Common use of BUSINESS ASSOCIATE TERMINATION Clause in Contracts

BUSINESS ASSOCIATE TERMINATION. 1. Notwithstanding the Termination provisions set forth in this Contract, the Contract shall only terminate when all of the PHI provided by County to Contractor, or created or received by Contractor on behalf of County, is destroyed or returned to County, or if infeasible to return or destroy PHI, protections are extended to such information, in accordance with the Termination provisions of this Section. 2. In addition to the rights and remedies provided in the Termination paragraph of this Contract, upon County’s knowledge of a material breach by Contractor of the requirements of this paragraph, County shall either: a. Provide an opportunity for Contractor to cure the material breach or end the violation and terminate this Contract if Contractor does not cure the material breach or end the violation within thirty (30) business days; or b. Immediately terminate this Contract if Contractor has breached a material term of this Contract and cure is not possible; or c. If neither termination nor cure is feasible, County shall report the violation to the Secretary of the Department of Health and Human Services. 3. Upon termination of this Contract, all PHI provided by County to Contractor, or created or received by Contractor on behalf of County, shall either be destroyed or returned to County as provided in the Termination paragraph of this Contract, and in conformity with the Privacy Rule. a. This provision shall apply to PHI that is in the possession of subcontractors or agents of County of Orange Health Care Agency 26 MA-042-1201060414010576 Contractor. b. Contractor shall retain no copies of the PHI. c. In the event that Contractor determines that returning or destroying the PHI is infeasible, Contractor shall provide to County notification of the conditions that make return or destruction infeasible. Upon determination by County that return or destruction of PHI is infeasible, Contractor shall extend the protections of this Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Contractor maintains such PHI.

BUSINESS ASSOCIATE TERMINATION. 1. Notwithstanding the Termination provisions set forth in this Contract, the Contract shall only terminate when all of the PHI provided by County to Contractor, or created or received by Contractor on behalf of County, is destroyed or returned to County, or if infeasible to return or destroy PHI, protections are extended to such information, in accordance with the Termination provisions of this Section. 2. In addition to the rights and remedies provided in the Termination paragraph of this Contract, upon County’s County‟s knowledge of a material breach by Contractor of the requirements of this paragraph, County shall either: a. Provide an opportunity for Contractor to cure the material breach or end the violation and terminate this Contract if Contractor does not cure the material breach or end the violation within thirty (30) business days; or b. Immediately terminate this Contract if Contractor has breached a material term of this Contract and cure is not possible; or c. If neither termination nor cure is feasible, County shall report the violation to the Secretary of the Department of Health and Human Services. 3. Upon termination of this Contract, all PHI provided by County to Contractor, or created or received by Contractor on behalf of County, shall either be destroyed or returned to County as provided in the Termination paragraph of this Contract, and in conformity with the Privacy Rule. a. This provision shall apply to PHI that is in the possession of subcontractors or agents of County of Orange Health Care Agency 26 MA-042-1201060414010576 Contractor. b. Contractor shall retain no copies of the PHI. c. In the event that Contractor determines that returning or destroying the PHI is infeasible, Contractor shall provide to County notification of the conditions that make return or destruction infeasible. Upon determination by County that return or destruction of PHI is infeasible, Contractor shall extend the protections of this Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Contractor maintains such PHI. CONTRACT NO. MA-042-1101244512011513 EXHIBIT 1 In order to enhance the child support collection efforts of the County of Orange Family Support Enforcement, all Contractors are required to provide the following information as listed on the attached form:  If the Contractor is an individual contractor: Name, date of birth, social security number, and residence address.  If Contractor is doing business in a form other than as an individual: Name, date of birth, social security number, and residence address of each individual who owns an interest of ten (10) percent or more in the contracting entity. In addition, all Contractors must provide:  A certification that the Contractor has fully complied with all applicable federal and state reporting requirements regarding its employees, and  A certification that the Contractor has fully complied with all lawfully served Wage and Earnings Assignment Orders and Notices of Assignment and will continue to so comply. In order to comply with child support enforcement requirements of the County of Orange, within thirty (30) days of award of Contract, the Contractor agrees to furnish the required contractor data and certifications to the Deputy Purchasing Agent. Failure of the Contractor to timely submit the data and/or certifications required above or to comply with all federal and state reporting requirements for child support enforcement or to comply with all lawfully served Wage and Earnings Assignment Orders and Notices of Assignment shall constitute a material breach of the contract. Failure to cure such breach within sixty (60) calendar days of notice from the County shall constitute grounds for termination of the Contract. A. In the case of an individual contractor, his/her name, date of birth, social security number, and residence address: Name: DOB: Social Security No.: Residence Address: B. In the case of a contractor doing business in a form other than as an individual, the name, date of birth, social security number, and residence address of each individual who owns an interest of 10 percent or more in the contracting entity:

BUSINESS ASSOCIATE TERMINATION. 1. Notwithstanding the Termination provisions set forth in this Contract, the Contract shall only terminate when all of the PHI provided by County to Contractor, or created or received by Contractor on behalf of County, is destroyed or returned to County, or if infeasible to return or destroy PHI, protections are extended to such information, in accordance with the Termination termination provisions of this Section. 2. In addition to the rights and remedies provided in the Termination paragraph of this Contract, upon County’s knowledge of a material breach by Contractor of the requirements of this paragraphParagraph, County shall either: a. Provide an opportunity for Contractor to cure the material breach or end the violation and terminate this Contract if Contractor does not cure the material breach or end the violation within thirty (30) business days; or b. Immediately terminate this Contract if Contractor has breached a material term of this Contract and cure is not possible; or c. If neither termination nor cure is feasible, County shall report the violation to the Secretary of the Department of Health and Human Services. 3. Upon termination of this Contract, all PHI provided by County to Contractor, or created or received by Contractor on behalf of County, shall either be destroyed or returned to County as provided in the Termination paragraph of this Contract, and in conformity with the Privacy Rule. a. This provision shall apply to PHI that is in the possession of subcontractors or agents of County of Orange Health Care Agency 26 MA-042-1201060414010576 Contractor. b. Contractor shall retain no copies of the PHI. c. In the event that Contractor determines that returning or destroying the PHI is infeasible, Contractor shall provide to County notification of the conditions that make return or destruction infeasible. Upon determination by County that return or destruction of PHI is infeasible, Contractor shall extend the protections of this Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Contractor maintains such PHI.,

BUSINESS ASSOCIATE TERMINATION. 1. Notwithstanding the Termination provisions set forth in this Contract, the Contract shall only terminate when all of the PHI provided by County to Contractor, or created or received by Contractor CONTRACTOR on behalf of County, is destroyed or returned to County, or if infeasible to return or destroy PHI, protections are extended to such information, in accordance with the Termination termination provisions of this Section. 2. In addition to the rights and remedies provided in the Termination paragraph of this Contract, upon County’s County‘s knowledge of a material breach by Contractor of the requirements of this paragraphParagraph, County shall either: a. Provide an opportunity for Contractor to cure the material breach or end the violation and terminate this Contract if Contractor does not cure the material breach or end the violation within thirty (30) business days; or b. Immediately terminate this Contract if Contractor has breached a material term of this Contract and cure is not possible; or c. If neither termination nor cure is feasible, County shall report the violation to the Secretary of the Department of Health and Human Services. 3. Upon termination of this Contract, all PHI provided by County to Contractor, or created or received by Contractor on behalf of County, shall either be destroyed or returned to County as provided in the Termination paragraph of this Contract, and in conformity with the Privacy Rule. a. This provision shall apply to PHI that is in the possession of subcontractors or agents of County of Orange Health Care Agency 26 MA-042-1201060414010576 Contractor. b. Contractor shall retain no copies of the PHI. c. In the event that Contractor determines that returning or destroying the PHI is infeasible, Contractor shall provide to County notification of the conditions that make return or destruction infeasible. Upon determination by County that return or destruction of PHI is infeasible, Contractor shall extend the protections of this Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Contractor maintains such PHI.. In order to enhance the child support collection efforts of the County of Orange Child Support Services, all contractors are required to provide the following information as listed on the attached form: • If the Contractor is an individual contractor: Name, date of birth, social security number, and residence address. • If Contractor is doing business in a form other than as an individual: Name, date of birth, social security number, and residence address of each individual who owns an interest of ten

BUSINESS ASSOCIATE TERMINATION. 1. Notwithstanding the Termination provisions set forth in this Contract, the Contract shall only terminate when all of the PHI provided by County to Contractor, or created or received by Contractor on behalf of County, is destroyed or returned to County, or if infeasible to return or destroy PHI, protections are extended to such information, in accordance with the Termination provisions of this Section. 2. In addition to the rights and remedies provided in the Termination paragraph of this Contract, upon County’s knowledge of a material breach by Contractor of the requirements of this paragraph, County shall either: a. Provide an opportunity for Contractor to cure the material breach or end the violation and terminate this Contract if Contractor does not cure the material breach or end the violation within thirty (30) business days; or b. Immediately terminate this Contract if Contractor has breached a material term of this Contract and cure is not possible; or c. If neither termination nor cure is feasible, County shall report the violation to the Secretary of the Department of Health and Human Services. 3. Upon termination of this Contract, all PHI provided by County to Contractor, or created or received by Contractor on behalf of County, shall either be destroyed or returned to County as provided in the Termination paragraph of this Contract, and in conformity with the Privacy Rule. a. This provision shall apply to PHI that is in the possession of subcontractors or agents of County of Orange Health Care Agency 26 MA-042-1201060414010576 Contractor. b. Contractor shall retain no copies of the PHI. c. In the event that Contractor determines that returning or destroying the PHI is infeasible, Contractor shall provide to County notification of the conditions that make return or destruction infeasible. Upon determination by County that return or destruction of PHI is infeasible, Contractor shall extend the protections of this Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Contractor maintains such PHI. 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall have the same meaning given to such terms under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and the HIPAA regulations between the Contractor and County arises to the extent that Contractor performs, or delegates to subcontractors to perform, functions or activities on behalf of County pursuant to, and as set forth in, the Contract MA-042-14011345 that are described in the definition of “Business Associate” in 45 CFR § 160.103. 3. The County wishes to disclose to Contractor certain information pursuant to the terms of the Contract MA-042-14011345, some of which may constitute Protected Health Information (“PHI”), as defined below in Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, and as set forth, in the Contract MA-042-14011345.

BUSINESS ASSOCIATE TERMINATION. 1. Notwithstanding the Termination provisions set forth in this Contract, the Contract shall only terminate when all of the PHI provided by County to Contractor, or created or received by Contractor on behalf of County, is destroyed or returned to County, or if infeasible to return or destroy PHI, protections are extended to such information, in accordance with the Termination provisions of this Section. 2. In addition to the rights and remedies provided in the Termination paragraph of this Contract, upon County’s knowledge of a material breach by Contractor of the requirements of this paragraph, County shall either: a. Provide an opportunity for Contractor to cure the material breach or end the violation and terminate this Contract if Contractor does not cure the material breach or end the violation within thirty (30) business days; or b. Immediately terminate this Contract if Contractor has breached a material term of this Contract and cure is not possible; or c. If neither termination nor cure is feasible, County shall report the violation to the Secretary of the Department of Health and Human Services. 3. Upon termination of this Contract, all PHI provided by County to Contractor, or created or received by Contractor on behalf of County, shall either be destroyed or returned to County as provided in the Termination paragraph of this Contract, and in conformity with the Privacy Rule. a. This provision shall apply to PHI that is in the possession of subcontractors or agents of County of Orange Health Care Agency 26 23 MA-042-1201060414010576 11011483 13011452 Contractor. b. Contractor shall retain no copies of the PHI. c. In the event that Contractor determines that returning or destroying the PHI is infeasible, Contractor shall provide to County notification of the conditions that make return or destruction infeasible. Upon determination by County that return or destruction of PHI is infeasible, Contractor shall extend the protections of this Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Contractor maintains such PHI. 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall have the same meaning given to such terms under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and the HIPAA regulations between the Contractor and County arises to the extent that Contractor performs, or delegates to subcontractors to perform, functions or activities on behalf of County pursuant to, and as set forth in, the Contract MA-042-13011452 that are described in the definition of “Business Associate” in 45 CFR § 160.103. 3. The County wishes to disclose to Contractor certain information pursuant to the terms of the Contract MA-042-13011452, some of which may constitute Protected Health Information (“PHI”), as defined below in Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, and as set forth, in the Contract MA-042-13011452.

BUSINESS ASSOCIATE TERMINATION. 1. Notwithstanding the Termination provisions set forth in this Contract, the Contract shall only terminate when all of the PHI provided by County to Contractor, or created or received by Contractor on behalf of County, is destroyed or returned to County, or if infeasible to return or destroy PHI, protections are extended to such information, in accordance with the Termination provisions of this Section. 2. In addition to the rights and remedies provided in the Termination paragraph of this Contract, upon County’s County‟s knowledge of a material breach by Contractor of the requirements of this paragraph, County shall either: a. Provide an opportunity for Contractor to cure the material breach or end the violation and terminate this Contract if Contractor does not cure the material breach or end the violation within thirty (30) business days; or b. Immediately terminate this Contract if Contractor has breached a material term of this Contract and cure is not possible; or c. If neither termination nor cure is feasible, County shall report the violation to the Secretary of the Department of Health and Human Services. 3. Upon termination of this Contract, all PHI provided by County to Contractor, or created or received by County of Orange Health Care Agency 35 MA-042-10013343 Orange County – Medical Emergency Data System Contractor on behalf of County, shall either be destroyed or returned to County as provided in the Termination paragraph of this Contract, and in conformity with the Privacy Rule. a. This provision shall apply to PHI that is in the possession of subcontractors or agents of County of Orange Health Care Agency 26 MA-042-1201060414010576 Contractor. b. Contractor shall retain no copies of the PHI. c. In the event that Contractor determines that returning or destroying the PHI is infeasible, Contractor shall provide to County notification of the conditions that make return or destruction infeasible. Upon determination by County that return or destruction of PHI is infeasible, Contractor shall extend the protections of this Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Contractor maintains such PHI.. County of Orange Health Care Agency 36 MA-042-10013343 Orange County – Medical Emergency Data System Contractor assumes the responsibility for protecting the County‟s assets and maintaining their integrity, confidentiality, and availability. Contractor shall be required to have formal, published IT security policies that address how it manages and maintains the internal security posture of its own infrastructures. The Contractor shall also clearly demonstrate that additional security features are in place to protect systems and data in the unique environment of the service provider model: namely, security issues associated with storing County-owned data on a remote server that is not under direct County control and the necessity of transferring this data over an untrusted network. Provide all security policies and procedures to the County for review and approval upon the County‟s request and, at a minimum provide said policies and procedures yearly for County‟s review and approval. All documentation shall be provided in electronic format for the County‟s review. These policies shall include, but not be limited to, the following: