Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
Exhibit X. Special Terms and Conditions – Information Privacy & Security – HIPAA Business Associate Addendum
This Business Associate Addendum (“Addendum”) supplements and is made a part of the services agreement (“AgreementMOU”) by and between County of Sonoma (“County”) and <vendor name> (“Business Associate”).
R E C I T A L S
WHEREAS, County of Sonoma (County) is a Hybrid Entity as defined under 45 Code of Federal Regulations (“CFR”) Section 164.103;
WHEREAS, PPSC is a Business Associate as defined under 45 CFR Section 160.103; WHEREAS, <vendor name> is a Business Associate as defined under 45 CFR Section 160.103;
WHEREAS, County wishes to disclose certain information to Business Associate pursuant to the terms of Addendum, some of which information may constitute Protected Health Information (“PHI”), including electronic Protected Health Information (“ePHI”); WHEREAS, County and Business Associate intend to protect the privacy and provide for the security of PHI, including ePHI, disclosed to Business Associate pursuant to Addendum in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104 191 (“HIPAA”), regulations promulgated thereunder by the U.S. Department of Health and Human Services, and other applicable laws; and
WHEREAS, as part of the HIPAA Regulations, the Privacy Rule and Security Rule require County to enter into a contract containing specific requirements with Business Associate prior to the disclosure of PHI, including ePHI, as set forth in, but not limited to, 45 CFR Sections 164.502(e), 164.504(e), and 164.308(b)(1) and contained in Addendum.
NOW THEREFORE, in consideration of the mutual promises below and the exchange of information pursuant to Addendum, the parties agree as follows:
Part I: HIPAA Business Associate Addendum (Applies to HIPAA Business Associates)
1. Definitions
Terms used, but not otherwise defined, in Addendum shall have the same meaning as those terms in the HIPAA Regulations as set forth at 45 CFR Sections 160.103, 164.304, and 164.501.
A. HIPAA Regulations. “HIPAA Regulations” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules as set forth at 45 CFR Part 160 and Part 164.
B. Breach. “Breach” shall mean the acquisition, access, use, or disclosure of PHI in a manner not permitted under 45 CFR Part 164 Subpart E and that compromises the security or privacy of PHI as defined at 45 CFR Section 164.402.
C. Business Associate. “Business Associate” shall have the same meaning as the term “Business Associate” as set forth at 45 CFR Section 160.103.
D. Covered Entity. “Covered Entity” shall have the meaning given to such term under the Privacy Rule and the Security Rule, including, but not limited to, 45 CFR Section Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
160.103. For purposes of this Addendum, this term is intended to mean the County of Sonoma.
E. Data Aggregation. “Data Aggregation” shall have the same meaning as the term “Data aggregation” as set forth at 45 CFR Section 164.501.
F. Designated Record Set. “Designated Record Set” shall have the same meaning as the term “designated record set” as set forth at 45 CFR Section 164.501.
G. Disclosure. “Disclosure” shall mean the release of, transfer of, provision of access to, or divulging in any manner information outside the entity holding the information in accordance with 45 CFR Section 160.103.
H. Health Care Operations. “Health Care Operations” shall have the same meaning as “Health care operations” as set forth at 45 CFR Section 164.501.
I. Individual. “Individual” shall have the same meaning as the term ''Individual'' as set forth at 45 CFR Section 164.501, except that the term “Individual” as used in this Addendum shall also include a person who qualifies as a personal representative in accordance with 45 CFR Section 164.502(g).
J. Minimum Necessary. “Minimum Necessary” shall mean the minimum amount of PHI necessary for the intended purpose, as set forth at 45 CFR Sections 164.502(b) and 164.514(d): Standard: Minimum Necessary.
K. Privacy Rule. “Privacy Rule” shall mean the HIPAA Standards for Privacy of Individually Identifiable Health Information as set forth at 45 CFR Part 160 and 45 CFR Part 164 Subparts A and E.
L. PHI. “PHI” shall have the same meaning as the term “protected health information” as set forth at 45 CFR Section 160.103, except limited to the information received from Covered Entity or created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity.
M. Required by Law. “Required by law” shall have the same meaning as the term “required by law” as set forth at 45 CFR Section 164.103.
N. Secretary. “Secretary” shall mean the Secretary of the United States Department of Health and Human Services (“DHHS”) or his/her designee.
O. Security Incident. “Security Incident” shall mean the attempted or successful unauthorized access, use, disclosure, modification, or destruction of personally identifiable information. . A Security Incident includes the attempted or successful unauthorized access, use, disclosure, modification, or destruction of or interference with systems operations in an information system which processes PHI that is under the control of Covered Entity or Business Associate of Covered Entity, but does not include minor incidents that occur on a daily basis, such as scans, “pings”, or unsuccessful random attempts to penetrate computer networks or servers maintained by Business Associate.
P. Security Rule. “Security Rule” shall mean the HIPAA Security Standards for the Protection of ePHI as set forth at 45 CFR Part 160 and 45 CFR Part 164 Subparts A and E.
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
Q. Subcontractor. “Subcontractor” shall mean a subcontractor of Business Associate that creates, receives, maintains, or transmits PHI on behalf of Business Associate.
R. Unsecured PHI. “Unsecured PHI” shall have the same meaning as the term “unsecured protected health information” as set forth at 45 CFR Section 164.402, except limited to the information received from Covered Entity or created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity.
S. Use. “Use” shall mean, with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information in accordance with 45 CFR Section 160.103.
2. Obligations of Business Associate
Business Associate acknowledges that Business Associate is directly required to comply with the HIPAA Regulations and that Business Associate (including its subcontractors) may be held directly liable for and be subject to penalties for failure to comply. . To the extent Business Associate is to carry out one or more of County's obligations under 45 CFR Part 164 Subpart E of the Privacy Rule, Business Associate agrees to comply with the requirements of 45 CFR Part 164 Subpart E that apply to County in the performance of such obligations.
3. Use or Disclosure of Protected Health Information
Except as otherwise provided in Addendum, Business Associate shall use and/or disclose PHI only as necessary to perform functions, activities, or services documented in the Scope of Work (Exhibit A) section of this Agreement for or on behalf of County, provided that such use and/or disclosure does not violate the HIPAA Regulations. . Business Associate agrees not to further use or disclose PHI other than as permitted or required by Addendum or as required by law. .
Business Associate must make reasonable efforts to limit PHI to the Minimum Necessary to accomplish the intended purpose of the use, disclosure, or request. The uses of PHI may not exceed the limitations applicable to County under the HIPAA Regulations.
4. Designation of a Privacy Officer and a Security Officer A. Contractor shall designate a qualified and trained Security Officer to oversee its data security program who shall be responsible for carrying out the requirements of the HIPAA Security Rule (45 CFR Part 164 Subpart C)
B. Contractor shall designate a qualified and trained Privacy Officer to oversee its information privacy program who shall be responsible for carrying out the requirements of the HIPAA Privacy Rule (45 CFR Part 164 et. seq.)
5. Safeguarding Protected Health Information
Business Associate shall use appropriate safeguards to prevent the use or disclosure of PHI other than as provided for by Addendum. Business Associate shall implement administrative, physical, and technical safeguards and shall comply with 45 CFR Part 164 Subpart C with respect to ePHI that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI created, received, maintained, or transmitted on behalf of County and prevent the use or disclosure of PHI other than as provided for by Agreement.
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
A. Encryption Requirements for Transmission and Storage of Electronic Data. All ePHI transmitted to Business Associate by County, and/or for or on behalf of County by Business Associate, and/or to County by Business Associate shall be provided or transmitted using encryption methods which renders such ePHI unusable, unreadable, or indecipherable by unauthorized persons. All ePHI stored by Business Associate on electronic media shall be protected using encryption methods which render such ePHI unusable, unreadable, or indecipherable by unauthorized persons. Encryption of ePHI in transit or at rest shall use a technology or methodology set forth by the Secretary in the guidance issued under Section 13402(h)(2) of Public Law 111-5, and in accordance with the National Institute of Standards Technology (NIST) and Standards and Federal Information Processing Standards (FIPS), as applicable.
B. Destruction of PHI on paper, film, or other hard copy media must involve either shredding or otherwise destroying the PHI so that it cannot be read or reconstructed.
C. Should any employee or subcontractor of Business Associate have direct, authorized access to County computer systems that contain ePHI, Business Associate shall immediately notify County of any change of such personnel (e.g., employee or subcontractor termination, or change in assignment where such access is no longer necessary) in order for County to disable the previously authorized access.
6. Notification of Breach, Unauthorized Use or Improper Disclosure Business Associate must notify County in writing of any access, use, or disclosure of PHI not permitted or provided for by Addendum and/or any actual or suspected use or disclosure of data in violation of any applicable federal or state laws or regulations of which Business Associate becomes aware. A breach or unauthorized access, use, or disclosure shall be treated as discovered by Business Associate the first day on which such unauthorized access, use, or disclosure is known, or should reasonably have been known, to Business Associate or to any person, other than the individual committing the unauthorized disclosure, that is an employee, officer, subcontractor, agent, or other representative of Business Associate.
A. Notification must be made as soon as practicable, but not later than 24 hours after discovery, by telephone call to 707-565-5703 plus e-mail to:
DHS-Privacy&[email protected], and will include:
1) The identification of each Individual whose PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, or disclosed; and 2) A description of any remedial action taken or proposed to be taken by Business Associate.
B. Business Associate must provide a complete report of the investigation to the County Privacy and Security Officer within ten (10) working days of the discovery of the breach or unauthorized use or disclosure. The report shall be submitted on the “Privacy Incident Report” form and shall include an assessment of all known factors relevant to a determination of whether a breach occurred. The report shall also include a full, detailed corrective action plan, including information on measures that were taken to halt and/or contain the improper use or disclosure. If the County requests information in addition to Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
that listed on the “Privacy Incident Report” form, Contractor shall make reasonable efforts to provide the County with such information.
C. Business Associate must mitigate any harm that results or may result from the breach, security incident, or unauthorized access, use, or disclosure of unsecured PHI by Business Associate or its employees, officers, subcontractors, agents, or other representatives.
D. Following a breach or unauthorized access, use, or disclosure of unsecured PHI, Business Associate agrees to take any and all corrective action necessary to prevent recurrence, to document any such corrective action, and to make this documentation available to County.
7. Agents and Subcontractors of Business Associate
In accordance with 45 CFR Sections 164.502(e)(1)(ii) and 164.308(b)(2), and to the extent that Business Associate uses any agent, including a subcontractor, to which Business Associate provides PHI received from, created by, maintained by, or received by Business Associate on behalf of County, Business Associate shall execute an agreement with such agent or contractor containing a requirement to ensure compliance with the same restrictions and conditions that apply through Addendum to Business Associate with respect to PHI.
8. Access to Protected Health Information
At the request of County, and in the time and manner designated by County, Business Associate shall provide access to PHI in Designated Record Set to an Individual or County to meet the requirements of 45 CFR Section 164.524, and Ca. Health & Safety Code 123100 et. seq.
9. Amendments to Designated Record Set
Business Associate shall make any amendment(s) to PHI in Designated Record Set as directed or agreed to by County, or to take other measures necessary to satisfy County's obligations under 45 CFR Section 164.526.
10. Accounting of Disclosures
Business Associate shall document and make available such disclosures of PHI and information related to such disclosures as would be required for County to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR Section 164.528.
11. Records Available to County, State, and Secretary
Business Associate shall make available internal practices, books, and records related to the use, disclosure, and privacy protection of PHI received from County, or created, maintained, or received by Business Associate on behalf of County, to County, State, or the Secretary for the purposes of investigating or auditing Business Associate's compliance with the HIPAA Regulations in the time and manner designated by County, State, or Secretary.
12. Return or Destruction of Protected Health Information A. Upon termination of Addendum for any reason, Business Associate shall:
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
1) Return all PHI received from County; return all PHI created, maintained or received by Business Associate on behalf of County; and return all PHI required to be retained by the HIPAA Regulations; OR:
2) at the discretion of County, destroy all PHI received from County, or created, maintained, or received by Business Associate on behalf of County. Destruction of PHI on paper, film, or other hard copy media must involve shredding or otherwise destroying the PHI in a manner which will render the PHI unreadable, undecipherable, or unable to be reconstructed. Business Associate shall certify in writing that such PHI has been destroyed.
B. In the event Business Associate determines that returning or destroying PHI is not feasible, Business Associate shall provide County notification of the conditions that make return or destruction not feasible. Business Associate shall extend the protections of this Addendum to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI.
13. Data Aggregation
Business Associate may provide data aggregation services related to the health care operations of County as permitted by 45 CFR Section 164.504(e)(2)(i)(B).
14. Other Applicable Laws
Business Associate shall comply with all other applicable laws to the extent that such state confidentiality laws are not preempted by HIPAA.
15. Penalties/Fines for Failure to Comply with HIPAA
Business Associate shall pay any penalty or fine assessed against Covered Entity arising from Business Associate's failure to comply with the obligations imposed by HIPAA.
16. Training of Employees and Enforcement of Requirements Business Associate shall train and use reasonable measures to ensure compliance with the requirements of this Business Associate Agreement by employees who assist in the performance of functions or activities on behalf of County under this Contract and use or disclose protected information; and discipline employees who intentionally violate any provisions.
17. Amendments to Addendum
No amendment of Addendum shall be effective unless and until such amendment is evidenced by a writing signed by the parties. County and Business Associate agree to take such action as is necessary to amend Addendum as required for County to comply with the requirements of the HIPAA Regulations. However, any provision required by HIPAA Regulations to be in Addendum shall bind the parties whether or not provided for in Addendum.
18. Termination of Addendum
If Business Associate should fail to perform any of its obligations hereunder, or materially breach any of the terms of Addendum, County may terminate Addendum immediately upon provision of notice stating the reason for such termination to Business Associate. County, within its sole discretion, may elect to give Business Associate an opportunity to cure such breach.
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
19. Material Breach
A breach by Business Associate or any of its agents or subcontractors of any provision of Addendum, as determined by County, shall constitute a material breach of Addendum and shall provide grounds for immediate termination of Addendum.
20. Indemnification
Business Associate agrees to accept all responsibility for loss or damage to any person or entity, including County, and to indemnify, hold harmless, and release County, its officers, agents, and employees from and against any actions, claims, damages, liabilities, disabilities, or expenses that may be asserted by any person or entity, including Business Associate, that arise out of, pertain to, or relate to Business Associate's or its agents', employees', contractors', subcontractors', or invitees' performance or obligations under Agreement. Business Associate agrees to provide a complete defense for any claim or action brought against County based upon a claim relating to such Business Associates' or its agents', employees', contractors', subcontractors', or invitees' performance or obligations under Agreement. Business Associates' obligations under Article 5 (Indemnification) apply whether or not there is concurrent negligence on County's part, but to the extent required by law, excluding liability due to County's conduct.
County shall have the right to select its legal counsel at Business Associate's expense, subject to Business Associate's approval, which shall not be unreasonably withheld. This indemnification obligation is not limited in any way by any limitation on the amount or type of damages or compensation payable to or for Business Associate or its agents under workers' compensation acts, disability benefits acts, or other employee benefit acts.
Part II: Privacy and Security of Personal Information and Personally Identifiable Information Not Subject to HIPAA: (Applies to all contractors)
1. Recitals
A. In addition to the Privacy and Security Rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) the County is subject to various other legal and contractual requirements with respect to the personal information (PI) and personally identifiable information (PII) it maintains. These include:
1) The California Information Practices Act of 1977 (California Civil Code §§ 1798 et seq.).
2) The Agreement between the Social Security Administration (SSA) and the County, known as the Information Exchange Agreement (IEA), which incorporates the Computer Matching and Privacy Protection Act Agreement (CMPPA) between the SSA and the California Health and Human Services Agency. The IEA, including the CMPPA, is attached to this Exhibit as Attachment B and is hereby incorporated in this Agreement.
B. The purpose of this Exhibit, Part II is to set forth Contractor’s privacy and security obligations with respect to PI and PII that Contractor may create, receive, maintain, use, or disclose for or on behalf of County pursuant to this Agreement. Specifically, this Exhibit applies to PI and PII which is not Protected Health Information (PHI) as defined by HIPAA and therefore is not addressed in this Exhibit, Part I of this Agreement, the HIPAA Business Associate Addendum.
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
C. The IEA Agreement referenced in A.2) above requires the County to extend its substantive privacy and security terms to subcontractors who receive data provided to DHCS by the Social Security Administration. If Contractor receives data from County that includes data provided to DHCS by the Social Security Administration, Contractor must comply with the following specific sections of the IEA Agreement: E. Security Procedures, F. Contractor/Agent Responsibilities, and G. Safeguarding and Reporting Responsibilities for Personally Identifiable Information (“PII”), and in Attachment 4 to the IEA, Electronic Information Exchange Security Requirements, Guidelines and Procedures for Federal, State and Local Agencies Exchanging Electronic Information with the Social Security Administration. Contractor must also ensure that any agents, including a subcontractor, to whom it provides County data that includes data provided by the Social Security Administration, agree to the same requirements for privacy and security safeguards for such confidential data that apply to Contractor with respect to such information.
D. The terms used in this Exhibit, Part II, but not otherwise defined, shall have the same meanings as those terms have in the above referenced statute and Agreement. Any reference to statutory, regulatory, or contractual language shall be to such language as in effect or as amended.
19. Definitions
A. “Breach” shall have the meaning given to such term under the IEA and CMPPA. It shall include a “PII loss” as that term is defined in the CMPPA.
B. “Breach of the security of the system” shall have the meaning given to such term under the California Information Practices Act, Civil Code § 1798.29(d).
C. Confidential Information shall mean information that is exempt from disclosure under the provisions of the California Public Records Act (Government Code sections 6250-6265) or other applicable state or federal laws
D. “CMPPA Agreement” means the Computer Matching and Privacy Protection Act Agreement between the Social Security Administration and the California Health and Human Services Agency (CHHS).
https://www.ssa.gov/dataexchange/documents/CMPPA%20State%20Model.pdf E. “County PI” shall mean Personal Information, as defined below, accessed in a database maintained by the County, received by Contractor from the County or acquired or created by Contractor in connection with performing the functions, activities and services specified in this Agreement on behalf of the County.
F. “IEA” shall mean the Information Exchange Agreement currently in effect between the Social Security Administration (SSA) and the California Department of Health Care Services (DHCS).
https://www.ssa.gov/dataexchange/documents/IEA(F)%20State%20Level.pdf G. “Notice-triggering Personal Information” shall mean the personal information identified in Civil Code section 1798.29(e) whose unauthorized access may trigger notification requirements under Civil Code § 1709.29. For purposes of this provision, identity shall include, but not be limited to, name, identifying number, symbol, or other identifying Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
particular assigned to the individual, such as a finger or voice print, a photograph or a biometric identifier. Notice-triggering Personal Information includes PI in electronic, paper or any other medium.
H. “Personally Identifiable Information” (PII) shall have the meaning given to such term in the IEA and CMPPA.
I. “Personal Information” (PI) shall have the meaning given to such term in California Civil Code § 1798.3(a).
J. “Required by law” means a mandate contained in law that compels an entity to make a use or disclosure of PI or PII that is enforceable in a court of law. This includes, but is not limited to, court orders and court-ordered warrants, subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information, and a civil or an authorized investigative demand. It also includes Medicare conditions of participation with respect to health care providers participating in the program, and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.
K. “Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of PI, or confidential data utilized in complying with this Agreement; or interference with system operations in an information system that processes, maintains or stores PI.
L. Sensitive Information shall mean information that requires special precautions to protect from unauthorized use, access, disclosure, modification, loss, or deletion. Sensitive Information may be either Public Information or Confidential Information. It is information that requires a higher than normal assurance of accuracy and completeness.
Thus, the key factor for Sensitive Information is that of integrity. Typically, Sensitive Information includes records of agency financial transactions and regulatory actions.
20. Terms of Agreement
A. Permitted Uses and Disclosures of County PI and PII by Contractor Except as otherwise indicated in this Exhibit, Part II, Contractor may use or disclose County PI only to perform functions, activities or services for or on behalf of the County pursuant to the terms of this Agreement provided that such use or disclosure would not violate the California Information Practices Act (CIPA) if done by the County.
B. Responsibilities of Contractor
Contractor agrees:
1) Nondisclosure. Not to use or disclose County PI or PII other than as permitted or required by this Agreement or as required by applicable state and federal law. o The Contractor and its employees, agents, or subcontractors shall protect from unauthorized disclosure any Personal Information, Sensitive Information, or Confidential Information (hereinafter identified as PSCI).
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
o The Contractor and its employees, agents, or subcontractors shall not use any PSCI for any purpose other than carrying out the Contractor's obligations under this Agreement.
o The Contractor and its employees, agents, or subcontractors shall promptly transmit to the County Program Contract Manager all requests for disclosure of any PSCI not emanating from the person who is the subject of PSCI. o The Contractor shall not disclose, except as otherwise specifically permitted by this Agreement or authorized by the person who is the subject of PSCI, any PSCI to anyone other than County without prior written authorization from the County Program Contract Manager, except if disclosure is required by State or Federal law.
2) Safeguards. To implement appropriate and reasonable administrative, technical, and physical safeguards to protect the security, confidentiality and integrity of County PI and PII, to protect against anticipated threats or hazards to the security or integrity of County PI and PII, and to prevent use or disclosure of County PI or PII other than as provided for by this Agreement. Contractor shall develop and maintain a written information privacy and security program that include administrative, technical and physical safeguards appropriate to the size and complexity of Contractor’s operations and the nature and scope of its activities, which incorporate the requirements of Section 3, Security, below. Contractor will provide County with its current policies upon request.
3) Security. Contractor shall take any and all steps necessary to ensure the continuous security of all computerized data systems containing PHI and/or PI, and to protect paper documents containing PHI and/or PI. These steps shall include, at a minimum:
a) Complying with all of the data system security precautions listed in Part IV of this Special Terms and Conditions Document, Contractor Data Security Requirements; and
b) Providing a level and scope of security that is at least comparable to the level and scope of security established by the Office of Management and Budget in OMB Circular No. A-130, Appendix III- Security of Federal Automated Information Systems, which sets forth guidelines for automated information systems in Federal agencies; and
c) If the data obtained by User(s) from County includes PII, User(s) shall also comply with the substantive privacy and security requirements in the Computer Matching and Privacy Protection Act Agreement between the SSA and the California Health and Human Services Agency (CHHS) and in the Agreement between the SSA and DHCS, known as the Information Exchange Agreement (IEA), which are attached as Attachment B and are incorporated into this Agreement. The specific sections of the IEA with substantive privacy and security requirements to be complied with are sections E, F, and G, and in Attachment 4 to the IEA, Electronic Information Exchange Security Requirements, Guidelines and Procedures for Federal, State and Local Agencies Exchanging Electronic Information with the SSA. The User(s) also agree to ensure that any agents, Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
including a subcontractor, to whom they provide County PII agree to the same requirements for privacy and security safeguards for confidential data that apply to the User(s) with respect to such information. The User(s) also agree to ensure that any agents, including a subcontractor, to whom they provide County PII agree to the same requirements for privacy and security safeguards for confidential data that apply to the User(s) with respect to such information. 4) Mitigation of Harmful Effects. To mitigate, to the extent practicable, any harmful effect that is known to Contractor of a use or disclosure of County PI or PII by Contractor or its subcontractors in violation of this Exhibit, Part II. 5) Contractor’s Agents and Subcontractors. To impose the same restrictions and conditions set forth in this Exhibit, Part II on any subcontractors or other agents with whom Contractor subcontracts any activities under this Agreement that involve the disclosure of County PI or PII to the subcontractor.
6) Availability of Information to County. To make PI and PII available to the County for purposes of oversight, inspection, amendment, and response to requests for records, injunctions, judgments, and orders for production of County PI and PII. If Contractor receives County PII, upon request by County, Contractor shall provide County with a list of all employees, contractors and agents who have access to County PII, including employees, contractors and agents of its subcontractors and agents. 7) Cooperation with County. With respect to County PI, to cooperate with and assist the County to the extent necessary to ensure the County’s compliance with the applicable terms of the CIPA including, but not limited to, accounting of disclosures of County PI, correction of errors in County PI, production of County PI, disclosure of a security breach involving County PI and notice of such breach to the affected individual(s). 8) Breaches and Security Incidents. During the term of this Agreement, Contractor agrees to implement reasonable systems for the discovery and prompt reporting of any breach or security incident, and to take the following steps:
a) Initial Notice to the County. (1) To notify the County immediately by telephone call plus email or fax upon the discovery of a breach of unsecured County PI or PII in electronic media or in any other media if the PI or PII was, or is reasonably believed to have been, accessed or acquired by an unauthorized person, or upon discovery of a suspected security incident involving County PII. (2) To notify the County within 24 hours (1 hour if SSA data) by email or fax of the discovery of any suspected security incident, intrusion or unauthorized access, use or disclosure of County PI or PII in violation of this Agreement or this Exhibit, Part I, or potential loss of confidential data affecting this Agreement. A breach shall be treated as discovered by Contractor as of the first day on which the breach is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing the breach) who is an employee, officer or other agent of Contractor.
b) Notice shall be provided to the County Privacy and Security Officer. If the incident occurs after business hours or on a weekend or holiday and involves electronic County PI or PII, notice shall be provided by calling the County Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
Privacy and Security Officer. Notice shall be made using the County “Privacy Incident Report” form.
c) Upon discovery of a breach or suspected security incident, intrusion or unauthorized access, use or disclosure of County PHI, Contractor shall take:
i. Prompt corrective action to mitigate any risks or damages involved with the breach and to protect the operating environment; and
ii. Any action pertaining to such unauthorized disclosure required by applicable Federal and State laws and regulations.
d) Investigation and Investigation Report. To immediately investigate such suspected security incident, security incident, breach, or unauthorized access, use or disclosure of PHI within 72 hours of the discovery, Contractor shall submit an updated “Privacy Incident Report” containing the information marked with an asterisk and all other applicable information listed on the form, to the extent known at the time, to the County Privacy and Security Officer. e) Complete Report. To provide a complete report of the investigation to the County Privacy and Security Officer within ten (10) working days of the discovery of the breach or unauthorized use or disclosure. The report shall be submitted on the “Privacy Incident Report” form and shall include an assessment of all known factors relevant to a determination of whether a breach occurred. The report shall also include a full, detailed corrective action plan, including information on measures that were taken to halt and/or contain the improper use or disclosure. If the County requests information in addition to that listed on the “Privacy Incident Report” form, Contractor shall make reasonable efforts to provide the County with such information. If, because of the circumstances of the incident, Contractor needs more than ten (10) working days from the discovery to submit a complete report, the County may grant a reasonable extension of time, in which case Contractor shall submit periodic updates until the complete report is submitted. If necessary, a Supplemental Report may be used to submit revised or additional information after the completed report is submitted, by submitting the revised or additional information on an updated “Privacy Incident Report” form. The County will review and approve the determination of whether a breach occurred and individual notifications are required, and the corrective action plan. f) Responsibility for Reporting of Breaches. If the cause of a breach of County PI or PII is attributable to Contractor or its agents, subcontractors or vendors, Contractor is responsible for all required reporting of the breach as specified in CIPA, § 1798.29(a) – (d) and as may be required under the IEA. Contractor shall bear all costs of required notifications to individuals as well as any costs associated with the breach. The County Privacy and Security Officer shall approve the time, manner and content of any such notifications and their review and approval must be obtained before the notifications are made. The County will provide its review and approval expeditiously and without unreasonable delay. If Contractor has reason to believe that duplicate reporting of the same breach or incident may occur because its subcontractors, agents or vendors may report the Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
breach or incident to the County in addition to Contractor, Contractor shall notify the County, and the County and Contractor may take appropriate action to prevent duplicate reporting.
g) County Contact Information. To direct communications to the above referenced County staff, the Contractor shall initiate contact as indicated herein. The County reserves the right to make changes to the contact information below by giving written notice to the Contractor. Said changes shall not require an amendment to this Addendum or the Agreement to which it is incorporated.
Sonoma Co. Privacy Officer: 1450 Neotomas Ave. Suite 200, Santa Rosa, CA 95405; 707-565-5703; DHS-Privacy&[email protected] Part III: Miscellaneous Terms and Conditions including Access to 42 CFR Part 2 information. (Applies to all Contractors)
1. Confidentiality of Alcohol and Drug Abuse Patient Records If Contractor is in possession or has access to information regulated by Title 42 Code of Federal Regulations, Chapter I, Subchapter A, Part 2, (42 CFR Part 2), Contractor shall comply with all related regulations. Contractor is aware that criminal penalties may be imposed for a violation of these confidentiality requirements.
2. Disclaimer
The County makes no warranty or representation that compliance by Contractor with this Exhibit, HIPAA or the HIPAA regulations will be adequate or satisfactory for Contractor’s own purposes or that any information in Contractor’s possession or control, or transmitted or received by Contractor, is or will be secure from unauthorized use or disclosure. Contractor is solely responsible for all decisions made by Contractor regarding the safeguarding of the County PHI.
3. Amendment
A. The parties acknowledge that federal and state laws relating to electronic data security and privacy are rapidly evolving and that amendment of this Exhibit may be required to provide for procedures to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to implement the standards and requirements of HIPAA, the HITECH Act, and the HIPAA regulations. Upon either party’s request, the other party agrees to promptly enter into negotiations concerning an amendment to this Exhibit embodying written assurances consistent with the standards and requirements of HIPAA, the HITECH Act, and the HIPAA regulations. The County may terminate this Agreement upon thirty (30) days written notice in the event:
1) Contractor does not promptly enter into negotiations to amend this Exhibit when requested by the County pursuant to this section; or
2) Contractor does not enter into an amendment providing assurances regarding the safeguarding of County PHI that the County deems necessary to satisfy the standards and requirements of HIPAA and the HIPAA regulations.
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
21. Judicial or Administrative Proceedings
Contractor will notify the County if it is named as a defendant in a criminal proceeding for a violation of HIPAA or other security or privacy law. The County may terminate this Agreement if Contractor is found guilty of a criminal violation of HIPAA. The County may terminate this Agreement if a finding or stipulation that the Contractor has violated any standard or requirement of HIPAA, or other security or privacy laws is made in any administrative or civil proceeding in which the Contractor is a party or has been joined. County will consider the nature and seriousness of the violation in deciding whether or not to terminate the Agreement.
22. Assistance in Litigation or Administrative Proceedings Contractor shall make itself and any subcontractors, employees or agents assisting Contractor in the performance of its obligations under this Agreement, available to the County at no cost to the County to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against the County, its directors, officers or employees based upon claimed violation of HIPAA, or the HIPAA regulations, which involves inactions or actions by the Contractor, except where Contractor or its subcontractor, employee or agent is a named adverse party.
23. No Third-Party Beneficiaries
Nothing express or implied in the terms and conditions of this Exhibit is intended to confer, nor shall anything herein confer, upon any person other than the County or Contractor and their respective successors or assignees, any rights, remedies, obligations or liabilities whatsoever.
24. Interpretation
The terms and conditions in this Exhibit shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HITECH Act, and the HIPAA regulations. The parties agree that any ambiguity in the terms and conditions of this Exhibit shall be resolved in favor of a meaning that complies and is consistent with HIPAA, the HITECH Act and the HIPAA regulations.
25. Conflict
In case of a conflict between any applicable privacy or security rules, laws, regulations or standards the most stringent shall apply. The most stringent means that safeguard which provides the highest level of protection to PHI from unauthorized disclosure. Further, Contractor must comply within a reasonable period of time with changes to these standards that occur after the effective date of this Agreement.
26. Regulatory References
A reference in the terms and conditions of this Exhibit to a section in the HIPAA regulations means the section as in effect or as amended.
27. Survival
The respective rights and obligations of Contractor under Section 3, Item D of Exhibit, Part I, Responsibilities of Contractor, shall survive the termination or expiration of this Agreement.
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
11. No Waiver of Obligations
No change, waiver or discharge of any liability or obligation hereunder on any one or more occasions shall be deemed a waiver of performance of any continuing or other obligation, or shall prohibit enforcement of any obligation, on any other occasion.
12. Audits, Inspection and Enforcement
From time to time, and subject to all applicable federal and state privacy and security laws and regulations, the County may conduct a reasonable inspection of the facilities, systems, books and records of Contractor to monitor compliance with this Exhibit. Contractor shall promptly remedy any violation of any provision of this Exhibit. The fact that the County inspects, or fails to inspect, or has the right to inspect, Contractor’s facilities, systems and procedures does not relieve Contractor of its responsibility to comply with this Exhibit. The County's failure to detect a non-compliant practice, or a failure to report a detected non-compliant practice to Contractor does not constitute acceptance of such practice or a waiver of the County's enforcement rights under this Agreement, including this Exhibit.
13. Due Diligence
Contractor shall exercise due diligence and shall take reasonable steps to ensure that it remains in compliance with this Exhibit and is in compliance with applicable provisions of HIPAA, the HITECH Act and the HIPAA regulations, and that its agents, subcontractors and vendors are in compliance with their obligations as required by this Exhibit.
14. Term
The Term of this Exhibit shall extend beyond the termination of the Agreement and shall terminate when all County PHI is destroyed or returned to the County, in accordance with 45 C.F.R. § 164.504(e)(2)(ii)(I), and when all County PI and PII is destroyed in accordance with Attachment A.
15. Effect of Termination
Upon termination or expiration of this Agreement for any reason, Contractor shall return or destroy all County PHI, PI and PII that Contractor still maintains in any form, and shall retain no copies of such PHI, PI or PII. If return or destruction is not feasible, Contractor shall notify the County of the conditions that make the return or destruction infeasible, and the County and Contractor shall determine the terms and conditions under which Contractor may retain the PHI, PI or PII. Contractor shall continue to extend the protections of this Exhibit to such County PHI, PI and PII, and shall limit further use of such data to those purposes that make the return or destruction of such data infeasible. This provision shall apply to County PHI, PI and PII that is in the possession of subcontractors or agents of Contractor.
Part IV: Contractor Data Security Requirements
1. General Controls
Contractor shall preserve and shall ensure that its sub-consultants or vendors preserve, the confidentiality, integrity, and availability of County data with administrative, technical and physical measures that conform to generally recognized industry standards and best practices that the selected firm then applies to its own processing environment. Maintenance of a secure processing environment includes, but is not limited to, the timely application of patches, fixes Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
and updates to operating systems and applications as provided by Contractor and/or its subconsultants or vendors. Contractor agrees to, and shall ensure that its sub-consultants or venders, comply with County’s current and future information security policies, standards, procedures, and guidelines.
28. Designation of Individual(s) Responsible for information Privacy and Security A. Security Officer:
Contractor shall designate a qualified individual, (HIPAA Security Officer), to implement and oversee its data security program. The individual shall be responsible for, and knowledgeable about, carrying out the requirements of this Special Terms and Conditions Exhibit, ensuring Contractor compliance with all provisions of the HIPAA Security Rule (45 CFR 164.300 et. seq.), and for communicating about privacy and security matters with the County.
B. Privacy Officer:
Contractor shall designate a qualified individual, (HIPAA Privacy Officer), to implement and oversee its information privacy program. The individual shall be responsible for, knowledgeable about, and trained in, carrying out the requirements of this Special Terms and Conditions Exhibit, ensuring Contractor compliance with all applicable state and federal information privacy laws (including but not limited to HIPAA, WIC 5328, 42 CFR Part 2, California Medical Information Act, etc.), and for communicating about privacy and security matters with the County.
C. The individual designated to the above roles may be the same individual so long as they are qualified and able to effectively perform the duties of both designations.
D. Any individual(s) designated as the Privacy Officer and/or Security Officer, must attend a Basic Privacy Compliance Academy course offered by the Health Care Compliance Association (HCCA) and obtain, within six (6) months of appointment, a “Certified in Healthcare Privacy Compliance” certification from the Health Care Compliance Association. Certification must be maintained continuously while designated in the role.
Alternate training and certification may be considered equivalent if approved at the sole discretion of the County Privacy & Security Officer.
29. Personnel Controls
A. Employee Training. All workforce members who assist in the performance of functions or activities on behalf of the County, or access or disclose County PHI or PI must complete information privacy and security training, at least annually, at Contractor's expense. Each workforce member who receives information privacy and security training must sign a certification, indicating the member’s name and the date on which the training was completed. These certifications must be retained for a period of six (6) years following termination of this Agreement.
B. Employee Discipline. Appropriate sanctions must be applied against workforce members who fail to comply with privacy policies and procedures or any provisions of these requirements, including termination of employment where appropriate.
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
C. Confidentiality Statement. All persons that will be working with County PHI or PI must sign a confidentiality statement that includes, at a minimum, General Use, Security and Privacy Safeguards, Unacceptable Use, and Enforcement Policies. The statement must be signed by the workforce member prior to access to County PHI or PI. The statement must be renewed annually. The Contractor shall retain each person’s written confidentiality statement for County inspection for a period of six (6) years following termination of this Agreement.
D. Background Check. Before a member of the workforce may access County PHI or PI, a background screening of that worker must be conducted. The screening should be commensurate with the risk and magnitude of harm the employee could cause, with more thorough screening being done for those employees who are authorized to bypass significant technical and operational security controls. The Contractor shall retain each workforce member’s background check documentation for a period of three (3) years.
30. Technical Security Controls
A. Workstation/Laptop encryption. All workstations and laptops that store County PHI or PI either directly or temporarily must be encrypted using a FIPS 140-2 certified algorithm which is 128bit or higher, such as Advanced Encryption Standard (AES). The encryption solution must be full disk unless approved by the County Privacy and Security Office.
B. Server Security. Servers containing unencrypted County PHI or PI must have sufficient administrative, physical, and technical controls in place to protect that data, based upon a risk assessment/system security review.
C. Minimum Necessary. Only the minimum necessary amount of County PHI or PI required to perform necessary business functions may be copied, downloaded, or exported.
D. Removable media devices. All electronic files that contain County PHI or PI data must be encrypted when stored on any removable media or portable device (i.e.: USB thumb drives, floppies, CD/DVD, Blackberry, backup tapes etc.). Encryption must be a FIPS 140-2 certified algorithm which is 128bit or higher, such as AES.
E. Antivirus software. All workstations, laptops and other systems that process and/or store County PHI or PI must install and actively use comprehensive anti-virus software solution with automatic updates scheduled at least daily.
F. Patch Management. All workstations, laptops and other systems that process and/or store County PHI or PI must have critical security patches applied, with system reboot if necessary. There must be a documented patch management process which determines installation timeframe based on risk assessment and vendor recommendations. At a maximum, all applicable patches must be installed within 30 days of vendor release.
Applications and systems that cannot be patched within this time frame due to significant operational reasons must have compensatory controls implemented to minimize risk until the patches can be installed. Applications and systems that cannot be patched must have compensatory controls implemented to minimize risk, where possible.
G. User IDs and Password Controls. All users must be issued a unique user name for accessing County PHI or PI. Username must be promptly disabled, deleted, or the password changed upon the transfer or termination of an employee with knowledge of the Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
password. Passwords are not to be shared. Passwords must be at least eight characters and must be a non-dictionary word. Passwords must not be stored in readable format on the computer. Passwords must be changed at least every 90 days, preferably every 60 days.
Passwords must be changed if revealed or compromised. Passwords must be composed of characters from at least three of the following four groups from the standard keyboard:
1) Upper case letters (A-Z)
2) Lower case letters (a-z)
3) Arabic numerals (0-9)
4) Non-alphanumeric characters (punctuation symbols)
H. Data Destruction. When no longer needed, all County PHI or PI must be wiped using the Gutmann or US Department of Defense (DoD) 5220.22-M (7 Pass) standard, or by degaussing. Media may also be physically destroyed in accordance with NIST Special Publication 800-88. Other methods require prior written permission of the County Privacy and Security Office.
I. System Timeout. The system providing access to County PHI or PI must provide an automatic timeout, requiring re-authentication of the user session after no more than 20 minutes of inactivity.
J. Warning Banners. All systems providing access to County PHI or PI must display a warning banner stating that data is confidential, systems are logged, and system use is for business purposes only by authorized users. User must be directed to log off the system if they do not agree with these requirements.
K. System Logging. The system must maintain an automated audit trail which can identify the user or system process which initiates a request for County PHI or PI, or which alters County PHI or PI. The audit trail must be date and time stamped, must log both successful and failed accesses, must be read only, and must be restricted to authorized users. If County PHI or PI is stored in a database, database logging functionality must be enabled. Audit trail data must be archived for at least 3 years after occurrence.
L. Access Controls. The system providing access to County PHI or PI must use role-based access controls for all user authentications, enforcing the principle of least privilege.
M. Transmission encryption. All data transmissions of County PHI or PI outside the secure internal network must be encrypted using a FIPS 140-2 certified algorithm which is 128bit or higher, such as AES. Encryption can be end to end at the network level, or the data files containing County PHI can be encrypted. This requirement pertains to any type of County PHI or PI in motion such as website access, file transfer, and E-Mail.
N. Intrusion Detection. All systems involved in accessing, holding, transporting, and protecting County PHI or PI that are accessible via the Internet must be protected by a comprehensive intrusion detection and prevention solution.
31. Audit Controls
A. System Security Review. Contractor must ensure audit control mechanisms that record and examine system activity are in place. All systems processing and/or storing County PHI or PI must have at least an annual system risk assessment/security review which provides Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
assurance that administrative, physical, and technical controls are functioning effectively and providing adequate levels of protection. Reviews should include vulnerability scanning tools.
B. Log Reviews. All systems processing and/or storing County PHI or PI must have a routine procedure in place to review system logs for unauthorized access.
C. Change Control. All systems processing and/or storing County PHI or PI must have a documented change control procedure that ensures separation of duties and protects the confidentiality, integrity and availability of data.
D. Random Audits. Contractor will accommodate and upon reasonable notice by Sonoma County, work with Sonoma County and/or its subcontractors to submit to a random information security audit. This is to ensure that Contractor’s and/or vendor’s information security practices or standards comply with Sonoma County’s information security policies, standards, procedures and guidelines. Contractor shall ensure that its subconsultants or vendors comply with this requirement.
32. Business Continuity/Disaster Recovery Controls
A. Emergency Mode Operation Plan. Contractor must establish a documented plan to enable continuation of critical business processes and protection of the security of County PHI or PI held in an electronic format in the event of an emergency. Emergency means any circumstance or situation that causes normal computer operations to become unavailable for use in performing the work required under this Agreement for more than 24 hours.
B. Data Backup Plan. Contractor must have established documented procedures to backup County PHI to maintain retrievable exact copies of County PHI or PI. The plan must include a regular schedule for making backups, storing backups offsite, an inventory of backup media, and an estimate of the amount of time needed to restore County PHI or PI should it be lost. At a minimum, the schedule must be a weekly full backup and monthly offsite storage of County data.
33. Paper Document Controls
A. Supervision of Data. County PHI or PI in paper form shall not be left unattended at any time, unless it is locked in a file cabinet, file room, desk or office. Unattended means that information is not being observed by an employee authorized to access the information.
County PHI or PI in paper form shall not be left unattended at any time in vehicles or planes and shall not be checked in baggage on commercial airplanes.
B. Escorting Visitors. Visitors to areas where County PHI or PI is contained shall be escorted and County PHI or PI shall be kept out of sight while visitors are in the area.
C. Confidential Destruction. County PHI or PI must be disposed of through confidential means, such as cross cut shredding and pulverizing.
D. Removal of Data. Only the minimum necessary County PHI or PI may be removed from the premises of the Contractor except with express written permission of the County.
County PHI or PI shall not be considered “removed from the premises” if it is only being transported from one of Contractor's locations to another of the same Contractor’s locations.
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
E. Faxing. Faxes containing County PHI or PI shall not be left unattended and fax machines shall be in secure areas. Faxes shall contain a confidentiality statement notifying persons receiving faxes in error to destroy them. Fax numbers shall be verified with the intended recipient before sending the fax.
F. Mailing. Mailings containing County PHI or PI shall be sealed and secured from damage or inappropriate viewing of such PHI or PI to the extent possible. Mailings which include 500 or more individually identifiable records of County PHI or PI in a single package shall be sent using a tracked mailing method which includes verification of delivery and receipt, unless the prior written permission of the County to use another method is obtained.
Part V: Provisions for Access to County Electronic Health Records System (Applies to contractors that have access to County E.H.R. system)
1. General Controls
AGREEMENTS AND CONDITIONS OF ACCESS AND USE In consideration for use of the Department of Health Services (DHS) Electronic Health Record system (“EHR”), User agrees to the following terms and conditions:
A. Contractor shall only use the EHR system to support clients served pursuant to a contract with the County.
B. Contractor and Contractor staff shall only access the EHR and Protected Health Information for the purpose of providing healthcare services.
C. Contractor shall ensure that staff will not use or disclose Protected Health Information other than as permitted or as required by law or this Agreement.
D. Contractor shall ensure that staff will not share or give authentication credentials, such as a USERID or password, to any other individual, or fail to take appropriate measures to safeguard their authentication credentials.
E. Contractor shall ensure that all staff with EHR access shall be trained on (i) the use of the EHR system; (ii) safeguards necessary to protect the EHR system, and (iii) the proper use/disclosure of information stored in the EHR system.
F. Contractor shall ensure that all staff with access to the EHR system sign a confidentiality agreement stating they will maintain confidentiality of protected information maintained in the EHR System. This agreement may be combined with other required confidentiality agreements.
G. Within 24 hours of discovery, Contractor shall report to DHS Privacy and Security Officer any use or disclosure of Protected Health Information which would violate State/federal regulations or the terms of this Agreement.
H. Contractor shall notify County of staff enrollment, staff changes job duties/credentialling, or staff separation from employment within 24 hours of the staff change using the form provided by the County.
Contract No. 2024-1xxx-A00
Exhibit X (Privacy #4 – v20231218)
I. County shall be responsible for enrollment of new staff into the EHR system, and adjustments to staff’s level of access when staff changes job duties/credentialling or staff is separated from employment.
J. Contactor shall comply with all other information privacy and security provisions as articulated in this Agreement and exhibits.
K. If any use or disclosure of Protected Health Information by Contractor or Contractor’s agents, staff, subcontractors, or invitees violates State/Federal regulations or the terms of this Agreement, Contractor agrees to accept all responsibility in accordance with Provision 19 (Indemnification) of the Business Associate Agreement.