3. Business Associate Agreement (01-10-2024).pdf

APPENDIX E

San Francisco Department of Public Health

Business Associate Agreement

1 | P a g e OCPA & CAT v1/10/2024

This Business Associate Agreement (“BAA”) supplements and is made a part of the contract by and between the City and County of San Francisco, the Covered Entity (“CE”), and Contractor, the Business Associate (“BA”) (the “Agreement”). To the extent that the terms of the Agreement are inconsistent with the terms of this BAA, the terms of this BAA shall control.

RECITALS

A. CE, by and through the San Francisco Department of Public Health (“SFDPH”), wishes to disclose certain information to BA pursuant to the terms of the Agreement, some of which may constitute Protected Health Information (“PHI”) (defined below).

B. For purposes of the Agreement, CE requires Contractor, even if Contractor is also a covered entity under HIPAA, to comply with the terms and conditions of this BAA as a BA of CE.

C. CE and BA intend to protect the privacy and provide for the security of PHI disclosed to BA pursuant to the Agreement in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act, Public Law 111-005 (“the HITECH Act”), and regulations promulgated there under by the U.S. Department of Health and Human Services (the “HIPAA Regulations”) and other applicable laws, including, but not limited to, California Civil Code §§ 56, et seq., California Health and Safety Code § 1280.15, California Civil Code §§ 1798, et seq., California Welfare & Institutions Code §§5328, et seq., and the regulations promulgated there under (the “California Regulations”).

D. As part of the HIPAA Regulations, the Privacy Rule and the Security Rule (defined below) require CE to enter into a contract containing specific requirements with BA prior to the disclosure of PHI, as set forth in, but not limited to, Title 45, Sections 164.314(a), 164.502(a) and (e) and 164.504(e) of the Code of Federal Regulations (“C.F.R.”) and contained in this BAA.

E. BA enters into agreements with CE that require the CE to disclose certain identifiable health information to BA. The parties desire to enter into this BAA to permit BA to have access to such information and comply with the BA requirements of HIPAA, the HITECH Act, and the corresponding Regulations.

In consideration of the mutual promises below and the exchange of information pursuant to this BAA, the parties agree as follows:

1. Definitions.

a. Breach means the unauthorized acquisition, access, use, or disclosure of PHI that compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information, and shall have the meaning given to such term under the HITECH Act and HIPAA Regulations [42 U.S.C. Section 17921 and 45 C.F.R. Section 164.402], as well as California Civil Code Sections 1798.29 and 1798.82.

2 | P a g e OCPA & CAT v1/10/2024

b. Breach Notification Rule shall mean the HIPAA Regulation that is codified at 45 C.F.R.

Parts 160 and 164, Subparts A and D.

c. Business Associate is a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information received from a covered entity, but other than in the capacity of a member of the workforce of such covered entity or arrangement, and shall have the meaning given to such term under the Privacy Rule, the Security Rule, and the HITECH Act, including, but not limited to, 42 U.S.C. Section 17938 and 45 C.F.R. Section 160.103.

d. Covered Entity means a health plan, a health care clearinghouse, or a health care provider who transmits any information in electronic form in connection with a transaction covered under HIPAA Regulations, and shall have the meaning given to such term under the Privacy Rule and the Security Rule, including, but not limited to, 45 C.F.R. Section 160.103.

e. Data Aggregation means the combining of Protected Information by the BA with the Protected Information received by the BA in its capacity as a BA of another CE, to permit data analyses that relate to the health care operations of the respective covered entities, and shall have the meaning given to such term under the Privacy Rule, including, but not limited to, 45 C.F.R. Section 164.501.

f. Designated Record Set means a group of records maintained by or for a CE, and shall have the meaning given to such term under the Privacy Rule, including, but not limited to, 45 C.F.R.

Section 164.501.

g. Electronic Protected Health Information means Protected Health Information that is maintained in or transmitted by electronic media and shall have the meaning given to such term under HIPAA and the HIPAA Regulations, including, but not limited to, 45 C.F.R. Section 160.103. For the purposes of this BAA, Electronic PHI includes all computerized data, as defined in California Civil Code Sections 1798.29 and 1798.82.

h. Electronic Health Record means an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff, and shall have the meaning given to such term under the HITECH Act, including, but not limited to, 42 U.S.C. Section 17921.

i. Health Care Operations shall have the meaning given to such term under the Privacy Rule, including, but not limited to, 45 C.F.R. Section 164.501.

j. Privacy Rule shall mean the HIPAA Regulation that is codified at 45 C.F.R. Parts 160 and 164, Subparts A and E.

k. Protected Health Information or PHI means any information, including electronic PHI, whether oral or recorded in any form or medium: (i) that relates to the past, present or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (ii) that identifies the individual or

3 | P a g e OCPA & CAT v1/10/2024 with respect to which there is a reasonable basis to believe the information can be used to identify the individual, and shall have the meaning given to such term under the Privacy Rule, including, but not limited to, 45 C.F.R. Sections 160.103 and 164.501. For the purposes of this BAA, PHI includes all medical information and health insurance information as defined in California Civil Code Sections 56.05 and 1798.82.

l. Protected Information shall mean PHI provided by CE to BA or created, maintained, received or transmitted by BA on CE’s behalf.

m. Security Incident means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system, and shall have the meaning given to such term under the Security Rule, including, but not limited to, 45 C.F.R. Section 164.304.

n. Security Rule shall mean the HIPAA Regulation that is codified at 45 C.F.R. Parts 160 and 164, Subparts A and C.

o. Unsecured PHI means PHI that is not secured by a technology standard that renders PHI unusable, unreadable, or indecipherable to unauthorized individuals and is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute, and shall have the meaning given to such term under the HITECH Act and any guidance issued pursuant to such Act including, but not limited to, 42 U.S.C. Section 17932(h) and 45 C.F.R. Section 164.402.

2. Obligations of Business Associate.

a. Attestations. Except when CE’s data privacy officer exempts BA in writing, the BA shall complete the following forms, attached and incorporated by reference as though fully set forth herein, SFDPH Attestations for Privacy (Attachment 1) and Data Security (Attachment 2) within sixty (60) calendar days from the execution of the Agreement. If CE makes substantial changes to any of these forms during the term of the Agreement, the BA will be required to complete CE's updated forms within sixty (60) calendar days from the date that CE provides BA with written notice of such changes. BA shall retain such records for a period of seven years after the Agreement terminates and shall make all such records available to CE within 15 calendar days of a written request by CE.

b. User Training. The BA shall provide, and shall ensure that BA subcontractors, provide, training on PHI privacy and security, including HIPAA and HITECH and its regulations, to each employee or agent that will access, use or disclose Protected Information, upon hire and/or prior to accessing, using or disclosing Protected Information for the first time, and at least annually thereafter during the term of the Agreement. BA shall maintain, and shall ensure that BA subcontractors maintain, records indicating the name of each employee or agent and date on which the PHI privacy and security trainings were completed. BA shall retain, and ensure that BA subcontractors retain, such records for a period of seven years after the Agreement terminates and shall make all such records available to CE within 15 calendar days of a written request by CE.

4 | P a g e OCPA & CAT v1/10/2024

c. Permitted Uses. BA may use, access, and/or disclose Protected Information only for the purpose of performing BA’s obligations for, or on behalf of, the City and as permitted or required under the Agreement and BAA, or as required by law. Further, BA shall not use Protected Information in any manner that would constitute a violation of the Privacy Rule or the HITECH Act if so used by CE.

However, BA may use Protected Information as necessary (i) for the proper management and administration of BA; (ii) to carry out the legal responsibilities of BA; (iii) as required by law; or (iv) for Data Aggregation purposes relating to the Health Care Operations of CE [45 C.F.R. Sections 164.502, 164.504(e)(2). and 164.504(e)(4)(i)].

d. Permitted Disclosures. BA shall disclose Protected Information only for the purpose of performing BA’s obligations for, or on behalf of, the City and as permitted or required under the Agreement and BAA, or as required by law. BA shall not disclose Protected Information in any manner that would constitute a violation of the Privacy Rule or the HITECH Act if so disclosed by CE. However, BA may disclose Protected Information as necessary (i) for the proper management and administration of BA; (ii) to carry out the legal responsibilities of BA; (iii) as required by law; or (iv) for Data Aggregation purposes relating to the Health Care Operations of CE. If BA discloses Protected Information to a third party, BA must obtain, prior to making any such disclosure, (i) reasonable written assurances from such third party that such Protected Information will be held confidential as provided pursuant to this BAA and used or disclosed only as required by law or for the purposes for which it was disclosed to such third party, and (ii) a written agreement from such third party to immediately notify BA of any breaches, security incidents, or unauthorized uses or disclosures of the Protected Information in accordance with paragraph 2 (n) of this BAA, to the extent it has obtained knowledge of such occurrences [42 U.S.C.

Section 17932; 45 C.F.R. Section 164.504(e)]. BA may disclose PHI to a BA that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit Protected Information on its behalf, if the BA obtains satisfactory assurances, in accordance with 45 C.F.R. Section 164.504(e)(1), that the subcontractor will appropriately safeguard the information [45 C.F.R. Section 164.502(e)(1)(ii)].

e. Prohibited Uses and Disclosures. BA shall not use or disclose Protected Information other than as permitted or required by the Agreement and BAA, or as required by law. BA shall not use or disclose Protected Information for fundraising or marketing purposes. BA shall not disclose Protected Information to a health plan for payment or health care operations purposes if the patient has requested this special restriction, and has paid out of pocket in full for the health care item or service to which the Protected Information solely relates [42 U.S.C. Section 17935(a) and 45 C.F.R. Section 164.522(a)(1)(vi)]. BA shall not directly or indirectly receive remuneration in exchange for Protected Information, except with the prior written consent of CE and as permitted by the HITECH Act, 42 U.S.C.

Section 17935(d)(2), and the HIPAA regulations, 45 C.F.R. Section 164.502(a)(5)(ii); however, this prohibition shall not affect payment by CE to BA for services provided pursuant to the Agreement.

f. Appropriate Safeguards. BA shall take the appropriate security measures to protect the confidentiality, integrity and availability of PHI that it creates, receives, maintains, or transmits on behalf of the CE, and shall prevent any use or disclosure of PHI other than as permitted by the Agreement or this

5 | P a g e OCPA & CAT v1/10/2024

BAA, including, but not limited to, administrative, physical and technical safeguards in accordance with the Security Rule, including, but not limited to, 45 C.F.R. Sections 164.306, 164.308, 164.310, 164.312,

164.314 164.316, and 164.504(e)(2)(ii)(B). BA shall comply with the policies and procedures and documentation requirements of the Security Rule, including, but not limited to, 45 C.F.R. Section 164.316, and 42 U.S.C. Section 17931. BA is responsible for any civil penalties assessed due to an audit or investigation of BA, in accordance with 42 U.S.C. Section 17934(c).

g. Business Associate’s Subcontractors and Agents. BA shall ensure that any agents and subcontractors that create, receive, maintain or transmit Protected Information on behalf of BA, agree in writing to the same restrictions and conditions that apply to BA with respect to such PHI and implement the safeguards required by paragraph 2.f. above with respect to Electronic PHI [45 C.F.R. Section 164.504(e)(2) through (e)(5); 45 C.F.R. Section 164.308(b)]. BA shall mitigate the effects of any such violation.

h. Accounting of Disclosures. Within ten (10) calendar days of a request by CE for an accounting of disclosures of Protected Information or upon any disclosure of Protected Information for which CE is required to account to an individual, BA and its agents and subcontractors shall make available to CE the information required to provide an accounting of disclosures to enable CE to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 C.F.R. Section 164.528, and the HITECH Act, including but not limited to 42 U.S.C. Section 17935 (c), as determined by CE. BA agrees to implement a process that allows for an accounting to be collected and maintained by BA and its agents and subcontractors for at least seven (7) years prior to the request. However, accounting of disclosures from an Electronic Health Record for treatment, payment or health care operations purposes are required to be collected and maintained for only three (3) years prior to the request, and only to the extent that BA maintains an Electronic Health Record. At a minimum, the information collected and maintained shall include: (i) the date of disclosure; (ii) the name of the entity or person who received Protected Information and, if known, the address of the entity or person; (iii) a brief description of Protected Information disclosed; and (iv) a brief statement of purpose of the disclosure that reasonably informs the individual of the basis for the disclosure, or a copy of the individual’s authorization, or a copy of the written request for disclosure [45 C.F.R. 164.528(b)(2)]. If an individual or an individual’s representative submits a request for an accounting directly to BA or its agents or subcontractors, BA shall forward the request to CE in writing within five (5) calendar days.

i. Access to Protected Information. BA shall make Protected Information maintained by BA or its agents or subcontractors in Designated Record Sets available to CE for inspection and copying within (5) days of request by CE to enable CE to fulfill its obligations under state law [Health and Safety Code Section 123110] and the Privacy Rule, including, but not limited to, 45 C.F.R. Section 164.524 [45 C.F.R. Section 164.504(e)(2)(ii)(E)]. If BA maintains Protected Information in electronic format, BA shall provide such information in electronic format as necessary to enable CE to fulfill its obligations under the HITECH Act and HIPAA Regulations, including, but not limited to, 42 U.S.C. Section 17935(e) and 45 C.F.R. 164.524.

6 | P a g e OCPA & CAT v1/10/2024

j. Amendment of Protected Information. Within ten (10) days of a request by CE for an amendment of Protected Information or a record about an individual contained in a Designated Record Set, BA and its agents and subcontractors shall make such Protected Information available to CE for amendment and incorporate any such amendment or other documentation to enable CE to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 C.F.R Section 164.526. If an individual requests an amendment of Protected Information directly from BA or its agents or subcontractors, BA must notify CE in writing within five (5) days of the request and of any approval or denial of amendment of Protected Information maintained by BA or its agents or subcontractors [45 C.F.R. Section 164.504(e)(2)(ii)(F)].

k. Governmental Access to Records. BA shall make its internal practices, books and records relating to the use and disclosure of Protected Information available to CE and to the Secretary of the U.S. Department of Health and Human Services (the “Secretary”) for purposes of determining BA’s compliance with HIPAA [45 C.F.R. Section 164.504(e)(2)(ii)(I)]. BA shall provide CE a copy of any Protected Information and other documents and records that BA provides to the Secretary concurrently with providing such Protected Information to the Secretary.

l. Minimum Necessary. BA, its agents and subcontractors shall request, use and disclose only the minimum amount of Protected Information necessary to accomplish the intended purpose of such use, disclosure, or request. [42 U.S.C. Section 17935(b); 45 C.F.R. Section 164.514(d)]. BA understands and agrees that the definition of “minimum necessary” is in flux and shall keep itself informed of guidance issued by the Secretary with respect to what constitutes “minimum necessary” to accomplish the intended purpose in accordance with HIPAA and HIPAA Regulations.

m. Data Ownership. BA acknowledges that BA has no ownership rights with respect to the Protected Information.

n. Notification of Breach. BA shall notify CE within 5 calendar days of any breach of Protected Information; any use or disclosure of Protected Information not permitted by the BAA; any Security Incident (except as otherwise provided below) related to Protected Information, and any use or disclosure of data in violation of any applicable federal or state laws by BA or its agents or subcontractors. The notification shall include, to the extent possible, the identification of each individual whose unsecured Protected Information has been, or is reasonably believed by the BA to have been, accessed, acquired, used, or disclosed, as well as any other available information that CE is required to include in notification to the individual, the media, the Secretary, and any other entity under the Breach Notification Rule and any other applicable state or federal laws, including, but not limited, to 45 C.F.R.

Section 164.404 through 45 C.F.R. Section 164.408, at the time of the notification required by this paragraph or promptly thereafter as information becomes available. BA shall take (i) prompt corrective action to cure any deficiencies and (ii) any action pertaining to unauthorized uses or disclosures required by applicable federal and state laws. [42 U.S.C. Section 17921; 42 U.S.C. Section 17932; 45 C.F.R.

164.410; 45 C.F.R. Section 164.504(e)(2)(ii)(C); 45 C.F.R. Section 164.308(b)]

7 | P a g e OCPA & CAT v1/10/2024

o. Breach Pattern or Practice by Business Associate’s Subcontractors and Agents.

Pursuant to 42 U.S.C. Section 17934(b) and 45 C.F.R. Section 164.504(e)(1)(iii), if the BA knows of a pattern of activity or practice of a subcontractor or agent that constitutes a material breach or violation of the subcontractor or agent’s obligations under the Contract or this BAA, the BA must take reasonable steps to cure the breach or end the violation. If the steps are unsuccessful, the BA must terminate the contractual arrangement with its subcontractor or agent, if feasible. BA shall provide written notice to CE of any pattern of activity or practice of a subcontractor or agent that BA believes constitutes a material breach or violation of the subcontractor or agent’s obligations under the Contract or this BAA within five

(5) calendar days of discovery and shall meet with CE to discuss and attempt to resolve the problem as one of the reasonable steps to cure the breach or end the violation.

3. Termination.

a. Material Breach. A breach by BA of any provision of this BAA, as determined by CE, shall constitute a material breach of the Agreement and this BAA and shall provide grounds for immediate termination of the Agreement and this BAA, any provision in the AGREEMENT to the contrary notwithstanding. [45 C.F.R. Section 164.504(e)(2)(iii).]

b. Judicial or Administrative Proceedings. CE may terminate the Agreement and this BAA, effective immediately, if (i) BA is named as defendant in a criminal proceeding for a violation of HIPAA, the HITECH Act, the HIPAA Regulations or other security or privacy laws or (ii) a finding or stipulation that the BA has violated any standard or requirement of HIPAA, the HITECH Act, the HIPAA Regulations or other security or privacy laws is made in any administrative or civil proceeding in which the party has been joined.

c. Effect of Termination. Upon termination of the Agreement and this BAA for any reason, BA shall, at the option of CE, return or destroy all Protected Information that BA and its agents and subcontractors still maintain in any form, and shall retain no copies of such Protected Information. If return or destruction is not feasible, as determined by CE, BA shall continue to extend the protections and satisfy the obligations of Section 2 of this BAA to such information, and limit further use and disclosure of such PHI to those purposes that make the return or destruction of the information infeasible [45 C.F.R.

Section 164.504(e)(2)(ii)(J)]. If CE elects destruction of the PHI, BA shall certify in writing to CE that such PHI has been destroyed in accordance with the Secretary’s guidance regarding proper destruction of PHI. Per the Secretary’s guidance, the City will accept destruction of electronic PHI in accordance with the standards enumerated in the NIST SP 800-88, Guidelines for Media Sanitization. The City will accept destruction of PHI contained in paper records by shredding, burning, pulping, or pulverizing the records so that the PHI is rendered unreadable, indecipherable, and otherwise cannot be reconstructed.

d. Civil and Criminal Penalties. BA understands and agrees that it is subject to civil or criminal penalties applicable to BA for unauthorized use, access or disclosure or Protected Information in accordance with the HIPAA Regulations and the HITECH Act including, but not limited to, 42 U.S.C.

17934 (c).

8 | P a g e OCPA & CAT v1/10/2024

e. Disclaimer. CE makes no warranty or representation that compliance by BA with this BAA, HIPAA, the HITECH Act, or the HIPAA Regulations or corresponding California law provisions will be adequate or satisfactory for BA’s own purposes. BA is solely responsible for all decisions made by BA regarding the safeguarding of PHI.

4. Amendment to Comply with Law.

The parties acknowledge that state and federal laws relating to data security and privacy are rapidly evolving and that amendment of the Agreement or this BAA may be required to provide for procedures to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to implement the standards and requirements of HIPAA, the HITECH Act, the HIPAA regulations and other applicable state or federal laws relating to the security or confidentiality of PHI. The parties understand and agree that CE must receive satisfactory written assurance from BA that BA will adequately safeguard all Protected Information. Upon the request of either party, the other party agrees to promptly enter into negotiations concerning the terms of an amendment to this BAA embodying written assurances consistent with the updated standards and requirements of HIPAA, the HITECH Act, the HIPAA regulations or other applicable state or federal laws. CE may terminate the Agreement upon thirty (30) days written notice in the event (i) BA does not promptly enter into negotiations to amend the Agreement or this BAA when requested by CE pursuant to this section or (ii) BA does not enter into an amendment to the Agreement or this BAA providing assurances regarding the safeguarding of PHI that CE, in its sole discretion, deems sufficient to satisfy the standards and requirements of applicable laws.

5. Reimbursement for Fines or Penalties.

In the event that CE pays a fine to a state or federal regulatory agency, and/or is assessed civil penalties or damages through private rights of action, based on an impermissible access, use or disclosure of PHI by BA or its subcontractors or agents, then BA shall reimburse CE in the amount of such fine or penalties or damages within thirty (30) calendar days from City’s written notice to BA of such fines, penalties or damages.

Attachment 1 – SFDPH Privacy Attestation, version 06-07-2017 Attachment 2 – SFDPH Data Security Attestation, version 06-07-2017 Attachment 3 – Protected Information Destruction Order Purge Certification 01-10-2024

Office of Compliance and Privacy Affairs

101 Grove Street, Room 330, San Francisco, CA 94102 Email: compliance.privacy@sfdph.org Hotline (Toll-Free): 1-855-729-6040 mailto:compliance.privacy@sfdph.org

San Francisco Department of Public Health (SFDPH) Office of Compliance and Privacy Affairs (OCPA) ATTACHMENT 1

Contractor Name: Contractor City Vendor ID

PRIVACY ATTESTATION

FORM REVISED 06072017 SFDPH Office of Compliance and Privacy Affairs (OCPA)

INSTRUCTIONS: Contractors and Partners who receive or have access to health or medical information or electronic health record systems maintained by SFDPH must complete this form. Retain completed Attestations in your files for a period of 7 years. Be prepared to submit completed attestations, along with evidence related to the following items, if requested to do so by SFDPH.

Exceptions: If you believe that a requirement is Not Applicable to you, see instructions below in Section IV on how to request clarification or obtain an exception.

I. All Contractors.

DOES YOUR ORGANIZATION… Yes No* A Have formal Privacy Policies that comply with the Health Insurance Portability and Accountability Act (HIPAA)?

B Have a Privacy Officer or other individual designated as the person in charge of investigating privacy breaches or related incidents?

If yes:

Name & Title:

Phone # Email:

C Require health information Privacy Training upon hire and annually thereafter for all employees who have access to health information? [Retain documentation of trainings for a period of 7 years.] [SFDPH privacy training materials are available for use; contact OCPA at 1‐855‐729‐6040.]

D Have proof that employees have signed a form upon hire and annually thereafter, with their name and the date, acknowledging that they have received health information privacy training? [Retain documentation of acknowledgement of trainings for a period of 7 years.]

E Have (or will have if/when applicable) Business Associate Agreements with subcontractors who create, receive, maintain , transmit, or access SFDPH’s health information?

F Assure that staff who create, or transfer health information (via laptop, USB/thumb‐drive, handheld), have prior supervisorial authorization to do so AND that health information is only transferred or created on encrypted devices approved by SFDPH Information Security staff?

II. Contractors who serve patients/clients and have access to SFDPH PHI, must also complete this section.

If Applicable: DOES YOUR ORGANIZATION… Yes No* G Have (or will have if/when applicable) evidence that SFDPH Service Desk (628‐206‐SERV) was notified to de‐provision employees who have access to

SFDPH health information record systems within 2 business days for regular terminations and within 24 hours for terminations due to cause?

H Have evidence in each patient's / client’s chart or electronic file that a Privacy Notice that meets HIPAA regulations was provided in the patient’s / client’s preferred language? (English, Cantonese, Vietnamese, Tagalog, Spanish, Russian forms may be required and are available from SFDPH.)

I Visibly post the Summary of the Notice of Privacy Practices in all six languages in common patient areas of your treatment facility?

J Document each disclosure of a patient's/client’s health information for purposes other than treatment, payment, or operations?

K When required by law, have proof that signed authorization for disclosure forms (that meet the requirements of the HIPAA Privacy Rule) are obtained

PRIOR to releasing a patient’s/client’s health information?

III. ATTEST: Under penalty of perjury, I hereby attest that to the best of my knowledge the information herein is true and correct and that I have authority to sign on behalf of and bind Contractor listed above.

ATTESTED by Privacy Officer or designated person

Name:

(print)

Signature Date

IV. *EXCEPTIONS: If you have answered “NO” to any question or believe a question is Not Applicable, please contact OCPA at 1‐855‐729‐6040 or compliance.privacy@sfdph.org for a consultation. All “No” or “N/A” answers must be reviewed and approved by OCPA below.

EXCEPTION(S) APPROVED

by OCPA Name (print) Signature Date

San Francisco Department of Public Health (SFDPH) Office of Compliance and Privacy Affairs (OCPA) ATTACHMENT 2

Contractor Name: Contractor City Vendor ID

DATA SECURITY ATTESTATION

FORM REVISED 06072017 SFDPH Office of Compliance and Privacy Affairs (OCPA)

INSTRUCTIONS: Contractors and Partners who receive or have access to health or medical information or electronic health record systems maintained by SFDPH must complete this form. Retain completed Attestations in your files for a period of 7 years. Be prepared to submit completed attestations, along with evidence related to the following items, if requested to do so by SFDPH.

Exceptions: If you believe that a requirement is Not Applicable to you, see instructions in Section III below on how to request clarification or obtain an exception.

I. All Contractors.

DOES YOUR ORGANIZATION… Yes No* A Conduct assessments/audits of your data security safeguards to demonstrate and document compliance with your security policies and the requirements of HIPAA/HITECH at least every two years? [Retain documentation for a period of 7 years] B Use findings from the assessments/audits to identify and mitigate known risks into documented remediation plans?

Date of last Data Security Risk Assessment/Audit:

Name of firm or person(s) who performed the Assessment/Audit and/or authored the final report:

C Have a formal Data Security Awareness Program?

D Have formal Data Security Policies and Procedures to detect, contain, and correct security violations that comply with the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH)?

E Have a Data Security Officer or other individual designated as the person in charge of ensuring the security of confidential information?

If yes:

Name & Title:

Phone # Email:

F Require Data Security Training upon hire and annually thereafter for all employees who have access to health information? [Retain documentation of trainings for a period of 7 years.] [SFDPH data security training materials are available for use; contact OCPA at 1‐855‐729‐6040.]

G Have proof that employees have signed a form upon hire and annually, or regularly, thereafter, with their name and the date, acknowledging that they have received data security training? [Retain documentation of acknowledgement of trainings for a period of 7 years.]

H Have (or will have if/when applicable) Business Associate Agreements with subcontractors who create, receive, maintain , transmit, or access SFDPH’s health information?

I Have (or will have if/when applicable) a diagram of how SFDPH data flows between your organization and subcontractors or vendors (including named users, access methods, on‐premise data hosts, processing systems, etc.)?

II. ATTEST: Under penalty of perjury, I hereby attest that to the best of my knowledge the information herein is true and correct and that I have authority to sign on behalf of and bind Contractor listed above.

ATTESTED by Data Security Officer or designated person

Name:

(print)

Signature Date

III. *EXCEPTIONS: If you have answered “NO” to any question or believe a question is Not Applicable, please contact OCPA at 1‐855‐729‐6040 or compliance.privacy@sfdph.org for a consultation. All “No” or “N/A” answers must be reviewed and approved by OCPA below.

EXCEPTION(S) APPROVED by

OCPA

Name (print)

Signature Date

Attachment 3 to Appendix E

Protected Information Destruction Order Purge Certification - Contract ID #

In accordance with section 3.c (Effect of Termination) of the Business Associate Agreement, attached as Appendix E to the Agreement between the City and Contractor dated (“Agreement”), the City hereby directs Contractor to destroy all Protected Information that Contractor and its agents and subcontractors (collectively “Contractor”) still maintain in any form. Contractor may retain no copies of destroyed Protected Information.” Destruction must be in accordance with the guidance of the Secretary of the U.S. Department of Health and Human Services (“Secretary”) regarding proper destruction of PHI.

Electronic Data: Per the Secretary’s guidance, the City will accept destruction of electronic Protected Information in accordance with the standards enumerated in the NIST SP 800-88, Guidelines for Data Sanitization (“NIST”).

Hard-Copy Data: Per the Secretary’s guidance, the City will accept destruction of Protected Information contained in paper records by shredding, burning, pulping, or pulverizing the records so that the Protected Information is rendered unreadable, indecipherable, and otherwise cannot be reconstructed.

Contractor hereby certifies that Contractor has destroyed all Protected Information as directed by the City in accordance with the guidance of the Secretary of the U.S. Department of Health and Human Services (“Secretary”) regarding proper destruction of PHI.

So Certified

Signature

Title:

Date:

01/10/2024