CITY OF FULLERTON
BUSINESS ASSOCIATE AGREEMENT
WITH
BIO-CARE, INC.
THIS BUSINESS ASSOCIATE AGREEMENT (this “BAA”) is made and entered into this _____ day of _________________, 2026 (the “Effective Date”), by and between the CITY OF FULLERTON, a California municipal corporation (“City”), and BIO-CARE, INC. (also doing business as Bio-Care USA, Inc.), a Michigan corporation (“Business Associate”). City and Business Associate may be referred to herein individually as a “Party” and collectively as the “Parties”.
RECITALS:
In connection with the City of Fullerton Fire Department's Firefighter Wellness Program (the “Wellness Program”), Business Associate will create, receive, maintain, or transmit Protected Health Information (as defined below) governed by the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, the Health Information Technology for Economic and Clinical Health Act of 2009, Pub. L. No. 111-5, Title XIII, and the regulations promulgated thereunder at 45 C.F.R. Parts 160 and 164 (collectively, “HIPAA” and the “HIPAA Rules”). The parties enter into this BAA to govern Business Associate's handling of such PHI consistent with the standards of the HIPAA Rules, as if the parties were a Covered Entity and a Business Associate under the HIPAA Rules.
City and Business Associate have entered into a Professional Services Agreement with an Effective Date concurrent herewith (the “Underlying Agreement”), pursuant to which Business Associate will provide on-site, mobile-unit NFPA 1582-compliant occupational medical evaluations, including the comprehensive ultrasound screening suite, laboratory testing, specialized screenings, cardiovascular assessment, infectious disease surveillance and immunizations, cancer screenings, behavioral health screening, and wellness consultations to City Fire Department personnel as part of the Wellness Program.
In performing the Underlying Agreement, Business Associate will, on behalf of City, create, receive, maintain, transmit, use, or disclose Protected Health Information (as defined below).
The parties enter into this BAA to satisfy the requirements of the HIPAA Rules, including 45 C.F.R. §§ 164.502(e) and 164.504(e).
NOW, THEREFORE, in consideration of the mutual covenants and conditions contained herein, the parties agree as follows:
DEFINITIONS
Capitalized terms used and not otherwise defined in this BAA shall have the meanings ascribed to them in the HIPAA Rules. The following terms shall have the meanings set forth below:
“Breach” has the meaning set forth in 45 C.F.R. § 164.402. “Business Associate” has the meaning set forth in 45 C.F.R. § 160.103. “Covered Entity” has the meaning set forth in 45 C.F.R. § 160.103. “Designated Record Set” has the meaning set forth in 45 C.F.R. § 164.501. “Electronic Protected Health Information or ePHI” means PHI that is transmitted by or maintained in electronic media, as defined in 45 C.F.R. § 160.103. “HIPAA Rules” means the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164. “Individual” has the meaning set forth in 45 C.F.R. § 160.103. “Protected Health Information or PHI” has the meaning set forth in 45 C.F.R. § 160.103 and includes ePHI; for purposes of this BAA, PHI refers only to PHI created, received, maintained, or transmitted by Business Associate on behalf of City. “Required by Law” has the meaning set forth in 45 C.F.R. § 164.103. “Secretary” means the Secretary of the U.S. Department of Health and Human Services or the Secretary's designee. “Security Incident” has the meaning set forth in 45 C.F.R. § 164.304. “Subcontractor” has the meaning set forth in 45 C.F.R. § 160.103. “Unsecured PHI” has the meaning set forth in 45 C.F.R. § 164.402.
PERMITTED USES AND DISCLOSURES OF PHI
General Limitation. Business Associate shall not use or disclose PHI other than as permitted or required by this BAA or as Required by Law. In no event shall Business Associate use or disclose PHI in any manner that would violate the HIPAA Rules if done by City.
Performance of Services. Business Associate may use and disclose PHI as necessary to perform the services for, or functions on behalf of, City as set forth in the Underlying Agreement, including the performance of NFPA 1582-compliant occupational medical evaluations and related screening and consultation services, generation of individual results reports to participants, generation of de-identified aggregate reports to City, and maintenance of the participation tracking log.
Internal Management and Legal Responsibilities. Business Associate may use PHI for its proper management and administration or to carry out its legal responsibilities, and may disclose PHI for such purposes only if: (a) the disclosure is Required by Law; or (b) Business Associate obtains reasonable assurances from the person to whom PHI is disclosed that it will be held confidentially and used or further disclosed only as Required by Law or for the purpose for which it was disclosed, and that the person will notify Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached.
Data Aggregation. Business Associate may, to the extent permitted by 45 C.F.R. § 164.504(e)(2)(i)(B), use PHI to provide data aggregation services relating to the health-care operations of City.
Prohibited Uses. Business Associate shall not (a) use or disclose PHI for marketing purposes as prohibited by 45 C.F.R. § 164.508(a)(3) without a valid Individual authorization; or (b) sell PHI as prohibited by 45 C.F.R. § 164.502(a)(5)(ii) without a valid Individual authorization.
Minimum Necessary. Business Associate shall use, disclose, and request only the minimum necessary PHI to accomplish the intended purpose of each use, disclosure, or request, in accordance with 45 C.F.R. § 164.502(b) and § 164.514(d).
SAFEGUARDS
Appropriate Safeguards. Business Associate shall use appropriate administrative, physical, and technical safeguards, and shall comply with Subpart C of 45 C.F.R. Part 164 with respect to ePHI, to prevent the use or disclosure of PHI other than as permitted by this BAA and to protect the confidentiality, integrity, and availability of ePHI Business Associate creates, receives, maintains, or transmits on behalf of City. Business Associate shall document its safeguards and provide such documentation to City upon reasonable request.
REPORTING OBLIGATIONS
Reporting of Improper Uses or Disclosures. Business Associate shall report to City any use or disclosure of PHI not provided for by this BAA of which it becomes aware (other than Breaches of Unsecured PHI, which are governed by Section 4.3 below) within five (5) business days of discovery.
Security Incidents. Business Associate shall report to City any Security Incident of which it becomes aware. The parties acknowledge and agree that this Section constitutes notice of attempted but unsuccessful Security Incidents (such as pings, port scans, and similar activity that does not result in actual unauthorized access to ePHI), and no further notice of such unsuccessful incidents shall be required. Business Associate shall report all successful Security Incidents within five (5) business days of discovery.
Breach Notification. Business Associate shall notify City of any Breach of Unsecured PHI without unreasonable delay, and in no case later than five (5) business days after discovery of the Breach. The initial notification shall include the information then known to Business Associate. Business Associate shall supplement the notification with the information required by 45 C.F.R. § 164.410(c), including: (a) the identification of each Individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, or disclosed during the Breach; (b) a description of what happened, including the date of the Breach and the date of discovery; (c) a description of the types of Unsecured PHI involved; (d) a description of Business Associate's investigation, mitigation efforts, and corrective actions; and (e) any other information that City may reasonably request, as such information becomes available and in no event later than thirty (30) calendar days after discovery of the Breach. Business Associate shall cooperate with City in fulfilling City's notification obligations under 45 C.F.R. §§ 164.404, 164.406, and 164.408, and shall not directly notify any Individual, the media, or the Secretary regarding a Breach without City's prior written authorization, except as Required by Law.
Mitigation. Business Associate shall mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of this BAA or the HIPAA Rules.
SUBCONTRACTORS AND AGENTS
Flow-Down Requirement. Business Associate shall ensure that any Subcontractor or agent to whom it provides PHI, or that creates, receives, maintains, or transmits PHI on its behalf in connection with the services hereunder, agrees in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to PHI, in accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.504(e)(5).
Subcontractor Liability. Business Associate shall remain fully responsible and liable to City for the acts and omissions of its Subcontractors with respect to PHI.
INDIVIDUAL RIGHTS
Access. To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate shall, within ten (10) business days of a request from City, provide access to PHI to City or, as directed by City, to an Individual, to enable City to meet its obligations under 45 C.F.R. § 164.524.
Amendment. To the extent Business Associate maintains PHI in a Designated Record Set, Business Associate shall, within ten (10) business days of a request from City, make any amendment(s) to PHI as directed by City, to enable City to meet its obligations under 45 C.F.R. § 164.526.
Accounting of Disclosures. Business Associate shall document all disclosures of PHI and information related to such disclosures as required to permit City to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528. Within ten (10) business days of a request from City, Business Associate shall provide City with the information needed to fulfill such request.
Restrictions and Confidential Communications. To the extent applicable, Business Associate shall comply with restrictions on use or disclosure of PHI agreed to by City pursuant to 45 C.F.R. § 164.522, including the requirement under 45 C.F.R. § 164.522(a)(1)(vi) regarding services paid for in full out of pocket, to the extent City notifies Business Associate of such restrictions and the restriction affects Business Associate's use or disclosure of PHI.
BOOKS, RECORDS, AND COMPLIANCE
Access for Secretary. Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI received from City, or created or received by it on behalf of City, available to City and the Secretary for purposes of determining City's compliance with the HIPAA Rules.
Compliance with the HIPAA Security Rule. Business Associate shall comply with the applicable requirements of the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C) with respect to ePHI.
CITY'S OBLIGATIONS
Notice of Privacy Practices. City shall provide Business Associate with a copy of its Notice of Privacy Practices applicable to the Wellness Program (if any) and shall notify Business Associate of any limitation(s) in such Notice that may affect Business Associate's use or disclosure of PHI.
Restrictions. City shall notify Business Associate of any restriction on the use or disclosure of PHI that City has agreed to under 45 C.F.R. § 164.522, to the extent such restriction may affect Business Associate's use or disclosure of PHI.
Permissible Requests. City shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by City, except as permitted by this BAA.
TERM AND TERMINATION
Term. This BAA shall be effective as of the Effective Date and shall continue in effect until the earlier of: (a) the termination or expiration of the Underlying Agreement; or (b) termination of this BAA pursuant to Section 9.2.
Termination for Cause by City. Pursuant to 45 C.F.R. § 164.504(e)(2)(iii), if City determines that Business Associate has materially breached this BAA, City shall provide Business Associate with written notice describing the breach and requiring cure within thirty (30) calendar days. If Business Associate fails to cure the breach within the cure period, or if the breach involves an unauthorized disclosure that cannot be cured, City may immediately terminate this BAA and the Underlying Agreement. If termination is not feasible, City may report the breach to the Secretary.
Effect of Termination. Upon termination of this BAA for any reason, Business Associate shall return or destroy all PHI received from City or created or received on behalf of City that it maintains in any form, and shall retain no copies of such information. If return or destruction is not feasible, Business Associate shall: (a) notify City in writing of the specific conditions that make return or destruction infeasible; (b) extend the protections of this BAA to such retained PHI; (c) limit further uses and disclosures of such PHI to the purposes that make return or destruction infeasible, including retention required by 2 C.F.R. § 200.334 and the AFG Award; and (d) return or destroy the PHI when the conditions making return or destruction infeasible no longer exist. Business Associate shall provide City with written certification of destruction or return of PHI within thirty (30) calendar days of the effective date of termination.
Survival. The obligations of Business Associate under this BAA relating to reporting, breach notification, mitigation, indemnification, books and records, and effect of termination shall survive the expiration or termination of this BAA.
INDEMNIFICATION
Indemnification by Business Associate. Business Associate shall indemnify, defend, and hold harmless City, its elected officials, officers, agents, and employees from and against any and all claims, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and costs) arising from or related to: (a) Business Associate's breach of this BAA; (b) Business Associate's violation of the HIPAA Rules in its capacity as Business Associate of City; (c) Business Associate's wrongful use or disclosure of PHI received from City or created on behalf of City; (d) costs of breach notifications, credit monitoring, and other remedial measures arising from a Breach attributable to Business Associate; and (e) civil monetary penalties imposed on City by the Secretary to the extent attributable to Business Associate's acts or omissions. Nothing in this BAA limits City's rights or remedies under the HIPAA Rules, the Underlying Agreement, or applicable law.
AMENDMENT
Amendment to Comply with Law. The parties shall amend this BAA from time to time as necessary to comply with changes in the HIPAA Rules or other applicable law. If Business Associate does not agree to a required amendment, Business Associate may terminate this BAA on thirty (30) days' prior written notice to City. If this BAA terminates for any reason, Business Associate shall immediately cease using, disclosing, processing, or creating PHI on behalf of City, and City may terminate the Underlying Agreement in whole or in part as to services that would require the use, disclosure, processing, or creation of PHI without a current Business Associate Agreement in effect.
Mutual Amendment. Other amendments shall be made by mutual written agreement signed by both parties.
MISCELLANEOUS
Regulatory References. All references to the HIPAA Rules include current and future amendments and guidance issued by the Secretary.
Interpretation. Any ambiguity in this BAA shall be resolved in favor of a meaning that permits City to comply with the HIPAA Rules.
No Third-Party Beneficiaries. Except as expressly provided in 45 C.F.R. § 164.504(e)(2)(ii)(E), nothing in this BAA is intended to create rights in any third party.
Governing Law and Venue. This BAA shall be governed by the laws of the State of California and applicable federal law, without regard to conflict-of-laws principles. The sole and exclusive venue for any legal action to enforce or interpret this BAA shall be a court of competent jurisdiction located in Orange County, California.
Relationship to Underlying Agreement. This BAA supplements and is incorporated into the Underlying Agreement. In the event of any conflict between this BAA and the Underlying Agreement regarding the use, disclosure, or protection of PHI, this BAA shall control.
Notices. Notices under this BAA shall be delivered in accordance with Section 6.4 of the Underlying Agreement.
Counterparts. This BAA may be executed in one or more counterparts, including by electronic signature, each of which shall be deemed an original and all of which together shall constitute one and the same instrument.
IN WITNESS WHEREOF, the parties hereto have caused this Agreement to be executed by and through their respective authorized officers, as of the date first above written.
BIO-CARE, INC.
Employer Identification Number: On File
By: ________________________________ Date: ________________ By: ________________________________ Date: ________________
CITY OF FULLERTON
By: ________________________________ Date: ________________ Eddie Manfro, City Manager
By: ________________________________ Date: ________________ Adam Loeser, Fire Chief
APPROVED AS TO FORM:
By: ________________________________ Date: ________________ Baron J. Bettenhausen, City Attorney
Business Associate Agreement | Page 1 of 1