HIPAA Laws” means collectively HIPAA, HITECH, 42 C.F.R. Part 2, and the related regulations and amendments.

1.3 “Penalties” as used in Section 4.21 below is defined as civil penalties that may be applied to Business Associate and its workforce members by the Secretary (“Secretary”) of Health and Human Services (“HHS”). The amount of the penalties range depending on the type of violation. In determining penalties, the Secretary may take into account:

a. the nature and extent of the violation;

b. the nature and extent of harm resulting from such violation;

c. the degree of culpability of the covered entity or business associate;

d. the history of prior compliance with the administrative simplification provision including violations by the covered entity or business associate;

e. the financial condition of the covered entity or business associate; and

f. such other matters as justice may require.

1.4 “Master Agreement” means the written, executed agreement between County and the Business Associate, if any, that involves the use or disclosure of PHI and that is identified on the signature page below or to which this document is an exhibit.

ARTICLE 2. Effective Date This BAA shall become effective on the earliest of the following (“Effective Date”): (a) the effective date of the Master Agreement; (b) the date this BAA is executed by the Parties; or (c) the date Business Associate begins to receive PHI for purposes of this BAA.

ARTICLE 3. Confidentiality

3.1 County and Business Associate shall comply with all federal and state laws governing the privacy and security of PHI.

3.2 ☒ If this box is checked, this BAA also constitutes a Qualified Service Organization Agreement, and County and Business Associate are required to comply with 42 C.F.R. Part 2 with respect to patient identifying information concerning substance use disorder treatment. Accordingly, information obtained by Business Associate relating to individuals who may have been diagnosed as needing, or who have received, substance use disorder treatment services shall be maintained and used only for the purposes intended under this BAA and in compliance with all applicable provisions of 42 C.F.R. Part 2. If necessary, Business Associate will resist any efforts in judicial proceedings to obtain access to PHI except as permitted by 42 C.F.R. Part 2.

ARTICLE 4. Obligations and Activities of Business Associate Use and Disclosure of PHI

4.1 Business Associate shall not use or disclose PHI other than as permitted or required by this BAA or as required by law. Business Associate may:

a. Use and disclose PHI only as necessary to perform its obligations under the Master Agreement or this BAA, provided that such use or disclosure would not violate HIPAA Laws if done by County;

b. Use the PHI received in its capacity as a Business Associate of County for its proper management and administration and to fulfill any legal responsibilities of Business Associate;

c. Disclose PHI in its possession to a third party for the proper management and administration of Business Associate, or to fulfill any legal responsibilities of Business Associate, provided that the disclosure would not violate HIPAA Laws if made by County or is required by law, and Business Associate has received from the third party written assurances that (i) the information will be kept confidential and used or further disclosed only for the purposes for which it was disclosed to the third party or as required by law; (ii) the third party will notify Business Associate of any instances of which it becomes aware in which the confidentiality of the information may have been breached; and (iii) the third party has agreed to implement reasonable and appropriate steps to safeguard the information;

d. Use PHI to provide data aggregation activities related to County operations; and

e. Deidentify any and all PHI created or received by Business Associate under the Master Agreement or this BAA, provided that the deidentification conforms to the requirements of the HIPAA Laws.

4.2 Business Associate is prohibited from selling PHI, using PHI for marketing purposes, or attempting to reidentify any PHI information in violation of HIPAA Laws. Business Associate agrees to comply with the restrictions set forth in 42 U.S.C. §§ 17935 and 17936 and related guidance issued by the Secretary from time to time.

4.3 Business Associate acknowledges that, effective on the Effective Date of this BAA, it shall be liable under the civil and criminal enforcement provisions set forth in 42 U.S.C. §§ 1320d-5 and 1320d-6, as amended, for failure to comply with any of the use and disclosure requirements of this BAA or any guidance issued by the Secretary from time to time with respect to such use and disclosure requirements.

Administrative, Physical, and Technical Safeguards

4.4 Business Associate shall implement the administrative safeguards set forth in 45 C.F.R. § 164.308, the physical safeguards set forth in 45 C.F.R. § 164.310, the technical safeguards set forth in 45 C.F.R. § 164.312, and the policies and procedures set forth in 45 C.F.R. § 164.316, to reasonably and appropriately protect the confidentiality, integrity, and availability of the PHI that it creates, receives, maintains, or transmits on behalf of County. Business Associate acknowledges that, effective on the Effective Date of this BAA, (a) the foregoing safeguards, policies, and procedures requirements shall apply to Business Associate in the same manner that such requirements apply to County, and (b) Business Associate shall be liable under the civil and criminal enforcement provisions set forth in 42 U.S.C. §§ 1320d-5 and 1320d-6, as amended from time to time, for failure to comply with the safeguards, policies, and procedures requirements and any guidance issued by the Secretary from time to time with respect to such requirements.

4.5 Business Associate shall require all of its subcontractors, agents, and other third parties that receive, use, transmit, maintain, store, or have access to PHI to agree, in writing, to the same restrictions, conditions, and requirements that apply to Business Associate pursuant to this BAA and the HIPAA Laws.

Access of Information; Amendment of Information; Accounting of Disclosures

4.6 Business Associate shall make available to County all PHI in designated record sets within ten days after County’s request to comply with 45 C.F.R. § 164.524.

4.7 Business Associate shall make any amendments to PHI in a designated record set as directed or agreed to by County pursuant to 45 C.F.R. § 164.526, and in the time and manner reasonably designated by County.

4.8 Business Associate agrees to comply with an individual’s request to restrict the disclosure of their personal PHI in a manner consistent with 45 C.F.R. § 164.522, except where such use, disclosure, or request is required or permitted under applicable law.

4.9 Business Associate agrees that, when requesting, using, or disclosing PHI in accordance with 45 C.F.R. § 164.502(b)(1), such request, use, or disclosure shall be to the minimum extent necessary, including the use of a “limited data set” as defined in 45 C.F.R. § 164.514(e)(2), to accomplish the intended purpose of such request, use, or disclosure, as interpreted under related guidance issued by the Secretary from time to time.

4.10 Business Associate shall timely document such disclosures of PHI and maintain information related to such disclosures as would be required for County to respond to an individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528. Further, Business Associate shall provide to County an accounting of all disclosures of PHI during the term of this BAA within ten days after termination of this BAA, or sooner if reasonably requested by County for purposes of any monitoring/auditing compliance with HIPAA Laws.

4.11 Business Associate shall provide County, or an individual under procedures approved by County, information and documentation collected in accordance with the preceding section to respond to an individual requesting an accounting for disclosures as provided under 45 C.F.R. § 164.528 or HIPAA Laws.

Notification of Breach

4.12 Business Associate shall notify County’s HIPAA Privacy Official at (954) 357-6500 of any impermissible access, acquisition, use, or disclosure of any Unsecured PHI (collectively and individually, a “Breach”) within 24 hours after Business Associate discovers such Breach. “Unsecured PHI” refers to such PHI that is not secured through use of a technology or methodology specified by the Secretary that renders such PHI unusable, unreadable, or indecipherable to unauthorized individuals. A Breach of Unsecured PHI is treated as discovered by Business Associate as of the first day on which such Breach is known to Business Associate or, by exercising reasonable diligence, would have been known to Business Associate, including any employee, officer, contractor, subcontractor, or other agent of Business Associate. In addition, Business Associate’s notification under this section shall comply in all respects with each applicable provision of the HIPAA Laws and all related guidance issued by the Secretary or the delegate of the Secretary from time to time.

4.13 Business Associate shall submit a written report of a Breach to County within ten business days after initial notification, which report shall document the following:

a. The identification of each individual whose Unsecured PHI has been, or is reasonably believed by Business Associate, to have been accessed, acquired, used, or disclosed during the Breach;

b. A brief description of what occurred, including the date of the Breach, if known, and the date of the discovery of the Breach;

c. A description of the types of Unsecured PHI that were involved in the Breach (such as full name, social security number, date of birth, home address, account number, diagnosis, etc.);

d. A description of what is being done to investigate the Breach and to mitigate harm to individuals, and the reasonable and appropriate safeguards being taken to protect against future Breaches;

e. Any steps County or the individual(s) impacted by the Breach should take to protect themselves from potential harm resulting from the Breach;

f. Contact procedures for Business Associate to enable individuals to ask questions or learn additional information, which may include, in the discretion of County, a toll-free telephone number, email address, website, or postal address, depending upon the available contact information that Business Associate has for the affected individuals; and

g. Any other information reasonably requested by County.

4.14 County, in its sole discretion, will determine whether County or Business Associate shall be responsible to provide notification to individuals whose Unsecured PHI has been impermissibly accessed, acquired, used, or disclosed, as well as to the Secretary and the media. Such notification shall be provided as follows:

a. Notification will be by first-class mail, or by electronic mail, if the individual has specified notice by electronic mail.

b. Information may be posted on County’s and Business Associate’s website(s) where Business Associate experienced, or is reasonably believed to have experienced, an impermissible access, acquisition, use, or disclosure of Unsecured PHI that compromised the security or privacy of more than ten individuals if no other current information is available to inform such individuals.

c. Notice shall be provided to prominent media outlets with information on an incident where Business Associate experienced an impermissible access, acquisition, use or disclosure of Unsecured PHI that compromised the security or privacy of more than 500 individuals within the same state or jurisdiction.

4.15 In the event of the impermissible access, acquisition, use, or disclosure of Unsecured PHI in violation of HIPAA Laws, Business Associate bears the burden of demonstrating that all notification(s) required by Sections 4.12 through 4.14 (as applicable) were made, including evidence demonstrating the necessity of any delay, or that the use or disclosure did not constitute a Breach of Unsecured PHI.

4.16 Business Associate shall pay the costs of providing all notification(s) required by Sections 4.12 through 4.14 (as applicable) of this BAA.

Mitigation of Breach

4.17 Business Associate shall mitigate to the extent possible, at its own expense, any harmful effects that are known to Business Associate regarding any access, use, or disclosure of Unsecured PHI in violation of the requirements of this BAA or applicable law.

4.18 Business Associate shall take appropriate disciplinary action against any members of its workforce who use or disclose Unsecured PHI in any manner not authorized by this BAA or applicable law.

4.19 Business Associate shall have established procedures to investigate a Breach, mitigate losses, and protect against any future breaches, and shall provide such procedures and any specific findings of the investigation to County in the time and manner reasonably requested by County.

4.20 In the event of a Breach, Business Associate shall, in consultation with and at the direction of County, assist County in conducting a risk assessment of the Breach and mitigate, to the extent practicable, any harmful effects of such Breach known to Business Associate. Business Associate shall pay the reasonable costs for mitigating damages, including, but not limited to, the expenses for credit monitoring, if County determines that the Breach warrants such measures. The mitigation described in this section shall be in addition to, and not in lieu of, any other remedy County may have for the Breach, including but not limited to indemnification and any action for damages available to County under contract or at law or in equity.

4.21 In the event of a violation of the HIPAA Laws as a result of any practice, behavior, or conduct of Business Associate or its agents or employees, Business Associate will be liable to County for any civil penalties imposed on County arising from the violation.

4.22 The requirement to comply with the Notification of Breach and Mitigation of Breach sections of this BAA shall survive the expiration or earlier termination of this BAA.

Available Books and Records

4.23 Business Associate shall make its internal practices and books, related to the Master Agreement or this BAA, including all policies and procedures required by HIPAA Laws, available to the County Contract Administrator within five business days after County’s written request.

4.24 Business Associate shall make its internal practices, books, and records, including all policies and procedures required by HIPAA Laws, relating to the use and disclosure of PHI received from County or created or received on behalf of County, available to County or to the Secretary or its designee within five business days after request for the purposes of determining Business Associate’s compliance with HIPAA Laws.

ARTICLE 5. Obligations of County

5.1 County shall notify Business Associate of any limitations in its notice of privacy practices in accordance with 45 C.F.R. § 164.520, to the extent that such limitations may affect the Business Associate’s use of PHI.

5.2 County shall notify Business Associate of any changes in, or revocation of, permission by an individual to use or disclose PHI, to the extent that such changes may affect Business Associate’s use of PHI.

5.3 County shall notify Business Associate of any restriction to the use or disclosure of PHI to which County has agreed in accordance with 45 C.F.R. § 164.522, to the extent that such changes may affect Business Associate’s use of PHI.

5.4 County shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Laws if done by County.

5.5 County may report, at least annually, any impermissible access, use, or disclosure of unsecured PHI by Business Associate to the Secretary as required by HIPAA Laws.

ARTICLE 6. Term and Termination

6.1 This BAA shall be effective upon the Effective Date, and shall terminate upon the later of (a) expiration or earlier termination of the Master Agreement, or (b) return or destruction of all PHI within the possession or control of Business Associate as a result of the Master Agreement or this BAA.

6.2 Upon a material breach of this BAA by Business Associate, County may:

6.3 Upon expiration or termination of the Master Agreement, Business Associate agrees, at County’s option, to return to County or destroy all PHI gathered, created, received, or processed pursuant to the Master Agreement or this BAA. No PHI related to the Master Agreement or this BAA will be retained by Business Associate, or a contractor, subcontractor, or other agent of Business Associate, unless retention is required by law and specifically permitted in writing by County.

6.4 If returning or destroying PHI is infeasible, Business Associate shall provide to County a written statement that it is infeasible to return or destroy the PHI and describe the conditions that make return or destruction of the PHI infeasible. Under that circumstance, Business Associate shall extend the protections of this BAA to the PHI retained and limit further uses and disclosures of such PHI to those purposes that make return or destruction infeasible, for so long as Business Associate maintains the PHI. Business Associate’s obligations under this section shall survive termination of this BAA.

ARTICLE 7. Miscellaneous

7.1 Amendment. County and Business Associate shall cooperate to take any action necessary to amend this BAA for County to comply with HIPAA Laws or other applicable law.

7.2 Interpretation. Any ambiguity in this BAA shall be resolved to permit County to comply with HIPAA Laws. Any inconsistency between the HIPAA Laws, as interpreted by the HHS, a court, or another regulatory agency with authority over the Parties, and this BAA shall be interpreted in favor of the HIPAA Laws as interpreted by the HHS, the court, or the regulatory agency. Any provision of this BAA that differs from the requirements of the HIPAA Laws, but is nonetheless permitted by the HIPAA Laws, shall be adhered to as stated in this BAA.

7.3 Florida Electronic Health Records Exchange Act. If Business Associate is a healthcare provider, as that term is used in Section 408.051(2), Florida Statutes, Business Associate shall comply with the requirements of the Florida Electronic Health Records Exchange Act (“FEHREA”), Section 408.051, Florida Statutes. The requirement to comply with this provision and FEHREA shall survive the expiration or earlier termination of this BAA.

7.4 Successors and Assignment. This BAA will be binding on the respective successors and assigns of County and Business Associate. However, this BAA may not be assigned, in whole or in part, without the written consent of the other Party. Any attempted assignment in violation of this provision shall be null and void.

7.5 Standard Agreement Terms and Conditions. If a Master Agreement exists between the Parties, then the terms of the Master Agreement are expressly incorporated herein. If no such Master Agreement exists between the Parties, then the following portions of the Broward County Standard Agreement Form (BCF 101), available on the County’s Purchasing website (click here: https://www.broward.org/Purchasing/Pages/StandardTerms.aspx, are hereby incorporated as if fully set forth herein:

a. Article 6;

b. Article 7;

c. Article 9;

d. Article 11, with Business Associate’s contact information listed in the signature pages incorporated in the “Notices” Section, and incorporating the following contact information for County in the “Public Records” and the “Notices” Sections: Averill Dorsett, Broward County Privacy Officer, 115 S. Andrews Avenue, Fort Lauderdale, Florida 33301, (954) 357-6503, adorsett@broward.org.

[Remainder of Page Intentionally Left Blank]

IN WITNESS WHEREOF, the Parties have made and executed this Business Associate Agreement: Broward County, through its Board of County Commissioners, signing by its County Administrator, authorized to execute same, and Business Associate, signing by and through its duly authorized representative.

Master Agreement: _____________________________________________________________ (List agreement title and solicitation or contract number; if none, leave blank.)

BROWARD COUNTY

BROWARD COUNTY, by and through its County Administrator By: ____________________________ County Administrator ____ day of _______________, 20___ Approved as to form by Andrew J. Meyers Broward County Attorney 115 South Andrews Avenue, Suite 423 Fort Lauderdale, Florida 33301 Telephone: (954) 357-7600 By: ____________________________ Attorney’s Name (Date) Senior/Assistant County Attorney ABC/wp Name of Document 00/00/26

#XXXXX

BUSINESS ASSOCIATE

Entity Name: __________________________ Signature: _____________________________ Print Name: ___________________________ Title: _________________________________ Date: _________________________________ Business Associate Contact information:

Contact person: ________________________ Address: ______________________________ Telephone: ____________________________ E-mail: ________________________________

Business Associate Agreement (2026) Page 1 of 2 image1.jpeg