Title
Health and Human Services Agency (HHSA) recommending the Board:
1) Approve and authorize the Chair to sign non-financial Business Associate Agreement (BAA) 5879 with Zoom to ensure that the video communication services they provide to HHSA’s clients are HIPAA compliant, for a term to begin upon final execution and continue until terminated;
2) Authorize the HHSA Director, or designee, to execute further documents including amendments, contingent upon County Counsel and Risk Management concurrence, relating to BAA 5879; and
3) Authorize and direct the Chief Administrative Office Procurement and Contracts Division to accept Zoom’s Deputy General Counsel, Commercial, DocuSign signature as binding on BAA 5879.
FUNDING: N/A
Body
DISCUSSION / BACKGROUND:
The Health and Human Services Agency (HHSA) subscribed to Zoom Video Communications, Inc., (Zoom), effective June 6, 2020, to use their video communication platform for a variety of meetings and communications, including but not limited to use by the Behavioral Health Division for client meetings. The purpose of entering into Zoom’s Business Associate Agreement (BAA 5879) is to ensure that the health information of HHSA’s clients remains protected under various confidentiality standards, including but not limited to: the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Part 160 and Part 164, Subparts A and E (Privacy Rule), 45 CRF Part 160 and Subparts A and C of Part 164 (Security Rule) and the Health Information Technology for Economic and Clinical Health Act (HITECH Act).
Zoom initially provided a BAA signed by their Deputy General Counsel, Chief Compliance and Ethics Officer, dated December 23, 2020. HHSA requested several times that Zoom have the BAA signed by their corporate officers in accordance with California Corporation Code Sections (CC) 312, 313, and 314, which is the standard followed by the County for contract signatures or to provide a corporate resolution showing that their Deputy General Counsel was authorized to bind Zoom to their BAA. Zoom responded by sending a letter of authorization, signed only by the Founder & Chief Executive Officer, and stating that the Deputy General Counsel is an authorized signatory on behalf of Zoom Video Communications, Inc. HHSA sought guidance from County Procurement and Contracts regarding the signature on the signed BAA and the letter of authorization, who stated that, typically they require a corporate resolution and Secretary Certificate authenticating the resolution based upon recent guidance from County Counsel that supported this requirement. HHSA staff communicated to Zoom that either the letter authorizing the signature on the BAA, or the BAA, needed to be signed in accordance with CC 312, et seq. Zoom responded by sending another BAA signed on April 22, 2021 by their Deputy General Counsel, Commercial Legal.
HHSA sought input from the Information Technology Department, working directly with the Compliance Officer who engaged the State Department of Health Care Services (DHCS), seeking guidance on HIPAA compliance at Zoom. The response from DHCS addressed HIPAA compliance in general and did not specifically speak to the issue of what roles/positions/representatives were authorized to sign on behalf of Zoom. To seek other guidance, HHSA then contacted other counties via the County Behavioral Health Directors Association to ascertain whether those counties are using Zoom for client communications and, if so, to understand if they had accepted the Zoom standard BAA and signature. Of the 16 responses received, 11 reported that they are using Zoom for HIPAA compliant communications and accepted the standard BAA.
County Counsel reviewed BAA 5879 with respect to Zoom’s signatory and determined that though it is “signed in a manner different than that which we require for individualized contracts, it does not make the BAA legally deficient.” Although Zoom declined to sign their BAA according to the County’s signature requirements (e.g., CC 312, et seq), it has been signed by their Deputy General Counsel in accordance with their standard practices, which demonstrates their “willingness to sign a binding BAA”. HHSA is now recommending the Board approve and execute BAA 5879 thereby accepting the signature of the Deputy General Counsel of Zoom as the authorized signer for the BAA.
ALTERNATIVES:
Should the Board decline to approve this recommendation, HHSA will not have a Business Associate Agreement with Zoom to ensure that video conferencing with HHSA clients is HIPAA compliant.
PRIOR BOARD ACTION:
N/A
OTHER DEPARTMENT / AGENCY INVOLVEMENT:
Approved by County Counsel, Human Resources, and Risk Management.
CAO RECOMMENDATION:
Approve as recommended.
FINANCIAL IMPACT:
There is no financial impact associated with this non-financial Business Associate Agreement.
CLERK OF THE BOARD FOLLOW UP ACTIONS
1) Clerk of the Board to obtain the Chair’s signature on one (1) original of Agreement 5879.
2) Clerk of the Board to return a copy of the fully signed Agreement to Health and Human Services Agency, Contracts Unit.
STRATEGIC PLAN COMPONENT:
Healthy Communities and Good Governance
CONTACT
Don Semon, Director