Business Associate Agreement - (rev. 10-2019) - HIPAA Business Associate Obligations

Sep 16, 2026

Business Associate Agreement establishing legal terms between a Contractor and the County of Orange to ensure compliance with HIPAA. It supplements an Underlying Agreement and defines key HIPAA terms, including Business Associate and Covered Entity roles. The agreement sets obligations for permitted uses and disclosures, safeguarding electronic protected health information, timely reporting of improper access, use, or disclosure, subcontractor requirements, and responsibilities for access, amendments, and accounting related to protected health information.

LanguageEnglish

CategoryForms

FormatPDF

Pages5

Reading Time2 min

AccessFree to download

Background

Incorporation and Definitions

Obligations and Activities of Business Associates

Permitted Uses and Disclosures

Safeguards and Reporting

Access, Amendment, and Accounting

(rev. 10-2019) BUSINESS ASSOCIATE AGREEMENT THIS BUSINESS ASSOCIATE AGREEMENT (“Agreement”) is made as of , 2025, by and between (“Contractor”) and the County of Orange (“County”) (collectively, the “Parties”) . BACKGROUND The County and Contractor are parties to an agreement pursuant to which Contractor has agreed to perform certain services (“Services”) for or on behalf of the County, which Services may involve the use or disclosure of certain protected health information that is subject to protection under the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), as amended by the security provisions of the American Recovery and Reinvestment Act of 2009 (also known as the Health Information Technology for Economic and Clinical Health Act, or the “HITECH Act,” as each may be further amended from time to time) (“HIPAA”), and their implementing regulations, 45 CFR Parts 160, 162, and 164 (collectively,“HIPAA Rules”) . This Agreement supplements the Underlying Agreement and is intended to satisfy the requirements for business associates agreements as set forth in the HIPAA Rules, which requires that the County, as a covered entity, receives adequate assurances that Contractor, as a business associate, will comply with certain obligations with respect to the protected health information received in the course of providing Services to or on behalf of the County and that prohibit the disclosure to or use of protected health information by Contractor if such an agreement is not in place. In consideration of the mutual promises and covenants herein, and for other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties agree as follows: 1. INCORPORATION. The background information set forth above is true and correct and is hereby incorporated into this Agreement as if set forth at length here. 2. DEFINITIONS. a. General Definitions. The following terms used, but not otherwise defined in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Electronic Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use. Otherwise, to the extent terms are not defined herein, they shall be given their plain and ordinary meaning. b. Specific Definitions. i. Business Associate. “Business Associate” shall generally have the same meaning as the term“business associate” at 45 CFR 160.103, and in reference to this Agreement the Contractor is the Business Associate. ii. Covered Entity. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to this Agreement the County is the Covered Entity. (rev. 10-2019) iii. Underlying Agreement. “Underlying Agreement” shall mean that certain Consultant Services Agreement, effective , 2025, by and between the Parties, including any and all subsequent amendments thereto. 3. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATES. Business Associate agrees to comply with the provisions applicable to “business associates” imposed by HIPAA Rules, includingthe following: a. Permitted Uses and Disclosures. Business Associate shall not Use or Disclose Protected Health Information other than as permitted or required by this Agreement or as Required by Law. b. Appropriate Safeguards. Business Associate shall use appropriate safeguards and comply with Subpart C of 45 CFR Part 164, with respect to Electronic Protected Health Information, to prevent Use or Disclosure of the Protected Health Information other than as provided for by this Agreement. c. Reporting of Improper Access, Use, or Disclosure. Business Associate shall report in writing to Covered Entity any Use or Disclo

FAQs

What is the purpose of this Business Associate Agreement?

It supplements the Underlying Agreement to satisfy HIPAA business associate requirements, including protections for protected health information used or disclosed while providing services for the County.

What are the Business Associate’s main obligations under HIPAA?

The Business Associate must limit uses and disclosures to what is permitted or required, apply appropriate safeguards for electronic protected health information, and report improper access, use, or disclosure and security incidents within required timeframes.

How are subcontractors handled in this agreement?

The Business Associate must ensure subcontractors that create, receive, maintain, or transmit protected health information agree to the same restrictions and requirements that apply to the Business Associate.

Sep 16, 2026

Uploaded by River Wang