JCM_ECM_Exhibit_G_BAA_HIPAA.pdf

This is a Business Associate Agreement (BAA) and HIPAA compliance document for the County of Los Angeles Justice, Care and Opportunities Department (JCOD) related to the Care Management (JCM) Program Including Enhanced Care Management (ECM) Services. The document establishes the legal framework and requirements for contractors to comply with the Health Insurance Portability and Accountability Act (HIPAA) and protect protected health information (PHI) of program participants who are justice-involved or justice-impacted adults and transition-age youth residing in Los Angeles County. The BAA outlines the obligations of the business associate (contractor) in handling, safeguarding, and managing all PHI in accordance with federal regulations, including requirements for administrative, physical, and technical safeguards, breach notification protocols, and restrictions on PHI use and disclosure.

The agreement specifies that contractors must implement comprehensive security measures to protect PHI, maintain detailed documentation of all uses and disclosures, establish audit controls and access management, and report any breaches or unauthorized access immediately to the County. The BAA establishes liability provisions holding contractors accountable for violations, requires contractors to ensure subcontractors comply with equivalent HIPAA standards, and mandates that all PHI be returned or destroyed upon contract termination. The document serves as a prerequisite compliance requirement for any organization contracting to provide JCM and ECM services under the Justice Supportive Services Master Agreement (JSSMA) and must be executed prior to handling any participant health information.