Common use of OBLIGATIONS AND ACTIVITIES OF CONTRACTOR AS BUSINESS ASSOCIATE Clause in Contracts

OBLIGATIONS AND ACTIVITIES OF CONTRACTOR AS BUSINESS ASSOCIATE. 35 1. XXXXXXXXXX agrees not to use or further disclose PHI COUNTY discloses to 36 CONTRACTOR other than as permitted or required by this Business Associate Contract or as required 37 by law. 1 2. XXXXXXXXXX agrees to use appropriate safeguards, as provided for in this Business 2 Associate Contract and the Agreement, to prevent use or disclosure of PHI COUNTY discloses to 3 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY 4 other than as provided for by this Business Associate Contract. 5 3. XXXXXXXXXX agrees to comply with the HIPAA Security Rule at Subpart C of 45 CFR 6 Part 164 with respect to ePHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, 7 receives, maintains, or transmits on behalf of COUNTY. 8 4. XXXXXXXXXX agrees to mitigate, to the extent practicable, any harmful effect that is 9 known to CONTRACTOR of a Use or Disclosure of PHI by CONTRACTOR in violation of the 10 requirements of this Business Associate Contract. 11 5. CONTRACTOR agrees to report to COUNTY immediately any Use or Disclosure of PHI 12 not provided for by this Business Associate Contract of which CONTRACTOR becomes aware. 13 CONTRACTOR must report Breaches of Unsecured PHI in accordance with Subparagraph E. below 14 and as required by 45 CFR § 164.410. 15 6. CONTRACTOR agrees to ensure that any Subcontractors that create, receive, maintain, or 16 transmit PHI on behalf of CONTRACTOR agree to the same restrictions and conditions that apply 17 through this Business Associate Contract to CONTRACTOR with respect to such information. 18 7. CONTRACTOR agrees to provide access, within fifteen (15) calendar days of receipt of a 19 written request by COUNTY, to PHI in a DRS, to COUNTY or, as directed by COUNTY, to an 20 Individual in order to meet the requirements under 45 CFR § 164.524. If CONTRACTOR maintains an 21 EHR with PHI, and an individual requests a copy of such information in an electronic format, 22 CONTRACTOR shall provide such information in an electronic format. 23 8. XXXXXXXXXX agrees to make any amendment(s) to PHI in a DRS that COUNTY directs 24 or agrees to pursuant to 45 CFR § 164.526 at the request of COUNTY or an Individual, within thirty 25 (30) calendar days of receipt of said request by COUNTY. XXXXXXXXXX agrees to notify COUNTY 26 in writing no later than ten (10) calendar days after said amendment is completed. 27 9. XXXXXXXXXX agrees to make internal practices, books, and records, including P&Ps, 28 relating to the use and disclosure of PHI received from, or created or received by CONTRACTOR on 29 behalf of, COUNTY available to COUNTY and the Secretary in a time and manner as determined by 30 COUNTY or as designated by the Secretary for purposes of the Secretary determining COUNTY’s 31 compliance with the HIPAA Privacy Rule. 32 10. XXXXXXXXXX agrees to document any Disclosures of PHI COUNTY discloses to 33 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY, 34 and to make information related to such Disclosures available as would be required for COUNTY to

OBLIGATIONS AND ACTIVITIES OF CONTRACTOR AS BUSINESS ASSOCIATE. 35 2 1. XXXXXXXXXX agrees not to use or further disclose PHI COUNTY discloses to 36 3 CONTRACTOR other than as permitted or required by this Business Associate Contract or as required 37 4 by law. 1 5 2. XXXXXXXXXX agrees to use appropriate safeguards, as provided for in this Business 2 6 Associate Contract and the Agreement, to prevent use or disclosure of PHI COUNTY discloses to 3 7 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY 4 8 other than as provided for by this Business Associate Contract. 5 9 3. XXXXXXXXXX agrees to comply with the HIPAA Security Rule at Subpart C of 45 CFR 6 10 Part 164 with respect to ePHI electronic PHI COUNTY discloses to CONTRACTOR or CONTRACTOR 11 creates, 7 receives, maintains, or transmits on behalf of COUNTY. 8 12 4. XXXXXXXXXX agrees to mitigate, to the extent practicable, any harmful effect that is 9 13 known to CONTRACTOR of a Use or Disclosure of PHI by CONTRACTOR in violation of the 10 14 requirements of this Business Associate Contract. 11 15 5. CONTRACTOR agrees to report to COUNTY immediately any Use or Disclosure of PHI 12 16 not provided for by this Business Associate Contract of which CONTRACTOR becomes aware. 13 CONTRACTOR must report Breaches of Unsecured PHI in accordance with Subparagraph E. below 14 and as required by 45 CFR § 164.410. 15 6. CONTRACTOR agrees to ensure that any Subcontractors that create, receive, maintain, or 16 transmit PHI on behalf of CONTRACTOR agree to the same restrictions and conditions that apply 17 through this Business Associate Contract to CONTRACTOR with respect to such information. 18 7. CONTRACTOR agrees to provide access, within fifteen (15) calendar days of receipt of a 19 written request by COUNTY, to PHI in a DRS, to COUNTY or, as directed by COUNTY, to an 20 Individual in order to meet the requirements under 45 CFR § 164.524. If CONTRACTOR maintains an 21 EHR with PHI, and an individual requests a copy of such information in an electronic format, 22 CONTRACTOR shall provide such information in an electronic format. 23 8. XXXXXXXXXX agrees to make any amendment(s) to PHI in a DRS that COUNTY directs 24 or agrees to pursuant to 45 CFR § 164.526 at the request of COUNTY or an Individual, within thirty 25 (30) calendar days of receipt of said request by COUNTY. XXXXXXXXXX agrees to notify COUNTY 26 in writing no later than ten (10) calendar days after said amendment is completed. 27 9. XXXXXXXXXX agrees to make internal practices, books, and records, including P&Ps, 28 relating to the use and disclosure of PHI received from, or created or received by CONTRACTOR on 29 behalf of, COUNTY available to COUNTY and the Secretary in a time and manner as determined by 30 COUNTY or as designated by the Secretary for purposes of the Secretary determining COUNTY’s 31 compliance with the HIPAA Privacy Rule. 32 10. XXXXXXXXXX agrees to document any Disclosures of PHI COUNTY discloses to 33 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY, 34 and to make information related to such Disclosures available as would be required for COUNTY to

OBLIGATIONS AND ACTIVITIES OF CONTRACTOR AS BUSINESS ASSOCIATE. 35 7 1. XXXXXXXXXX CONTRACTOR agrees not to use or further disclose PHI COUNTY discloses to 36 CONTRACTOR other than as permitted or required by this Business Associate Contract or as required 37 by law. 1 9 2. XXXXXXXXXX CONTRACTOR agrees to use appropriate safeguards, as provided for in this Business 2 10 Associate Contract and the Agreement, to prevent use or disclosure of PHI COUNTY discloses to 3 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY 4 11 other than as provided for by this Business Associate Contract. 5 12 3. XXXXXXXXXX CONTRACTOR agrees to comply with the HIPAA Security Rule at Subpart C of 45 CFR 6 13 Part 164 with respect to ePHI electronic PHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, 7 receives, maintains, or transmits on behalf of COUNTY. 8 14 4. XXXXXXXXXX CONTRACTOR agrees to mitigate, to the extent practicable, any harmful effect that is 9 15 known to CONTRACTOR of a Use or Disclosure of PHI by CONTRACTOR in violation of the 10 requirements of this Business Associate Contract. 11 16 5. CONTRACTOR agrees to report to COUNTY immediately any Use or Disclosure of PHI 12 17 not provided for by this Business Associate Contract of which CONTRACTOR becomes aware. 13 18 CONTRACTOR must report Breaches of Unsecured PHI in accordance with Subparagraph E. E below 14 and as required by 45 CFR § 164.410. 15 19 6. CONTRACTOR agrees to ensure that any Subcontractors that create, receive, maintain, or 16 20 transmit PHI on behalf of CONTRACTOR agree to the same restrictions and conditions that apply 17 through this Business Associate Contract to CONTRACTOR with respect to such information. 18 7. CONTRACTOR agrees to provide access, within fifteen (15) calendar days of receipt of a 19 written request by COUNTY, to PHI in a DRS, to COUNTY or, as directed by COUNTY, to an 20 Individual in order to meet the requirements under 45 CFR § 164.524. If CONTRACTOR maintains an 21 EHR with PHI, and an individual requests a copy of such information in an electronic format, 22 CONTRACTOR shall provide such information in an electronic format. 23 8. XXXXXXXXXX agrees to make any amendment(s) to PHI in a DRS that COUNTY directs 24 or agrees to pursuant to 45 CFR § 164.526 at the request of COUNTY or an Individual, within thirty 25 (30) calendar days of receipt of said request by COUNTY. XXXXXXXXXX agrees to notify COUNTY 26 in writing no later than ten (10) calendar days after said amendment is completed. 27 9. XXXXXXXXXX agrees to make internal practices, books, and records, including P&Ps, 28 relating to the use and disclosure of PHI received from, or created or received by CONTRACTOR on 29 behalf of, COUNTY available to COUNTY and the Secretary in a time and manner as determined by 30 COUNTY or as designated by the Secretary for purposes of the Secretary determining COUNTY’s 31 compliance with the HIPAA Privacy Rule. 32 10. XXXXXXXXXX agrees to document any Disclosures of PHI COUNTY discloses to 33 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY, 34 and to make information related to such Disclosures available as would be required for COUNTY to

OBLIGATIONS AND ACTIVITIES OF CONTRACTOR AS BUSINESS ASSOCIATE. 35 6 1. XXXXXXXXXX agrees not to use or further disclose PHI COUNTY discloses to 36 7 CONTRACTOR other than as permitted or required by this Business Associate Contract or as required 37 8 by law. 1 9 2. XXXXXXXXXX agrees to use appropriate safeguards, as provided for in this Business 2 10 Associate Contract and the Agreement, to prevent use or disclosure of PHI COUNTY discloses to 3 11 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY 4 12 other than as provided for by this Business Associate Contract. 5 13 3. XXXXXXXXXX agrees to comply with the HIPAA Security Rule at Subpart C of 45 CFR 6 14 Part 164 with respect to ePHI COUNTY discloses to CONTRACTOR or CONTRACTOR creates, 7 15 receives, maintains, or transmits on behalf of COUNTY. 8 16 4. XXXXXXXXXX agrees to mitigate, to the extent practicable, any harmful effect that is 9 17 known to CONTRACTOR of a Use or Disclosure of PHI by CONTRACTOR in violation of the 10 18 requirements of this Business Associate Contract. 11 19 5. CONTRACTOR agrees to report to COUNTY immediately any Use or Disclosure of PHI 12 20 not provided for by this Business Associate Contract of which CONTRACTOR becomes aware. 13 21 CONTRACTOR must report Breaches of Unsecured PHI in accordance with Subparagraph E. below 14 and 22 as required by 45 CFR § 164.410. 15 23 6. CONTRACTOR agrees to ensure that any Subcontractors that create, receive, maintain, or 16 24 transmit PHI on behalf of CONTRACTOR agree to the same restrictions and conditions that apply 17 through 25 this Business Associate Contract to CONTRACTOR with respect to such information. 18 26 7. CONTRACTOR agrees to provide access, within fifteen (15) calendar days of receipt of a 19 27 written request by COUNTY, to PHI in a DRS, to COUNTY or, as directed by COUNTY, to an 20 Individual 28 in order to meet the requirements under 45 CFR § 164.524. If CONTRACTOR maintains an 21 EHR with 29 PHI, and an individual requests a copy of such information in an electronic format, 22 CONTRACTOR shall 30 provide such information in an electronic format. 23 31 8. XXXXXXXXXX agrees to make any amendment(s) to PHI in a DRS that COUNTY directs 24 32 or agrees to pursuant to 45 CFR § 164.526 at the request of COUNTY or an Individual, within thirty 25 (30) 33 calendar days of receipt of said request by COUNTY. XXXXXXXXXX agrees to notify COUNTY 26 in 34 writing no later than ten (10) calendar days after said amendment is completed.. 35 36 37 4 of 14 EXHIBIT B X:\ASR\SUD\ASR 16-000543 HIV TRANSITIONAL STC FY 16-17 JCG REDLINE.DOCX STR05ADKK16 27 1 9. XXXXXXXXXX agrees to make internal practices, books, and records, including P&Ps, 28 2 relating to the use and disclosure of PHI received from, or created or received by CONTRACTOR on 29 3 behalf of, COUNTY available to COUNTY and the Secretary in a time and manner as determined by 30 4 COUNTY or as designated by the Secretary for purposes of the Secretary determining COUNTY’s 31 5 compliance with the HIPAA Privacy Rule. 32 . 6 10. XXXXXXXXXX agrees to document any Disclosures of PHI COUNTY discloses to 33 7 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY, 34 8 and to make information related to such Disclosures available as would be required for COUNTY toto 9 respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 10 45 CFR § 164.528. 11 // 12 11. CONTRACTOR agrees to provide COUNTY or an Individual, as directed by COUNTY, in 13 a time and manner to be determined by COUNTY, that information collected in accordance with the 14 Agreement, in order to permit COUNTY to respond to a request by an Individual for an accounting of 15 Disclosures of PHI in accordance with 45 CFR § 164.528. 16 12. XXXXXXXXXX agrees that to the extent CONTRACTOR carries out COUNTY’s obligation 17 under the HIPAA Privacy and/or Security rules CONTRACTOR will comply with the requirements of 45 18 CFR Part 164 that apply to COUNTY in the performance of such obligation. 19 13. If CONTRACTOR receives Social Security data from COUNTY provided to COUNTY by 20 a state agency, upon request by COUNTY, CONTRACTOR shall provide COUNTY with a list of all 21 employees, subcontractors, and agents who have access to the Social Security data, including employees, 22 agents, subcontractors, and agents of its subcontractors. 23 14. CONTRACTOR will notify COUNTY if CONTRACTOR is named as a defendant 24 in a criminal proceeding for a violation of HIPAA. COUNTY may terminate the Agreement, if 25 CONTRACTOR is found guilty of a criminal violation in connection with HIPAA. COUNTY may 26 terminate the Agreement, if a finding or stipulation that CONTRACTOR has violated any standard or 27 requirement of the privacy or security provisions of HIPAA, or other security or privacy laws are made 28 in any administrative or civil proceeding in which CONTRACTOR is a party or has been joined. 29 COUNTY will consider the nature and seriousness of the violation in deciding whether or not to terminate 30 the Agreement. 31 15. CONTRACTOR shall make itself and any subcontractors, employees or agents assisting 32 CONTRACTOR in the performance of its obligations under the Agreement, available to COUNTY at no 33 cost to COUNTY to testify as witnesses, or otherwise, in the event of litigation or administrative 34 proceedings being commenced against COUNTY, its directors, officers or employees based upon claimed 35 violation of HIPAA, the HIPAA regulations or other laws relating to security and privacy, which involves 36 37 5 of 14 EXHIBIT B X:\ASR\SUD\ASR 16-000543 HIV TRANSITIONAL STC FY 16-17 JCG REDLINE.DOCX STR05ADKK16 1 inactions or actions by CONTRACTOR, except where CONTRACTOR or its subcontractor, employee, 2 or agent is a named adverse party. 3 16. The Parties acknowledge that federal and state laws relating to electronic data security and 4 privacy are rapidly evolving and that amendment of this Business Associate Contract may be required to 5 provide for procedures to ensure compliance with such developments. The Parties specifically agree to 6 take such action as is necessary to implement the standards and requirements of HIPAA, the HITECH 7 Act, the HIPAA regulations and other applicable laws relating to the security or privacy of PHI. Upon 8 COUNTY’s request, CONTRACTOR agrees to promptly enter into negotiations with COUNTY 10 with the standards and requirements of HIPAA, the HITECH Act, the HIPAA regulations or other 11 applicable laws. COUNTY may terminate the Agreement upon thirty (30) days written notice in the 12 event: 13 // 14 a. CONTRACTOR does not promptly enter into negotiations to amend this Business 15 Associate Contract when requested by COUNTY pursuant to this Subparagraph C.; or 16 b. CONTRACTOR does not enter into an amendment providing assurances regarding the 17 safeguarding of PHI that COUNTY deems are necessary to satisfy the standards and requirements of 18 HIPAA, the HITECH Act, and the HIPAA regulations. 19 17. CONTRACTOR shall work with COUNTY upon notification by CONTRACTOR to 20 COUNTY of a Breach to properly determine if any Breach exclusions exist as defined in Subparagraph 21 B.2.a. above.

OBLIGATIONS AND ACTIVITIES OF CONTRACTOR AS BUSINESS ASSOCIATE. 35 37 1. XXXXXXXXXX agrees not to use or further disclose PHI COUNTY discloses to 36 1 CONTRACTOR other than as permitted or required by this Business Associate Contract or as required 37 2 by law. 1 3 2. XXXXXXXXXX agrees to use appropriate safeguards, as provided for in this Business 2 4 Associate Contract and the Agreement, to prevent use or disclosure of PHI COUNTY discloses to 3 5 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY 4 6 other than as provided for by this Business Associate Contract. 5 7 3. XXXXXXXXXX agrees to comply with the HIPAA Security Rule at Subpart C of 45 CFR 6 8 Part 164 with respect to ePHI electronic PHI COUNTY discloses to CONTRACTOR or CONTRACTOR 9 creates, 7 receives, maintains, or transmits on behalf of COUNTY. 8 10 4. XXXXXXXXXX agrees to mitigate, to the extent practicable, any harmful effect that is 9 11 known to CONTRACTOR of a Use or Disclosure of PHI by CONTRACTOR in violation of the 10 12 requirements of this Business Associate Contract. 11 13 5. CONTRACTOR agrees to report to COUNTY immediately any Use or Disclosure of PHI 12 14 not provided for by this Business Associate Contract of which CONTRACTOR becomes aware. 13 CONTRACTOR must report Breaches of Unsecured PHI in accordance with Subparagraph E. below 14 and as required by 45 CFR § 164.410. 15 6. CONTRACTOR agrees to ensure that any Subcontractors that create, receive, maintain, or 16 transmit PHI on behalf of CONTRACTOR agree to the same restrictions and conditions that apply 17 through this Business Associate Contract to CONTRACTOR with respect to such information. 18 7. CONTRACTOR agrees to provide access, within fifteen (15) calendar days of receipt of a 19 written request by COUNTY, to PHI in a DRS, to COUNTY or, as directed by COUNTY, to an 20 Individual in order to meet the requirements under 45 CFR § 164.524. If CONTRACTOR maintains an 21 EHR with PHI, and an individual requests a copy of such information in an electronic format, 22 CONTRACTOR shall provide such information in an electronic format. 23 8. XXXXXXXXXX agrees to make any amendment(s) to PHI in a DRS that COUNTY directs 24 or agrees to pursuant to 45 CFR § 164.526 at the request of COUNTY or an Individual, within thirty 25 (30) calendar days of receipt of said request by COUNTY. XXXXXXXXXX agrees to notify COUNTY 26 in writing no later than ten (10) calendar days after said amendment is completed. 27 9. XXXXXXXXXX agrees to make internal practices, books, and records, including P&Ps, 28 relating to the use and disclosure of PHI received from, or created or received by CONTRACTOR on 29 behalf of, COUNTY available to COUNTY and the Secretary in a time and manner as determined by 30 COUNTY or as designated by the Secretary for purposes of the Secretary determining COUNTY’s 31 compliance with the HIPAA Privacy Rule. 32 10. XXXXXXXXXX agrees to document any Disclosures of PHI COUNTY discloses to 33 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY, 34 and to make information related to such Disclosures available as would be required for COUNTY to

OBLIGATIONS AND ACTIVITIES OF CONTRACTOR AS BUSINESS ASSOCIATE. 35 1 1. XXXXXXXXXX agrees not to use or further disclose PHI COUNTY discloses to 36 2 CONTRACTOR other than as permitted or required by this Business Associate Contract or as required 37 by 3 law. 1 5 2. XXXXXXXXXX agrees to use appropriate safeguards, as provided for in this Business 2 6 Associate Contract and the AgreementContract, to prevent use or disclosure of PHI COUNTY discloses to 3 7 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY 4 8 other than as provided for by this Business Associate Contract. 5 9 3. XXXXXXXXXX agrees to comply with the HIPAA Security Rule at Subpart C of 45 CFR 6 10 Part 164 with respect to ePHI electronic PHI COUNTY discloses to CONTRACTOR or CONTRACTOR 11 creates, 7 receives, maintains, or transmits on behalf of COUNTY. 8 12 4. XXXXXXXXXX CONTRACTOR agrees to mitigate, to the extent practicable, any harmful effect that is 9 known 13 to CONTRACTOR of a Use or Disclosure of PHI by CONTRACTOR in violation of the 10 requirements of 14 this Business Associate Contract. 11 15 5. CONTRACTOR XXXXXXXXXX agrees to report to COUNTY immediately any Use or Disclosure of PHI 12 not 16 provided for by this Business Associate Contract of which CONTRACTOR XXXXXXXXXX becomes aware. 13 CONTRACTOR must report Breaches of Unsecured PHI in accordance with Subparagraph E. below 14 and as required by 45 CFR § 164.410. 15 6. CONTRACTOR agrees to ensure that any Subcontractors that create, receive, maintain, or 16 transmit PHI on behalf of CONTRACTOR agree to the same restrictions and conditions that apply 17 through this Business Associate Contract to CONTRACTOR with respect to such information. 18 7. CONTRACTOR agrees to provide access, within fifteen (15) calendar days of receipt of a 19 written request by COUNTY, to PHI in a DRS, to COUNTY or, as directed by COUNTY, to an 20 Individual in order to meet the requirements under 45 CFR § 164.524. If CONTRACTOR maintains an 21 EHR with PHI, and an individual requests a copy of such information in an electronic format, 22 CONTRACTOR shall provide such information in an electronic format. 23 8. XXXXXXXXXX agrees to make any amendment(s) to PHI in a DRS that COUNTY directs 24 or agrees to pursuant to 45 CFR § 164.526 at the request of COUNTY or an Individual, within thirty 25 (30) calendar days of receipt of said request by COUNTY. XXXXXXXXXX agrees to notify COUNTY 26 in writing no later than ten (10) calendar days after said amendment is completed. 27 9. XXXXXXXXXX agrees to make internal practices, books, and records, including P&Ps, 28 relating to the use and disclosure of PHI received from, or created or received by CONTRACTOR on 29 behalf of, COUNTY available to COUNTY and the Secretary in a time and manner as determined by 30 COUNTY or as designated by the Secretary for purposes of the Secretary determining COUNTY’s 31 compliance with the HIPAA Privacy Rule. 32 10. XXXXXXXXXX agrees to document any Disclosures of PHI COUNTY discloses to 33 CONTRACTOR or CONTRACTOR creates, receives, maintains, or transmits on behalf of COUNTY, 34 and to make information related to such Disclosures available as would be required for COUNTY to