HomeMy WebLinkAboutSHJ26-008 VALLEY HEALTH BAA - PARTIALLY EXECUTEDMUTUAL BAA AND DATA PROTECTION AGREEMENT
MUTUAL HIPAA BUSINESS ASSOCIATE
AND DATA PROTECTION AGREEMENT
Kittitas County / Kittitas County Jail and Contractor I August 2026
1. PARTIES AND PURPOSE
This Mutual HIPAA Business Associate and Data Protection Agreement (BAA) is between Kittitas County, acting
through Kittitas County Jail (County), and Apple Valley Counseling Services, LLC, a Washington limited liability
company doing business as Valley Health and Counseling (Contractor). This BAA governs protected information
exchanged or created in connection with mental health, substance use disorder, behavioral -health practitioner, and
medication -management services at the Jail.
Role follows the transaction. A party is a Business Associate only to the extent it creates, receives, maintains, or
transmits Protected Health Information (PHI) on behalf of the other party as a Covered Entity or Business Associate.
Nothing in this BAA concedes that either party has a status not otherwise imposed by law.
2. DEFINITIONS AND CONTROLLING LAW
Terms not defined here have the meanings assigned by HIPAA and its implementing regulations at 45 C.F.R. Parts
160 and 164. Part 2 Record means a record protected by 42 C.F.R. Part 2. Washington Health Care Information has
the meaning and protections supplied by chapter 70.02 RCW and other applicable Washington law.
The most protective applicable requirement controls. The parties will apply HIPAA, 42 C.F.R. Part 2, chapter 70.02
RCW, professional privilege, correctional -health rules, and valid patient authorizations or court orders as applicable.
3. PERMITTED USES AND DISCLOSURES
• Use or disclose PHI only to perform the service agreement, administer this BAA, or as required by law.
• Limit access, use, and disclosure to the minimum necessary and to personnel with a legitimate role.
• Do not use PHI for marketing, sale, unrelated analytics, employment decisions, custody classification,
punishment, or law -enforcement purposes unless separately authorized,required by law, or necessary to ensure
care and safety of those incarcerated.
• Do not use or disclose psychotherapy notes except with the authorization or legal basis specifically required for
those notes.
• Use de -identified or aggregate information whenever it will satisfy the operational purpose.
4.SAFEGUARDS
• Maintain reasonable and appropriate administrative, physical, and technical safeguards, including unique
accounts, least privilege, access review, encryption in transit and at rest where reasonable, secure disposal, audit
logging, workforce training, and incident response.
• Access County systems only through County -approved methods and access Contractor systems only through
Contractor -approved methods.
• Do not place PHI in ordinary email, personal cloud storage, personal messaging, or unapproved Al systems. Any
cloud or Al service receiving PHI must be authorized in writing and covered by required contractual protections.
• Ensure subcontractors that create, receive, maintain, or transmit PHI accept materially equivalent restrictions in
writing before access.
5. INCIDENT AND BREACH RESPONSE
A party discovering an unauthorized use or disclosure, Security Incident, breach of Unsecured PHI, or compromise of
a Part 2 Record will notify the other party without unreasonable delay and no later than ten (10) calendar days after
discovery. Routine unsuccessful security events that do not compromise data need not be individually reported
unless requested.
The initial notice will identify, to the extent known: discovery date; occurrence date; systems and records involved;
individuals and data elements affected; containment; mitigation; evidence preserved; and a response contact. The
parties will cooperate on risk assessment, mitigation, legally required notices, regulator communications, and
documentation. Neither party will notify affected individuals or regulators on the other party's behalf without
coordination, unless law requires immediate independent action.
Page 1
MUTUAL BAA AND DATA PROTECTION AGREEMENT
The responsible party bears reasonable, documented response and notice costs to the extent caused by its breach,
subject to the service agreement and applicable law.
6. INDIVIDUAL RIGHTS AND GOVERNMENT ACCESS
Make designated -record -set information available as reasonably necessary for access, amendment, and
accounting -of -disclosures duties within the time needed for the responsible party to meet legal deadlines.
Forward a request from an individual, personal representative, attorney, court, regulator, or law -enforcement
agency to the party responsible for responding, unless direct response is required by law.
Make practices, books, and records relating to PHI available to the U.S. Department of Health and Human
Services as required by law.
7. PART 2 RECORDS
A Part 2 Record may be used or disclosed only as permitted by 42 C.F.R. Part 2 and other applicable law. Each party
will preserve required consent limitations and redisclosure restrictions, limit access to authorized personnel, and
resist compulsory process that does not satisfy Part 2. A general HIPAA permission does not independently authorize
a Part 2 disclosure.
The parties will not disclose a Part 2 Record in a civil, criminal, administrative, or legislative proceeding against a
patient without the specific consent or court order required by Part 2. Any Part 2 breach or complaint will be handled
under Section 5 and the applicable Part 2 breach -notification rules.
8. DATA OWNERSHIP, RECORD CUSTODY, AND RETENTION
This BAA grants no ownership interest in clinical records, PHI, psychotherapy notes, or Part 2 Records. Record
custody and retention follow applicable law, professional duties, the approved EHR arrangement, and the service
agreement. Each party remains responsible for records it is legally required to maintain.
TERM, TERMINATION, AND RETURN OR DESTRUCTION
This BAA begins before the first exchange of PHI and remains effective while either party maintains PHI received or
created under the service agreement. A party may terminate for an uncured material privacy breach after written
notice and a reasonable cure opportunity, unless immediate termination is required to protect individuals or comply
with law.
10. GENERAL TERMS
This BAA is incorporated into the service agreement. If they conflict on privacy or data protection, the more protective
privacy requirement controls. The parties will amend this BAA as needed to remain compliant. No third party is a
beneficiary. Electronic signatures and counterparts are permitted.
SIGNATURES
KITTITAS COUNTY
By:
Name/Ti e: C( ���
Date: g ^ l S'r —2 ! .
REFERENCE AUTHORITIES
CONTRACTOR
Apple Valley Counseling Services, LLC
d/b/a Valley Health and Counseling
By:
Name/Title:
Date:
References: 45 C.F.P. Parts 160 and 164, 42 C.F.R. Part 2; chapter 70.02 RCW; and U.S. Department of Health and Human Services
sample Business Associate Agreement provisions. These references do not replace review by County counsel or Contractor counsel.
Page 2