08/30/2019 Agreement County of Oar®e covio,'fs�s : BOARD OF COUNTY COMMISSIONERS
l• ' �tY Mayor Sylvia J.Murphy,District 5
The Florida Keys Mayor Pro Tem Danny L. Kolhage,District 1
Michelle Coldiron, District 2
': Heather Carruthers,District 3
a,mom David Rice,District 4
Monroe County
Board of County Commissioners
Office of the County Administrator
The Historic Gato Cigar Factory
1100 Simonton Street, Suite 205
Key West,FL 33040
(305)292-4441 —Phone
(305)292-4544-Fax
MEMORANDUM
TO: Pam Hancock, Deputy ut Clerk
FROM: Lindsey Ballard, Aide to County Administrator
DATE: September 4, 2019
SUBJECT: Small Contracts
Small contracts for your records only.
Enclosures:
Smarsh— 1 copy
Health Designs,Inc 1 copy
Health Designs, Inc— 1 copy
ATTACHMENT D.6
COUNTY ADMINISTRATOR
CONTRACT SUMMARY FORM FOR CONTRACTS LESS THAN $50,000.00
Contract with: Health Beiiittsittic, Contract#
Effective Date: Upon execution
Expiration Date: See Agreement
Contract Purpose/Description:
Business Associate Agreement between Health Designs, Inc. and Monroe County BOCC, for handling
PHI/biometric screening at annual employee health and wellness events.
BContract is Contract Am- 1 s u- • .J . -n inn Renewal
Contract Manager: Bryan Cook 4458 Employee Services/Stop#1
(Name) xt. (Department/Stop#)
CONTRACT COSTS
Total Dollar Value of Contract: Zero Current Year Portion: $ Zero
(must be less than$50,000) Billable services (If multiyear agreement then Billable services
processed on requires BOCC approval,unless the processed on
separate contract. total cumulative amount is less than separate contract.
$50,000.00).
Budgeted? YesFR No Account Codes:502-08005-530490
Grant: $ - - - -
County Match: $,_ - - - -
ADDITIONAL COSTS
Estimated Ongoing Costs: $ N/A /yr For:
(Not included in dollar value above) (e.g. maintenance,utilities,janitorial, salaries,etc.)
CONTRACT REVIEW
Changes Date Out
Rite In Needed viewer
Department Head 177/11 YesE NoZ �yl
Risk Management ()O►7.Idi Yes❑ No ]
County Attorney S-a--4-'aO Tesn No074/ j' — -o7619
OMB %f1' /iq Yes❑ NoYb)(064111 / f,q
Comments:
Page 70 of 73
Business Associate Agreement
This BUSINESS ASSOCIATE AGREEMENT(the"Agreement") is entered into by and between Monroe County Board of
County Commissioners (hereinafter the"Group Health Plan"), and Health Designs, Inc., a Florida corporation, located at 35
Executive Way, Suite 110, Ponte Vedra Beach, FL 32082 (hereinafter the"Business Associate), as of the latest of the
execution dates set forth below in Section VII.
I. General Provisions
A. Purpose. Business Associate has been retained by Group Health Plan to perform certain plan-related functions,
activities, or services(collectively, "Services")on behalf of its Group Health Plan that is part of the Plan Sponsors
organized Health Care Arrangement.
These Services are identified in the Wellness Services& Fee Agreement between the parties ("Services Agreement").
The terms and provisions of this Agreement are incorporated in and shall supersede any conflicting or inconsistent
terms and provisions of any other agreement, including without limitation the Services Agreement,to which Business
Associate and Group Health Plan are parties, including all exhibits or other attachments thereto and all documents
incorporated therein by reference.
This Agreement is intended to ensure that the Business Associate will establish and implement appropriate privacy and
security safeguards with respect to"Protected Health Information"(as defined below)that the Business Associate may
create, receive, use, or disclose in connection with the Services to be provided by Business Associate to Group Health
Plan or Plan Sponsor, consistent with the standards set forth in regulations and administrative guidance with respect to
the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 ("HIPAA"), including as amended
by the Health Information Technology for Economic and Clinical Health Act as set forth in Title XIII of Division A and
Title IV of Division B of the American Recovery and Reinvestment Act of 2009 ("HITECH Act").
B. Effective Date. The provisions of this Agreement shall take effect upon execution.
C. Definitions. Capitalized terms used, but not otherwise defined, in this Agreement shall have the same meaning as
those terms in the HIPAA Privacy and Security Rules. Other defined terms include:
1. "Breach"shall have the meaning given such term in 45 C.F.R. §164.402.
2. "Designated Record Set"shall have the meaning given such term in 45 C.F.R. §164.501.
3. "Electronic Protected Health Information"shall have the same meaning as the term"electronic protected health
information" in 45 C.F.R. §160.103.
4. "Individual"shall have the same meaning given such term under 45 C.F.R. §160.103, and shall include a
person who qualifies as a personal representative in accordance with 45 C.F.R. §164.502(g).
5. "Privacy Rules"shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R.
Part 160 and Part 164, subparts A and E.
6. "Protected Health Information" (or"PHI")shall have the meaning given to such term in 45 C.F.R.§160.103,
limited to the information created or received by Business Associate from or on behalf of Group Health Plan.
7. "Required By Lain'shall have the same meaning given to such term in 45 C.F.R. §164.103.
Page 1 of 9
8. "Secretary"shall mean the Secretary of the United States Department of Health and Human Services("HHS")
or his designee.
9. "Security Incident"shall have the same meaning given to such term in 45 C.F.R. §164.304.
10. Health Information at 45 C.F.R. Part 160 and Part 164, subpart C.
11. "Unsecured Protected Health Information"shall have the same meaning given to such term in 45 C.F.R.
§164.402.
12. "Security Rules"means final regulations issued by the Secretary governing the security of electronic PHI by
covered entities contained in 45 C.F.R. parts 160, 162 and 164.
II. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE
A. Scope of Use and Disclosure of Protected Health Information. Business Associate agrees to not use or further
disclose PHI other than as permitted or required by this Agreement or as Required By Law.
B. Safeguard Against Misuse of Information. Business Associate agrees to use appropriate safeguards to prevent use
or disclosure of the PHI other than as provided for by this Agreement. Furthermore, Business Associate will implement
administrative, physical, and technical safeguards(including written policies and procedures)that reasonably and
appropriately protect the confidentiality, integrity, and availability of Electronic Protected Health Information that it
creates, receives, maintains, or transmits on behalf of the Group Health Plan as required by the Security Rules. To the
extent practicable, Business Associate will secure all Protected Health Information by technological means that render
such information unusable, unreadable, or indecipherable to unauthorized individuals and in accordance with any
applicable guidance issued by the Department of Health and Human Services under Section 13402 of the HITECH Act.
C. Duty to Mitigate. Business Associate agrees to cure or mitigate,to the extent practicable, any harmful effect that is
known to Business Associate of a use or disclosure of PHI by Business Associate or its agents or subcontractors in
violation of the requirements of this Agreement.
D. Reporting of Violations. Business Associate agrees to notify the Group Health Plan, in writing, of any use or
disclosure of the PHI not provided for by this Agreement, any Security Incident, and any Breach of Group Health Plan's
Unsecured Protected Health Information. This notification will be made within thirty(30) business days after the
discovery of the use, disclosure, Security Incident, or Breach. In the event of a Breach, if a delay is requested by law
enforcement under 45 C.F.R. §164.412, Business Associate may delay notifying the Group Health Plan for the
applicable timeframe. This notification will include, to the extent possible,the identification of each individual whose
Unsecured Protected Health Information has been, or is reasonably believed by the Business Associate to have been,
accessed, acquired used or disclosed during the Breach. Business Associate will also provide the Group Health Plan
with any other available information that the Group Health Plan is required to include in its notification to the individual
under C.F.R. §164.404(c)at the time of the initial notification or promptly thereafter as the information becomes
available.
E. Use or Disclosure to Subcontractors. Business Associate shall ensure that any subcontractor or agent to whom it
provides PHI received from, or created or received by Business Associate on behalf of, Group Health Plan agrees to
implement reasonable and appropriate safeguards to protect the Group Health Plan's PHI. In turn, Business Associate
agrees to ensure that any such subcontractor or agent agrees, in writing, to the same restrictions and conditions that
apply through this Agreement to Business Associate with respect to such information. Business Associate shall
provide copies of such agreements to Plan Sponsor upon request.
F. Access,Amendment, and Accounting Responsibilities. In a mutually agreeable time and manner,the Business
Associate agrees to provide access to the PHI that it maintains in Designated Record Sets to the Group Health Plan,or
Page 2 of 9
to the Individual to whom the PHI relates in accordance with 45 C.F.R. §164.524. Business Associate shall have the
right to charge the Individual a reasonable, cost-based fee, as permitted by 45 C.F.R. §164.524. The Business
Associate further agrees to document any disclosures of PHI if requested by the Group Health Plan in accordance with
45 C.F.R. §164.528, and to provide such documentation to the Group Health Plan as it may request from time to time.
Furthermore, at the request of the Group Health Plan,the Business Associate agrees to make amendments to PHI that
it maintains in a Designated Record Set as directed by the Group Health Plan and to incorporate any amendments to
PHI in accordance with 45 C.F.R. §164.526. Business Associate assumes no obligation to coordinate the provision of
PHI maintained by other business associates of the Group Health Plan. Notwithstanding the foregoing,the Group
Health Plan will not request that the Business Associate use or disclose PHI in any manner that would not be
permissible under the Privacy rule if such disclosure or use were done by the Group Health Plan itself.
G. Electronic Data Interchange. Inasmuch as Business Associate transmits or receives Transactions(as that term is
defined in 45 C.F.R. §160.103)on behalf of Group Health Plan, Business Associate shall comply with any applicable
provisions of the Electronic Data Interchange Requirement(as set forth in 45 C.F.R. parts 160 and 162)and shall
ensure that any subcontractors or agents that assist Business Associate in conducting Transactions on behalf of Group
Health Plan agree in writing to comply with the Electronic Data Interchange Requirements.
H. Availability of Books and Records. For purposes of the Secretary determining the Group Health Plan's compliance
with the Privacy Rules, Business Associate agrees to make internal practices, books, and records, including policies
and procedures and PHI relating to the use and disclosure of PHI received from, or created or received by the
Business Associate on behalf of the Group Health Plan available(i)to the Group Health Plan in a mutually agreeable
time and manner, or(ii)to the Secretary in the manner designated by the Secretary.
I. HITECH Act Business Associate Agreement Requirements. The parties intended for this Agreement to satisfy the
requirements of sections 13401 (a) and 13404(a) of the HITECH Act that specified security and privacy provisions
requirements be incorporated into business associate agreements. This Agreement shall be interpreted in a manner
consistent with this intention.
III. OBLIGATIONS AND ACTIVITIES OF GROUP HEALTH PLAN
A. Obligations of Group Health Plan. Group Health Plan shall inform Business Associate with respect to the following
privacy practices and restriction:
1. Group Health Plan shall provide Business Associate with a copy of the notice of privacy practices that Group
Health Plan approves/produces and has distributed in accordance with 45 C.F.R. §164.520, as well as any
changes to such notice. Furthermore,Group Health Plan shall specifically notify Business Associate of any
limitation(s) in its notice of privacy practices to the extent that such limitation(s) may affect Business Associate's
use or disclosure of PHI.
2. Group Health Plan shall provide Business Associate with any changes in,or revocation of, permission by
Individual to use or disclose PHI, if such changes affect Business Associate's permitted or required uses or
disclosures as set forth in this Agreement or the Services Agreement.
3. Group Health Plan shall notify Business Associate within five(5) business days of any restriction to the use or
disclosure of PHI requested by an Individual in accordance with 45 C.F.R. §164.522, to the extent that such
restriction may affect Business Associate's use or disclosure of PHI. In turn, due to the wide variety of services
and clients of Business Associate, Business Associate has limited capacity to comply with special privacy
restrictions requested by Individuals. Accordingly, Group Health Plan agrees that it will only accommodate such
requests to the extent required by 45 C.F.R. §164.522(b)(1)(ii).
Page 3 of 9
4. Group Health Plan shall notify Business Associate in advance of the time and manner in which Business
Associate must comply with requests by Group Health Plan with respect to any of the obligations and activities of
Business Associate set forth above in Section II, and in all events such times and manners shall be reasonable.
5. The parties acknowledge and agree that the Privacy Rules allow Group Health Plan to permit Business Associate
to disclose or provide access to PHI to Plan Sponsor only after Plan Sponsor has amended its plan documents to
provide for the permitted and required uses and disclosures of PHI and to require Plan Sponsor to provide a
certification to Group Health Plan that certain required provisions have been incorporated into Group Health
Plan's plan documentation before Group Health Plan may disclose, either directly or through a business associate
any PHI to Plan Sponsor. Group Health Plan hereby warrants and represents that Group Health Plan's plan
documentation has been or will be amended and that Group Health Plan has or will have received such
certification from Plan Sponsor no later than the Effective Date of this Agreement.
6. Business Associate acknowledges and agrees that the Privacy Rules allow Group Health Plan to permit Business
Associate to disclose or provide access to PHI to only those employees or other persons(including third parties)
under the control of Plan Sponsor who are described by name or position in Group Health Plan's plan
documentation as the persons who are given access to PHI solely to carry out plan administration functions that
Plan Sponsor performs for Group Health Plan. Accordingly, notwithstanding any other terms and conditions of
this Agreement, to the extent that the fulfillment of its obligations under this Agreement requires Business
Associate to disclose or provide access to PHI to Plan Sponsor or any employees or other persons(including
third parties) under the control of Plan Sponsor, Business Associate shall make such disclosure of or provide
such access to PHI on as follows:
a) Business Associate shall disclose or make available PHI at the direction or Group Health Plan to only the
following employees or other persons(including third parties) identified in Group Health Plan's plan
documentation and under the control of Plan Sponsor solely for the purpose of carrying out the plan
administration functions that Plan Sponsor performs for Group Health Plan (list each person by position):
Benefits Manager
Benefits Manager Designee
Claims Processors
Group Health Plan agrees to promptly notify Business Associate in writing of changes to the above list.
Business Associate is authorized to rely on the information provided by Group Health Plan.
b) It is acknowledged and agreed that the Privacy Rules require Group Health Plan to maintain policies and
procedures to ensure that any PHI that it uses, requests, or discloses be no more that the minimum necessary
to accomplish the intended purposes. Group Health Plan hereby warrants and represents that any requests
for Plan Sponsor will be for no more than the minimum amount necessary for the intended purpose.
c) Business Associate shall provide PHI to other business associates who assist in administering Group Health
Plan and are authorized by Group Health Plan to receive such information for the purpose of facilitating plan
administration. Such parties may include, but are not limited to, consultants, brokers, auditors, successor
administrators or insurers, and stop-loss carriers. Group Health Plan shall enter into and maintain a written
agreement with each agent and subcontractor or other third party to which it directs Business Associate to
disclose PHI under which such agent, subcontractor,or other third party is legally bound by the same
restrictions with respect to PHI that apply to Business Associate pursuant to this Agreement.
B. Permissible Requests by Group Health Plan. Group Health Plan shall not request Business Associate to
use, disclose, or handle PHI in any manner that would not be permissible under the Privacy and Security
Rules if done by the Group Health Plan, except for the data aggregation or management and administrative
activities of the Business Associate.
Page 4 of 9
IV. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE
A. General Use and Disclosure Provisions. Except as otherwise limited in this Agreement, Business Associate
may use or disclose PHI to perform functions, activities, or services for,or on behalf of, Group Health Plan or
Plan Sponsor as specified in this Agreement, provided that such use or disclosure would not violate the
Privacy and Security Rules if done by Group Health Plan, or the minimum necessary policies and procedures
of the Group Health Plan.
B. Specific Use and Disclosure Provisions.
1. Business Associate will make reasonable efforts to use, disclose, and to request only the minimum amount
of the Group Health Plan's PHI necessary to accomplish the intended purpose of the use, disclosure or
request, except that Business Associate will not be required to comply with this minimum necessary
limitation if neither Business Associate nor the Group Health Plan is required to limit its use, disclosure or
request to the minimum necessary. Business Associate and the Group Health Plan acknowledge that the
phrase"minimum necessary"shall be interpreted in accordance with the HITECH Act.
2. Except as otherwise limited in this Agreement or in the Services Agreement, specific examples of permitted
use or disclosure of PHI by Business Associate on behalf of, or to provide Services to, Group Health Plan
and Plan Sponsors may include, but are not limited to:
a) To enroll or disenroll participants and beneficiaries in and/or confirm or not confirm enrollment(as
determined by the plan administrator of Group Health Plan)of participants and beneficiaries for
coverage under Group Health Plan. (Note that only enrollment/disenrollment information may be used
by Business Associate to provide these services to Plan Sponsor unless Plan Sponsor satisfies its
obligations under Section II.A.6).
b) To assist Plan Sponsor with respect to certain specific plan administration functions, such as claims
processing, quality assurance, auditing of the Group Health Plan, medical review, precertification, and
coordination with carve-out health plans(such as vision and dental). For purposes of this section,
claims processing shall include investigating, auditing, and otherwise administering and facilitating the
payment of Group Health Plan claims from the payers of such claims (including, but not limited to,
providing assistance to participants and beneficiaries,the coordination or benefits, determination of
cost sharing amounts, and subrogation of health benefit claims), and obtaining payment on behalf of
Plan Sponsor under a contract for stop-loss or reinsurance being utilized with respect to Group Health
Plan. (Note that Plan Sponsor must satisfy its obligations under Section III.A.6 before Business
Associate can provide these services to Plan Sponsor.)
c) To assist Group Health Plan and Plan Sponsor with respect to activities relating to the creation,
modification, termination, renewal, or replacement of a contract of health insurance or health benefits,
and the ceding, securing,or placing of a contract for stop-loss or reinsurance of risk relating to health
care claims. (Note that Summary Health Information may be used to provide these services,even if
Plan Sponsor has not satisfied its obligations under Section III.A.6.)
Page 5 of 9
3. Business Associate may use PHI to report violations of law to appropriate Federal and State authorities,
consistent with 45 C.F.R. §164.502(j)(1).
4. Except as otherwise limited in this Agreement, Business Associate may use PHI for the proper
management and administration of Business Associate or to carry out any present or future legal
responsibilities of the Business Associate.
5. Except as otherwise limited in this Agreement, Business Associate may use PHI to provide Data
Aggregation services to Group Health Plan as permitted by 42 C.F.R. §164.504(e)(2)(i)(B).
C. Applicability. This Agreement applies with respect to any aspect of the Services Agreement that involves the
use or disclosure of PHI but only to the extent that the services or transactions of Business Associate are not
exempt from HIPAA pursuant to 1179 of the Social Security Act(42 U.S.C. §1320d-8).
V. TERM AND TERMINATION
A. Term. The term of this Agreement shall commence as of the Effective Date set forth above in Section I.B.,
and shall terminate when all of the PHI provided by Group Health Plan Entity to Business Associate, or created
or received by Business Associate on behalf of Group Health Plan, is destroyed or returned to Group Health
Plan, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance
with the termination provisions of this Section.
B. Termination for Cause. Upon Group Health Plan's knowledge of a material breach by Business Associate,
Group Health Plan (or, Plan Sponsor,on behalf of Group Health Plan)shall either:
1. Provide an opportunity for Business Associate to cure the breach or end the violation and terminate this
Agreement and the Services Agreement if Business Associate does not cure the breach or end the violation
within the time specified by Group Health Plan or Plan Sponsor;
2. Immediately terminate this Agreement and the Services Agreement if Business Associate has breached a
material term of this Agreement and cure is not possible; or
3. If neither termination nor cure is feasible, Group Health Plan or Plan Sponsor shall report the violation to
the Secretary.
C. Effect of Termination. Upon termination of the Agreement,for any reason, Business Associate shall return
all PHI received from Group Health Plan, or created or received by Business Associate on behalf of Group
Health Plan. This provision shall apply to PHI that is in the possession of subcontractors or agents of
Business Associate. Business Associate shall retain copies of the PHI. If Business Associate has determined
that destroying the PHI is infeasible, it shall provide Group Health Plan an explanation of the conditions that
make destruction infeasible. If Group Health Plan and Business Associate mutually agree that destruction of
the PHI is infeasible, Business Associate shall extend the protections of this Agreement to such PHI and limit
further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for
so long as Business Associate maintains such PHI.
VI. MISCELLANEOUS
Page 6 of 9
A. Regulatory References. A reference in this Agreement to a section in the Privacy and Security Rules
means the section as in effect or as amended and for which compliance is required.
B. Governing Law. This Agreement shall be construed and enforced according to HIPAA, and any applicable
state law to the extent not preempted by HIPAA or other federal law.
C. Complete Integration. This Agreement constitutes the entire agreement between the parties and
supersedes all prior negotiations, discussions, representations, or proposals, whether oral or written, unless
expressly incorporated herein, related to the subject matter of the Agreement. Unless expressly provided
otherwise herein,this Agreement may not be modified unless in writing signed by the duly authorized
representatives of both parties. If any provision or part thereof is found to be invalid, the remaining provisions
shall remain in full force and effect.
D. Amendment. The parties agree to take such action as is necessary to amend this Agreement from time to
time as is necessary for Group Health Plan and Plan Sponsor to comply with the requirements of the Privacy
and Security Rules, the Health Insurance Portability and Accountability Act, Public Law 104-191, and the
HITECH Act.
E. Interpretation. The parties hereto acknowledge and agree that both (i)the rule of construction to the effect
that any ambiguities are resolved against the drafting party, and (ii)the terms and provisions of this
Agreement, will be construed fairly as to all parties hereto an not in favor of or against a party, regardless of
which party was generally responsible for the preparation of this Agreement. Moreover, any ambiguity in this
Agreement shall be resolved in favor of a meaning that permits Group Health Plan to comply with the Privacy
and Security Rules. In the event of an inconsistency between the provisions of this Agreement and the
Privacy and Security Rules, as may be amended from time to time, because of interpretations by HHS, a court,
or another regulatory agency with authority over the Parties,the interpretation of HHS, such other court or
regulatory agency shall prevail. In the event provisions of this Agreement differ from those mandated by the
Privacy and Security Rules but are nonetheless permitted by such rules, the provisions of this Agreement shall
control.
F. Severability. The parties intend this Agreement to be enforced as written. However, (i) if any portion or
provision of this Agreement will to any extent be declared illegal or unenforceable by a duly authorized court
having jurisdiction,then the remainder of this Agreement, or the application of such portion or provision in
circumstances other than those as to which it is so declared illegal or unenforceable, will not affected thereby,
and each portion and provision or this Agreement will be valid and enforceable to the fullest extent permitted
by law; and (ii) if any provision, or part thereof, is held to be unenforceable because of the duration or such
provision, the Group Health Plan and the Business Associate agree that the court making such determination
will have the power to reduce the duration of such provision,and/or to delete specific words and phrases, and
in its reduced form such prevision will then be enforceable and will be enforced.
G. Successors and Assigns. This Agreement will inure to the benefit of and be binding upon the successors
and assigns of Group Health Plan and Business Associate. However,this Agreement is not assignable by
either party without the prior written consent of the other party, except that Business Associate may assign or
transfer this Agreement to any entity owned or under common control with Business Associate.
Page 7 of 9
H. No Third Party Beneficiaries. Business Associate and Group Health Plan agree that nothing express or
implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than
Business Associate, Group Health Plan, and Plan Sponsor, and their respective successors or assigns, any
rights, remedies, or obligations or liabilities whatsoever.
I. Headings and Captions. The headings and captions of the various subdivisions of this Agreement are for
convenience of reference only and will in no way modify, or affect the meaning or construction of any of the
terms or provisions thereof.
J. No Waiver of Rights, Powers, and Remedies. No failure or delay by a party hereto in exercising any right,
power or remedy under this Agreement, and no course of dealing between the parties hereto, will operate as a
waiver of any such right, power or remedy of the party. No single or partial exercise of any right, power or
remedy under this Agreement by a party hereto, nor any abandonment or discontinuance of steps to enforce
any such right, power or remedy, will preclude such party from any other or further exercise thereof or the
exercise of any other right, power or remedy hereunder. The election of any remedy by a party hereto will not
constitute a waiver of the right of such party to pursue other available remedies. No notice to or demand on a
party not expressly required under this Agreement will entitle the party receiving such notice or demand to any
other or further notice or demand in similar or other circumstances or constitute a waiver of the rights of the
party giving such notice or demand in similar or other circumstances or constitute a waiver of the rights of the
party giving such notice or demand to any other or further action in any circumstances without such notice or
demand. The terms and provisions of this Agreement may be waived, or consent for the departure there from
granted, only by written document executed by the party entitled to the constitute a waiver or consent with
respect to any other terms or provisions of this Agreement, whether or not similar. Each such waiver or
constitute a continuing waiver or consent.
K. Indemnification. Business Associate shall indemnify and hold harmless Group Health Plan from and
against any and all loss, damage, or expense(including claims of damage or liability) asserted against Group
Health Plan by third parties and arising out of(i)the use or disclosure of PHI by Business Associate or its
agents or subcontractors other than as provided in this Agreement, or(ii) a breach of Business Associate's
representations contained in this Agreement. To the extent allowed by Section 768.28, Florida Statutes,
Group Health Plan shall indemnify and hold harmless Business Associate from and against any and all loss,
damage, or expense (including claims of damage or liability) asserted against Business Associate by third
parties and arising out of(i)the use or disclosure of PHI by Group Health Plan or its agents or subcontractors
other than as provided in this Agreement, or(ii) a breach of Group Health Plan's representations contained in
this Agreement.
L. Notice. All notices, requests, consents, and other communications hereunder will be in writing, and in
accordance with the Notice provision of the referenced Services Agreement.
M. Survival. The respective rights and obligations of Business Associate under V.C. and VI.K of this Agreement
shall survive the termination of this Agreement.
N. Counterparts. This Agreement may be executed in two or more counterparts, each of which may be
deemed an original.
Page 8 of 9
VII. ACKNOWLEDGEMENT AND SIGNATURES
The parties acknowledge that they have read this agreement, understand it, and agree to be bound by its terms.
Accordingly, in witness whereof,this Agreement is executed by the parties, by their duly authorized
representatives as of the date set forth above.
BUSINESS ASSOCIATE
Britney Hollyoak
Printed Name of Officer:
Signature: 6 l-tu (2-"-it°11 k,
Title: Lead Project Manager
Date: 8/13/19
GROUP HEALTH PLAN
Printed Name of Pl.17• dministrator: 12om a-r' 67 y 4-ttrf/ e
Signature: A I
Title: 6o141117J Cfd tlir)1,111-/-?a1 Aschitt CourtMrvti Yl.is+rc 1tr
Date: A ag.O1q I
MONROE COUNTY ATTORNEY
. � PROVED ASIT(DFQRM._
Date: 7. - 0—o��
Page 9 of 9