2025-039-E-Health Dept-Forvis-Prepare analysis of 2023-24 Cost Report

Browse Search

Orange County Health Department January 23, 2025 Page 7 HIPAA Business Associate Agreement This Business Associate Agreement (BAA) is entered into by and between Forvis Mazars, LLP (hereinafter referred to as Business Associate) and Orange County Health Department (hereinafter referred to as Covered Entity). RECITALS Business Associate provides services to Covered Entity under this contract (the Contract), and Covered Entity wishes to disclose certain information to Business Associate pursuant to the terms of such Contract, some of which may constitute Protected Health Information (PHI). The purpose of this BAA is to comply with all applicable federal and state laws governing the privacy of PHI. As used herein, the Privacy Rule and the Security Rule are each deemed to include the amendments thereto, collectively referred to as HIPAA/HITECH Final Omnibus Rule, that are included in the: Modifications to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act (the HITECH Act) and the Genetic Information Nondiscrimination Act Other Modifications to the HIPAA Rules Final Rule (the Omnibus Rule), 78 Fed. Reg. 5565 Notwithstanding the terms of this or any other agreement between Covered Entity and Business Associate, Business Associate shall comply with all of its statutory and regulatory obligations stated under the HIPAA/HITECH Final Omnibus Rule. The terms stated herein shall have the same definitions as provided in HIPAA. In consideration of the mutual promises below and the exchange of information pursuant to this BAA, the parties agree as follows: 1. Permitted Uses and Disclosures. Except as described in the enumerated subparagraphs below, Business Associate shall not use or disclose PHI received from Covered Entity or created on behalf of Covered Entity. Exceptions: 1.1. As reasonably necessary to provide the services in the Contract; 1.2. As otherwise permitted or required by this BAA; 1.3. As required by law; and 1.4. For the proper management and administration of Business Associates business and to disclose PHI in connection with such management and administration, and to carry out the legal responsibilities of the Business Associate, provided Business Associate obtains reasonable assurances from the recipient that the PHI shall be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the recipient, and Business Associate requires the recipient to notify it of any instances of which it is aware in which the confidentiality of the PHI has been breached. 2. Safeguards. Business Associate shall not use or disclose PHI other than as permitted or required by the BAA or as required by law. 2.1. Business Associate shall establish and maintain appropriate safeguards and shall comply with the Security Rule with respect to electronic PHI (ePHI) to prevent the use or disclosure of such ePHI other than as provided for by the Contract including this BAA. 2.2. To the extent the Business Associate is to carry out one or more of Covered Entitys obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the Covered Entity in the performance of such obligation(s). 3. Subcontracts. In accordance with the requirements of the Privacy Rule and the Security Rule, Business Associate shall ensure any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information. 4. Obligations of Covered Entity. Covered Entity shall obtain any consent or authorization that may be required by HIPAA, or applicable state law, prior to furnishing Business Associate with PHI, including ePHI. Covered Entity shall notify Business Associate of: 4.1. Any limitation(s) in the Covered Entitys notice of privacy practices under 45 CFR 164.520, to the extent that such limitation may affect Business Associates use or disclosure of PHI; 4.2. Any changes in, or revocation of, the permission by an individual to use or disclose his or her PHI, to the extent that such changes may affect Business Associates use or disclosure of PHI; and 4.3. Any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associates use or disclosure of PHI. Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity. Covered Entity shall provide to Business Associate only the minimum PHI necessary to perform the services set forth in a Contract. 5. Reporting, Notification, and Mitigation. 5.1. Reporting. Business Associate shall notify Covered Entity of any use or disclosure of PHI not provided for by the BAA of which it becomes aware, including breaches of unsecured PHI as required at 45 CFR 164.410, and any security incident of which it becomes aware, provided that with respect to Unsuccessful Security Incidents (as defined below), Business Associate shall report to Covered Entity any such Unsuccessful Security Incidents that are material to the protection of Covered Entitys PHI. For purposes of this Business Associate Agreement, the Docusign Envelope ID: 183D8F77-022B-48BA-9D7A-59C5C1C4FC1A