25-8426_Attachment_A_Business_Associate_Agreement.pdf

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement ("Agreement") is entered into between COLLIER COUNTY Government, a political subdivision of the State of Florida (hereinafter referred to as the "Covered Entity") and ___________________________________________, a corporation duly organized and existing under the laws of the State of _________, and registered to do business in the State of Florida (hereinafter referred to as the "Business Associate"), effective as of this _____day_________________, 2026 (the “Effective Date”).

WHEREAS, Covered Entity and Business Associate have entered into, or plan to enter into, an arrangement pursuant to which Business Associate may provide services for Covered Entity that require Business Associate to receive Protected Health Information ("PHI") on behalf of Covered Entity that is confidential under state and/or federal law; and

WHEREAS, Covered Entity and Business Associate intend to protect the privacy and provide for the security of PHI disclosed by Covered Entity to Business Associate, or created by Business Associate on behalf of Covered Entity, in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 ("HIPAA"), and the regulations promulgated there under, including, without limitation, the Standards for the Privacy of Individually Identifiable Health Information codified at 45 CFR Parts 160 and 164 (“Privacy Rule”) and the Security Standards for the Protection of Electronic Protected Health Information at 45 C.F.R. Parts 160 and 164 (“Security Rule”) (collectively "HIPAA Regulations");

as amended by the applicable provisions of the Health Information Technology for Economic and Clinical Health Act, as incorporated in the American Recovery and Reinvestment Act of 2009, and its implementing regulations and guidance issued by the Secretary of the Department of Health and Human Services (the "Secretary") (the "HITECH Act"); as amended by the Final HIPAA regulations (collectively the “HIPAA Rules"); and

WHEREAS, the HIPAA Regulations require Covered Entity to enter into an agreement with

Business Associate meeting certain requirements with respect to the Use and Disclosure of PHI, which are met by this Agreement.

NOW, THEREFORE, in consideration of the mutual promises contained herein and the exchange of information pursuant to this Agreement, the parties agree as follows:

1. Definitions.

Capitalized terms used herein without definition shall have the meanings ascribed to them in the HIPAA Rules, as applicable unless otherwise defined herein.

“Protected Health Information” or “PHI” shall have the same meaning as the term “protected health information” in 45 C.F.R. §160.103 and is limited to the PHI that Business Associate creates or receives from or on behalf of Covered Entity. As used herein, it also includes electronic Protected Health Information.

“Electronic Protected Health Information” or “ePHI” shall have the same meaning as the term “electronic protected health information” in 45 C.F.R. § 160.103 and refers to electronic Protected Health Information transmitted by, or maintained in, electronic media for or on behalf of the Covered Entity.

2. Obligations and Activities of Business Associate.

a. Permitted Uses and Disclosures. Business Associate shall Use or Disclose PHI for the purposes of (i) performing Business Associate's obligations under the (insert description of the Agreement) _____________ Services Agreement (the “Services Agreement”) resulting from Covered Entity's solicitation (insert RFP/ITB/etc. No. and description)” (including all Appendices/Agreements attached to that Services Agreement); or (ii) as permitted or Required By Law; or (iii) as otherwise permitted by this Agreement.

Business Associate shall not Use or further Disclose PHI other than as permitted or required by this Agreement or as Required By Law.

Further, Business Associate shall not Use or Disclose PHI in any manner that would constitute a violation of the Privacy Rule if it were done by Covered Entity, except as set forth below in this Section 2.a, Business Associate may Use PHI: (i) for the proper management and administration of Business Associate; and, (ii) to carry out the legal responsibilities of Business Associate. Business Associate may Disclose PHI for the proper management and administration of Business Associate, to carry out its legal responsibilities or for payment purposes as specified in 45 CFR § 164.506(c)(l) and (3), including but not limited to Disclosure to a business associate on behalf of a covered entity or health care provider for payment purposes of such covered entity or health care provider, provided that with respect to any such Disclosure either: (i) the Disclosure is Required By Law; or (ii) Business Associate shall obtain reasonable assurances from the person to whom the PHI is to be Disclosed that such person will hold the PHI in confidence and will not use and further disclose such PHI except as Required By Law and for the purpose(s) for which it was Disclosed by Business Associate to such person, and that such person will notify Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached. Business Associate may de-identify any and all PHI obtained by Business Associate, and use such de-identified data on Business Associate’s own behalf, all in accordance with the de-identification requirements of the Privacy Rule. The parties acknowledge and agree that de-identified data does not constitute PHI. Business Associate may use PHI to provide Data Aggregation services to Covered Entity as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B). Business Associate may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 C.F.R. § 164.502(j)(1). Business Associate may use PHI to the extent and for any purpose authorized by an Individual under 45 C.F.R. § 164.508.

b. Appropriate Safeguards. Business Associate shall implement administrative, physical and technical safeguards that (i) reasonably and appropriately protect the confidentiality, integrity and availability of electronic PHI that it creates, receives, maintains or transmits on behalf of Covered Entity;

and (ii) prevent the Use or Disclosure of PHI other than as contemplated by the Services Agreement and this Agreement.

c. Compliance with Security Provisions. Business Associate shall: (i) implement and maintain administrative safeguards as required by 45 CFR § 164.308, physical safeguards as required by 45 CFR § 164.310 and technical safeguards as required by 45 CFR § 164.312; (ii) implement and document reasonable and appropriate policies and procedures as required by 45 CFR § 164.316; and (iii) be in compliance with all requirements of the Security Rule related to security and applicable to Business Associate.

d. Compliance with Privacy Provisions. Business Associate shall only Use and

Disclose PHI as permitted in this Agreement or as Required By Law and in compliance with each applicable requirement of 45 CFR § 164.504(e). To the extent Business Associate is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of Subpart E of 45 CFR Part 164 that apply to Covered Entity in the performance of such obligation(s).

e. Duty to Mitigate. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in violation of the requirements of this Agreement.

f. Encryption. To facilitate Business Associate's compliance with this Agreement and to assure adequate data security, Covered Entity agrees that all PHI provided or transmitted to Business Associate pursuant to the Services Agreement shall be provided or transmitted in a manner which renders such PHI unusable, unreadable or indecipherable to unauthorized persons, through the use of a technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2) of the HITECH Act.

Covered Entity acknowledges that failure to do so could contribute to or permit a Breach requiring patient notification under the HITECH Act and further agrees that Business Associate shall have no liability for any Breach caused by such failure.

3. Reporting.

a. Security Incidents and/or Unauthorized Use or Disclosure. Business Associate shall report to Covered Entity a successful Security Incident affecting Covered Entity’s PHI or any Use and/or Disclosure of PHI other than as provided for by this Agreement within a reasonable time of becoming aware of such Security Incident and/or unauthorized Use or Disclosure (but not later than five (5) days thereafter), in accordance with the notice provisions set forth herein. Business Associate shall take prompt and reasonable action to cure any such deficiencies. Notwithstanding the foregoing, the parties acknowledge that this Section 3.a constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence or attempts of “Unsuccessful Security Incidents” for which no additional notice to Covered Entity shall be required. “Unsuccessful Security Incidents” means, without limitation, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denial of service attacks, and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of PHI.

b. Breach of Unsecured PHI. If Business Associate Discovers that a Breach of unsecured

PHI has occurred, Business Associate shall notify Covered Entity of such reportable Breach in writing within five (5) days of the date Business Associate Discovers such Breach. Business Associate shall be deemed to have discovered a Breach as of the first day that the Breach is either known to Business Associate, or by exercising reasonable diligence would have been known to any of Business Associate’s employees, officers or agents, other than the person who committed the Breach. To the extent the information is available to Business Associate, Business Associate's written notice shall include the information required by 45 CFR § 164.410(c). Business Associate shall promptly supplement the written report with additional information regarding the Breach as it obtains such information. Business Associate shall reasonably cooperate with Covered Entity in meeting Covered Entity's obligations under the HIPAA Rules with respect to such Breach.

4. Business Associate's Agents. To the extent that Business Associate uses one or more subcontractors or agents to provide services under the Services Agreement, and such subcontractors or agents receive or have access to PHI that Business Associate received from, or created or received from or on behalf of Covered Entity, Business Associate shall sign an agreement with such subcontractors or agents containing substantially the same provisions as this Agreement.

5. Rights of Individuals.

a. Access to PHI. To the extent that Business Associate maintains a Designated Record

Set on behalf of Covered Entity, within ten (10) days of receipt of a request by Covered Entity, Business Associate shall make PHI maintained in that Designated Record Set available to Covered Entity to enable Covered Entity to fulfill its obligations under 45 CFR § 164.524. Subject to Section 5.b below, in the event that any Individual requests access to PHI directly from Business Associate, Business Associate shall forward a copy of such request to Covered Entity and Covered Entity shall be responsible for responding to such request.

b. Access to Electronic Health Records. If Business Associate is deemed to use or maintain an Electronic Health Record on behalf of Covered Entity with respect to PHI received from Covered Entity, then, pursuant to 45 CFR § 164.524, Business Associate shall provide Covered Entity with a copy of an Individual's PHI maintained in such Electronic Health Record in an electronic format in order for Covered Entity to comply with 45 CFR § 164.524, provided that it is readily producible in such format;

if it is not readily producible in such format, Business Associate will work with Covered Entity to determine an alternative form and format or provide a hard copy form if the Individual declines to accept all readily producible electronic forms. If an Individual requests access to his or her PHI directly from Business Associate, Business Associate shall promptly forward such request to Covered Entity and Covered Entity shall be responsible for responding to such request.

c. Amendment of PHI. To the extent that Business Associate maintains a Designated

Record Set on behalf of Covered Entity, Business Associate agrees to make any amendment(s) to PHI in that Designated Record Set that Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 at the request of Covered Entity, and in the time and manner mutually agreed. If an Individual requests an amendment of his or her PHI directly from Business Associate, Business Associate shall either (1) promptly forward such request to Covered Entity and Covered Entity shall be responsible for responding to such request or (2) elect to respond directly to the request.

d. Accounting Rights. This Section 5.d is subject to Section 5.e below. Business

Associate shall make available to Covered Entity, in response to a request from an Individual, information required for an accounting of disclosures of PHI with respect to the Individual, in accordance with 45 CFR § 164.528. Such accounting is limited to disclosures that were made in the six (6) years prior to the request.

Business Associate shall provide such information as is necessary to provide an accounting within ten (10) days of Covered Entity's request, at no cost to the Covered Entity or Individual.

e. Accounting of Disclosures of Electronic Health Records. If Business Associate is deemed to use or maintain an Electronic Health Record with respect to PHI maintained on behalf of Covered Entity, then, in addition to complying with the requirements set forth in Section 5.d above, Business Associate shall maintain an accounting of any Disclosures made through such Electronic Health Record.

Such accounting shall comply with the requirements of 45 CFR § 164.528. Upon request by Covered Entity, Business Associate shall provide such accounting to Covered Entity in compliance with the HIPAA Rules, provided that it is readily producible in such format; if it is not readily producible in such format, Business Associate will work with Covered Entity to determine an alternative form and format or provide a hard copy form if the Individual declines to accept all readily producible electronic forms.

f. Agreement to Restrict Disclosure. If Covered Entity is required to comply with a restriction on the Disclosure of PHI pursuant to 45 C.F.R. § 164.522 or 42 U.S.C. § 17935(a), then Covered Entity shall, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI under this Agreement, provide written notice to Business Associate of the name of the Individual requesting the restriction and the PHI affected thereby. Business Associate shall, upon receipt of such notification, not Disclose the identified PHI to any health plan for the purposes of carrying out Payment or Health Care Operations, except as otherwise required by law or unless doing so would unreasonably burden healthcare operations, in which case Business Associate will notify Covered Entity.

6. Remuneration and Marketing.

a. Remuneration for PHI. Business Associate agrees that it shall not, directly or indirectly, receive remuneration in exchange for any PHI of Covered Entity in compliance with 42 U.S.C.

§ 17935(d).

b. Limitations on Use of PHI for Marketing Purposes. Business Associate shall not make or cause to be made any communication about a product or service that is prohibited by 42 U.S.C. § 17936(a).

7. Governmental Access to Records. Business Associate shall make its internal practices, books and records relating to the Use and Disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity available to the Secretary for purposes of determining Covered Entity's compliance with the HIPAA Regulations. Except to the extent prohibited by law, Business Associate agrees to notify Covered Entity of all requests served upon Business Associate for information or documentation by or on behalf of the Secretary. Business Associate shall provide to Covered Entity a copy of any PHI that Business Associate provides to the Secretary promptly after providing such PHI to the Secretary.

8. Minimum Necessary. Business Associate shall limit its Use, Disclosure or request of PHI to the minimum necessary to accomplish the intended Use, Disclosure or request, respectively in accordance with 42 U.S.C. § 17935(b).

9. Obligations of Covered Entity. (a) Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices of Covered Entity in accordance with 45 C.F.R. § 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI under this Agreement; (b) Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose PHI, to the extent that such changes may affect Business Associate’s use or disclosure of PHI under this Agreement; (c) Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI to which Covered Entity has agreed in accordance with 45 C.F.R. § 164.522 or 42 U.S.C. § 17935(a), to the extent that such restriction may affect Business Associate’s use or disclosure of PHI under this Agreement; (d) Covered Entity represents that: (i) it is entitled to receive PHI in accordance with 45 C.F.R. § 164.504(f), (ii) it has received a certification from the Plan Sponsor in accordance with 45 C.F.R. § 164.504(f)(2)(ii), and (iii) the Plan documents permit the Plan to received PHI, including detailed invoices, reports and statements from Business Associate; (e) Covered Entity in performing its obligations and exercising its rights under this Agreement shall use and disclose PHI in compliance with the HIPAA Rules and shall not request Business Associate to use or disclose PHI in any manner that would violate this Agreement or the HIPAA Rules. Covered Entity represents that a request for PHI from Business Associate to Covered Entity shall only be the minimum amount of PHI necessary to accomplish the permitted purpose of the applicable request or use.

10. Termination.

a. Breach by Business Associate. If Covered Entity knows of a pattern of activity or practice of Business Associate that constitutes a material breach or violation of Business Associate's obligations under this Agreement, then Covered Entity shall promptly notify Business Associate. With respect to such breach or violation, Business Associate shall take reasonable steps to cure such breach or end such violation on or before ten (10) days after receipt of such written notice, if possible. If such steps are either not possible or are unsuccessful, upon written notice to Business Associate, Covered Entity may immediately terminate this Agreement with Business Associate.

b. Breach by Covered Entity. If Business Associate knows of a pattern of activity or practice of Covered Entity that constitutes a material breach or violation of Covered Entity's obligations under this Agreement, then Business Associate shall promptly notify Covered Entity. With respect to such breach or violation, Covered Entity shall take reasonable steps to cure such breach or end such violation on or before ten (10) days after receipt of such written notice, if possible. If such steps are either not possible or are unsuccessful, upon written notice to Covered Entity, Business Associate may immediately terminate this Agreement with Covered Entity.

c. Automatic Termination. This Agreement will automatically terminate, without any further action by the parties hereto, upon expiration or termination of the Services Agreement by and between the parties hereto.

d. Effect of Termination. Except as provided in this Section 10.d, upon termination of this Agreement for any reason, Business Associate shall either return or destroy all PHI that Business Associate or its agents or subcontractors still maintain in any form and shall retain no copies of such PHI.

If Business Associate reasonably determines that return or destruction is not feasible, Business Associate shall continue to extend the protections of this Agreement to such PHI, and limit further uses and disclosures of such PHI to those purposes that make the return or destruction of such PHI not feasible. If Business Associate is asked to destroy the PHI, Business Associate shall destroy PHI in a manner that renders the PHI unusable, unreadable or indecipherable to unauthorized persons. The parties agree that it would not be feasible for Business Associate to return or destroy the PHI reasonably needed to be retained by Business Associate for its own legal and risk management purposes, including copies of PHI that may be included in information retained for archival purposes.

11 Amendment. The parties acknowledge that federal laws relating to the HIPAA Rules are rapidly evolving and that amendment of this Agreement and the Services Agreement may be required to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to implement any new or modified standards or requirements of the HIPAA Rules relating to the security or confidentiality of PHI. Upon the request of Covered Entity, Business Associate agrees to promptly enter into negotiation concerning the terms of an amendment to this Agreement and the Services Agreement incorporating any such changes.

12. No Third-Party Beneficiaries. Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than Covered Entity, Business Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.

13. Effect on Services Agreement. In the event of any conflict between this Agreement and the related Services Agreement between Covered Entity and Business Associate, the terms of this Agreement shall control with respect to the subject matter herein.

14. Survival. The rights and obligations of Business Associate under Section 10.d of this

Agreement shall survive the termination or expiration of this Agreement.

15. Interpretation. This Agreement shall be interpreted as necessary to comply with the HIPAA Rules. The parties agree that any ambiguity in this Agreement shall be resolved in favor of a meaning that complies and is consistent with the HIPAA Rules.

16. Governing Law. Except to the extent not preempted by federal law with respect to the

HIPAA Rules, this Agreement shall be construed in accordance with the laws of the State of Florida.

16.1 Further, Business Associate shall comply with any relevant State privacy laws to the extent that such State privacy laws are not preempted by the HIPAA Rules.

17. Notices. All notices required or permitted under this Agreement shall be in writing and sent to the other party as directed below or as otherwise directed by either party, from time to time, by written notice to the other. All such notices shall be deemed validly given upon receipt of such notice by certified mail, postage prepaid, facsimile transmission, e-mail or personal or courier delive1y:

If to Covered Entity: Collier County Government Center

3311 Tamiami Trail E.

Naples, FL 34112 Attn: Risk Management Director Telephone no: 239-252-8966 Email: Michael.Quigley@collier.gov

If to Business Associate:

Telephone:

Email: _________________________________

18. Indemnification. The Business Associate shall indemnify and hold harmless Covered Entity and any of Covered Entity’s affiliates, directors, officers, employees and agents from and against any claim, cause of action, liability, damage, cost or expense (including reasonably attorneys’ fees) arising out of or directly relating to any non-permitted disclosure of PHI or other breach of this Agreement by Business Associate or any affiliate, director, officer, employee, agent or subcontractor of Business Associate.

19. Miscellaneous.

a. Severability. In the event that any provision of this Agreement is adjudged by any court of competent jurisdiction to be void or unenforceable, all remaining provisions hereof shall continue to be binding on the parties hereto with the same force and effect as though such void or unenforceable provision had been deleted.

b. Waiver. No failure or delay in exercising any right, power or remedy hereunder shall operate as a waiver thereof; nor shall any single or partial exercise of any right, power or remedy hereunder preclude any other further exercise thereof or the exercise of any other right, power or remedy. The rights provided hereunder are cumulative and not exclusive of any rights provided by law.

c. Entire Agreement. This Agreement constitutes the entire agreement between the parties hereto relating to the subject matter hereof, and supersedes any prior or contemporaneous verbal or written agreements, communications and representations relating to the subject matter hereof.

d. Counterparts, Facsimile. This Agreement may be signed in two or more counterparts, each of which shall be deemed an original and all of which taken together shall constitute one and the same instrument. A copy of this Agreement bearing a facsimile signature shall be deemed to be an original.

e. Regulatory Reference. Any reference made herein to any provision of law or regulation shall be a reference to such section as in effect and as same may be amended from time to time.

f. Amendment Generally. This Agreement may not be amended except in a writing signed by both parties hereto. Both parties hereto agree that this agreement shall be amended to comply with any and all state or federal laws rules, or regulations, including without limitation any future laws, rules or regulations.

IN WITNESS WHEREOF, the parties hereto have caused this Agreement to be signed as of the date first set forth above.

COVERED ENTITY:

BOARD OF COUNTY COMMISSIONERS OF

COLLIER COUNTY, FLORIDA

By: _____________________________________ Michael Quigley, Director of Risk Management

BUSINESS ASSOCIATE:

First Witness: By:_________________________________________

________________________________ Print Name: __________________________________ Signature Title:________________________________________ Print Name

Second Witness:

Signature

Print Name

BUSINESS ASSOCIATE AGREEMENT