Laserfiche WebLink
A TRUE COPY <br />CERTIFICATION ON LAST PAGE <br />RYAN L. BUTLER, CLERK <br />EXHIBIT B <br />BUSINESS ASSOCIATE AGREEMENT <br />THIS BUSINESS ASSOCIATE AGREEMENT (this "Agreement"), by and between Indian River County <br />Board of County Commissioners's Health Plan (the "Plan") and Indian River County Board of County Commisdoners (the <br />"Company") (the Plan and the Company are collectively referred to herein as the "Company"), and RzBenefits, Inc., on <br />behalf of itself and its subsidiaries (the "Business Associate"), is effective as of October 1, 2024. <br />RECITALS <br />WHEREAS, ,Company and the Business Associate are parties to an Administrative Services Agreement dated <br />October 1, 2024 (the "Underlying Agreement") under which the Business Associate provides the Services (as defined in the <br />Underlying Agreement) to Company with respect to the Plan; <br />WHEREAS, in order to perform the Services set forth in the Underlying Agreement, Company may disclose to <br />the Business Associate certain Protected Health Information ("PHI") and Electronic Protected Health Information subject to <br />the Privacy Regulations and the Security Regulations, promulgated by the United States Department of Health and Human <br />Services ("HHS") under the Health Insurance Portability and Accountability Act of 1996 (the "Regulations"), may be <br />transmitted, created, received, and/or maintained; <br />WHEREAS, Company is a "Covered Entity" and the Business Associate is a "Business Associate" under the <br />Regulations and are required to protect the privacy and provide for the security of PHI disclosed by Company to the Business <br />Associate and to satisfy certain requirements in compliance with the Regulations; <br />WHEREAS, to the extent required by the Regulations, the Business Associate and the Company desire to comply <br />with the "Business Associate" requirements of the Regulations and to memorialize their agreements with respect to such <br />compliance; and <br />WHEREAS, Company and Business Associate agree that, to the extent that Company has disclosed PHI to <br />Business Associate prior to this Agreement's Effective Date, such PHI shall be subject to all terms of this Agreement. <br />AGREEMENT <br />NOW, THEREFORE, for and in consideration of the mutual covenants and conditions set forth herein, and other <br />good and valuable consideration, the receipt and adequacy of which hereby are acknowledged, the Business Associate and <br />the Company agree as follows: <br />1. Definitions. Unless otherwise defined herein, capitalized terms shall have the same meanings as set forth <br />in the Regulations. <br />2. Restrictions on Use and Disclosure of PHI. The Business Associate may Use and Disclose PHI as <br />permitted or required by this Agreement, as necessary to perform the Services in the Underlying Agreement, or as Required <br />By Law. The Business Associate shall make reasonable efforts to limit PHI that is subject to this Agreement to the minimum <br />amount that is necessary to accomplish the intended purpose of a required or permitted Use or Disclosure under this <br />Agreement. The Business Associate shall not Use or Disclose PHI received from the Company or any participant in the Plan <br />in any manner that would constitute a violation of the Regulations if the Company made the same Use or Disclosure, except <br />that the Business Associate may Use or Disclose such PHI for the Business Associate's er management and <br />administration and legal responsibilities, provided that the Uses and Disclosures are Required -A—aw; or the Business <br />Associate obtains reasonable assurances from the person to whom the PHI is Disclosed that it will be held confidentially and <br />Used or further Disclosed only as Required By Law or for the purpose for which it was Disclosed to the person, and the <br />person agrees to notify the Business Associate of any instances of which it is aware in which the confidentiality of the PHI <br />has been breached. <br />3. Data Aggregation: De -identification. The Business Associate may use PHI received from the Company, <br />or created or received by Business Associate on behalf of the Company, to provide Data Aggregation services for the health <br />care operations of the Company as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B). Further, the Business Associate may de - <br />identify such PHI in accordance with 45 C.F.R. § 164.514. Company hereby grants to the Business Associate a non - <br />1 <br />NOT FOR DISTRIBUTION. THE INFORMATION CONTAINED HEREIN IS CONFIDENTIAL, PROPRIETARY AND <br />CONSTITUTES TRADE SECRETS OF ESI AND RXBENEFITS <br />