Exhibit_D_-_Business_Associate_Agreement_(BAA)_04.2025.docx

EXHIBIT D-1

SOLANO COUNTY

HIPAA CONTRACTOR AGREEMENT

(Contractor Name)

This Exhibit shall constitute the Business Associate Agreement (the “Agreement”) between the County of Solano (the “County”) and the Contractor or grant recipient (the “Contractor”) and applies to the functions Contractor will perform on behalf of the County (collectively, “Services”), that is identified in Exhibit A, Scope of Work.

· County wishes to disclose certain information to Contractor pursuant to the terms of the Agreement, some of which may constitute Protected Health Information (“PHI”) (defined below).

B County and its Contractor acknowledge that Contractor is subject to the Privacy and Security Rules (45 CFR parts 160 and 164) promulgated by the United States Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191 as amended by the Health Information Technology for Economic and Clinical Health Act as set forth in Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (“HITECH Act), in certain aspects of its operations performed on behalf of the County.

C As part of the HIPAA Regulations, the Privacy Rule and the Security Rule (defined below) require County to enter into an Agreement containing specific requirements with Contractor prior to the disclosure of PHI, as set forth in, but not limited to, Title 45, sections 164.314(a), 164.502(e) and 164.504(e) of the Code of Federal Regulations (“C.F.R.”) and contained in this Agreement.

I. DEFINITIONS

Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR parts 160 and 164.

1. Breach means the same as defined under the HITECH Act [42 U.S.C. section 17921].

2. Contractor means the same as defined under the Privacy Rule, the Security rule, and the HITECH Act, including, but not limited to, 42 U.S.C. section 17938 and 45 C.F.R. § 160.103.

3. Breach of the Security of the Information System means the unauthorized acquisition, including, but not limited to, access to, use, disclosure, modification or destruction, of unencrypted computerized data that materially compromises the security, confidentiality, or integrity of personal information maintained by or on behalf of the County. Good faith acquisition of personal information by an employee or agent of the information holder for the purposes of the information holder is not a breach of the security of the system; provided, that the personal information is not used or subject to further unauthorized disclosure.

4. Commercial Use means obtaining protected health information with the intent to sell, transfer or use it for commercial, or personal gain, or malicious harm; sale to third party for consumption, resale, or processing for resale; application or conversion of data to make a profit or obtain a benefit contrary to the intent of this Agreement.

5. Covered Entity means the same as defined under the Privacy Rule and the Security rule, including, but not limited to, 45 C.F.R. § 160.103.

6. Designated Record Set means the same as defined in 45 C.F.R. § 164.501.

7. Electronic Protected Health Information (ePHI) means the same as defined in 45 C.F.R. § 160.103.

8. Electronic Health Record means the same as defined shall have the meaning given to such term in the HITECH Act, including, but not limited to, 42 U.S.C. § 17921.

9. Encryption means the process using publicly known algorithms to convert plain text and other data into a form intended to protect the data from being able to be converted back to the original plain text by known technological means.

10. Health Care Operations means the same as defined in 45 C.F.R. § 164.501.

11. Individual means the same as defined in 45 CFR § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g).

12. Marketing means the same as defined under 45 CFR § 164.501 and the act or process of promoting, selling, leasing or licensing any patient information or data for profit without the express written permission of County.

13. Privacy Officer means the same as defined in 45 C.F.R. § 164.530(a)(1). The Privacy Officer is the official designated by a County or Contractor to be responsible for compliance with HIPAA/HITECH regulations.

14. Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR parts 160 and 164, subparts A and E.

15. Protected Health Information or PHI means any information, whether oral or recorded in any form or medium: (i) that relates to the past, present or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and (ii) that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual, and shall have the meaning given to such term under the Privacy Rule, including, but not limited to, 45 C.F.R. § 164.501. Protected Health Information includes Electronic Protected Health Information [45 C.F.R. §§ 160.103 and 164.501].

16. Required By Law means the same as defined in 45 CFR § 164.103.

17. Security Rule means the HIPAA Regulation that is codified at 45 C.F.R. parts 160 and 164, subparts A and C.

18. Security Incident means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

19. Security Event means an immediately reportable subset of security incidents which incident would include:

a. a suspected penetration of Contractor’s information system of which the Contractor becomes aware of but for which it is not able to verify immediately upon becoming aware of the suspected incident that PHI was not accessed, stolen, used, disclosed, modified, or destroyed;

b. any indication, evidence, or other security documentation that the Contractor’s network resources, including, but not limited to, software, network routers, firewalls, database and application servers, intrusion detection systems or other security appliances, may have been damaged, modified, taken over by proxy, or otherwise compromised, for which Contractor cannot refute the indication of the time the Contractor became aware of such indication;

c. a breach of the security of the Contractor’s information system(s) by unauthorized acquisition, including, but not limited to, access to or use, disclosure, modification or destruction, of unencrypted computerized data and which incident materially compromises the security, confidentiality, or integrity of the PHI; and or,

d. the unauthorized acquisition, including but not limited to access to or use, disclosure, modification or destruction, of unencrypted PHI or other confidential information of the County by an employee or authorized user of Contractor’s system(s) which materially compromises the security, confidentiality, or integrity of PHI or other confidential information of the County.

If data acquired (including but not limited to access to or use, disclosure, modification or destruction of such data) is in encrypted format but the decryption key which would allow the decoding of the data is also taken, the parties shall treat the acquisition as a breach for purposes of determining appropriate response.

20. Security Rule means the Security Standards for the Protection of Electronic Protected Health Information at 45 CFR parts 160 and 164, subparts A and C.

21. Unsecured PHI means protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary. Unsecured PHI shall have the meaning given to such term under the HITECH Act and any guidance issued pursuant to such Act including, but not limited to, 42 U.S.C. section 17932(h).

II. OBLIGATIONS OF CONTRACTOR

1. Compliance with the Privacy Rule: Contractor agrees to fully comply with the requirements under the Privacy Rule applicable to “Business Associates” as defined in the Privacy Rule and not use or further disclose Protected Health Information other than as permitted or required by this agreement or as required by law.

2. Compliance with the Security Rule: Contractor agrees to fully comply with the requirements under the Security Rule applicable to “Business Associates” as defined in the Security Rule.

3. Compliance with the HITECH Act: Contractor hereby acknowledges and agrees it will comply with the HITECH provisions as proscribed in the HITECH Act.

III. USES AND DISCLOSURES

Contractor shall not use Protected Health Information except for the purpose of performing Contractor’s obligations under the Contract and as permitted by the Contract and this Agreement. Further, Contractor shall not use Protected Health Information in any manner that would constitute a violation of the Privacy Rule or the HITECH Act if so used by County.

1. Contractor may use Protected Health Information:

a. For functions, activities, and services for or on the Covered Entities’ behalf for purposes specified in the Contract and this Agreement.

b. As authorized for Contractor’s management, administrative or legal responsibilities as a Contractor of the County. The uses and disclosures of PHI may not exceed the limitations applicable to the County;

c. As required by law.

d. To provide Data Aggregation services to the County as permitted by 45 CFR § 164.504(e)(2)(i)(B).

e. To report violations of law to appropriate Federal and State authorities, consistent with CFR § 164.502(j)(1).

2. Any use of Protected Health Information by Contractor, its agents, or subcontractors, other than those purposes of the Agreement, shall require the express written authorization by the County and a Business Associate Agreement or amendment as necessary.

3. Contractor shall not disclose Protect Health Information to a health plan for payment or health care operations if the patient has requested this restriction and has paid out of pocket in full for the health care item or service to which the Protected Health information relates.

4. Contractor shall not directly or indirectly receive remuneration in exchange for Protected Health Information, except with the prior written consent of County and as permitted by the HITECH Act, 42 U.S.C. section 17935(d)(2); however, this prohibition shall not affect payment by the County to Contractor for services provided pursuant to the Contract.

5. Contractor shall not use or disclose Protected Health Information for prohibited activities including, but not limited to, marketing or fundraising purposes.

6. Contractor agrees to adequately and properly maintain all Protected Health Information received from, or created, on behalf of County.

7. If Contractor discloses Protected Health Information to a third party, Contractor must obtain, prior to making any such disclosure, i) reasonable written assurances from such third party that such Protected Health Information will be held confidential as provided pursuant to this Agreement and only disclosed as required by law or for the purposes for which it was disclosed to such third party, and (ii) a written agreement from such third party to immediately notify Contractor of any breaches of confidentiality of the Protected Health Information, to the extent it has obtained knowledge of such breach [42 U.S.C. section 17932; 45 C.F.R. §§ 164.504(e)(2)(i), 164.504(e)(2)(i)(B), 164.504(e)(2)(ii)(A) and 164.504(e)(4)(ii)].

IV. MINIMUM NECESSARY

Contractor (and its agents or subcontractors) shall request, use and disclose only the minimum amount of Protected Health necessary to accomplish the purpose of the request, use or disclosure. [42 U.S.C. section 17935(b); 45 C.F.R. § 164.514(d)(3)]. Contractor understands and agrees that the definition of “minimum necessary” is in flux and shall keep itself informed of guidance issued by the Secretary with respect to what constitutes “minimum necessary.”

V. APPROPRIATE SAFEGUARDS

1. Contractor shall implement appropriate safeguards as are necessary to prevent the use or disclosure of Protected Health Information otherwise than as permitted by this Agreement, including, but not limited to, administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the Protected Health Information in accordance with 45 C.F.R. §§ 164.308, 164.310, and 164.312. [45 C.F.R. § 164.504(e)(2)(ii)(B); 45 C.F.R. § 164.308(b)]. Contractor shall comply with the policies and procedures and documentation requirements of the HIPAA Security Rule, including, but not limited to, 45 C.F.R. § 164.316. [42 U.S.C. section 17931].

2. Contractor agrees to comply with Subpart 45 CFR part 164 with respect to Electronic Protected Health Information (ePHI). Contractor must secure all Electronic Protected Health Information by technological means that render such information unusable, unreadable, or indecipherable to unauthorized individuals and in accordance with the National Institute of Standards Technology (NIST) Standards and Federal Information Processing Standards (FIPS) as applicable.

3. Contractor agrees that destruction of Protected Health Information on paper, film, or other hard copy media must involve either cross cut shredding or otherwise destroying the Protected Health Information so that it cannot be read or reconstructed.

4. Should any employee or subcontractor of Contractor have direct, authorized access to computer systems of the County that contain Protected Health Information, Contractor shall immediately notify County of any change of such personnel (e.g. employee or subcontractor termination or change in assignment where such access is no longer necessary) in order for County to disable previously authorized access.

VI. AGENT AND SUBCONTRACTOR’S OF CONTRACTOR

1. Contractor shall ensure that any agents and subcontractors to whom it provides Protected Health Information, agree in writing to the same restrictions and conditions that apply to Contractor with respect to such PHI and implement the safeguards required with respect to Electronic PHI [45 C.F.R. § 164.504(e)(2)(ii)(D) and 45 C.F.R. § 164.308(b)].

2. Contractor shall implement and maintain sanctions against agents and subcontractors that violate such restrictions and conditions and shall mitigate the effects of any such violation (see 45 C.F.R. §§ 164.530(f) and 164.530(e)(I)).

VII. ACCESS TO PROTECTED HEALTH INFORMATION

1. If Contractor receives Protected Health Information from the County in a Designated Record Set, Contractor agrees to provide access to Protected Health Information in a Designated Record Set to the County in order to meet its requirements under 45 C.F.R. § 164.524.

2. Contractor shall make Protected Health Information maintained by Contractor or its agents or subcontractors in Designated Record Sets available to County for inspection and copying within five (5) days of a request by County to enable County to fulfill its obligations under state law, [Health and Safety Code section 123110] the Privacy Rule, including, but not limited to, 45 C.F.R. § 164.524 [45 C.F.R. § 164.504(e)(2)(ii)(E)]. If Contractor maintains an Electronic Health Record, Contractor shall provide such information in electronic format to enable County to fulfill its obligations under the HITECH Act, including, but not limited to, 42 U.S.C. section 17935(e).

3. If Contractor receives a request from an Individual for a copy of the individual’s Protected Health Information, and the Protected Health Information is in the sole possession of the Contractor, Contractor will provide the requested copies to the individual in a timely manner. If Contractor receives a request for Protected Health Information not in its possession and in the possession of the County, or receives a request to exercise other individual rights as set forth in the Privacy Rule, Contractor shall promptly forward the request to the County. Contractor shall then assist County as necessary in responding to the request in a timely manner. If a Contractor provides copies of Protected Health Information to the individual, it may charge a reasonable fee for the copies as the regulations shall permit.

4. Contractor shall provide copies of HIPAA Privacy and Security Training records and HIPAA policies and procedures within five (5) calendar days upon request from the County.

VIII. AMENDMENTOF PROTECTED HEALTH INFORMATION

Upon receipt of notice from County, Contractor shall promptly amend or permit the County access to amend any portion of Protected Health Information in the designated record set which Contractor created for or received from the County so that the County may meet its amendment obligations under 45 CFR § 164.526. If any individual requests an amendment of Protected Information directly from Contractor or its agents or subcontractors, Contractor must notify the County in writing within five (5) days of the request. Any approval or denial of amendment of Protected Information maintained by Contractor or its agents or subcontractors shall be the responsibility of the County [45 C.F.R. § 164.504(e)(2)(ii)(F)].

IX. ACCOUNTING OF DISCLOSURES

1. At the request of the County, and in the time and manner designed by the County, Contractor and its agents or subcontractors shall make available to the County, the information required to provide an accounting of disclosures to enable the County to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 C.F.R. § 164.528, and the HITECH Act, including but not limited to 42 U.S.C. § 17935. Contractor agrees to implement a process that allows for an accounting to be collected and maintained by the Contractor and its agents or subcontractors for at least six (6) years prior to the request. However, accounting of disclosures from an Electronic Health Record for treatment, payment or health care operations purposes are required to be collected and maintained for only three (3) years prior to the request, and only to the extent that Contractor maintains an electronic health record and is subject to this requirement.

2. At a minimum, the information collected and maintained shall include: (i) the date of disclosure; (ii) the name of the entity or person who received Protected Health Information and, if known, the address of the entity or person; (iii) a brief description of Protected Information disclosed; and (iv) a brief statement of purpose of the disclosure that reasonably informs the individual of the basis for the disclosure, or a copy of the individual’s authorization, or a copy of the written request for disclosure.

3. In the event that the request for an accounting is delivered directly to Contractor or its agents or subcontractors, Contractor shall forward within five (5) calendar days a written copy of the request to the County. It shall be the County’s responsibility to prepare and deliver any such accounting requested. Contractor shall not disclose any Protected Information except as set forth in this Agreement [45 C.F.R. §§ 164.504(e)(2)(ii)(G) and 165.528]. The provisions of this paragraph shall survive the termination of this Agreement.

X. GOVERNMENTAL ACCESS TO RECORDS

Contractor shall make its internal practices, books and records relating to its use and disclosure of the protected health information it creates for or receives from the County, available to the County and to the Secretary of the U.S. Department of Health and Human for purposes of determining Contractor’s compliance with the Privacy rule [45 C.F.R. § 164.504(e)(2)(ii)(H)]. Contractor shall provide to the County a copy of any Protected Health Information that Contractor provides to the Secretary concurrently with providing such Protected Information to the Secretary.

XI. CERTIFICATION

To the extent that the County determines that such examination is necessary to comply with the Contractor’s legal obligations pursuant to HIPAA relating to certification of its security practices, County, or its authorized agents or contractors may, at the County’s expense, examine Contractor’s facilities, systems, procedures and records as may be necessary for such agents or contractors to certify to County the extent to which Contractor’s security safeguards comply with HIPAA Regulations, the HITECH Act, or this Agreement.

XII. BREACH OF UNSECURED PROTECTED HEALTH INFORMATION

1. In the case of a breach of unsecured Protected Health Information, Contractor shall comply with the applicable provisions of 42 U.S.C. § 17932 and 45 C.F.R. part 164, subpart D, including but not limited to 45 C.F.R. § 164.410.

2. Contractor agrees to notify County of any access, use or disclosure of Protected Health Information not permitted or provided for by this Agreement of which it becomes aware, including any breach as required in 45 45 C.F.R. § 164.410. or security incident immediately upon discovery by telephone at 707-784-3198 and hss-compliance@solanocounty.gov or through the online reporting portal at https://solanocounty.cqs.symplr.com/Portal and will include, to the extent possible, the identification of each Individual whose unsecured Protect Health Information has been, or is reasonably believed by the Contractor to have been accessed, acquired, used, or disclosed, a description of the Protected Health Information involved, the nature of the unauthorized access, use or disclosure, the date of the occurrence, and a description of any remedial action taken or proposed to be taken by Contractor. Contractor will also provide to County any other available information that the County requests.

3. A breach or unauthorized access, use or disclosure shall be treated as discovered by the Contractor on the first day on which such unauthorized access, use, or disclosure is known, or should reasonably have been known, to the Contractor or to any person, other than the individual committing the unauthorized disclosure, that is an employee, officer, subcontractor, agent or other representative of the Contractor.

4. Contractor shall mitigate, to the extent practicable, any harmful effect that results from a breach, security incident, or unauthorized access, use or disclosure of unsecured Protected Health Information by Contractor or its employees, officers, subcontractors, agents or representatives.

5. Following a breach, security incident, or any unauthorized access, use or disclosure of unsecured Protected Health Information, Contractor agrees to take any and all corrective action necessary to prevent recurrence, to document any such action, and to make all documentation available to the County.

6. Except as provided by law, Contractor agrees that it will not inform any third party of a breach or unauthorized access, use or disclosure of Unsecured Protected Health Information without obtaining the County’s prior written consent. County hereby reserves the sole right to determine whether and how such notice is to be provided to any individuals, regulatory agencies, or others as may be required by law, regulation or contract terms, as well as the contents of such notice. When applicable law requires the breach to be reported to a federal or state agency or that notice be given to media outlets, Contractor shall cooperate with and coordinate with County to ensure such reporting is in compliance with applicable law and to prevent duplicate reporting, and to determine responsibilities for reporting.

7. Contractor acknowledges that it is required to comply with the referenced rules and regulations and that Contractor (including its subcontractors) may be held liable and subject to penalties for failure to comply.

8. In meeting its obligations under this Agreement, it is understood that Contractor is not acting as the County’s agent. In performance of the work, duties, and obligations and in the exercise of the rights granted under this Agreement, it is understood and agreed that Contractor is at all times acting an independent contractor in providing services pursuant to this Agreement and Exhibit A, Scope of Work.

XIII. TERMINATION OF AGREEMENT

1. Upon termination of this Agreement for any reason, Contractor shall return or destroy, at County’s sole discretion, all other Protected Health Information received from the County, or created or received by Contractor on behalf of the County.

2. Contractor will retain no copies of Protected Health Information in possession of subcontractors or agents of Contractor.

3. Contractor shall provide the County notification of the conditions that make return or destruction not feasible, in the event that Contractor determines that returning or destroying the PHI is not feasible. If the County agrees that the return of the Protected Health Information is not feasible, Contractor shall extend the protections of this Agreement to such Protected Health Information and limit further use and disclosures of such Protected Health Information for so long as the Contractor or any of its agents or subcontractor maintains such information.

4. Contractor agrees to amend this Exhibit as necessary to comply with any newly enacted or issued state or federal law, rule, regulation or policy, or any judicial or administrative decision affecting the use or disclosure of Protected Health Information.

5. Contractor agrees to retain records, minus any Protected Health Information required to be returned by the above section, for a period of at least 7 years following termination of the Agreement. The determining date for retention of records shall be the last date of encounter, transaction, event, or creation of the record.

XIV. QUALIFIED SERVICE ORGANIZATION

To the extent that Contractor is also considered a Qualified Service Organization (“QSO”), with access to protected substance abuse treatment information, this Agreement shall be considered a Qualified Services Organization Agreement as required by 42 C.F.R. Part 2, and Contractor agrees to the following:

1. In receiving, storing, processing or otherwise dealing with any protected substance abuse information from County, Contractor is fully bound by the provisions of the federal regulations governing confidentiality of alcohol and drug abuse patient records, 42. C.F.R. Part 2.

2. If necessary, Contractor will resist in judicial proceedings any efforts to obtain access to protected substance abuse information, including patient identifying information related to substance use disorder diagnosis, treatment, or referral for treatment, except and unless access is expressly permitted under 42 C.F.R. Part 2. (See 42 C.F.R. § 2.12(c)(4).)

CERTIFICATION

I, the official named below, certify that I am duly authorized legally to bind the Contractor or grant recipient to the above described certification. I am fully aware that this certification is made under penalty of perjury under the laws of the State of California.

Contractor or Grant Recipient Signature Date

Official’s Name (type or print)

Title Federal Tax ID Number Revised 3/31/2025