ATTACHMENT A

Business Associate Addendum between Orange County and BUSINESS ASSOCIATE NAME

Regarding HIPAA and FIPA

ORANGE COUNTY, FLORIDA

and

BUSINESS ASSOCIATE

ADDENDUM TO CONTRACT NO. YXX-XXX

related to

BUSINESS ASSOCIATE ASSURANCE OF COMPLIANCE WITH THE

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)

PRIVACY, BREACH AND SECURITY RULES AND THE

FLORIDA INFORMATION PROTECTION ACT (FIPA)

THIS ADDENDUM is by and between, ORANGE COUNTY, FLORIDA (the “County”), a charter county and political subdivision of the State of Florida, located at 201 South Rosalind Avenue, Orlando, Florida 32801, on behalf of its COUNTY DEPARTMENT/DIVISION (the “Covered Healthcare Component”), and BUSINESS ASSOCIATE NAME (“Business Associate”), located at BUSINESS ASSOCIATE ADDRESS. The County and Business Associate may be referred to herein individually as “Party” or collectively as “Parties”.

RECITALS

WHEREAS, the County has been designated as a “Hybrid Entity” under the HIPAA

Privacy and Security Rules, 45 CFR §164.105; and

WHEREAS, pursuant to 45 CFR §164.105(a)(2)(iii)(D), the County, as a Hybrid Entity, has documented that its COUNTY DEPARTMENT/DIVISION is a “Covered Healthcare Component” of the County and, as such, when the County is acting through its COUNTY DEPARTMENT/DIVISION, it must be treated as a “Covered Entity”; and

WHEREAS, in connection with the provision of services to the County (collectively referenced to as “Services”) by the Business Associate, the County, through its Covered Healthcare Component, may disclose to the Business Associate certain Protected Health Information (“PHI”) that is subject to protection under the HIPAA Privacy and Security Rules, 45 CFR Parts 160, 162, and 164; and

WHEREAS, the HIPAA Privacy and Security Rules require that a Covered Entity, as well as a Hybrid Covered Entity when it is acting through one of its Covered Healthcare Components, receives adequate assurances that the Business Associate will comply with certain obligations with respect to the PHI received in the course of providing Services to, or on behalf of, the Covered Entity or Hybrid Covered Entity; and

WHEREAS, the purpose of this Addendum is to comply with the requirements of the

HIPAA Privacy and Security Rules, 45 CFR Parts 160, 162, and 164, and the Florida Information Protection Act, §501.171, Florida Statutes, and 42 CFR Part 2, where applicable, and as amended;

and

WHEREAS, the County and Business Associate have entered, or will be entering into, a contract for services known as Contract No. YXX-XXX (the “Agreement”) and the Parties wish to adopt this Addendum to the Agreement in order to ensure that the Services provided by the Business Associate pursuant to the Agreement are provided in compliance with the requirements of the HIPAA Privacy and Security Rules, 45 CFR Parts 160, 162, and 164, and the Florida Information Protection Act, §501.171, Florida Statutes, and 42 CFR Part 2, where applicable, and as amended.

NOW, THEREFORE, in consideration of the terms, conditions, covenants, agreements and obligations herein stated, the Parties agree as follows:

Section 1. Incorporation

A. Recitals Incorporated. The above recitals are true and correct and are hereby incorporated as a material part of this Addendum.

B. HIPAA Privacy and Security Rules 45 CFR Parts 160, 162, and 164, and the Florida Information Protection Act, §501.171, Florida Statutes, and 42 CFR Part 2, where applicable and as amended, are hereby incorporated into this Addendum.

C. To the extent that this Addendum, or the Agreement, imposes more stringent requirements than those contained in HIPAA Privacy and Security Rules 45 CFR Parts 160, 162, and 164, the Florida Information Protection Act, §501.171, Florida Statutes, and 42 CFR Part 2, where applicable and as amended, those more stringent requirements of this Addendum, or the Agreement, will control.

Section 2. Definitions.

A. Terms used, but not otherwise defined, in this Addendum shall have the same meaning as those terms in 45 CFR §§160.103, 162.103, 164.103, 164.402, and 164.501, and §501.171, Florida Statutes.

1. Breach shall have the meaning given to such term as found in 45 CFR §164.402, and the Florida Information Protection Act, §501.171, Florida Statutes.

2. Designated Record Set shall mean a group of records maintained by or for a covered entity that is: (a) the medical records and billing records about individuals maintained by or for a covered health care provider; (b) the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (c) used, in whole or in part, by or for the covered entity to make decisions about individuals. For purposes of this paragraph, the term record means any item, collection, or grouping of information that includes PHI and is maintained, collected, used, or disseminated by or for a covered entity.

3. Disclosure shall mean the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information.

4. Florida Information Protection Act shall mean the Florida Information Protection Act (“FIPA”) codified at §501.171, Florida Statutes.

5. HIPAA Privacy and Security Rules shall mean the Standards for Privacy, Security, Breach, Notification, and Enforcement at 45 CFR Parts 160, 162 and 164.

6. Individual shall mean the person who is the subject of PHI, and shall include a person who qualifies as a personal representative, in accordance with 45 CFR §164.502(g).

7. Individually Identifiable Health Information shall mean information that is a subset of health information, including demographic information collected from an individual, and: (a) is created or received by a health care provider, health plan, employer, or health care clearinghouse; (b) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (c) that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual.

8. Privacy Officer shall mean the individual designated by the County pursuant to 45

CFR §164.530, who is responsible for the development and implementation of the County’s policies and procedures as they relate to its, and its Covered Healthcare Component’s, compliance with HIPAA Privacy and Security Rules.

9. Personally Identifiable Information (“PII”) shall mean either of the following:

a. An individual’s initials, first name, or first initial and last name in combination with any one or more of the following data elements for that individual:

i. A social security number;

ii. A driver’s license or identification card number, passport number, military identification number, or other similar number issued on a government document used to verify identity;

iii. A financial account number or credit or debit card number in combination with any required security code, access code, or password that is necessary to permit access to an individual’s financial account;

iv. Any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; or

v. An individual’s health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual.

vi. Any other identifier, as referenced in the Department of Health &

Human Services “Safe Harbor Standards.”

vii. The term “Personally Identifiable Information” does not include information about an individual that has been made publicly available by a federal, state, or local governmental entity. The term also does not include information that is encrypted, secured, or modified by any other method or technology that removes elements that personally identify an individual or that otherwise renders the information unusable.

b. A user name or e-mail address, in combination with a password or security question and answer that would permit access to an online account.

c. The PII provided pursuant to the Agreement shall be limited to what is necessary for the Business Associate to meet its obligations thereunder.

10. Protected Health Information (“PHI”) shall mean an individual’s identifiable health information that is – or has been – created, received, transmitted, or maintained in any form or medium, on or behalf of the County, with the exception of education records covered by the Family Educational Rights and Privacy Act, 20 U.S.C. 1232g, as amended, and the health care records of students at post-secondary educational institutions or of students eighteen (18) years of age or older, used exclusively for their health care treatment which have not been disclosed to anyone other than a health care provider at the student’s request. The PHI provided pursuant to the Agreement shall limited to what is necessary for the Business Associate to meet its obligations thereunder.

11. Required by Law shall have the same meaning as the term “required by law” in 45

CFR §164.103.

12. Secretary of Health and Human Services shall mean the Secretary of the Health and Human Services (“HHS”) or any other officer or employee of HHS to whom the authority involved has been delegated.

13. Security Incident or Incident shall mean the attempted or successful unauthorized access, use, disclosure, modification, or destruction of PHI or PII contained in any form or interference with system operations in an information system that contains PHI or PII.

14. Use shall mean the sharing, employment, application, utilization, examination, or analysis of PII or PHI within an entity that maintains such information.

Section 3. Scope of Agreement

A. Independent Status of Parties. The Parties agree that they are, and shall be, independently responsible for complying, and shall independently comply, with the HIPAA Privacy and Security Rules and FIPA, as it may be amended from time to time. The Parties further agree that they are, and shall be, responsible for their own actions and conduct and shall not assume responsibility for the actions and conduct of one another. Additionally, the Parties agree that they shall maintain all corporate formalities establishing separate and individual control by each organization's board of directors, as applicable.

B. The Business Associate acknowledges that the confidentiality requirements set forth herein shall apply to all of its employees, agents, and representatives. The Business Associate assumes responsibility and liability for any damages or claims, including state and federal administrative proceedings and sanctions brought against the County, including costs and attorneys' fees, resulting from the breach by the Business Associate of the confidentiality requirements of this Addendum.

Section 4. Privacy of Protected Health Information and Confidentiality of Personal Information.

A. Permitted Uses and Disclosures of PHI and PII by Business Associate. The Business Associate may use, or disclose, PHI and PII received from the County to its officers and employees. The Business Associate may disclose PHI and PII to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit PHI and PII on its behalf if the Business Associate obtains satisfactory assurances, in accordance with 45 CFR §164.504(e)(1)(i) and §501.171(2), that the subcontractor will appropriately safeguard the information. All other uses or disclosures, not otherwise authorized by this Addendum or otherwise governed by law, are prohibited.

B. Responsibilities of the Business Associate. Regarding the use or disclosure of PHI and PII, the Business Associate agrees to:

1. Only use or disclose the PHI and PII as allowed under this Addendum or otherwise by applicable law.

2. Only use or disclosure PHI and PII in a manner that would not violate the HIPAA

Privacy and Security Rules, or FIPA, if done so by a Covered Entity.

3. Establish and implement appropriate procedures, physical, and technical safeguards to prevent improper access, uses, transmissions, or disclosures of PHI and PII for mitigating, to the greatest extents possible under the circumstances, any deleterious effects from any improper access, use, or disclosure of PHI and PII that the Business Associate reports to the County. Safeguards shall include, but are not limited to: (a) the implementation and use of electronic security measures to safeguard electronic data; (b) requiring employees to agree to access, use, or disclose PHI and PII only as permitted or required by this Addendum; and (c) taking related disciplinary action for inappropriate access, use or disclosure as necessary.

4. Ensure that the Business Associate’s subcontractors or agents to whom the

Business Associate provides PHI or PII, created received, maintained, or transmitted on behalf County agree to the same restrictions and conditions that apply to the Business Associate with respect to PHI and PII, and ensure that its subcontractors or agents agree to establish and implement reasonable and appropriate safeguards to protect the confidentiality, integrity, and availability of all PHI and PII that it creates receives, maintains, or transmits on behalf of the County.

5. Make the Business Associate’s records, books, accounts, agreements, policies, and procedures available to the Secretary of HHS for determining the County’s compliance with the HIPAA Privacy and Security Rules, and also, with the State of Florida’s Department of Legal Affairs to determine the County’s compliance with FIPA.

6. Limit use by, or disclosure to, its subcontractors, agents, and other third parties, to the minimum PHI and PII necessary to perform or fulfill a specific function required or permitted hereunder.

7. Provide information to the County to permit the County to respond to a request by an individual for an accounting of disclosures within five (5) days of receiving a written request from the County, if the Business Associate maintains a Designated Records Set on behalf of the County.

8. At the request of, and in the time and manner designated by, the County, provide access to the PHI and PII maintained by the Business Associate to the County or individual, if the Business Associate maintains a Designated Records Set on behalf of the County.

9. At the request of, and in the time and manner designated by, the County, make any amendment(s) to the PHI and PII when directed by the County, if the Business Associate maintains a Designated Record Set on behalf of the County.

10. Establish and implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any PHI and PII the Business Associate creates, receives, maintains, or transmits on behalf of the County.

11. Report to the County any Security Incident involving PHI and PII that the Business

Associate discovers in the manner detailed in Section 7 below.

C. Compliance with the County’s Policies. The Business Associate hereby agrees to abide by the County’s policies and practices for its Covered Healthcare Component that relate to the confidentiality, privacy, and security of PHI and PII.

D. Use of PHI and PII for Management and Administration or Legal Responsibilities of the Business Associate. The Business Associate may use PHI and PII received by the County pursuant to the Agreement for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. However, the Business Associate will only be allowed to use PHI and PII for the aforementioned uses if:

1. the disclosure is required by law; or

2. the Business Associate obtains reasonable assurances from the person to whom the

PHI and PII is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notified the Business Associate of any instances in which the person is aware of a confidentiality breach of PHI or PII.

E. Data Aggregation Services. With respect to PHI and PII created or received by the Business Associate in its capacity as the Business Associate of the County, the Business Associate may combine such PHI and PII it has received from the County with the PHI and PII received by the Business Associate in its capacity as a Business Associate of another Covered Entity, or Hybrid Covered Entity, to permit data analysis that relates to the health care operation of the respective Covered Entity, or Hybrid Covered Entity, if data analyses is part of the Services that Business Associate is to provide to the County pursuant to the Agreement.

F. Compliance. The Business Associate agrees to keep all PHI and PII confidential and secure in compliance with the provisions of this Addendum and according to current state and federal laws.

Section 5. Confidentiality

A. In the course of performing under this Addendum, each Party may receive, be exposed to, or acquire the confidential information including, but not limited to, all information, data, reports, records, summaries, tables, and studies, whether written or oral, fixed in hard copy or contained in any computer database or computer readable form, as well as any information identifiable as confidential (“Confidential Information”) of the other Party.

B. For purposes of this Addendum, Confidential Information shall not include PHI, the security and privacy of which is the subject of this Addendum. The Parties, including their employees, agents, or representatives shall:

1. not disclose to any third party the Confidential Information of the other Party except as otherwise permitted by this Addendum, or as mandated by the State of Florida’s Public Records Laws;

2. only permit use of such Confidential Information by employees, agents, and representatives having a need to know in connection with performance under the Agreement; and

3. advise each of their employees, agents, and representatives of their obligations to keep such Confidential Information confidential.

C. This provision shall not apply to Confidential Information:

1. after it becomes publicly available through no fault of either Party;

2. which is later publically released by either Party in writing;

3. which is lawfully obtained from third parties without restrictions; or

4. which can be shown to be previously known or developed by either Party independently of the other Party.

Section 6. Security

A. Security of Electronic Protected Health Information and Personal Information. The Business Associate will develop, implement, maintain, and use administrative, technical, and physical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI (as defined in 45 C.F.R. §160.103) and PII (as defined by §501.171, Florida Statutes) that the Business Associate creates, receives, maintains, or transmits on behalf of the County consistent with the HIPAA Privacy and Security Rules and FIPA.

B. Reporting Security Incidents. The Business Associate will report to the County any Incident of which the Business Associate becomes aware that is:

1. a successful unauthorized access, use or disclosure of Electronic PHI or PII;

2. a modification or destruction of electronic PHI or PII; or

3. interference with system operations in an information system containing electronic PHI or PII.

Section 7. Reporting Requirements

A. Reporting. The Business Associate shall make a good faith effort to identify any use or disclosure of protected information not provided for in this Addendum.

B. Reporting to the County.

1. The Business Associate will report to the County within:

a. two (2) days of any suspected – or confirmed – access, use, or disclosure of

PHI or PII, regardless of form, not permitted or required by this Addendum of which the Business Associate becomes aware; and

b. twenty-four (24) hours of discovery, any Security Incident of which the

Business Associate is aware.

2. Such report shall include the identification of each individual whose unsecured PHI and PII has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, or disclosed during such breach.

3. Reports of Security Incidents shall include a detailed description of each Incident, at a minimum, to include: (a) the date of the Incident; (b) the nature of the Incident;

(c) the information involved, whether the information was accessed, disclosed, used, modified, destroyed, etc.; (d) the identities of the individual(s) and their relationship to the Business Associate; (e) a description of the Business Associate’s response to each Incident; (f) and the name and title of the individual the County should contact for additional information.

4. The Business Associate will conduct such further investigation as is reasonably required by the County and promptly advise the County of additional information pertinent to the Incident.

5. The Business Associate will cooperate with the County in conducting any required risk analysis related to such Security Incident(s).

6. The Business Associate will cooperate with the County in complying with any applicable notification requirements pursuant to the Breach Notification Rule and/or pursuant to Florida law (including but not limited to, §§501.171 and 817.5681, Florida Statutes), and in taking steps determined by the County to be necessary to mitigate any potential harm caused by a Security Incident. The Business Associate will pay and/or reimburse the County for any reasonable expenses the County incurs in notifying individuals of, and /or mitigating potential harm caused by, a Security Incident caused by the Business Associate and/or its subcontractors or agents.

C. Reporting to Individuals. In the case of a breach of PHI or PII discovered by the Business Associate, the Business Associate shall first notify the County of the pertinent details of the breach and, upon prior approval of the County’s Privacy Officer, shall notify each individual whose unsecured PHI or PII has been, or is reasonably believed by the Business Associate to have been, accessed, acquired or disclosed as a result of such breach. Such notification shall be in writing by first-class mail to the individual (or the next of kin if the individual is deceased) at the last known address of the individual or next of kin, respectively, or, if specified as a preference by the individual, by electronic mail. Where there is insufficient or out-of-date contact information (including a phone number, email address, or any other form of appropriate communication) that precludes written (or, if specifically requested, electronic) notification to the individual, a substitute form of notice shall be provided, including, in the case that there are ten (10) or more individuals for which there is insufficient or out-of-date contact information, a conspicuous posting on the web site of the Business Associate involved or notice in major print of broadcast media, including major media in the geographic areas where the individuals affected by the breach are likely to reside. In any case deemed by the Business Associate to require urgency because of possible imminent misuse of unsecured PHI or PII, the Business Associate may also provide information to individuals by telephone or other means, as appropriate.

D. Reporting to Media. In the case of a breach of PHI discovered by the Business Associate where the unsecured PHI of more than five hundred (500) persons or unsecured PII of more than five hundred (500) persons is reasonably believed to have been, accessed, acquired, or disclosed, after prior approval by the County, the Business Associate shall provide notice to prominent media outlets serving the state or relevant portion of the state involved.

E. Reporting to HHS and the State of Florida Department of Legal Affairs. The Business Associate shall cooperate with the County to provide notice to the Secretary of HHS of unsecured PHI and to the State of Florida, Department of Legal Affairs, of unsecured PII that has been acquired or disclosed in a breach. If the breach was with respect to five hundred (500) or more individuals, such notice must be provided immediately. If the breach was with respect to less than five hundred (500) individuals, the Business Associate may maintain a log of such breach occurring and annually submit such log to the County so that it may satisfy its obligation to notify the Secretary of HHS documenting such breaches occurring in the year involved.

F. Content of Notices. All notices and reports required under this Addendum shall include the content set forth 45 C.F.R § 164.404 and FIPA. Notification to individuals, except that references therein to a "Covered Entity," shall be read as references to the Business Associate.

1. Regardless of the method by which notice is provided to individuals under this section, notice of a breach shall include, to the extent possible, the following: (a) a brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known; (b) a description of the types of unsecured PHI and PII that were involved in the breach (such as full name, social security number, date of birth, home address, account number, or disability code); (c) the steps individuals should take to protect themselves from potential harm resulting from the breach; (d) a brief description of what the covered entity involved is doing to investigate the breach, to mitigate losses, and to protect against any further breaches; and (e) contact procedures for individuals to ask questions or learn additional information, which shall include a toll free telephone number, an e-mail address, web site, or postal address.

G. Notice to Credit Reporting Agencies. In the case of a breach of PII discovered by the Business Associate where the unsecured PII of more than one thousand (1000) individuals has reasonably believed to have been, accessed, acquired, or disclosed, after prior approval by the County, the Business Associate shall notify all consumer reporting agencies nationwide, that complete and maintain files in accordance with the provisions of §501.171(5), Florida Statutes.

H. Financial Responsibility. The Business Associate shall be responsible for all costs related to the notice required by this Section.

I. Mitigation. The Business Associate shall mitigate, to the extent practicable, any harmful effects that are known to the Business Associate of use or disclosure of PHI or PII in violation of this Addendum, the HIPAA Privacy and Security Rules, HITECH Act, and FIPA.

J. A violation of this Section shall be a material violation of this Addendum.

Section 8. Termination

A. Automatic Termination. The County is authorized to automatically terminate the Agreement, if it determines that the Business Associate has violated a material term of this Addendum.

B. Opportunity to Cure or Terminate. At the County’s sole discretion, the County may either: (1) provide notice of breach and an opportunity for the Business Associate to reasonably and promptly cure the breach or end the violation and terminate the Agreement if the Business Associate does not cure the breach, or end the violation within the reasonable time specified by the County; or (2) immediately terminate the Agreement if the Business Associate has breached a material term of this Addendum and cure is not possible.

C. Effects of Termination. Termination of the Agreement shall not affect any claim or rights that may arise based on the acts or omissions of the Parties prior to the effective date of termination.

D. Duties of Business Associate Upon Termination of the Agreement.

1. When the Agreement is terminated, the PHI and PII that the Business Associate received from, created, or received on behalf of the County must be destroyed or returned to the County, at the Business Associate's expense, including all PHI and PII in the possession of the Business Associate's subcontractors or agents.

However, if the Business Associate determines that returning or destroying PHI and PII is not feasible, the Business Associate must maintain the privacy protections under this Addendum, and according to applicable law, for as long as the Business Associate retains the PHI and PII, and the Business Associate may only use or disclose the PHI and PII for specific uses or disclosures that make it necessary for the Business Associate to retain the PHI and PII.

2. If the Business Associate determines that it is not feasible for the Business

Associate to return PHI or PII in the subcontractor's or agent's possession, the Business Associate must provide a written explanation to the County of such reasons and require the subcontractors and agents to agree to extend any and all protections, limitations, and restrictions contained in this Addendum to the subcontractor's or agent's use or disclosure of any PHI and PII retained after the termination of the Agreement, and to limit any further uses or disclosures for the purposes that make the return or destruction of the PHI or PII not feasible.

Section 9. Miscellaneous

A. Agreement Subject to All Applicable Laws. The Parties recognize and agree that the Agreement, and any and all activities performed thereunder, is governed by federal, state, and local laws, including the regulations, rules, and policies of the U.S. Department of Health and Human Services including, but not limited to, HIPAA Privacy and Security Rules, FIPA, and their accompanying regulations. The Parties further recognize and agree that the Agreement is subject to new legislation as well as amendments to government regulations, rules, and police, and agree to amend this Addendum accordingly.

B. No Third Party Beneficiaries. Nothing expressed or implied in this Addendum is intended to confer, nor shall anything herein confer, upon any person other than the Parties and the respective successors or assigns of the Parties any rights, remedies, obligations, or liabilities whatsoever.

C. Survival. The rights and obligations of the Parties in Sections 4, 5, 6, 7 in their entirety, as well as subsections 8D., 9E., 9G., and 9H., shall survive termination of the Agreement indefinitely.

D. Amendment. This Addendum may only be revoked, amended, changed, or modified by a written amendment that is executed by both Parties.

E. Enforcement Costs and Attorneys Fees. If any legal action or other proceedings, including arbitration, is brought for the enforcement of this Addendum, or because of an alleged dispute, breach, default, or misrepresentation in connection with any provision of this Addendum, each Party will hereby be responsible for its own costs and attorneys’ fees.

F. Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits the County to comply with the Privacy and Security Rules.

G. Indemnification. To the fullest extent permitted by law, the Business Associate shall defend, indemnify, and hold harmless the County, its officials, agents, and employees from and against any and all claims, suits, judgments, demands, liabilities, damages, costs, and expenses (including attorney’s fees) of any kind or nature whatsoever arising directly or indirectly out of or caused in whole or part by any act or omission of the Business Associate, anyone directly or indirectly employed by them, or anyone for whose acts any of them may be liable; excepting those acts or omissions arising out of the sole negligence of the County. In the event the Business Associate is a state department or division, or a political subdivision of the State of Florida, indemnification shall follow the provisions of §768.28, Florida Statutes.

H. Signatory Authority. Each signatory to this Addendum represents and warrants that he or she possesses all necessary capacity and authority to act for, sign, and bind the respective entity or person on whose behalf he or she is signing.

I. Governing Law. This Addendum shall be governed by and construed in accordance with the laws of the State of Florida to the extent not preempted by the HIPPA Privacy Rules or other applicable federal law.

J. Notice. All notices and other communications under this Addendum shall be in writing and shall be deemed received when delivered personally or when deposited in the U.S. mail, postage prepaid, sent registered, or certified mail, return receipt requested, or sent via nationally recognized and receipted overnight courier service, to the Parties at their respective principal office or record as set forth below or as designed in writing from time-to-time. No notice of a change of address shall be effective until received by the other Party(ies).

To the County: Orange County HIPAA Privacy Officer

2002-A East Michigan Street

Orlando, FL 32806

(407) 836-9214

AND

Orange County Administrator Administration Building, 5th Floor 201 S Rosalind Avenue Orlando, FL 32801

To the Business Associate:

K. Severability. If any provision of this Addendum, or the application thereof to any person or circumstance, shall to any extent be invalid or unenforceable, the remainder of this Addendum, or the application of such affected provision to persons or circumstances other than those to which it is held invalid or unenforceable, shall not be affected thereby, and each provision of this Addendum shall be valid and shall be enforced to the fullest extent permitted by law. It is further the intention of the Parties that if any provision of this Addendum were capable of two constructions, one that rendered the provision void and one that renders the provision valid, then the provision shall have the meaning that renders it valid.

L. Successors and Assigns. The Business Associate shall not assign either its obligations or benefits under this Addendum without the expressed written consent of the County, which shall be at the sole discretion of the County. Given the nature of this Agreement, neither subcontracting nor assignment by the Business Associate is anticipated and the use of those terms herein does not indicate that permission to assign or subcontract has been granted.

M. Venue and Waiver of Jury Trial. Any action or proceeding seeking to enforce any provision, or based on any right arising out of this Addendum shall be brought in the federal or state courts located in Orange County, Florida, and each of the Parties consents to the jurisdiction of such courts (and of the appropriate appellate courts) in any such action or proceeding and waives any objection to venue therein. Any and all rights to a trial by jury are hereby waived.

N. Waiver and Breach. No failure by a Party to insist upon the strict performance of any covenant, agreement, term, or condition of this Addendum shall constitute a waiver of any such breach or such covenant, agreement, term, or condition. Any Party may waive compliance by the other Party with any of the provisions of this Addendum if done so in writing. No waiver of any provision shall be construed as a waiver of any other provision or any subsequent waiver of the same provision.

O. Entire Agreement. The Agreement, this Addendum and/or any additional addenda or amendments to the Agreement, any documents incorporated herein by reference, and/or attachments hereto, shall construe the entire understanding between the Parties as to the rights, obligations, duties, and services to be performed hereunder.

IN WITNESS HEREOF, the parties have executed this Addendum as of the date first above written.

ORANGE COUNTY, FLORIDA

By: Orange County Board of County Commissioners

BY:

Carrie Mathes, CFCM, NIGP-CPP, CPPO, C.P.M.

Manager, Procurement Division

DATE:

ATTEST: Phil Diamond, CPA, County Comptroller As Clerk of the Board of County Commissioners

By:

Deputy Clerk

Printed Name

THE BUSINESS ASSOCIATE

Business Associate:

By:

Printed Name:

Official Title:

Date:

STATE OF FLORIDA )

) ss:

COUNTY OF ______________ )

The foregoing instrument was acknowledged before me by means of ☐ physical presence, or ☐ online notarization, this _____ day of ________________, 20__, by __________________________________ [NAME OF PERSON], as ______________________________________ [TYPE OF AUTHORITY,… e.g. officer, trustee, etc.)] for

_____________________________[NAME OF PARTY ON BEHALF OF WHOM INSTRUMENT WAS

EXECUTED].

☐ Personally Known; OR ☐ Produced Identification. Type of identification produced:____________________________.

[CHECK APPLICABLE BOX TO SATISFY IDENTIFICATION REQUIREMENT OF FLA. STAT. §117.05]

Notary Public My Commission Expires:

(Printed, typed or stamped commissioned name of Notary Public)