Exhibit 8 - Business Associate Agreement.pdf

This is a Business Associate Agreement (BAA) executed between a California state agency and CrowdStrike, a cybersecurity software vendor, in connection with a CrowdStrike security software renewal contract. The agreement establishes the terms and conditions under which CrowdStrike will handle protected health information (PHI) and personal information on behalf of the state agency, ensuring compliance with applicable data protection and privacy regulations. The BAA defines the roles and responsibilities of both parties, with the state agency acting as the Covered Entity and CrowdStrike functioning as the Business Associate, and specifies the permitted uses and disclosures of sensitive information solely for legitimate business purposes related to the security software implementation.

The agreement imposes comprehensive safeguarding obligations on CrowdStrike, including administrative, physical, and technical security measures to protect PHI and personal data from unauthorized access, breach, or misuse. The BAA requires CrowdStrike to implement encryption protocols, access controls, audit logging, and incident response procedures, with provisions for notification of any security breaches to the state agency without unreasonable delay. The agreement also mandates that CrowdStrike impose equivalent data protection obligations on any subcontractors or agents who may access PHI, maintain documentation of security practices, and submit to periodic audits and inspections by the state agency. Termination provisions require CrowdStrike to return or securely destroy all PHI upon contract completion, and the agreement establishes liability provisions holding CrowdStrike accountable for breaches or violations of the BAA's terms.