Based on Cloud_Business Associate Agreement_v122316 Oracle Confidential Page 1 of 6
ORACLE RESELLER- BUSINESS ASSOCIATE AGREEMENT
C O N T R A C T I N F O R M A T I O N
This Business Associate Agreement (“BAA”) amends the Ordering Document to which it is attached, and all amendments and addenda thereto (the “Exhibit”) between City and City of San Bernardino (“You”) and Applications Software Technology Llc. as an authorized reseller of Oracle America, Inc. (“Oracle”). This BAA only applies to the Oracle products and /or services identified as being HIPAA Assessed in the Ordering Document.
WHEREAS you represent that the Health Insurance Portability and Accountability Act of 1996 as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 and all implementing regulations of the U.S. Department of Health & Human Services (collectively “HIPAA”), govern your use of Electronic Protected Health Information (“ePHI”) (as defined by 45 C.F.R. § 160.103);
WHEREAS Oracle recognizes your obligations under HIPAA require service providers that create, receive, maintain or transmit ePHI to agree to certain contractual terms and conditions designed to maintain the privacy and security of such ePHI;
THEREFORE, the parties agree to the following:
I. In the event that the Exhibit requires Oracle to access, receive, maintain or transmit your ePHI, Oracle will take the following measures designed to protect the privacy and security of such ePHI, unless otherwise required by law:
A. Not use or further disclose such ePHI other than as permitted or required by the Exhibit.
B. Use appropriate administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of such ePHI and comply, where applicable to Oracle in its performance of the services , with 45 C.F.R. § 164 Subpart C, to prevent the use or disclosure of such ePHI other than as provided under the Exhibit ; additional information concerning such measures may be specified in the Exhibit.
C. Report to you any use or disclosure of such ePHI in violation of the terms of the Exhibit of which Oracle becomes aware, including within 72 hours confirmed Breaches of Unsecured Protected Health Information as required by 45 C.F.R. § 164.410 (as those terms are defined by 45 C.F.R. § 164.402) and will report to you Security Incidents (as defined by 45 CFR 164.304). Such report shall include the identification of each individual, to the extent know n by Oracle, whose unsecured protected health information has been, or is reasonably believed by Oracle to have been, accessed, acquired or disclosed during such breach. To the extent known, Oracle shall also provide you with:
a brief description of what happened, including the date of the breach and the date of the discovery of the breach; a description of the types of unsecured ePHI that were involved in the breach; and a brief description of what Oracle is doing to investigate the breach, remediate its cause, and protect against any further breaches of the same or similar nature.
D. In accordance with 45 C.F.R. § 164.502(e)(1)(ii) and § 164.308(b)(2), ensure that any subcontractors that access, receive, maintain, or transmit such ePHI on Oracle’s behalf in its provision of services under the Exhibit agree in all material respects to the same restrictions and conditions that apply to Oracle with respect to such ePHI under the Exhibit.
E. Make available to you any requests received by Oracle from individuals to inspect or obtain a copy of their ePHI in accordance with 45 C.F.R. § 164.524.
Based on Cloud_Business Associate Agreement_v122316 Oracle Confidential Page 2 of 6
F. Make available to you any requests received by Oracle from individuals to have their ePHI amended in accordance with 45 C.F.R. § 164.526.
G. Make available to you any requests received by Oracle from individuals for an accounting of disclosures of ePHI in accordance with 45 C.F.R. § 164.528.
H. Make its internal practices, books and records relating to the use and disclosure of such ePHI available to the Secretary of the United States Department of Health and Human Services or his or her designee for purposes of determining your compliance with 45 C.F.R. § 164 Subpart E .
I. At the end of the services under the Exhibit or upon termination thereof in accordance with its terms, if feasible and at your request, Oracle shall return or destroy any such ePHI then in its possession in any form, and retain no copies of such ePHI. If such return or destruction is not feasible, Oracle will extend the protections specified in the ordering document to such ePHI and limit further uses and disclosures to those purposes that make its return or destruction of such ePHI infeasible.
II. Additional Terms
A. You may terminate this Exhibit if Oracle is in material breach of the obligations stated in this Business Associate Agreement and fails to correct the breach within 30 days of written specification of the breach.
B. Prior to the effective date of Your termination of this BAA, You are responsible for ensuring that Your Content in the Cloud Services contains no ePHI
C. If Oracle knows of a pattern of activity or practice of a subcontractor that constitutes a material breach of the subcontractor’s obligation of the contract executed with Oracle in accordance with Section I.D above, Oracle will promptly require the subcontractor to cure the breach or end the violation, as applicable, and if such steps are unsuccessful, terminate the contract, if feasible.
D. The terms and conditions of this Business Associate Agreement shall survive termination of the Exhibit.
E. When using or disclosing such ePHI or when requesting such ePHI from you, the parties shall make reasonable efforts to limit ePHI to the minimum necessary to accomplish the intended purposes of the use, disclosure or request.
F. You agree to follow any ePHI handling procedures that are specified in the Exhibit.
G. IN NO EVENT WILL EITHER YOU OR ORACLE AND ITS AFFILIATES BE LIABLE FOR
ANY INDIRECT, CONSEQUENTIAL, INCIDENTAL, SPECIAL, PUNITIVE, OR
EXEMPLARY DAMAGES, OR ANY LOSS OF REVENUE, PROFITS, SALES, DATA, DATA USE GOODWILL OR REPUTATION. IN NO EVENT SHALL THE AGGREGATE
LIABILITY OF ORACLE AND ITS AFFILIATES ARISING OUT OF OR RELATED TO
THIS BUSINESS ASSOCIATE AGREEMENT, WHETHER IN CONTRACT, TORT, OR
OTHERWISE, EXCEED THE TOTAL AMOUNTS ACTUALLY PAID UNDER YOUR
ORDER FOR THE SERVICES GIVING RISE TO THE LIABILITY DURING THE TWELVE (12) MONTHS IMMEDIATELY PR ECEDING THE EVENT GIVING RISE TO SUCH LIABILITY.
Based on Cloud_Business Associate Agreement_v122316 Oracle Confidential Page 3 of 6
Subject to the modifications herein, the Exhibit shall remain in full force and effect. {{*efdate_es_signer2}}
The effective date of this Business Associate Agreement is _______________, 2024. {to be completed by Oracle}.
City of San Bernardino Applications Software Technology Llc, authorized reseller of Oracle, America, Inc.
{{*_es_signer1_signature }} {{*_es_signer2_signature }} Authorized Signature: _________________________ Authorized Signature: _______________________ {{*_es_signer1_fullname }} {{*_es_signer2_fullname }} Name: _______________________________________ Name: _____________________________________ {*_es_signer1_title }} {{*_es_signer2_title }} Title: ________________________________________ Title: ______________________________________ {{*_es_signer1_date}} {{*_es_signer2_date}}
Signature Date: _______________________________ Signature Date: _____________________________