Business_Associate_Agreement-County.pdf

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (“Agreement”) is made and entered into effective as of the date of last signature by each Party hereto (the “Effective Date”) by and between _________________________________________________________ (“Covered Entity”) _______________________________ and Cisco Systems, Inc., and its affiliates (“Business Associate”).

RECITALS

WHEREAS, Subtitle F of the Health Insurance Portability and Accountability Act of 1996, Public Law No.

104-191, as amended by the American Recovery and Reinvestment Act of 2009, Public Law No. 111-005, Part I, Title XIII, Subpart D, Sections 13401-13409, (the “HITECH Act”), (collectively, “HIPAA”) provides that Covered Entity comply with standards to protect the security, confidentiality and integrity of health information; and

WHEREAS, the Department of Health and Human Services has issued regulations under HIPAA (the “HIPAA Regulations”), including the Standards for Privacy of Individually Identifiable Health Information, 45 CFR Parts 160 and 164, sub-parts A and E, as amended by the HITECH Act (the “Privacy Rule”) and the Standards for Security of Electronic Protected Health Information, 45 CFR Parts 160, 162 and 164, as amended by the HITECH Act (the “Security Rule”) (collectively, the “Privacy and Security Rules”); and

WHEREAS, Sections 164.502(e) and 164.504(e) of the Privacy and Security Rules set forth standards and requirements for Covered Entity to enter into written agreements with certain business associates that will have access to Covered Entity's Protected Health Information (as defined below); and

WHEREAS, Business Associate will provide the Cisco branded services (the “Services”) to Covered Entity as selected below:

Cisco Advanced Phishing Services Cisco Support Services (including Cisco SmartNet)

Cisco Advanced Services Cisco Umbrella

Cisco Advanced Malware Protection (Cisco AMP) Cisco Webex Calling

Cisco AMP Threat Grid Cisco Webex Meetings

Cisco BroadCloud Calling Cisco Webex Service (also known as Cisco Webex Teams)

Cisco Cloud E-mail Security Cisco Webex Contact Center

Cisco CloudLock Cisco StealthWatch

Cisco Cognitive Threat Analytics Cisco Identity Service Engine

Cisco Defense Orchestrator

DocuSign Envelope ID: 4A7F8766-CB65-4DAF-AE8C-BC007DEB16DA

X and its affiliates, Marathon County, Wisconsin

DRAFT

NOW THEREFORE, in consideration of the mutual promises below, the parties agree as follows:

1. DEFINITIONS

a. “Breach” shall have the meaning given to such term in 45 CFR Section 164.402.

b. “Designated Record Set” shall have the meaning given to such term under the Privacy Rule at 45 CFR Section 164.501.

c. “Electronic Protected Health Information” or “Electronic PHI” shall mean Protected Health Information which is transmitted by or maintained in Electronic Media (as defined in the Privacy and Security Rules), and for purposes of this Agreement, shall be limited to the information Business Associate received from or created, maintained, transmitted or received on behalf of Covered Entity.

d. “Individual” shall have the meaning given to such term under the Privacy and Security Rules at 45 CFR Section 160.103.

e. “Protected Health Information” or “PHI” shall have the meaning given to such term under the Privacy and Security Rules at 45 CFR Section 160.103, limited to the information maintained, created or received by Business Associate from or on behalf of Covered Entity. “Protected Health Information” includes, without limitation, “Electronic Protected Health Information”.

f. “Required by Law” shall have the meaning given to such term under the Privacy and Security Rules at 45 CFR Section 164.103.

g. “Secretary” shall mean the Secretary of the Department of Health and Human Services or his or her designee.

h. “Security Incident” shall have the meaning given to such term under the Security Rule at 45 CFR Section 164.304.

2. PERMITTED USES AND DISCLOSURES OF PHI

Business Associate agrees not to use or further disclose PHI received or created by Business Associate (or its agents and subcontractors) other than as permitted or required by this Agreement or as otherwise Required by Law. In connection with the foregoing and except as otherwise limited in this Agreement, Business Associate may:

a. Use or disclose PHI received or created by Business Associate to perform functions, activities or services for, or on behalf of, Covered Entity, provided that such use or disclosure would not violate the Privacy and Security Rules if done by Covered Entity;

b. Use PHI received or created by Business Associate for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate; and

c. Disclose PHI received or created by Business Associate for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided (i) the disclosure is Required by Law, or (ii) Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the person, and that the person agrees to notify Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

3. RESPONSIBILITIES OF BUSINESS ASSOCIATE

a. Appropriate Safeguards. Business Associate shall use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this Agreement. Business Associate shall implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of Electronic PHI, as required by the Security Rule.

b. Reporting of Improper Use or Disclosure. Business Associate shall report to Covered Entity, as soon as reasonably practicable, any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including breaches of Unsecured Protected Health Information (as defined in the Privacy and Security Rules). Knowledge of any improper use or disclosure by an agent or subcontractor of Business Associate shall not be imputed to Business Associate unless and until such agent or subcontractor shall have reported such improper use or disclosure to the Business Associate representative responsible for the Covered Entity engagement. With respect to Electronic PHI, Business Associate shall, as soon as reasonably practicable, report to Covered Entity any Security Incident. The parties acknowledge and agree that this Section 3.b. constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined herein) for which no additional notice to Covered Entity shall be required. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of PHI.

c. Business Associate’s Agents. Business Associate shall ensure that any agent, including a subcontractor, to whom it provides any PHI received from Covered Entity agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such PHI.

d. Access to PHI. To the extent that Business Associate maintains PHI in a Designated Record Set, and to the extent that Business Associate maintains the key or has the ability to decrypt the PHI in a Designated Record Set, Business Associate shall make such information available to the Covered Entity, and in the time and manner reasonably designated by Covered Entity, to Covered Entity in order to meet the requirements under 45 CFR Section 164.524.

e. Amendment of PHI. To the extent that Business Associate maintains PHI in a Designated Record Set, and to the extent that Business Associate maintains the key or has the ability to decrypt the PHI in a Designated Record Set, Business Associate shall make any amendment(s) to such information that Covered Entity directs or agrees to pursuant to 45 CFR Section 164.526, at the request of Covered Entity, and in the time and manner reasonably designated by Covered Entity.

f. Documentation of Disclosures. Business Associate agrees to document disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR Section 164.528.

g. Accounting of Disclosures. Business Associate agrees to provide to Covered Entity, in the reasonable time and manner designated by Covered Entity, information collected in accordance with Section 4(f) of this Agreement, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR Section 164.528.

h. Governmental Access to Records. Business Associate shall make its internal practices, books and records, including policies and procedures and PHI, relating to the use and disclosure of

PHI received from, or created or received by Business Associate on behalf of, Covered Entity available to the Secretary for purposes of the Secretary determining Covered Entity’s compliance with the Privacy and Security Rules.

4. RESPONSIBILITIES OF COVERED ENTITY

Covered Entity represents that it is a “covered entity” as that term is defined at 45 CFR 160.103 and that it is entering into this Agreement in order to enable its compliance with its HIPAA obligations in connection with its use of the Services. This Agreement shall be null and void in the event that either of those representations is false.

In addition to any other obligations set forth in this Agreement, Covered Entity shall:

a. identify which of the records it furnishes to Business Associate it considers to be PHI for purposes of this Agreement;

b. provide to Business Associate only the minimum PHI necessary to accomplish the Services;

c. implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of Electronic PHI, as required by the Security Rule;

d. notify Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose PHI, to the extent that such changes may affect Business Associate’s use or disclosure of PHI;

e. notify Business Associate of any restrictions to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR Section 164.522, to the extent that such restrictions may affect Business Associate’s use or disclosure of PHI; and

f. obtain any consent or authorization that may be required by applicable or federal or state laws and regulations prior to furnishing PHI to Business Associate.

5. TERM AND TERMINATION

a. Term. This Agreement will commence on the Effective Date and will terminate upon expiration or termination of all contracts, agreements or arrangements governing the services provided by Business Associate to which this Agreement applies, unless terminated earlier by written notice by either Party.

b. Termination for Cause. Upon Covered Entity’s knowledge of a material breach by Business Associate of this Agreement, Covered Entity shall either (i) provide an opportunity for Business Associate to cure the breach or end the violation within the time specified by Covered Entity, or (ii) immediately terminate this Agreement if cure is not possible.

c. Effect of Termination.

i. Except as provided in paragraph (ii) of this Section 5(c), upon termination of this Agreement for any reason, Business Associate shall return or destroy all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, and shall retain no copies of the PHI.

ii. In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction infeasible. If Business Associate determines that return or destruction of PHI is infeasible, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI.

6. REGULATORY REFERENCES

A reference in this Agreement to a section in the Privacy and Security Rules means the section as in effect or as amended, and for which compliance is required.

7. AMENDMENT

The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the Privacy and Security Rules and HIPAA.

8. NO AGENCY RELATIONSHIP

The parties agree that each individual party shall maintain its own independent HIPAA and HITECH Act compliance obligations. The parties will be providing their services as separate legal entities and independent contractors. The parties expressly agree that no agency relationship is created by this Agreement with regard to the individual parties’ HIPAA obligations. Each party certifies that

(1) Covered Entity shall not have the right or authority to control Business Associate’s conduct in the performance of services or in the performance of HIPAA obligations; (2) Covered Entity shall not have the authority to direct the daily performance of services by Business Associate; and (3) Covered Entity shall not have the right to give interim instruction to Business Associate regarding the performance of services.

9. SURVIVAL

The respective rights and obligations of Business Associate under Section 5.c of this Agreement shall survive the termination of this Agreement.

10. NO THIRD PARTY BENEFICIARIES

Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than Covered Entity, Business Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.

11. INTERPRETATION

Any ambiguity in this Agreement shall be resolved to permit Covered Entity to comply with the Privacy and Security Rules.

12. WAIVER OF CONSEQUENTIAL DAMAGES

In no event shall Business Associate be liable for any; (i) special, incidental, indirect or consequential damages; (ii) loss of any of the following: profits, revenue, business, anticipated savings, use of any product or service, opportunity, goodwill or reputation; or (iii) lost or damaged data.

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK

13. ENTIRE AGREEMENT

This Agreement represents the entire agreement between the parties regarding Protected Health Information and replaces any prior oral or written communications between the parties, except as agreed in writing by the parties. There are no conditions, understandings, agreements, representations, or warranties expressed or implied. This Agreement may only be modified by a written document executed by both parties.

IN WITNESS WHEREOF, the parties hereto have duly executed this Agreement as of the Effective Date.

Cisco Systems, Inc.

//externalsigner1 sign//

Authorized Signature Authorized Signature

Name Name

Title Title

Date Date

Address Address

170 W Tasman Drive

San Jose

CA 95134

United States United States

Scott Corbett

Marathon County, Wisconsin

Wisconsin 54403

Wausau

500 Forest St.

October 30, 2020

County Corporation Counsel