1 AGREEMENT BETWEEN
THE CITIES OF SAN BRUNO AND PACIFICA AND
THE COUNTY OF SAN MATEO FOR THE PROVISION OF
COMMUNITY WELLNESS CRISIS RESPONSE TEAM (CWCRT)
The purpose of this Agreement is to establish an agreement between the County of San Mateo (County), acting through the Behavioral Health and Recovery Services (BHRS) of San Mateo County Health, and the City Police Departments of San Bruno and Pacifica (each, a “City” and together, the “Cities”) for the provision of the law enforcement co-responding mobile crisis services, Community Wellness and Crisis Response Team (CWCRT), for FY26-28, to improve City and County response to community members experiencing mental health crisis.
The Parties agree to the following:
1. Exhibits and Attachments
Attachment I – HIPAA Requirements
Attachment II – County Driving Policy
2. Background Information
In December 2021, the County launched the Pilot Program of the CWCRT, designed as a law enforcement co-responding mobile crisis model, based on best practice models in other jurisdictions. CWCRT enhances city and county responses to incidents involving individuals experiencing mental health crises, by supplementing that response with the engagement of mental health clinician embedded in each partner police department. The CWCRT clinicians assist in the first response by providing early intervention, crisis de-escalation, 5150 evaluation, involuntary hold, and referrals to therapeutic hospitalizations, and follow-up case management linkages to support services for individuals in mental health crises. BHRS provides ongoing clinical training opportunities, as-needed consultation, oversight on the crisis response work, technical and infrastructure support, and contract monitoring responsibilities.
The CWCRT Pilot Program demonstrated reduction in psychiatric emergency service (PES) admissions and improved linkage connection to needed on-going treatment for the community members in crisis, as reported by John W.
Gardner Center for Youth and Their Communities of the Stanford University Graduate School of Education (Gardner Center), based on their evaluation study examining the interventions and assessment methods utilized by the CWCRT participant cities.
2 The current Agreement covers the period of FY2026-2028 for the implementation of CWCRT services in the Cities of San Bruno and Pacifica.
3. Purpose or Scope of Work
The Cities enter into this Agreement with the County to enhance their response to community members in mental health crises. In the event of a suspected mental health crisis within their city jurisdiction, the city-retained licensed mental health clinician shared between San Bruno and Pacifica Police Departments will respond to the scene together with the City law enforcement officer, exercising their independent judgment and expertise while in collaboration with the officer.
The goal of the immediate co-response will be to de-escalate the crisis and to support the safety of the individual in crisis, those around the individual, and all responding to the incident. The mental health clinician will then assess the person suspected to be in mental health crisis (“the client”), determine the best course of action (e.g., temporary mandatory placement in a medical facility for psychiatric evaluation and treatment under Section 5150 of the Welfare and Institutions Code (“W&I”), referral for treatment, etc.) and provide needed follow-up support and linkages to further stabilize the crisis and prevent future similar crises from happening again.
Another goal of the CWCRT program is that clients in mental health crisis contacting and interacting with law enforcement receive early intervention and guidance toward appropriate behavioral health services, i.e., mental health and substance use issues. The mental health clinician will be trained in the range of available behavioral health resources both within BHRS and in the community, and the law enforcement/mental health clinician response teams will collaboratively decide on the best course of action and resources for the client.
The County of San Mateo derives direct benefit from the implementation of this Agreement, by way of, for example, increasing its ability to directly respond to community members in mental health crisis; enhancing response time for those in need of behavioral health services and resources; and creating a broader and more effective continuum of care that results in a decrease in justice system contacts.
Important program outcomes of CWCRT include, but are not limited to, residential stability, improved mental health and connection to needed services 3 and treatment, reduced use of acute and emergency services, and reduced contact with the criminal justice system.
To achieve a healthy and integrated community, this Agreement represents a partnership between the Cities and the County to jointly exercise their common powers to enhance community linkages and help stabilize and improve the health and well-being of persons experiencing mental health crises. Important outcomes include, but are not limited to, residential stability, improved mental health and connection to needed services and treatment, reduced use of acute and emergency services, reduced potential unfavorable outcomes while interacting with law enforcement officers, and reduced contact with the criminal justice system.
4. Relationship of the Parties
The Parties acknowledge and agree that the services performed under this Agreement by the licensed mental health clinician shall be conducted by a California-licensed clinical professional (e.g., licensed social worker, licensed marriage and family therapist, licensed psychologist) who is an independent contract clinician retained by the Cities of San Bruno and Pacifica. The California-licensed clinician shall be a qualified independent behavioral health professional, competent of appropriate and sound clinical judgment and decision-making in interacting with behavioral health clients, their family members, and community. In addition, their professional conduct and clinical judgment in delivering behavioral health crisis and clinical services in California are governed by their License Board.
The clinician is and shall remain an independent contractor while providing services under specific terms of a contract between the Cities and the clinician and at no time shall the clinician be deemed an employee of the Cities or BHRS or the County.
5. Mutual Responsibilities of the Parties
5.1 The Parties agree to adopt and modify as needed policies and procedures developed during the Pilot phase of the CWCRT Program regarding, but not limited to, scope of work, necessary training, client grievance process, documentation requirement, and handling and disposition of data generated by the CWCRT Program. The policies and procedures will reflect the Parties’ mutual understanding that the CWCRT clinician is a professional who exercises independent clinical judgment and expertise in the performance of their scope of work, complying with all of the County’s requirements related to crisis 4 mental health services, applicable laws and ethics, follow-up clinical support to stabilize CWCRT clients, required documentation and reporting procedures, record storage and releases, ethics and professional conduct expected of a mental health clinician as governed by their License Board, applicable state and federal laws, including but not limited to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and State Medi-Cal requirements related to mental health and crisis response service delivery, and BHRS Documentation Guidelines.
5.2 The Parties will participate, as needed, in efforts to obtain and analyze data to document the effectiveness of the Program in reaching the anticipated goals and objectives listed under Section 7 of this Agreement, while protecting and respecting individuals’ confidentiality and privacy rights per HIPAA requirements.
5.3 The Parties will participate in all the collaborative trainings when appropriate and follow the developed program strategies and protocol of the response team, in a manner that respects the dignity and diversity of community members.
6. Responsibilities of the Cities
6.1 The Cities shall be responsible for the following:
• Recruit, hire, and employ/contract a license-appropriate clinician for the Program, and hold all applicable administrative oversight of the work of the CWCRT clinician.
• Ensure the licensed mental health clinician documents, maintains, and reports client level data as requested by BHRS.
• Ensure the licensed mental health clinician possesses and maintains a valid license to engage in the practice of crisis and therapeutic services in the State of California (LCSW, LMFT, or Licensed Psychologist). • Ensure the licensed mental health clinician adheres to and delivers all tasks and responsibilities listed in Section 5.2 of this Agreement. • Ensure the licensed mental health clinician passes the required BHRS certification test to become 5150-certified and takes all required training annually to keep up with laws and ethics related to provision of crisis services.
• Participate in meetings with BHRS, and as needed with other cities and other CWCRT clinicians for progress status, data collection, outcomes evaluation, coordination, and program development.
5 • Timely bring to the attention of the County if/when issues or concerns related to the legal, ethical, and clinical practices of the clinician emerge.
6.2 The scope of work provided by the CWCRT mental health clinician will comply with all the County’s requirements related to crisis mental health services, and the documentation and reporting procedures under the BHRS Documentation Guidelines. The CWCRT clinician’s duties shall include, but are not limited to the following:
A. Perform initial diagnostic evaluation during a crisis, noting behavioral symptoms which may indicate organic and/or mental disorders in children, youth, or adults.
B. Determine whether individuals meet criteria for an involuntary hold under W&I 5150 or W&I 5585 and follow appropriate
procedures.
C. Perform suicidal/homicidal/Grave Disability risk assessments.
D. Provide Crisis Intervention and Crisis De-escalation.
E. Determine other resources appropriate to connect individuals to needed services or treatment.
F. Provide follow-up counseling, engagement support and case management linkage to refer clients to appropriate resources within BHRS or in the community.
G. Work closely with different communities including, but not limited to, law enforcement, behavioral health providers, outpatient clinics, and BHRS-contracted agencies to provide quality crisis care.
H. Conduct home visits and/or field-based services, for crisis response and follow-up stabilization support.
I. Participate in monthly San Mateo County Field Crisis Consultation Committee (FCCC) meetings.
J. Collect and evaluate medical or psychosocial data such as case histories, behavior patterns and family relationships of patients/clients as requested.
K. Work as a care team member with other treatment disciplines or treatment providers of BHRS or BHRS-contracted agencies, for purpose of crisis safety planning and/or prevention of recidivism.
L. Utilize Trauma Informed Care and other Evidence-based practices.
M. Provide consultation and education services to law enforcement colleagues, family members, and community as indicated.
N. Document all crisis response, crisis-related engagement, follow-up services, and related administrative tasks in Avatar which is the electronic health record system (EHR) of BHRS.
O. Obtain insurance information from their crisis clients and 6 enter/upload such information into Avatar for care coordination and billing purposes.
P. As a HIPAA protected record, 5150 applications completed by the CWCRT clinician shall be uploaded onto Avatar timely and be incorporated as a part of the client’s clinical record.
Q. Ensure the CWCRT clinician adheres to the County Driving Policy and the Safe Driver Program (See Attachment II), as well as coordinate with BHRS and/or DPW regularly and timely for maintenance needs of the provided county vehicle.
7. Responsibilities of the County
BHRS shall be responsible for the following:
• Ensure required onboarding documentation and orientation, needed 5150 certification training, BHRS and community mental health/substance use services and resources training, clinical and technical consultation, and periodic training related to crisis response, crisis de-escalation, crisis assessment, 5150 involuntary hold, laws and ethics as arranged for or provided to the mental health clinicians.
• Provide the mental health clinician with County laptop and needed applications and technical support to address related technical issues as arise in the use and maintenance of this equipment.
• Provide credentialing of the clinician for access to Avatar electronic health record for the purpose of client look-up and documentation of mental health services.
• Provide the mental health clinician with County vehicle and coordinate regular maintenance needs with DPW and the Cities.
• Hold meetings with the mental health clinician and/or the Cities for the purpose of contract monitoring, quality assurance, clinical consultation, and clinical adherence.
• Ensure the mental health clinician follows and complies with all legal and clinical requirements related to the Agreement with the County.
8. Goals of the CWCRT Program
Goals of the CWCRT Program are:
Goal 1: Law enforcement staff and the mental health clinician will respond together to active crisis situations in San Bruno and Pacifica where mental health crisis is a factor.
7 Goal 2: Improve outcomes for individuals experiencing a crisis due to mental illness or suspected mental illness.
Goal 3: Increase access to appropriate behavioral health resources, services, and treatment within the County behavioral health system.
Goal 4: Increase knowledge of mental health conditions and effective intervention strategies among law enforcement personnel.
Goal 5: Law enforcement will strengthen relationships with service providers and community.
The Parties agree to meet and confer periodically to assess and revise program goals, and to add new program goals, as appropriate.
9. Special Terms and Conditions
9.1 Coordination and Oversight
The assigned BHRS Clinical Services Manager will be responsible for the oversight of this Agreement, and coordinate with the Cities regularly and on an ongoing basis.
The Chiefs of Police of San Bruno and Pacifica, or their designees, will participate in the BHRS contract monitoring meetings as needed to monitor the progress towards its objectives, review any operational issues that have arisen, and identify items for ongoing work plan as needed.
9.2 Conflict Resolution
In the event of disagreements or conflicts between the Parties to this Agreement, the disagreement or conflict will be addressed and resolved during the contract monitoring meeting between BHRS and the Cities. In the event when consultation at that level does not resolve the disagreement or conflict, then the Chiefs of Police or their designees, BHRS Clinical Services Manager, and BHRS’ Deputy Director of Adult and Older Adult Services shall meet and confer and attempt to resolve the matter. Finally, in the event the disagreement or conflict remains, the BHRS Director (or designee) and the Chiefs shall meet and confer.
9.3 Records and Confidentiality
Records created by the mental health clinician under the CWCRT program and maintained in the County system (Avatar) shall be considered the County’s records, free from the control and direction of the Cities. Such records will be subject to all federal, state, and local laws and regulations regarding the protection of client/patient privacy and confidentiality. 8 Records created by the mental health clinician retained by the Cities under the CWCRT program and maintained by each of the Cities in separate City-owned database shall be considered the City’s records, free from the control and direction of the County.
The Parties agree that the mental health clinician must adhere to the privacy requirements of HIPAA. BHRS will train the clinician on federal, state, and local policies and procedures with respect to the confidentiality and use or disclosure of protected health information of clients as necessary and appropriate for the clinician to carry out their functions. BHRS will provide the clinician with the appropriate Health System policies and procedures, which are subject to change from time to time.
The County reserves the right to take appropriate action for violation of its policies, and such action may include the immediate termination of this Agreement with the Cities or strong recommendation of the immediate termination of the specific clinician who violates Federal, State, or local law and policy.
BHRS shall maintain beneficiary medical and/or clinical records for a period of ten (10) years, except that the records of the persons under age eighteen (18) at the time of treatment shall be maintained: a) until one (1) year beyond the person's eighteenth (18th) birthday or b) for a period of ten (10) years beyond the date of discharge, whichever is later. This rule does not supersede professional standards (BHRS is allowed to maintain records for a longer period if required by other regulations or licenses).
10. Hold Harmless and Indemnification
10.1. The County shall defend, hold harmless, and indemnify the Cities from and against all claims, suits, or actions of every name, kind, and description which result from the acts or omissions of the County's representatives for services provided under this Agreement.
10.2. The Cities, individually and together, shall defend, hold harmless, and indemnify the County and its employees, agents, and servants from all claims, suits, or actions of every name, kind, and description which result from the acts or omissions of the Cities and/or its respective mental health clinician, officers, employees, agents, contractors, subcontractors, and servants. 9 10.3. The duty of each party to defend, hold harmless, and indemnify the other as set forth herein shall include the duty to defend as set forth in Section 2778 of the California Civil Code.
10.4. In the event of concurrent negligence (or intentional/reckless acts) of the Cities and/or its respective officers and employees, on the one hand, and the County and/or its officers, employees, agents, and servants, on the other hand, then the liability for any and all claims for injuries or damage to persons and/or property which arise out of terms and conditions of this Agreement shall be apportioned according to the California theory of comparative fault.
10.5 For purposes of this Agreement, each City shall be solely responsible for the acts, omissions, negligence, or misconduct of its own officers, employees, agents, contractors, and representatives. Nothing in this Agreement shall be construed to create joint and several liability between the Cities.
In the event a claim, action, or liability arises from the joint conduct of both Cities, responsibility for defense, indemnification, and any resulting costs or damages shall be allocated between the Cities in proportion to their respective degrees of fault, as determined by mutual agreement, mediation, arbitration, or a court of competent jurisdiction.
11. Term and Termination
11.1 Term
This Agreement shall be effective immediately upon signature by each of the Parties. The term of the Agreement shall end in two fiscal years on June 30, 2028.
11.2 Amendment/Modification Process
All subsequent modifications or amendments to this Agreement shall be in writing and signed by each of the Parties hereto before they will be effective.
11.3 Termination
Subject to the Parties’ understanding as to the term of this Agreement, detailed in Section 10.1, each Party agrees to remain a party to this Agreement for the entire duration of the term, subject only to termination for cause.
Cause for termination of this Agreement will include only a material breach by another Party or impossibility of performance. Prior to termination for cause, the terminating party must give the other party 30 days written notice of the 10 alleged material breach and notice of an opportunity to cure such breach during the notice period.
In addition, the Parties acknowledge that implementation of this Agreement is dependent upon the continued availability of contracted mental health clinician services necessary to operate the program. In the event the underlying clinician services agreement expires, is terminated, is not renewed, or clinician services otherwise become unavailable, this Agreement may be terminated by any Party upon thirty (30) days written notice to the other non-terminating Party.
12. Funding/Financial Responsibilities
12.1 Personnel Cost
Personnel costs for the CWCRT mental health clinician retained by the Cities shall be the responsibility of the Cities and be 100% covered by the Cities.
Personnel costs for training, clinical consultation, and technical support from the County are 100% covered by BHRS.
External training courses that the mental health clinician attends shall be 100% covered by the Cities or covered under other arrangements made between the Cities and the contracted clinician.
12.2 Operations, Administration, and Supplies Costs
The Cities shall be responsible for the Operating Costs, Administrative Costs, and Supplies Costs associated with the CWCRT program within their respective jurisdictions.
12.3 Auto, Equipment, and Maintenance Costs
BHRS shall provide a County vehicle and a county laptop including all required applications and software licenses necessary for the clinical documentation of the CWCRT services provided by the clinician retained by the Cities.
The cost of expenses related to the County vehicle, including insurance, maintenance, and fuel, totaling $4,000 per year for one vehicle shall be paid for by the Cities. BHRS shall invoice the Cities on a bi-annual basis 50-50 split, with each City paying $2,000 for the vehicle. Reimbursement from the Cities is expected within twenty (20) business days of the invoice. 11 Any loss, theft, damage, or destruction of County equipment, including Countyissued vehicles, laptops, software, or other equipment, shall be reported immediately to BHRS and documented as required by County policy.
The Cities shall be responsible for the reasonable costs of repair or replacement only to the extent such loss, theft, damage, or destruction results from the negligence, gross negligence, willful misconduct, or unauthorized use by the Cities, their officers, employees, contractors, agents, or the assigned clinician.
The Cities shall not be responsible for loss, theft, damage, or destruction resulting from criminal acts of third parties, ordinary wear and tear, manufacturer defects, acts of God, or other circumstances beyond the reasonable control of the Cities or the assigned clinician.
13. Contact Information
The followings are contact information of the persons responsible from each party/entity for the completion and maintenance of this Agreement:
13.1 Party A (BHRS) Information
Name: Jei Africa
Address: 2000 Alameda de las Pulgas, San Mateo
Contact number: (650) 753-2748
Email: [email protected]
13.2 Party B (San Bruno) Information
Name: Matt Lethin
Address: 567 El Camino Real, San Bruno, CA 94066
Contact number: (415) 310-3122
Email: [email protected]
13.3 Party C (Pacifica) Information
Name: Maria Sarasua
Address: 2075 Coast Highway, Pacifica, CA 94044
Contact number: (650) 738-7314
Email: [email protected]
12 Effective Date and Signatures:
This Agreement shall be effective upon the signature of all parties authorized officials. All Parties indicate agreement with this Agreement by their signatures.
Signatures and dates:
_______________________
Jei Africa
Director of BHRS
_______________________
Date
_______________________
Alex McIntyre
City Manager, San Bruno
_______________________
Date
________________________
Sean Charpentier
City Manager, Pacifica
________________________
Date
13 Attachment 1
Health Insurance Portability and Accountability Act (HIPAA) Business Associate Requirements
DEFINITIONS
Terms used, but not otherwise defined, in this Schedule shall have the same meaning as those terms are defined in 45 Code of Federal Regulations (CFR) sections 160.103, 164.304, and 164.501. All regulatory references in this Schedule are to Title 45 of the Code of Federal Regulations unless otherwise specified.
a. Business Associate. “Business Associate" shall generally have the same meaning as the term "business associate" at 45 CFR 160.103, and in reference to the parties to this agreement shall mean Contractor.
b. Covered Entity. "Covered entity" shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this agreement shall mean County.
c. HIPAA Rules. "HIPAA rules" shall mean the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR part 160 and part 164, as amended and supplemented by Subtitle D of the Health Information Technology for Economic and Clinical Health Act provisions of the American Recovery and Reinvestment Act of 2009. d. Designated Record Set. "Designated Record Set" shall have the same meaning as the term "designated record set" in Section 164.501.
e. Electronic Protected Health Information. "Electronic Protected Health Information" (EPHI) means individually identifiable health information that is transmitted or maintained in electronic media; it is limited to the information created, received, maintained or transmitted by Business Associate from or on behalf of Covered Entity. f. Individual. "Individual" shall have the same meaning as the term "individual" in Section 164.501 and shall include a person who qualifies as a personal representative in accordance with Section 164.502(g).
g. Privacy Rule. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E. h. Protected Health Information. "Protected Health Information" (PHI) shall have the same meaning as the term "protected health information" in Section 160.103 and is limited to the information created or received by Business Associate from or on behalf of County. i. Required By Law. "Required by law" shall have the same meaning as the term "required by law" in Section 164.103.
j. Secretary. "Secretary" shall mean the Secretary of the United States Department of Health and Human Services or his or her designee.
k. Breach. The acquisition, access, use, or disclosure of PHI in violation of the Privacy Rule that compromises the security or privacy of the PHI and subject to the exclusions set forth in Section 164.402. Unless an exception applies, an impermissible use or disclosure of PHI is presumed to be a breach, unless it can be demonstrated there is a low Issued by County of San Mateo Contract Compliance Committee ~ December 9, 2015 Page 1 14 probability that the PHI has been compromised based upon, at minimum, a four-part risk assessment:
1. Nature and extent of PHI included, identifiers and likelihood of re-identification;
2. Identity of the unauthorized person or to whom impermissible disclosure was made;
3. Whether PHI was actually viewed or only the opportunity to do so existed;
4. The extent to which the risk has been mitigated.
l. Security Rule. "Security Rule" shall mean the Security Standards for the Protection of Electronic Protected Health Information at 45 CFR Part 160 and Part 164, Subparts A and C.
m. Unsecured PHI. “Unsecured PHI” is protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in relevant HHS guidance. n. Security Incident. "Security Incident" shall mean the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with systems operations in an information system. “Security Incident” includes all incidents that constitute breaches of unsecured protected health information.
OBLIGATIONS AND ACTIVITIES OF CONTRACTOR AS BUSINESS ASSOCIATE a. Business Associate agrees to not use or further disclose Protected Health Information other than as permitted or required by the Agreement or as required by law. b. Business Associate agrees to use appropriate safeguards to comply with Subpart C of 45 CFR part 164 with respect to EPHI and PHI, and to prevent the use or disclosure of the Protected Health Information other than as provided for by this Agreement. c. Business Associate agrees to make uses and disclosures requests for Protected Health Information consistent with minimum necessary policy and procedures. d. Business Associate may not use or disclose protected health information in a manner that would violate subpart E of 45 CFR part 164.504 if used or disclosed by Covered Entity.
e. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. f. Business Associate agrees to report to County any use or disclosure of Protected Health Information not authorized by this Agreement.
g. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of County, agrees to adhere to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information.
h. If Business Associate has Protected Health Information in a Designated Record Set, Business Associate agrees to provide access, at the request of County, and in the time and manner designated by County, to Protected Health Information in a Designated Record Set, to County or, as directed by County, to an Individual in order to meet the requirements under Section 164.524.
Issued by County of San Mateo Contract Compliance Committee ~ December 9, 2015 Page 2 15 i. If Business Associate has Protected Health Information in a Designated Record Set, Business Associate agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the County directs or agrees to make pursuant to Section 164.526 at the request of County or an Individual, and in the time and manner designed by County.
j. Business Associate agrees to make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of County, available to the County at the request of County or the Secretary, in a time and manner designated by the County or the Secretary, for purposes of the Secretary determining County's compliance with the Privacy Rule.
k. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for County to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with Section 164.528. l. Business Associate agrees to provide to County or an Individual in the time and manner designated by County, information collected in accordance with Section (k) of this Schedule, in order to permit County to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with Section 164.528.
m. Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of EPHI that Business Associate creates, receives, maintains, or transmits on behalf of County.
n. Business Associate shall conform to generally accepted system security principles and the requirements of the final HIPAA rule pertaining to the security of health information.
o. Business Associate shall ensure that any agent to whom it provides EPHI, including a subcontractor, agrees to implement reasonable and appropriate safeguards to protect such EPHI.
p. Business Associate shall report to County any Security Incident within three (3) business days of becoming aware of such incident. Business Associate shall also facilitate breach notification(s) to the appropriate governing body (i.e. HHS, OCR, etc.) as required by law. As appropriate and after consulting with County, Business Associate shall also notify affected individuals and the media of a qualifying breach. q. Business Associate understands that it is directly liable under the HIPAA rules and subject to civil and, in some cases, criminal penalties for making uses and disclosures of Protected Health Information that are not authorized by this Attachment, the underlying contract as or required by law.
PERMITTED USES AND DISCLOSURES BY CONTRACTOR AS BUSINESS ASSOCIATE Except as otherwise limited in this Schedule, Business Associate may use or disclose Protected Health Information to perform functions, activities, or services for, or on behalf of, County as specified in the Agreement; provided that such use or disclosure would not violate the Privacy Rule if done by County.
Issued by County of San Mateo Contract Compliance Committee ~ December 9, 2015 Page 3 16 OBLIGATIONS OF COUNTY
a. County shall provide Business Associate with the notice of privacy practices that County produces in accordance with Section 164.520, as well as any changes to such notice. b. County shall provide Business Associate with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect Business Associate's permitted or required uses and disclosures. c. County shall notify Business Associate of any restriction to the use or disclosure of Protected Health Information that County has agreed to in accordance with Section 164.522.
PERMISSIBLE REQUESTS BY COUNTY
County shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if so requested by County, unless the Business Associate will use or disclose Protected Health Information for, and if the Agreement provides for, data aggregation or management and administrative activities of Business Associate.
DUTIES UPON TERMINATION OF AGREEMENT
a. Upon termination of the Agreement, for any reason, Business Associate shall return or destroy all Protected Health Information received from County, or created, maintained, or received by Business Associate on behalf of County, that Business Associate still maintains in any form. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the Protected Health Information. b. In the event that Business Associate determines that returning or destroying Protected Health Information is infeasible, Business Associate shall provide to County notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return or destruction of Protected Health Information is infeasible, Business Associate shall extend the protections of the Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such Protection Health Information.
MISCELLANEOUS
a. Regulatory References. A reference in this Schedule to a section in the HIPAA Privacy Rule means the section as in effect or as amended, and for which compliance is required.
b. Amendment. The Parties agree to take such action as is necessary to amend this Schedule from time to time as is necessary for County to comply with the requirements of the Privacy Rule and the Health Insurance Portability and Accountability Act, Public Law 104-191.
Issued by County of San Mateo Contract Compliance Committee ~ December 9, 2015 Page 4 17 c. Survival. The respective rights and obligations of Business Associate under this Schedule shall survive the termination of the Agreement. d. Interpretation. Any ambiguity in this Schedule shall be resolved in favor of a meaning that permits County to comply with the Privacy Rule.
e. Reservation of Right to Monitor Activities. County reserves the right to monitor the security policies and procedures of Business Associate.