Common use of GENERAL PROVISIONS AND RECITALS Clause in Contracts

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor activities on behalf of COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., apply to CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties Parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties Parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between CONTRACTOR the Contractor and COUNTY County arises to the extent that CONTRACTOR 19 Contractor performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY County pursuant 20 to, and as set forth in, the Contract MA-XXX that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. COUNTY The County wishes to disclose to CONTRACTOR Contractor certain information pursuant to the terms of 23 the ContractContract MA- XXX, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractContract MA-XXX. 26 4. The parties Parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract MA-XXX in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties Parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties Parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to CONTRACTOR the Contractor in the same manner as they apply to a covered 35 entity (COUNTYCounty). XXXXXXXXXX Contractor agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractContract MA-XXX.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties Parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties Parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between CONTRACTOR the Contractor and COUNTY County arises to the extent that CONTRACTOR 19 Contractor performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY County pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. COUNTY The County wishes to disclose to CONTRACTOR Contractor certain information pursuant to the terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract. 26 4. The parties Parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties Parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties Parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to CONTRACTOR the Contractor in the same manner as they apply to a covered 35 entity (COUNTYCounty). XXXXXXXXXX Contractor agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.

GENERAL PROVISIONS AND RECITALS. 12 13 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 14 Definitions Paragraph Bof Exhibit B to the Agreement or in Subparagraph B below, shall 13 have the same 15 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 16 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 18 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 20 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 21 “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 24 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract25 Agreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-–empt any state statutes, rules, or regulations that are not otherwise pre-–empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 35 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 36 terms of 36 this Business Associate Contract, Contract as it exists now or be hereafter updated with notice to 37 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the 1 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 2 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.

GENERAL PROVISIONS AND RECITALS. 12 13 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 14 Definitions Paragraph Bof Exhibit B to the Agreement or in Subparagraph B below, shall 13 have the same 15 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 16 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 18 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 20 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 21 “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 24 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract25 Agreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-–empt any state statutes, rules, or regulations that are not otherwise pre-–empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 35 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 36 terms of 36 this Business Associate Contract, Contract as it exists now or be hereafter updated with notice to 37 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the 1 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 2 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties Parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties Parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between CONTRACTOR the Contractor and COUNTY County arises to the extent that CONTRACTOR 19 Contractor performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY County pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. COUNTY The County wishes to disclose to CONTRACTOR Contractor certain information pursuant to the terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract. 26 4. The parties Parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties Parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties Parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to CONTRACTOR the Contractor in the same manner as they apply to a covered 35 entity (COUNTYCounty). XXXXXXXXXX Contractor agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or may hereafter be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.

GENERAL PROVISIONS AND RECITALS. 12 13 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 14 Definitions Paragraph Bof Exhibit B to the Agreement or in Subparagraph B below, shall 13 have the same 15 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 16 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 20 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business 21 Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 24 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract25 Agreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-–empt any state statutes, rules, or regulations that are not otherwise pre-–empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 35 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 36 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to 37 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the 1 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 2 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability 14 Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and 15 Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 16 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 20 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 21 “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 24 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 25 pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a 35 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 36 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to 37 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the 1 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 2 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 13 Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B. below, shall 13 have the same 14 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 15 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 16 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 17 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 18 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 19 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 20 “Business Associate” in 45 CFR 21 § 160.103. 22 21 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 22 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 23 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract24 Agreement. 26 25 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 26 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 27 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 28 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 29 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 30 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 31 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 32 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 33 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 34 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 35 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 36 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 37 // 1 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 2 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B below, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) regulations as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the // Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph BSubparagraph B., shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.

GENERAL PROVISIONS AND RECITALS. 12 13 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 14 Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B. below, shall 13 have the same 15 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 16 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 18 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 20 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 21 “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10., to 24 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract25 Agreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 35 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 36 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 37 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 1 with respect to PHI and electronic PHI 2 ePHI created, received, maintained, transmitted, used, or disclosed pursuant to 2 the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 13 Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B. below, shall 13 have the same 14 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 15 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 16 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 17 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 18 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 19 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 20 “Business Associate” in 45 CFR 21 § 160.103. 22 21 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 22 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 23 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract24 Agreement. 26 25 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 26 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 27 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 28 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 29 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 30 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 31 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 32 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 33 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 34 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 35 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to 36 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the 37 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 1 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 2 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 13 1. The parties agree that the terms used, but not otherwise defined below in Paragraph BSubparagraph B., 14 shall 13 have the same meaning given to such terms under the Health Insurance Portability and 15 Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for 16 Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing 17 regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be 18 hereafter amended. 17 19 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 20 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 21 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 22 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 23 “Business Associate” in 45 CFR 21 § 160.103. 22 24 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 25 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 26 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 27 pursuant to, 25 and as set forth, in the ContractAgreement. 26 28 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 29 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 30 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 31 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 32 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 33 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 34 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 35 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 36 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a 37 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 1 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 2 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 3 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 4 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 9 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 10 have the same meaning given to such terms under the Health Insurance Portability and Accountability 11 Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and 12 Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 13 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 14 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 15 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 16 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 17 COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business 18 Associate” in 45 CFR 21 § 160.103. 22 19 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 20 terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined 21 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 22 pursuant to, 25 and as set forth, in the Contract. 26 23 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 24 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance 25 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 26 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 27 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 28 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 29 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 30 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 31 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a 32 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 33 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to 34 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 35 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 36 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.. 37 // 1 B. DEFINITIONS

GENERAL PROVISIONS AND RECITALS. 12 9 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 10 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 11 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 12 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR 13 Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 14 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 15 the HIPAA regulations between CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 16 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY 17 pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business Associate” 18 in 45 CFR 21 § 160.103. 22 19 3. COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms 20 of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 21 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 22 and as set forth, in the Contract. 26 23 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 24 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance with 28 25 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 26 and the HIPAA regulations as they may exist now or be hereafter amended. 30 27 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 28 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 29 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 30 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 31 Subparagraphs B.9. and B.14., apply to CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the terms of 36 33 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 34 and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as 35 they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, 36 maintained, transmitted, used, or disclosed pursuant to the Contract.. 37 // 1 B. DEFINITIONS

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B below, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-–empt any state statutes, rules, or regulations that are not otherwise pre-–empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 13 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 14 Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B. below, shall 13 have the same 15 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 16 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 20 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 21 “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10., to 24 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract25 Agreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 35 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 36 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 37 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 1 with respect to PHI and electronic PHI 2 ePHI created, received, maintained, transmitted, used, or disclosed pursuant to 2 the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph BSubparagraph B., 13 shall 13 have the same meaning given to such terms under the Health Insurance Portability and 14 Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for 15 Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing 16 regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended.hereafter 17 18 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 19 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 20 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 21 COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business 22 Associate” in 45 CFR 21 § 160.103. 22 23 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 24 terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined 25 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 26 pursuant to, 25 and as set forth, in the Contract. 26 27 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 28 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance with 28 29 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 30 and the HIPAA regulations as they may exist now or be hereafter amended. 30 31 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 32 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 33 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 34 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 35 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a covered 35 36 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the terms of 36 37 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and 1 requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with 2 respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant 3 to the Contract.

GENERAL PROVISIONS AND RECITALS. 12 13 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 14 have the same meaning given to such terms under the Health Insurance Portability and Accountability 15 Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and 16 Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 17 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 18 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 19 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 20 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 21 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 22 “Business Associate” in 45 CFR 21 § 160.103. 22 23 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 24 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 25 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 26 pursuant to, 25 and as set forth, in the ContractAgreement. 26 27 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 28 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 29 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 30 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 31 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 32 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 33 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 34 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 35 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a 36 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 37 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 1 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 2 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 3 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph BSubparagraph B., 13 shall 13 have the same meaning given to such terms under the Health Insurance Portability and 14 Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for 15 Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing 16 regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be 17 hereafter amended. 17 18 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 19 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 20 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 21 COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business 22 Associate” in 45 CFR 21 § 160.103. 22 23 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 24 terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined 25 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 26 pursuant to, 25 and as set forth, in the Contract. 26 27 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 28 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance 29 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 30 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 31 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 32 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 33 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 34 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 35 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a 36 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 37 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to 1 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the 2 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 3 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 13 Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B. below, shall 13 have the same 14 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 15 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 16 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 17 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 18 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 19 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 20 “Business Associate” in 45 CFR 21 § 160.103. 22 21 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 22 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10., to 23 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract24 Agreement. 26 25 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 26 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 27 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 28 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 29 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 30 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 31 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 32 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 33 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 34 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 35 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 36 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 37 // 1 with respect to PHI and electronic PHI 2 ePHI created, received, maintained, transmitted, used, or disclosed pursuant to 2 the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 13 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 14 Definitions Paragraph Bof Exhibit B to the Agreement or in Subparagraph B below, shall 13 have the same 15 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 16 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 18 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 20 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 21 “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 24 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract25 Agreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-–empt any state statutes, rules, or regulations that are not otherwise pre-–empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 35 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 36 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to 37 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the 1 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 2 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties Parties agree that the terms used, but not otherwise defined below in the Common Terms and 13 Definitions Paragraph Bof Exhibit B to the Agreement or in Subparagraph B below, shall 13 have the same 14 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 15 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 16 2. The parties Parties agree that a business associate relationship under HIPAA, the HITECH Act, 17 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 18 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 19 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 20 “Business Associate” in 45 CFR 21 § 160.103. 22 21 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 22 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10B.10 , to 23 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract24 Agreement. 26 25 4. The parties Parties intend to protect the privacy and provide for the security of PHI that may be 27 26 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 27 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 28 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 29 5. The parties Parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 30 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 31 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 32 6. The parties Parties understand that the HIPAA Privacy and Security rules, as defined below in 34 33 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 34 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 35 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 36 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 37 // 1 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 2 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 14 1. The parties agree that the terms used, but not otherwise defined below in Paragraph BSubparagraph B., 15 shall 13 have the same meaning given to such terms under the Health Insurance Portability and 16 Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for 17 Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing 18 regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be 19 hereafter amended. 17 20 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 21 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 22 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 23 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 24 “Business Associate” in 45 CFR 21 § 160.103. 22 25 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 26 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 27 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 28 pursuant to, 25 and as set forth, in the ContractAgreement. 26 29 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 30 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 31 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 32 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 33 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 34 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 35 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 36 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 37 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a 1 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 2 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 3 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 4 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 5 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 10 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 11 have the same meaning given to such terms under the Health Insurance Portability and Accountability 12 Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and 13 Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 14 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 15 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 16 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 17 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 18 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 19 “Business Associate” in 45 CFR 21 § 160.103. 22 20 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 21 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 22 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 23 pursuant to, 25 and as set forth, in the ContractAgreement. 26 24 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 25 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 26 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 27 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 28 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 29 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 30 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 31 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 32 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a 33 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 34 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 35 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 36 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 37 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 20 COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business 21 Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined 24 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 25 pursuant to, 25 and as set forth, in the Contract. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 of 9 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 13 Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B. below, shall 13 have the same 14 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 15 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 16 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 17 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 18 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 19 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 20 “Business Associate” in 45 CFR 21 § 160.103. 22 21 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 22 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 23 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract24 Agreement. 26 25 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 26 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 27 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 28 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 29 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 30 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 31 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 32 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 33 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 34 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 35 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 36 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 37 // 1 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 2 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and Definitions Paragraph of Exhibit A, B, and C to the Agreement or in subparagraph B below, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) regulations as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY pursuant 20 to, and asonly as expressly set forth in, the Contract Agreement that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B below, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-–empt any state statutes, rules, or regulations that are not otherwise pre-–empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the // Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 9 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 10 have the same meaning given to such terms under the Health Insurance Portability and Accountability 11 Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and 12 Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 13 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 14 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 15 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 16 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 17 COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business 18 Associate” in 45 CFR 21 § 160.103. 22 19 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 20 terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined 21 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 22 pursuant to, 25 and as set forth, in the Contract. 26 23 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 24 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance 25 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 26 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 27 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 28 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 29 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 30 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 31 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a 32 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 33 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to 34 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 35 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 36 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.. 37 // 1 B. DEFINITIONS

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability 14 Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and 15 Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 16 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf 20 of COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 21 “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 24 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 25 pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a 35 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 36 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to 37 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the 1 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 2 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties Parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-111- 005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties Parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between CONTRACTOR the Contractor and COUNTY County arises to the extent that CONTRACTOR 19 Contractor performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY County pursuant 20 to, and as set forth in, the Contract # that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. COUNTY The County wishes to disclose to CONTRACTOR Contractor certain information pursuant to the terms of 23 the ContractContract #, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractContract #. 26 4. The parties Parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract # in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties Parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties Parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to CONTRACTOR the Contractor in the same manner as they apply to a covered 35 entity (COUNTYCounty). XXXXXXXXXX Contractor agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or may hereafter be hereafter updated with notice to CONTRACTOR, 37 the Contractor and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractContract #.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability 14 Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and 15 Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 16 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 20 COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business 21 Associate” in 45 CFR 21 § 160.103. 22 3. COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms 23 of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined below 24 in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant 25 to, 25 and as set forth, in the Contract. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., apply to CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to 37 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the 1 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 2 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 13 Definitions Paragraph Bof Exhibit A to this Contract or in Subparagraph B. below, shall 13 have the same 14 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 15 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 16 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 17 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 18 CONTRACTOR 19 performs, or delegates to subcontractors subcontractor to perform, functionsor functions or activities on behalf of 19 COUNTY pursuant 20 to, and as set forth in, the in this Contract that are described in the definition of “Business 20 Associate” in 45 CFR 21 § 160.103. 22 21 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 22 terms of 23 the this Contract, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be 23 used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, forth in the this 24 Contract. 26 25 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 26 created, received, maintained, transmitted, used, or disclosed pursuant to the this Contract in compliance 27 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 28 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 29 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 30 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 31 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 32 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 33 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 34 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 35 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 36 CONTRACTOR and the applicable standards, implementation specifications, and requirements of the 37 // 1 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 2 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the this Contract.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties Parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties Parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between CONTRACTOR the Contractor and COUNTY County arises to the extent that CONTRACTOR 19 Contractor performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY County pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. COUNTY The County wishes to disclose to CONTRACTOR Contractor certain information pursuant to the terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract. 26 4. The parties Parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties Parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-pre- empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties Parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to CONTRACTOR the Contractor in the same manner as they apply to a covered 35 entity (COUNTYCounty). XXXXXXXXXX Contractor agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or may hereafter be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties Parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties Parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between CONTRACTOR the Contractor and COUNTY County arises to the extent that CONTRACTOR 19 Contractor performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY County pursuant 20 to, and as set forth in, the Contract MA-042-16011547 that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. COUNTY The County wishes to disclose to CONTRACTOR Contractor certain information pursuant to the terms of 23 the ContractContract MA-042-16011547, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractContract MA- 042-16011547. 26 4. The parties Parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract MA-042-16011547 in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties Parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties Parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to CONTRACTOR the Contractor in the same manner as they apply to a covered 35 entity (COUNTYCounty). XXXXXXXXXX Contractor agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractContract MA-042- 16011547.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties Parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties Parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between CONTRACTOR the Contractor and COUNTY County arises to the extent that CONTRACTOR 19 Contractor performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY County pursuant 20 to, and as set forth in, the Contract MA-042-17011367 that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. COUNTY The County wishes to disclose to CONTRACTOR Contractor certain information pursuant to the terms of 23 the ContractContract MA-042-17011367, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractContract MA-042- 17011367. 26 4. The parties Parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract MA- 042-17011367 in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties Parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties Parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to CONTRACTOR the Contractor in the same manner as they apply to a covered 35 entity (COUNTYCounty). XXXXXXXXXX Contractor agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, County of Orange Health Care Agency Page 27 MA-042-17011367 transmitted, used, or disclosed pursuant to the ContractContract MA-042-17011367.

GENERAL PROVISIONS AND RECITALS. 12 11 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 12 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 13 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 14 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR 15 Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 16 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 17 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 18 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 19 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business 20 Associate” in 45 CFR 21 § 160.103. 22 21 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 22 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 23 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 24 pursuant to, 25 and as set forth, in the ContractAgreement. 26 25 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 26 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 27 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 28 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 29 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 30 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 31 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 32 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 33 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a covered 35 34 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the terms of 36 35 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and 36 requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 37 // 1 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 2 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability 14 Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and 15 Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 16 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf 20 of COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 21 “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 24 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 25 pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a 35 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 36 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to 37 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the 1 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 2 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the 104- he Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may 111- exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103.the 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), Agreemen as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties Parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties Parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between CONTRACTOR the Contractor and COUNTY County arises to the extent that CONTRACTOR 19 Contractor performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY County pursuant 20 to, and as set forth in, the Contract No. MA-042-20010626 that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. COUNTY The County wishes to disclose to CONTRACTOR Contractor certain information pursuant to the terms of 23 the ContractContract No. MA-042-20010626, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract.Contract No. MA-042- 20010626 26 4. The parties Parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract No. MA-042-20010626 in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties Parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties Parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to CONTRACTOR the Contractor in the same manner as they apply to a covered 35 entity (COUNTYCounty). XXXXXXXXXX Contractor agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractContract No. MA-042-20010626.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph BSubparagraph B., 13 shall 13 have the same meaning given to such terms under the Health Insurance Portability and 14 Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for 15 Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing 16 regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be 17 hereafter amended. 17 18 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 19 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 20 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf 21 of COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 22 “Business Associate” in 45 CFR 21 § 160.103. 22 23 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 24 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as 25 defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and 26 activities pursuant to, 25 and as set forth, in the ContractAgreement. 26 27 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 28 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 29 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 30 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 31 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 32 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 33 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 34 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 35 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a 36 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 37 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 1 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 2 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 3 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 13 Definitions Paragraph Bof Exhibit A to the Contract or in Subparagraph B. below, shall 13 have the same 14 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 15 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 16 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 17 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 18 CONTRACTOR 19 performs, or delegates to subcontractors subcontractor to perform, functionsor functions or activities on behalf of 19 COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business 20 Associate” in 45 CFR 21 § 160.103. 22 21 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 22 terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be 23 used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the 24 Contract. 26 25 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 26 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance 27 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 28 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 29 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 30 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 31 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 32 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 33 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 34 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 35 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 36 CONTRACTOR and the applicable standards, implementation specifications, and requirements of the 37 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 1 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.

GENERAL PROVISIONS AND RECITALS. 12 1. 1.01 The parties agree that the terms used, but not otherwise defined below in Paragraph Bbelow, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“"HIPAA”"), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-111- 005 (“"the HITECH Act”"), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“"the HIPAA regulations”") as they e x i s t or may exist now or hereafter be hereafter amended. 17 2. 1.02 The parties agree that a business associate relationship (as described in 45 CFR §160.103) under HIPAA, the HITECH Act, and 18 the HIPAA regulations arises between the CONTRACTOR and COUNTY arises the CITY to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103CITY. 22 3. COUNTY 1.03 CITY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the Contractinformation, some of which may constitute Protected Health Information (“PHI”), ) as defined below in 24 Subparagraph B.10below, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contractactivities. 26 4. 1.04 The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they exist or may exist now or hereafter be hereafter amended. 30 5. 1.05 The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. 1.06 The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., rules apply to the CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY)entity. XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance comply at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Agreement and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they exist or may exist now or hereafter be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractPHI.

GENERAL PROVISIONS AND RECITALS. 12 13 1. The parties agree that the terms used, but not otherwise defined below in 14 Terms and Definitions Paragraph BBof Exhibit A to the Agreement or in Subparagraph B. below, shall 13 15 have the same meaning given to such terms under the Health Insurance Portability and Accountability 16 Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and 17 Clinical 15 Health Act, Public Law 111-005 (“, the HITECH Act”),, and their implementing regulations at 18 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or may be hereafter 19 amended. 17 20 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 21 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 22 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 23 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 24 “Business Associate” in 45 CFR 21 § 160.103. 22 25 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 26 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”)PHI”),PHI, as 27 defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and 28 activities pursuant to, 25 and as set forth, in the ContractAgreement. 26 29 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 30 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 31 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 32 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 33 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 34 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 35 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI.. athe 33 36 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 37 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a 1 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 2 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 3 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 4 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 5 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph BSubparagraph B., 13 shall 13 have the same meaning given to such terms under the Health Insurance Portability and 14 Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for 15 Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing 16 regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be 17 hereafter amended. 17 18 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 19 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 20 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 21 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 22 “Business Associate” in 45 CFR 21 § 160.103. 22 23 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 24 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 25 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 26 pursuant to, 25 and as set forth, in the ContractAgreement. 26 27 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 28 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 29 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 30 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 31 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 32 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 33 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 34 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 35 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a 36 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 37 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 1 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 2 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 3 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 13 Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B. below, shall 13 have the same 14 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 15 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or may be hereafter amended. 17 16 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 17 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 18 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 19 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business 20 Associate” in 45 CFR 21 § 160.103. 22 21 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 22 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 23 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract24 Agreement. 26 25 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 26 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 27 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 28 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 29 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 30 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 31 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 32 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 33 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 34 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 35 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 36 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 37 // 1 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 2 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 13 Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B. below, shall 13 have the same 14 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 15 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or may be hereafter 16 amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 18 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 20 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 21 “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 24 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract25 Agreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 35 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 36 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 37 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 1 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 2 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. 1.01 The parties agree that the terms used, but not otherwise defined below in Paragraph Bbelow, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“"HIPAA”"), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“"the HITECH Act”"), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“"the HIPAA regulations”") as they e x i s t or may exist now or hereafter be hereafter amended. 17 2. 1.02 The parties agree that a business associate relationship (as described in 45 CFR §160.103) under HIPAA, the HITECH Act, and 18 the HIPAA regulations arises between the CONTRACTOR and COUNTY arises CITY to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103CITY. 22 3. COUNTY 1.03 CITY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the Contractinformation, some of which may constitute Protected Health Information (“PHI”), ) as defined below in 24 Subparagraph B.10below, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contractactivities. 26 4. 1.04 The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they exist or may exist now or hereafter be hereafter amended. 30 5. 1.05 The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. 1.06 The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., rules apply to the CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY)entity. XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance comply at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Agreement and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they exist or may exist now or hereafter be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractPHI.

GENERAL PROVISIONS AND RECITALS. 12 9 1. The parties agree that the terms used, but not otherwise defined below in Paragraph BSubparagraph B., 10 shall 13 have the same meaning given to such terms under the Health Insurance Portability and 11 Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for 12 Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing 13 regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be 14 hereafter amended. 17 15 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 16 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 17 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 18 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 19 “Business Associate” in 45 CFR 21 § 160.103. 22 20 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 21 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 22 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 23 pursuant to, 25 and as set forth, in the ContractAgreement. 26 24 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 25 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 26 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 27 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 28 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 29 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 30 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 31 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 32 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a 33 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 34 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 35 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 36 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 37 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph BSubparagraph B., shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-111- 005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B below, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 1 of 14 EXHIBIT B X:\CONTRACTS - 2018 -\2018-2019\BH\TEL03 Enhanced Recovery FSP FY 18-19 - JC.doc TEL03BHKK19 11 22 33 44 55 66 77 88 99 1010 111 1212 1313 1414 1515 1616 1717 1818 1919 2020 2121 222 2323 2424 2525 2626 2727 2828 2929 3030 3131 3232 333 3434 3535 3636 3737 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 ePHI created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability 14 Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and 15 Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 16 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 20 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 21 “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 24 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 25 pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a 35 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 36 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 37 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 1 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 2 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties Parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties Parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between CONTRACTOR the Contractor and COUNTY County arises to the extent that CONTRACTOR 19 Contractor performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY County pursuant 20 to, and as set forth in, the Contract MA-XXX that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. COUNTY The County wishes to disclose to CONTRACTOR Contractor certain information pursuant to the terms of 23 the ContractContract MA-XXX, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractContract MA-XXX. 26 4. The parties Parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract MA-XXX in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties Parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties Parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., apply to CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.Subparagraphs

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 13 Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B. below, shall 13 have the same 14 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 15 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 16 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 17 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 18 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 19 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business 20 Associate” in 45 CFR 21 § 160.103. 22 21 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 22 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 23 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract24 Agreement. 26 25 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 26 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 27 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 28 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 29 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 30 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 31 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 32 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 33 Subparagraphs B.9. and B.14.,, apply to the CONTRACTOR in the same manner as they apply to a athe 34 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 35 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to 36 141 of 37 14 12 EXHIBIT B X:\CONTRACTS - 2018 -\2018-2019\BH\PAC09 PACIFIC CLINICS REI FY 00-00 XX.Xxx XXX00XXXX00 PACIFIC CLINICS X:\ASR\SUD\ASR 19-000273 PACIFIC CLINICS REI KK FY 00-00 XX XXXXXXX.XXXX XXX00XXXX00 PACIFIC CLINICS HCA ASR 19-000273 Page 55 of 72 1 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the 2 // 3 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 4 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph BSubparagraph B., 13 shall 13 have the same meaning given to such terms under the Health Insurance Portability and 14 Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for 15 Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing 16 regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be 17 hereafter amended. 17 18 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 19 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 20 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 21 COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business 22 Associate” in 45 CFR 21 § 160.103. 22 23 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 24 terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined 25 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 26 pursuant to, 25 and as set forth, in the Contract. 26 27 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 28 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance 29 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 30 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 31 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 32 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 33 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 34 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 35 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a 36 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 37 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.to

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 13 Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B. below, shall 13 have the same 14 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 15 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 16 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 17 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 18 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 19 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 20 “Business Associate” in 45 CFR 21 § 160.103. 22 21 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 22 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 23 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract24 Agreement. 26 25 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 26 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 27 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 28 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 29 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 30 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 31 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 32 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 33 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 34 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 35 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 36 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 37 // 1 with respect to PHI and electronic PHI 2 ePHI created, received, maintained, transmitted, used, or disclosed pursuant to 2 the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B below, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the // Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 ePHI created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 13 Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B. below, shall 13 have the same 14 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 15 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 16 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 17 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 18 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 19 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 20 “Business Associate” in 45 CFR 21 § 160.103. 22 21 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 22 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 23 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract24 Agreement. 26 25 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 26 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 27 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 28 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 29 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 30 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 31 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 32 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 33 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 34 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 35 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 36 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 37 // 1 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 2 pursuant to the ContractAgreement. 3 B. DEFINITIONS 4 1. “Administrative Safeguards” are administrative actions, and policies and procedures, to 5 manage the selection, development, implementation, and maintenance of security measures to protect 6 electronic PHI and to manage the conduct of CONTRACTOR’s workforce in relation to the protection 7 of that information.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph BSubparagraph B., 13 shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability 14 Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and 15 Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 16 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 20 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business 21 Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 24 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 25 pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the terms of 36 this Business Associate ContractAgreement, as it exists now or be hereafter updated with notice to 37 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the DocuSign Envelope ID: 21793D0C-97D9-486F-9DA8-09B85A035BB7 Attachment C 1 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 2 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 13 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 14 Definitions Paragraph Bof Exhibit B to the Contract or in Subparagraph B below, shall 13 have the same 15 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 16 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY 20 pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business Associate” 21 in 45 CFR 21 § 160.103. 22 3. COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms 23 of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or 24 disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract. 26 25 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 26 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance with 28 27 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 28 and the HIPAA regulations as they may exist now or be hereafter amended. 30 29 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 30 regulations do not pre-–empt any state statutes, rules, or regulations that are not otherwise pre-–empted by 32 31 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 32 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 33 Subparagraphs B.9. B.9 and B.14., apply to CONTRACTOR in the same manner as they apply to a the covered 35 34 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the terms of 36 35 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 36 and the applicable standards, implementation specifications, and requirements of the Privacy and the 37 // 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.

GENERAL PROVISIONS AND RECITALS. 12 13 1. The parties agree that the terms used, but not otherwise defined below in the Common Terms and 14 Definitions Paragraph Bof Exhibit A to the Agreement or in Subparagraph B. below, shall 13 have the same 15 meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 16 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 18 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors subcontractor to perform, functionsor functions or activities on behalf of 20 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 21 “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 24 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract25 Agreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 35 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 36 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 CONTRACTOR and the applicable standards, implementation specifications, and requirements of the 1 // 2 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 3 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties Parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties Parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between CONTRACTOR the Contractor and COUNTY County arises to the extent that CONTRACTOR 19 Contractor performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY County pursuant 20 to, and as set forth in, the Contract MA-042-21011330 that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. COUNTY The County wishes to disclose to CONTRACTOR Contractor certain information pursuant to the terms of 23 the ContractContract MA-042-21011330, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractContract MA-042- 21011330. 26 4. The parties Parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract MA- 042-21011330 in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties Parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties Parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to CONTRACTOR the Contractor in the same manner as they apply to a covered 35 entity (COUNTYCounty). XXXXXXXXXX Contractor agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, County of Orange MA-042-21011330 Health Care Agency Page 36 of 49 Folder No. C032752 transmitted, used, or disclosed pursuant to the ContractContract MA-042-21011330.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph BSubparagraph B., 13 shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability 14 Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and 15 Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 16 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 19 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 20 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business 21 Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 23 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 24 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 25 pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 28 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 29 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the terms of 36 this Business Associate ContractAgreement, as it exists now or be hereafter updated with notice to 37 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the DocuSign Envelope ID: B2B397AD-2D13-46CE-A83E-516D9DE15279 Attachment A 1 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 2 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 9 1. The parties agree that the terms used, but not otherwise defined below in Paragraph BSubparagraph B., 10 shall 13 have the same meaning given to such terms under the Health Insurance Portability and 11 Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for 12 Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing 13 regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be 14 hereafter amended. 17 15 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 16 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 17 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 18 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 19 “Business Associate” in 45 CFR 21 § 160.103. 22 20 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 21 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 22 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 23 pursuant to, 25 and as set forth, in the ContractAgreement. 26 24 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 25 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 26 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 27 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 28 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 29 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 30 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 31 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 32 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a 33 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 34 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 35 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 36 with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed 37 pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 14 1. The parties agree that the terms used, but not otherwise defined below in Paragraph Bthe Common Terms and 15 Definitions Paragraphs of Exhibit A and B to the Agreement or in Subparagraph B. below, shall 13 have the 16 same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations 17 at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 18 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 19 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 20 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 21 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 22 “Business Associate” in 45 CFR 21 § 160.103. 22 23 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 24 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 25 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract26 Agreement. 26 27 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 28 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 29 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 30 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 31 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 32 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 33 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 34 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 35 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 36 covered 35 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the 37 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, 1 of 14 EXHIBIT C 1 and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, 2 with respect to PHI and electronic PHI 2 ePHI created, received, maintained, transmitted, used, or disclosed pursuant to 3 the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties Parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties Parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between CONTRACTOR the Contractor and COUNTY County arises to the extent that CONTRACTOR 19 Contractor performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY County pursuant 20 to, and as set forth in, the Contract MA-042-14010509 that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. COUNTY The County wishes to disclose to CONTRACTOR Contractor certain information pursuant to the terms of 23 the ContractContract MA-042-14010509, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractContract MA-042-14010509. 26 4. The parties Parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract MA-042- 14010509 in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties Parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties Parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. B.9 and B.14., apply to CONTRACTOR the Contractor in the same manner as they apply to a covered 35 entity (COUNTYCounty). XXXXXXXXXX Contractor agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractContract MA-042-14010509.

GENERAL PROVISIONS AND RECITALS. 12 13 1. The parties agree that the terms used, but not otherwise defined below in Paragraph Bthe Common Terms and 14 Definitions Paragraphs of Exhibit A and B to the Agreement or in Subparagraph B. below, shall 13 have 15 the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996HIPAA, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing 16 regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be 17 hereafter amended. 17 18 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, 19 and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 20 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 21 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of 22 “Business Associate” in 45 CFR 21 § 160.103. 22 23 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 24 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to 25 be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the Contract26 Agreement. 26 27 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 28 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 29 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 30 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 31 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 32 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 33 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 34 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 35 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a the 36 covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the 37 terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to 1 of 14 EXHIBIT B 1 CONTRACTOR, 37 and the applicable standards, implementation specifications, and requirements of the 2 Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and 3 electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business Associate” in 45 CFR 21 § 160.103. 22 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities pursuant to, 25 and as set forth, in the ContractAgreement. 26 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a covered 35 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the terms of 36 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 1. The parties agree that the terms used, but not otherwise defined below in Paragraph BSubparagraph B., 13 shall 13 have the same meaning given to such terms under the Health Insurance Portability and 14 Accountability Act 14 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for 15 Economic and Clinical 15 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing 16 regulations at 45 CFR Parts 16 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter 17 amended. 17 18 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 19 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 20 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 21 COUNTY pursuant 20 to, and as set forth in, the Contract Agreement that are described in the definition of “Business 22 Associate” in 45 CFR 21 § 160.103. 22 23 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 24 terms of 23 the ContractAgreement, some of which may constitute Protected Health Information (“PHI”), as defined 25 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 26 pursuant to, 25 and as set forth, in the ContractAgreement. 26 27 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 28 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract Agreement in compliance 29 with 28 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH 30 Act, 29 and the HIPAA regulations as they may exist now or be hereafter amended. 30 31 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 32 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 33 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 34 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 35 Subparagraphs B.9. B.9 and B.14., apply to the CONTRACTOR in the same manner as they apply to a covered 35 36 entity (COUNTY). XXXXXXXXXX CONTRACTOR agrees therefore to be in compliance at all times with the terms of 36 37 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 Contract and the applicable standards, implementation specifications, and 1 requirements of the Privacy and the 1 Security rules, as they may exist now or be hereafter amended, with 2 respect to PHI and electronic PHI 2 created, received, maintained, transmitted, used, or disclosed pursuant 3 to the ContractAgreement.

GENERAL PROVISIONS AND RECITALS. 12 13 1. The parties agree that the terms used, but not otherwise defined below in Paragraph B, shall 13 14 have the same meaning given to such terms under the Health Insurance Portability and Accountability Act 14 15 of 1996, Public Law 104-191 (“HIPAA”), the Health Information Technology for Economic and Clinical 15 16 Health Act, Public Law 111-005 (“the HITECH Act”), and their implementing regulations at 45 CFR Parts 16 17 160 and 164 (“the HIPAA regulations”) as they may exist now or be hereafter amended. 17 18 2. The parties agree that a business associate relationship under HIPAA, the HITECH Act, and 18 19 the HIPAA regulations between the CONTRACTOR and COUNTY arises to the extent that 20 CONTRACTOR 19 performs, or delegates to subcontractors to perform, functionsor functions or activities on behalf of 21 COUNTY pursuant 20 to, and as set forth in, the Contract that are described in the definition of “Business 22 Associate” in 45 CFR 21 § 160.103. 22 23 3. The COUNTY wishes to disclose to CONTRACTOR certain information pursuant to the 24 terms of 23 the Contract, some of which may constitute Protected Health Information (“PHI”), as defined 25 below in 24 Subparagraph B.10, to be used or disclosed in the course of providing services and activities 26 pursuant to, 25 and as set forth, in the Contract. 26 27 4. The parties intend to protect the privacy and provide for the security of PHI that may be 27 28 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract in compliance with 28 29 the applicable standards, implementation specifications, and requirements of HIPAA, the HITECH Act, 29 30 and the HIPAA regulations as they may exist now or be hereafter amended. 30 31 5. The parties understand and acknowledge that HIPAA, the HITECH Act, and the HIPAA 31 32 regulations do not pre-empt any state statutes, rules, or regulations that are not otherwise pre-empted by 32 33 other Federal law(s) and impose more stringent requirements with respect to privacy of PHI. 33 34 6. The parties understand that the HIPAA Privacy and Security rules, as defined below in 34 35 Subparagraphs B.9. and B.14., apply to the CONTRACTOR in the same manner as they apply to a covered 35 36 entity (COUNTY). XXXXXXXXXX agrees therefore to be in compliance at all times with the terms of 36 37 1 of 9 HEALTH PROMOTION FOR PUBLIC HEALTH SERVICES - LATINO CENTER FOR PREVENTION & ACTION IN HEALTH AND WELFARE DBA LATINO HEALTH ACCESS MA-042-24010298 1 this Business Associate Contract, as it exists now or be hereafter updated with notice to CONTRACTOR, 37 2 and the applicable standards, implementation specifications, and requirements of the Privacy and the 1 3 Security rules, as they may exist now or be hereafter amended, with respect to PHI and electronic PHI 2 4 created, received, maintained, transmitted, used, or disclosed pursuant to the Contract.