Exhibit_C2_-_P_A_Agreement.pdf

SUPERIOR COURT OF CALIFORNIA, COUNTY OF SAN BERNARDINO

AGREEMENT NUMBER

SERVICES—SHORT FORM AGREEMENT PC rev 2016-11-22 K22-0051

1. In this agreement (the “Agreement”), the term “Contractor” refers to P&A Administrative Services, Inc., and the term “Court” refers to the

Superior Court of California, County of San Bernardino. Contractor and Court are hereinafter sometimes referred to collectively as the

“parties” and individually as “party”.

2. This Agreement becomes effective as of January 1, 2023 (the “Effective Date”) and expires on December 31, 2023.The Court may, at its sole option, extend this Agreement for up to two consecutive one-year terms, at the end of which Option Terms this Agreement shall expire.

3.

4. The parties agree that this Agreement is made up of this signature page, the attached provisions labeled “Services—Short Form Agreement

Terms”, Exhibit A: Business Associate Agreement, Exhibit B: Flexible Benefits Administration Services Agreement, and Exhibit C: Fees. This

Agreement represents the parties’ entire understanding regarding its subject matter, and supersedes all previous proposals, both oral and written, negotiations, representations, commitments, writings and all other communications between the parties. Except as otherwise specified in this

Agreement, no amendment or change to this Agreement will be valid without written approval by the Court Executive Officer or designee, in the form of an Amendment, including any changes to the Scope of Work.

5. Contractor will perform the following services (the “Services”), and deliver the following work product (the “Work Product”):

Services:

Description of

Services Administration of the Court employees’ flexible spending accounts.

Completion Date End of (90) day run-out period.

Acceptance Criteria All claims properly administrated and accepted by Court’s project manager.

Year-end reports show carriers paid.

Work Product:

Description of Work

Product Statements and reports. Contractor’s response to RFP 22-02 may be relied upon for the purpose of clarifying, illustrating, or explaining the intention and understanding of the parties as to the performance of this

Agreement.

Delivery Date Monthly, quarterly, year-end and as requested.

Acceptance Criteria Accurate reports and statements.

6. The Court’s project manager is: Susan Zenzen, Benefits and Payroll Administrator (SZenzen@sb-court.org).

7. The Court will pay Contractor as follows: The total amount to be paid under this Agreement shall not exceed the rates set forth in Exhibit

C: Fees, attached hereto and incorporated herein.

COURT’S SIGNATURE

CONTRACTOR’S SIGNATURE

Superior Court of California, County of San Bernardino

CONTRACTOR’S NAME

P&A Administrative Services, Inc

BY (Authorized Signature)

BY (Authorized Signature)

PRINTED NAME AND TITLE OF PERSON SIGNING

Anabel Z. Romero

Court Executive Officer

PRINTED NAME AND TITLE OF PERSON SIGNING

Michael Rizzo

President

DATE EXECUTED

DATE EXECUTED

ADDRESS

247 West Third Street, 11th Floor

San Bernardino, CA 92415-0302

ADDRESS

17 Court Street, Suite 500

Buffalo, NY 14202

The maximum amount that the Court may pay Contractor under this Agreement is $45,000.00 (the “Maximum Amount”).

DocuSign Envelope ID: 7BBDF50D-B555-4D08-8073-15A8C669D0B6

12/21/202212/28/2022

K22-0051 P&A

SERVICES—SHORT FORM AGREEMENT TERMS

A. PERFORMANCE AND DELIVERY. Contractor will perform the Services and deliver all Services as specified on the coversheet of this

Agreement. Time is of the essence in Contractor’s performance of the Services and delivery of Services. The Maximum Amount listed on the coversheet of this Agreement includes all amounts allowed for expenses, including those related to shipping, handling, traveling, bonding, licensing, maintaining insurance, and obtaining permits.

B. ACCEPTANCE. All Services and Services are subject to written acceptance by the Court. The Court may reject any Service or Services that

(i) fails to meet applicable acceptance criteria, (ii) is not as warranted, or (iii) is performed or delivered late. Payment by the Court does not signify acceptance of the Services or Services.

C. CONFIDENTIALITY. General Obligations: While performing Services under this Agreement, Contractor may gain access to Confidential

Information that, if disclosed to Third Parties, may be damaging to the Court, its personnel, court users, or other government entity. The Court owns all right, title and interest in the Confidential Information. Contractor does not acquire any right or title to the Confidential Information. During the

Term and at all times thereafter, Contractor will: (a) hold all Confidential Information in strict trust and confidence, (b) refrain from using or permitting others to use Confidential Information in any manner or for any purpose not expressly permitted by this Agreement, and (c) refrain from disclosing or permitting others to disclose any Confidential Information to any Third Party without obtaining the Court’s express prior written consent on a case-by-case basis unless permitted by Applicable Law. Contractor will disclose Confidential Information only to Contractor Personnel or Subcontractors with a need to know in order to provide the Services hereunder and who have executed a confidentiality agreement with Contractor at least as protective as the provisions of this Section 3. Contractor will protect the Confidential Information from unauthorized use, access, or disclosure in the same manner as Contractor protects its own confidential or proprietary information of a similar nature, and with no less than reasonable care and industry-standard care. Contractor will notify the Court promptly upon learning of any unauthorized disclosure or use of

Confidential Information and will cooperate fully with the Court to protect such Confidential Information. The provisions of this Section 3 shall survive beyond the expiration or termination of this Agreement. Breach of Confidentiality: Contractor acknowledges that there can be no adequate remedy at law for any breach of Contractor’s obligations hereunder, that any such breach will likely result in irreparable harm, and therefore, that upon any breach or threatened breach of the confidentiality obligations, the Court shall be entitled to appropriate equitable relief, without the requirement of posting a bond, in addition to its other remedies at law.

D. INVOICES, PAYMENT AND SETOFF. After the Court has accepted Services and Services, Contractor will send one original and two copies of a correct, itemized invoice for the accepted Services and Services to “Accounts Payable” to AP@sb-court.org. Contractor will print each invoice on Contractor’s standard printed bill form, and each invoice will include at least (i) the Agreement number, (ii) a unique invoice number, (iii)

Contractor’s name and address, (iv) the nature of the invoiced charge, (v) the total invoiced amount, and (vi) all other details the Court considers reasonably necessary to permit the Court to evaluate the Services performed and the Services delivered, including the number of hours worked and the applicable hourly rate. If requested, Contractor will promptly correct any inaccuracy and resubmit the invoice. If the Court rejects any Services or Services after payment to Contractor, the Court may exercise all contractual and other legal remedies, including (a) setting off the overpayment against future invoices payable by the Court, (b) setting off the overpayment against any other amount payable for the benefit of Contractor pursuant to this Agreement or otherwise, and (c) requiring Contractor to refund the overpayment within thirty (30) days of the Court’s request. Unless

Contractor is a governmental entity, the Court will take no action on invoices submitted before Contractor has completed the Court’s standard payee data record form, which Contractor may obtain from the Court. Contractor must include with any request for reimbursement from the Court a certification that Contractor is not seeking reimbursement for costs incurred to assist, promote, or deter union organizing. If Contractor incurs costs, or makes expenditures to assist, promote or deter union organizing, Contractor will maintain records sufficient to show that no reimbursement from the Court was sought for these costs, and Contractor will provide those records to the Attorney General upon request.

E. WARRANTIES. Contractor will perform all Services using skilled personnel only, in a good and workmanlike manner, in accordance with industry standards, and in compliance with all applicable laws, rules, and regulations. Contractor warrants that, upon delivery, all Services will (i) not infringe any third party’s rights, including intellectual property rights, (ii) comply with the requirements of this Agreement, and (iii) be in compliance with all applicable laws, rules, and regulations.

F. CHANGES. Contractor may not alter, add to, or otherwise modify this Agreement. Contractor’s additional or different terms and conditions are expressly excluded from this Agreement. This Agreement may be amended, supplemented, or otherwise modified only in writing and signed by the Court’s authorized representative.

G. AUDIT RIGHTS. Contractor agrees to maintain records relating to performance and billing by Contractor under this Agreement for a period of four years after final payment. During the time that Contractor is required to retain these records, Contractor will make them available to the

Court, the State Auditor, or their representatives during normal business hours for inspection and copying.

H. INDEMNITY. CONTRACTOR WILL INDEMNIFY AND HOLD HARMLESS THE COURT, OTHER CALIFORNIA JUDICIAL

BRANCH ENTITIES, AND THEIR OFFICERS, AGENTS, AND EMPLOYEES FROM AND AGAINST ALL CLAIMS, LOSSES, AND

EXPENSES, INCLUDING ATTORNEYS’ FEES AND COSTS, THAT ARISE OUT OF (I) A DEFECT, WHETHER LATENT OR PATENT, IN

THE SERVICES, (II) AN ACT OR OMISSION OF CONTRACTOR, ITS AGENTS, EMPLOYEES, INDEPENDENT CONTRACTORS, OR

SUBCONTRACTORS IN THE PERFORMANCE OF THIS AGREEMENT, AND (III) A BREACH OF A REPRESENTATION, WARRANTY, OR OTHER PROVISION OF THIS AGREEMENT. THIS INDEMNITY APPLIES REGARDLESS OF THE THEORY OF LIABILITY ON

WHICH A CLAIM IS MADE OR A LOSS OCCURS. THIS INDEMNITY WILL SURVIVE THE EXPIRATION OR TERMINATION OF THIS

AGREEMENT, ACCEPTANCE OF SERVICES, AND DELIVERY AND ACCEPTANCE OF SERVICES. THIS INDEMNITY DOES NOT

COVER CLAIMS, LOSSES OR EXPENSES TO THE EXTENT THEY ARISE OUT OF THE GROSS NEGLIGENCE OF THE COURT.

I. TERMINATION. The Court may terminate all or part of this Agreement for convenience at any time by giving notice to Contractor. If the

Court terminates this Agreement for convenience, the Court’s liability will be the reasonable price for the Services rendered prior to termination, not to exceed the Maximum Amount. If an hourly or other time-based rate for Services is specified on the coversheet of this Agreement, that rate will be used in determining the reasonable price. Upon receipt of a termination notice, Contractor will, unless otherwise directed, cease work. Contractor will follow the Court’s directions as to work in progress and the delivery of completed or partially-completed Services.

J. INSURANCE. Contractor will maintain insurance that is sufficient in scope and amount to permit Contractor to pay in the ordinary course of business insurable claims, losses and expenses, including insurable claims, losses and expenses that arise out of Contractor’s performance of this

Agreement. Contractor will maintain employer’s liability and workers’ compensation coverage at statutory levels covering all employees performing work under this Agreement.

K. REPRESENTATIONS. Contractor represents and warrants the following during the term of this Agreement: (i) Contractor complies with all federal, state, city, and local laws, rules, and regulations, including the federal Americans with Disabilities Act of 1990, California’s Fair Employment and Housing Act, and Government Code16645-49; (ii) Contractor does not unlawfully discriminate against any employee or applicant for

SERVICES—SHORT FORM AGREEMENT TERMS

employment because of race, religion, color, national origin, ancestry, disability (mental or physical, including HIV or AIDS), medical condition

(including cancer or genetic characteristics), request for family and medical care leave, marital or domestic partner status, age (over 40), sex

(including gender identity) or sexual orientation; (iii) Contractor does not engage in unlawful harassment, including sexual harassment, with respect to any persons with whom Contractor may interact in the performance of this Agreement; (iv) Contractor will take all reasonable steps to prevent unlawful harassment from occurring; (v) no more than one, final unappealable finding of contempt of court by a federal court has been issued against

Contractor within the immediately preceding two-year period because of Contractor's failure to comply with an order of a federal court requiring

Contractor to comply with an order of the National Labor Relations Board (this representation is made under penalty of perjury); (vi) Contractor has authority to enter into and perform its obligations under this Agreement; (vii) if Contractor is a corporation, limited liability company, or limited partnership and this Agreement will be performed in California, Contractor is qualified to do business and in good standing in California; and (viii)

Contractor is not an expatriate corporation or subsidiary of an expatriate corporation within the meaning of Public Contract Code (“PCC”) section

10286.1, and is eligible to contract with the Court. Contractor will take all action necessary to ensure that the representations in this section remain true during the performance of this Agreement through final payment by the Court. Contractor must give written notice of its nondiscrimination obligations under this section to labor organizations with which it has a collective bargaining or other agreement.

L. ANTITRUST. Contractor shall assign to the Court all rights, title, and interest in and to all causes of action it may have under Section 4 of the

Clayton Act (15 U.S.C. Sec. 15) or under the Cartwright Act (Chapter 2 (commencing with Section 16700) of Part 2 of Division 7 of the Business and Professions Code), arising from purchases of goods, materials, or services by Contractor for sale to the Court. Such assignment shall be made and become effective at the time the Court tenders final payment to Contractor. If the Court receives, either through judgment or settlement, a monetary recovery for a cause of action assigned under this section, Contractor shall be entitled to receive reimbursement for actual legal costs incurred and may, upon demand, recover from the Court any portion of the recovery, including treble damages, attributable to overcharges that were paid by Contractor but were not paid by the Court as part of the bid price, less the expenses incurred in obtaining that portion of the recovery. Upon demand in writing by Contractor, the Court shall, within one year from such demand, reassign the cause of action assigned under this part if

Contractor has been or may have been injured by the violation of law for which the cause of action arose and (a) the Court has not been injured thereby, or (b) the Court declines to file a court action for the cause of action.

M. ORDER OF PRECEDENCE. Any conflict among or between the documents making up this Agreement will be resolved in accordance with the following order of precedence (in descending order of precedence): (a) Services -Short Form Agreement Terms; (b) Signature Page, and (c) any exhibits to this Agreement. All Court-issued competitive solicitation and related documents (e.g., the Court’s RFP, IFP, Addendum, Questions and

Answers), and cost or technical specifications contained in Contractor’s bid or proposal submitted in response to the Court’s competitive solicitation, may be relied upon for the purpose of clarifying, illustrating, or explaining the intention and understanding of the parties as to the performance of this

Agreement.

N. MISCELLANEOUS. Contractor will maintain a system of accounting and internal controls that is sufficient to adhere to Generally Accepted

Accounting Principles. Contractor is an independent contractor and Contractor will take all action available to Contractor to prevent Contractor, and its agents and employees, from being treated under the law as agents or employees of the Court. Contractor will not assign, subcontract or delegate its obligations under this Agreement without the prior written consent of the Court, and any attempted assignment, subcontract, or delegation is void;

however, no consent is required for an assignment that occurs (a) to an assignee in which the assignor owns more than 50% of the assets, or (b) as part of a sale or merger of all or substantially all of the assets of the assignor to an assignee if the Court approves the assignee. Subject to the foregoing, the terms and conditions of this Agreement apply to any assignee, subcontractor, trustee, successor, delegate or heir. Contractor shall cooperate with the Court if the Court wishes to perform a background check or drug test on any of Contractor’s employees or Subcontractors by (1) obtaining, at no additional cost, all releases, waivers, and permissions the Court may require, and (2) reimbursing the Court for the cost of each background check and drug test. California law, without regard to its choice-of-law provisions, governs this Agreement. In this Agreement, “including” means “including but not limited to.” The parties shall attempt in good faith to resolve informally and promptly any dispute that arises under this Agreement. Contractor irrevocably consents to personal jurisdiction in the courts of the State of California, and any legal action filed by

Contractor in connection with a dispute under this Agreement must be filed in San Bernardino County, California, which will be the sole venue for any such action; and further, the parties agree that California law, without regard to its choice-of-law provisions, governs this Agreement. If any part of this Agreement is held unenforceable, all other parts remain enforceable. All headings are for reference purposes only and do not affect the interpretation of this Agreement. A party’s waiver of enforcement of any of this Agreement’s terms or conditions will be effective only if it is in writing. A party’s specific waiver will not constitute a waiver by that party of any earlier, concurrent, or later breach or default. Contractor may not make a public announcement, or issue any press release or other writing, related to this Agreement, the Services, or Services without first obtaining the Court’s prior written approval, which may be denied for any or no reason.

O. DARFUR CONTRACTING ACT. If Contractor did not provide to Court a Darfur Contracting Act certification as part of the solicitation process, this section applies: Contractor certifies that either (a) it does not currently, and it has not within the previous three years, business activities or other operations outside of the United States, or (2) it is a “scrutinized company” as defined in PCC 10476, but it has received written permission for the Court to submit a bid or proposal pursuant to PCC 10477(b), or (3) it has, or it has had within the previous three years, business activities or other operations outside of the United States, but it is not a “scrutinized company” as defined in PCC 10476.

P. SIGNATURES. This Agreement may be executed in one or more counterparts, each of which shall be deemed an original, but taken together, all of which shall constitute one and the same Agreement. This Agreement is of no force and effect until signed by both parties and all Court-required approvals are secured. The Parties agree that this Agreement may be executed via electronic signature. Electronic signature means any electronic sound, symbol, or process attached to or logically associated with this Agreement and executed and adopted by a party with the intent to sign such record, including facsimile or email electronic signatures, pursuant to the California Uniform Electronic Act (Cal. Civ. Code §§ 1633.1 to 1633.17) as amended from time to time. Each Party agrees that the electronic signatures of the Parties included in this Agreement are intended to authenticate this writing and to have the same force and effect as manual signatures. The Parties further agree that electronic signatures for this Agreement are made by persons with authority to bind the Parties to the terms and conditions of this Agreement.

1. Definitions.

a. Breach. “Breach” shall have the same meaning as the term “breach” in 45 CFR § 164.402.

b. Breach Notification Rule. “Breach Notification Rule” shall mean the Standards and Implementation

Specifications for Notification of Breaches of Unsecured Protected Health Information under 45 CFR Parts

160 and 164, subparts A and D.

c. Business Associate. “Business Associate” shall mean P&A Administrative Services, Inc.

d. Covered Entity. “Covered Entity” shall mean the Medical Expense Reimbursement Account Option under the Superior Court of California, County of San Bernardino Flexible Benefits Plan.

e. Electronic Protected Health Information. “Electronic Protected Health Information” shall have the same meaning as the term “electronic protected health information” in 45 CFR § 160.103.

f. Electronic Transactions Rule. “Electronic Transactions Rule” shall mean the final regulations issued by HHS concerning standard transactions and code sets under 45 CFR Parts 160 and 162.

g. Enforcement Rule. “Enforcement Rule” shall mean the Enforcement Provisions set forth in 45 CFR

Part 160.

h. Genetic Information. “Genetic Information” shall have the same meaning as the term “genetic information” in 45 CFR § 160.103.

i. HHS. “HHS” shall mean the Department of Health and Human Services.

j. HIPAA Rules. “HIPAA Rules” shall mean the Privacy Rule, Security Rule, Breach Notification Rule, and Enforcement Rule.

k. HITECH Act. “HITECH Act” shall mean the Health Information Technology for Economic and Clinical

Health Act, enacted as part of the American Recovery and Reinvestment Act of 2009.

l. Privacy Rule. “Privacy Rule” shall mean the Privacy Standards and Implementation Specifications at 45 CFR Parts 160 and 164, subparts A and E.

m. Protected Health Information. “Protected Health Information” shall have the same meaning as the term “protected health information” in 45 CFR § 160.103, limited to the information created, received, EXHIBIT A

BUSINESS ASSOCIATE AGREEMENT

This Agreement made effective as of January 1, 2023 (the “Effective Date”), by and between the Covered Entity identified below, and P&A ADMINISTRATIVE SERVICES, INC., 17 Court Street, Suite

500, Buffalo, NY 14202-3294 ("Business Associate").

maintained, or transmitted by Business Associate from or on behalf of Covered Entity pursuant to this

Agreement.

n. Required by Law. “Required by Law” shall have the same meaning as the term “required by law” in

45 CFR § 164.103.

o. Security Incident. “Security Incident” shall have the same meaning as the term “security incident” in 45 CFR § 164.304.

p. Security Rule. “Security Rule” shall mean the Security Standards and Implementation

Specifications at 45 CFR Parts 160 and 164, subparts A and C.

q. Services Agreement. “Services Agreement” shall mean the “Flexible Benefits Plan Services

Agreement” of even date herewith between the Superior Court of California, County of San Bernardino and the Business Associate including any subsequent amendments or restatements thereof.

r. Subcontractor. “Subcontractor” shall have the same meaning as the term “subcontractor” in 45 CFR

§ 160.103.

s. Transaction. “Transaction” shall have the meaning given the term “transaction” in 45 CFR §

160.103.

t. Unsecured Protected Health Information. “Unsecured Protected Health Information” shall have the meaning given the term “unsecured protected health information” in 45 CFR § 164.402.

2. Privacy and Security of Protected Health Information.

a. Permitted Uses and Disclosures. Business Associate is permitted to use and disclose Protected

Health Information only as set forth below:

(i) Functions and Activities on Covered Entity’s Behalf. Business Associate shall provide the services described in a certain administrative services agreement of even date herewith (the “Services

Agreement”). The Business Associate hereby is authorized to de-identify Protected Health Information whenever, in its best judgment, it is necessary to do so to comply with the HIPAA Rules.

(ii) Business Associate’s Operations. Business Associate may use Protected Health

Information for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. Business Associate may disclose Protected Health

Information for the proper management and administration of the Business Associate or to carry out

Business Associate’s legal responsibilities, provided that —

(A) The disclosure is Required by Law; or

EXHIBIT A

(B) Business Associate obtains reasonable assurance from any person or entity to which

Business Associate will disclose Protected Health Information that the person or entity will —

(1) Hold the Protected Health Information in confidence and use or further disclose the

Protected Health Information only for the purpose for which Business Associate disclosed

Protected Health Information to the person or entity or as Required by Law; and

(2) Promptly notify Business Associate of any instance of which the person or entity becomes aware in which the confidentiality of Protected Health Information was breached.

(iii) Minimum Necessary. Business Associate will, in its performance of the functions, activities, services, and operations specified above, make reasonable efforts to use, to disclose, and to request only the minimum amount of Protected Health Information reasonably necessary to accomplish the intended purpose of the use, disclosure, or request, except that Business Associate will not be obligated to comply with this minimum-necessary limitation if neither Business Associate nor Covered

Entity is required to limit its use, disclosure, or request to the minimum necessary under the HIPAA

Rules. Business Associate and Covered Entity acknowledge that the phrase “minimum necessary” shall be interpreted in accordance with the HITECH Act and the HIPAA Rules.

b. Prohibition on Unauthorized Use or Disclosure. Business Associate will neither use nor disclose

Protected Health Information, except as permitted or required by this Agreement or in writing by Covered

Entity or as Required by Law. This Agreement does not authorize Business Associate to use or disclose

Covered Entity’s Protected Health Information in a manner that would violate the HIPAA Rules if done by

Covered Entity, except as permitted for Business Associate’s proper management and administration, as described above.

c. Information Safeguards.

(i) Privacy of Protected Health Information. Business Associate will develop, implement, maintain, and use appropriate administrative, technical, and physical safeguards to protect the privacy of Protected Health Information. The safeguards must reasonably protect Protected Health

Information from any intentional or unintentional use or disclosure in violation of the Privacy Rule and limit incidental uses or disclosures made pursuant to a use or disclosure otherwise permitted by this

Agreement. To the extent the parties agree that the Business Associate will carry out directly one or more of Covered Entity’s obligations under the Privacy Rule, the Business Associate will comply with the requirements of the Privacy Rule that apply to the Covered Entity in the performance of such obligations.

(ii) Security of Covered Entity’s Electronic Protected Health Information. Business Associate will comply with the Security Rule and will use appropriate administrative, technical, and physical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of

Electronic Protected Health Information that Business Associate creates, receives, maintains, or transmits on Covered Entity’s behalf.

(iii) No Transfer of PHI Outside United States. Business Associate will not transfer Protected

Health Information outside the United States without the prior written consent of the Covered Entity.

In this context, a “transfer” outside the United States occurs if Business Associate’s workforce members, agents, or subcontractors physically located outside the United States are able to access, use, or disclose Protected Health Information.

d. Subcontractors. Business Associate will require each of its Subcontractors to agree, in a written agreement with Business Associate, to comply with the provisions of the Security Rule; to appropriately safeguard Protected Health Information created, received, maintained, or transmitted on behalf of the

Business Associate; and to apply the same restrictions and conditions that apply to the Business Associate with respect to such Protected Health Information.

e. Prohibition on Sale of Protected Health Information. immediately, Business Associate shall not engage in any sale (as defined in the HIPAA rules) of Protected Health Information.

f. Prohibition on Use or Disclosure of Genetic Information. Effective immediately, Business

Associate shall not use or disclose Genetic Information for underwriting purposes in violation of the HIPAA rules.

g. Penalties for Noncompliance. Business Associate acknowledges that it is subject to civil and criminal enforcement for failure to comply with the HIPAA Rules, to the extent provided by the HITECH Act and the HIPAA Rules.

3. Compliance with Electronic Transactions Rule. If Business Associate conducts in whole or part electronic Transactions on behalf of Covered Entity for which HHS has established standards, Business

Associate will comply, and will require any Subcontractor it involves with the conduct of such Transactions to comply, with each applicable requirement of the Electronic Transactions Rule and of any operating rules adopted by HHS with respect to Transactions.

4. Individual Rights.

a. Access. Business Associate will, within twenty-nine calendar days following Covered Entity’s request, make available to Covered Entity (or, at Covered Entity’s written direction, to an individual or the individual’s designee) for inspection and copying Protected Health Information about the individual that is in a Designated Record Set in Business Associate’s custody or control, so that Covered Entity may meet its access obligations under 45 CFR § 164.524. If Covered Entity requests an electronic copy of Protected Health

Information that is maintained electronically in a Designated Record Set in the Business Associate’s custody or control, Business Associate will provide an electronic copy in the form and format specified by the Covered

Entity if it is readily producible in such format; if it is not readily producible in such format, Business Associate will work with Covered Entity to determine an alternative form and format that will enable Covered Entity to meet its electronic access obligations under 45 CFR § 164.524.

b. Amendment. Business Associate will, upon receipt of written notice from Covered Entity, promptly amend or permit Covered Entity access to amend any portion of an individual’s Protected Health Information that is in a Designated Record Set in the custody or control of the Business Associate, so that Covered Entity may meet its amendment obligations under 45 CFR § 164.526.

c. Disclosure Accounting. To allow Covered Entity to meet its obligations to account for disclosures of Protected Health Information under 45 CFR § 164.528:

(i) Disclosures Subject to Accounting. Business Associate will record the information specified below (“Disclosure Information”) for each disclosure of Protected Health Information, not excepted from disclosure accounting as specified below, that Business Associate makes to Covered Entity or to a third party.

(ii) Disclosures Not Subject to Accounting. Business Associate will not be obligated to record

Disclosure Information or otherwise account for disclosures of Protected Health Information if Covered

Entity need not account for such disclosures under the HIPAA Rules.

(iii) Disclosure Information. With respect to any disclosure by Business Associate of Protected

Health Information that is not excepted from disclosure accounting under the HIPAA Rules, Business

Associate will record the following Disclosure Information as applicable to the type of accountable disclosure made:

(A) Disclosure Information Generally. Except for repetitive disclosures of Protected Health

Information as specified below, the Disclosure Information that Business Associate must record for each accountable disclosure is (i) the disclosure date, (ii) the name and (if known) address of the entity to which Business Associate made the disclosure, (iii) a brief description of the

Protected Health Information disclosed, and (iv) a brief statement of the purpose of the disclosure.

(B) Disclosure Information for Repetitive Disclosures. For repetitive disclosures of Protected

Health Information that Business Associate makes for a single purpose to the same person or entity (including Covered Entity), the Disclosure Information that Business Associate must record is either the Disclosure Information specified above for each accountable disclosure, or

(i) the Disclosure Information specified above for the first of the repetitive accountable disclosures; (ii) the frequency, periodicity, or number of the repetitive accountable disclosures;

and (iii) the date of the last of the repetitive accountable disclosures.

(iv) Availability of Disclosure Information. Business Associate will maintain the Disclosure

Information for at least six years following the date of the accountable disclosure to which the

Disclosure Information relates. Business Associate will make the Disclosure Information available to

Covered Entity fifty-nine calendar days following Covered Entity’s request for such Disclosure

Information to comply with an individual’s request for disclosure accounting.

d. Restriction Agreements and Confidential Communications. Covered Entity shall notify

Business Associate of any limitations in the notice of privacy practices of Covered Entity under 45 CFR §

164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of Protected

Health Information. Business Associate will comply with any notice from Covered Entity to (1) restrict use or disclosure of Protected Health Information pursuant to 45 CFR § 164.522(a), or (2) provide for confidential communications of Protected Health Information pursuant to 45 CFR § 164.522(b), provided that Covered

Entity notifies Business Associate in writing of the restriction or confidential communications obligations that

Business Associate must follow. Covered Entity will promptly notify Business Associate in writing of the termination of any such restriction or confidential communications requirement and, with respect to termination of any such restriction, instruct Business Associate whether any of the Protected Health

Information will remain subject to the terms of the restriction agreement.

5. Breaches and Security Incidents.

a. Reporting.

(i) Impermissible Use or Disclosure. Business Associate will report to Covered Entity any use or disclosure of Protected Health Information not permitted by this Agreement not more than fifty-nine calendar days after Business Associate discovers such non-permitted use or disclosure.

(ii) Breach of Unsecured Protected Health Information. Business Associate will report to

Covered Entity any potential Breach of Unsecured Protected Health Information not more than fifty-nine calendar days after discovery of such potential Breach. Business Associate will treat a potential Breach as being discovered in accordance with 45 CFR § 164.410. Business Associate will make the report to Covered Entity’s Privacy Officer. If a delay is requested by a law-enforcement official in accordance with 45 CFR § 164.412, Business Associate may delay notifying Covered Entity for the applicable time period. Business Associate’s report will include at least the following, provided that absence of any information will not be cause for Business Associate to delay the report:

(A) Identify the nature of the Breach, which will include a brief description of what happened, including the date of any Breach and the date of the discovery of any Breach;

(B) Identify the types of Protected Health Information that were involved in the Breach (such as whether full name, Social Security number, date of birth, home address, account number, diagnosis, or other information were involved);

(C) Identify who made the non-permitted use or disclosure and who received the non- permitted disclosure;

(D) Identify what corrective or investigational action Business Associate took or will take to prevent further non-permitted uses or disclosures, to mitigate harmful effects, and to protect against any further Breaches;

(E) Identify what steps the individuals who were subject to a Breach should take to protect themselves;

(F) Provide such other information, including a written report and risk assessment under 45

CFR § 164.402, as Covered Entity may reasonably request.

(iii) Security Incidents. Business Associate will report to Covered Entity any Security Incident of which Business Associate becomes aware. Business Associate will make this report once per month, except if any such Security Incident resulted in a disclosure not permitted by this Agreement or Breach of Unsecured Protected Health Information, Business Associate will make the report in accordance with the provisions set forth above.

b. Mitigation. Business Associate shall mitigate, to the extent practicable, any harmful effect known to the Business Associate resulting from a use or disclosure in violation of this Agreement.

6. Term and Termination.

a. Term. This Agreement shall be effective as the Effective Date, and shall remain in effect until the

Service Agreement terminates.

b. Right to Terminate for Cause. Notwithstanding “a” above, Covered Entity may terminate this

Agreement if it determines, in its sole discretion, that Business Associate has breached any provision of this

Agreement, and after written notice to Business Associate of the breach, Business Associate has failed to cure the breach within thirty calendar days after receipt of the notice. Any such termination will be effective immediately or at such other date specified in Covered Entity’s notice of termination.

c. Treatment of Protected Health Information on Termination.

(i) Return or Destruction of Covered Entity’s Protected Health Information Is Feasible. Upon termination of this Agreement, Business Associate will, if feasible, return to Covered Entity or destroy all Protected Health Information in whatever form or medium, including all copies thereof and all data, compilations, and other works derived therefrom that allow identification of any individual who is a subject of the Protected Health Information. This provision shall apply to Protected Health Information that is in the possession of any Subcontractors of Business Associate. Further, Business Associate shall require any such Subcontractor to certify to Business Associate that it has returned or destroyed all such information which could be returned or destroyed. Business Associate will complete these obligations as promptly as possible, but not later than thirty calendar days following the effective date of the termination of this Agreement.

(ii) Procedure When Return or Destruction Is Not Feasible. Business Associate will identify any

Protected Health Information, including any Protected Health Information that Business Associate has disclosed to Subcontractors, that cannot feasibly be returned to Covered Entity or destroyed and explain why return or destruction is infeasible. Business Associate will limit its further use or disclosure of such information to those purposes that make return or destruction of such information infeasible.

Business Associate will complete these obligations as promptly as possible, but not later than thirty calendar days following the effective date of the termination or other conclusion of Agreement.

(iii) Continuing Privacy and Security Obligation. Business Associate’s obligation to protect the privacy and safeguard the security of Protected Health Information as specified in this Agreement will be continuous and survive termination or other conclusion of this Agreement.

7. General Provisions.

a. Definitions. All terms that are used but not otherwise defined in this Agreement shall have the meaning specified under HIPAA, including its statute, regulations, and other official government guidance.

b. Inspection of Internal Practices, Books, and Records. Business Associate will make its internal practices, books, and records relating to its use and disclosure of Protected Health Information available to

Covered Entity and to HHS to determine compliance with the HIPAA Rules.

c. Amendment to Agreement. This Agreement may be amended only by a written instrument signed by the parties. In case of a change in applicable law, the parties agree to negotiate in good faith to adopt such amendments as are necessary to comply with the change in law.

d. No Third-Party Beneficiaries. Nothing in this Agreement shall be construed as creating any rights or benefits to any third parties.

IN WITNESS WHEREOF, the parties have entered into this Agreement as of the Effective Date.

COVERED ENTITY BUSINESS ASSOCIATE

By: __________________________ By: __________________________

Title:___________________________ Title:__________________________

e. Interpretation. Any ambiguity in the Agreement shall be resolved to permit Covered Entity and

Business Associate to comply with the applicable requirements under the HIPAA Rules.

f. Severability. The invalidity or unenforceability of any provisions of this Agreement shall not affect the validity or enforceability of any other provision of this Agreement, which shall remain in full force and effect.

g. Construction and Interpretation. The section headings contained in this Agreement are for reference purposes only and shall not in any way affect the meaning or interpretation of this Agreement. This

Agreement has been negotiated by the parties at arm’s-length and each of them has had an opportunity to modify the language of the Agreement. Accordingly, the Agreement shall be treated as having been drafted equally by the parties, and the language shall be construed as a whole and according to its fair meaning. Any presumption or principle that the language is to be construed against any party shall not apply. This

Agreement may be executed in counterparts, each of which shall be deemed to be an original, but all of which, taken together, shall constitute one and the same agreement.

EXHIBIT B: FLEXIBLE BENEFITS

ADMINISTRATION SERVICES

AGREEMENT

This Agreement made effective as of January 1 , 2023 (the "Effective Date"), by and between the SUPERIOR COURT OF CALIFORNIA, COUNTY OF SAN BERNARDINO, 247 West Third Street, First Floor, San Bernardino, CA 92415 (the "Employer"), and P&A ADMINISTRATIVE SERVICES, INC., 1 7 Court Street, Suite 500, Buffalo, NY 14202-3294 ("P&A").

W I T N E S S E T H :

WHEREAS, the Employer maintains a "cafeteria p l a n " , as defined in Section 125 of the Internal Revenue Code, for the benefit of its eligible employees (the "Plan"); and

WHEREAS, the Employer desires to retain P&A to provide administrative services with respect to the Plan, and P&A desires to provide such services upon certain terms and conditions;

NOW, THEREFORE, in consideration of the mutual covenants and agreements contained herein and for other good and valuable consideration, receipt of which is hereby acknowledged, the parties hereto, with the intention of being legally bound hereby, covenant and agree as follows:

1. Services. P&A shall provide the following services with respect to the Plan:

a. prepare such Plan documents as shall be necessary to properly restate and amend the Plan as of the Effective Date, including a formal Plan document, a summary of the material provisions of the Plan for distribution to employees eligible to participate in the Plan ("Participants"), and a form for use in enrolling eligible employees. At the time provided to the Employer, all such documents shall conform in all respects with all applicable laws, regulations and formal governmental guidance;

b. with the assistance of the Employer, enroll Participants in the Plan

c. provide to each Participant who elects benefits under the Plan’s Medical Expense Reimbursement Account benefit option or Dependent Care Assistance Account benefit option an electronic payment card that may be used to pay expenses that are eligible for reimbursement under that benefit option, and such additional cards for use by family members of the Participant as he or she reasonably shall request.

d. substantiate the eligibility of expenses paid by use of an electronic payment card to the extent required by applicable law;

e. provide Participants who have elected flexible spending account benefits under the Plan with a form to use in submitting flexible spending account claims

f. receive, review and, when authorized by the Plan and by applicable law, approve flexible spending account claims;

g. from time to time, notify the Employer of the aggregate amount of funds needed from the Employer to pay pending approved claims and receive said funds as transmitted by the Employer;

h. pay approved flexible spending account claims from funds made available by the Employer for that purpose. Claims shall be paid by check or, where authorized by a claimant, by direct electronic deposit to a bank account of the claimant;

i. provide with each flexible spending account claim paid by check a statement of the Participant's remaining account balance under the flexible spending account from which the payment has been made;

j. provide such other services as shall be reasonably necessary to process flexible spending account claims under the Plan;

k. before the end of each Plan Year of the Plan as described in the Plan document (the "Plan Year"), provide to each Participant who elected any flexible spending account benefits for that Plan Year a statement setting forth each of his or her flexible spending account balances and advise of the potential forfeiture of any balances not used to reimburse the Participant for eligible expenses incurred prior to the end of that Plan Year; and

l. perform such benefits discrimination testing as P&A shall deem necessary to assure the Plan's continuing compliance under Code Section 125.

2. Compensation. As compensation for the services rendered hereunder, the Employer shall pay P&A such fees as are set forth in Schedule A attached hereto and made a part hereof.

3. Employer Responsibilities.

a. The Employer shall notify P&A in writing of any event or occurrence that affects the group of employees who are eligible for reimbursement of expenses under the Plan (e.g., hiring of a new employee, termination of an employee, change in hours worked) as soon as is reasonably practicable.

b. The Employer shall provide P&A on a timely basis with such other information as P&A reasonably shall request in furtherance of its responsibilities hereunder as soon as is reasonably practicable.

c. The Employer shall provide P&A with the funds necessary to pay all claims that qualify for reimbursement under the Plan. P&A shall not be obligated to advance funds to the Employer for this purpose.

d. The Employer shall be responsible for assuring that withholding from its payroll is consistent in all respects with salary reduction elections made under the Plan and for preparing Forms W-2 that reflect benefits that were received by Participants during the reporting year to the extent required by law.

e. Responsibilities of the Parties and Indemnification. P&A shall indemnify and hold harmless the Employer from any claim, liability, obligation or charge arising out of P&A's misconduct, negligence or other wrongdoing in connection with activities or responsibilities arising out of or relating to this Agreement.

4. Term; Termination. The initial term of this Agreement shall be as stated on the cover sheet of the Agreement.

5. Confidentiality. All books and records, including the data therein, pertaining to each party which may come into the hands of the other are to be treated as confidential and private records, and the other party shall not disclose information from such records unless it is required by law or authorized by the initial party in writing prior to such disclosure. Both parties reserve the right to control the use of any of their symbols, trademarks, computer programs and service marks currently existing or hereafter established. Both parties agree that they will not use the computer programs work, symbols, trademarks, service marks, or other devices of the other in advertising, promotional material, or otherwise and will not advertise or display such devices without the prior written consent of the other party. In addition, both parties further agree that any such work, symbols, trademarks, service marks, or other devices furnished by one party to the other shall remain the property of the initial party and shall be returned by the other party upon demand of the initial party upon termination of this Agreement.

6. HIPAA Compliance. The parties hereto acknowledge that they have entered into a separate Business Associate Agreement of even date herewith (the Employer doing so on behalf of the Plan}, a copy of which is appended hereto as Exhibit 1, and agree that said Business Associate Agreement and all of the obligations and rights of the parties thereunder shall be…