REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
November 18, 2025
FROM
ANDREW GOLDFRACH, ARMC Chief Executive Officer, Arrowhead Regional Medical Center
SUBJECT
Title
Business Associate Agreement with Baxter Healthcare Corporation for Handling Protected Health Information
End
RECOMMENDATION(S)
Recommendation
Approve non-financial Business Associate Agreement with Baxter Healthcare Corporation, including non-standard terms, for the purpose of providing certain health information protected under the Health Insurance Portability and Accountability Act of 1996, beginning November 18, 2025 and continuing until all County-provided protected health information is returned or destroyed.
(Presenter: Andrew Goldfrach, ARMC Chief Executive Officer, 580-6150)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Provide for the Safety, Health and Social Service Needs of County Residents.
FINANCIAL IMPACT
Approval of this item will not result in the use of Discretionary General Funding (Net County Cost), as the exchange of protected health information (PHI) is non-financial in nature.
BACKGROUND INFORMATION
On March 31, 2025, as the result of a competitive procurement, Purchasing approved Contract No. 4400027864 with Baxter Healthcare Corporation (Baxter) for infusion pumps, related equipment, and support services in the amount of $3,187,259, effective March 31, 2025 through March 30, 2030. Baxter’s relationship with Arrowhead Regional Medical Center (ARMC) meets the Health Insurance Portability and Accountability Act of 1996 (HIPAA) definition of a Business Associate (BA). The HIPAA Privacy Rule requires the execution of an Agreement for ARMC to conduct business with Baxter.
Approval of the Business Associate Agreement (Agreement) with Baxter is intended to protect the privacy and provide for the security of PHI disclosed to or used by Baxter in compliance with HIPAA. The Agreement will allow Baxter to perform or provide functions, activities or services to the County that require Baxter to create, access, receive, maintain, and/or transmit information that includes or may include PHI, as defined by the HIPAA Rules in order to provide such functions, activities or services.
The Agreement is Baxter’s standard form contract, which includes terms that differ from the standard County Business Associate Agreement and omits certain County terms. Baxter is unwilling to negotiate these terms. The non-standard and missing terms include the following:
1. Baxter does not agree to be responsible for costs associated with a breach of ePHI.
• The County standard Agreement requires the BA to be responsible for reasonable costs associated with a breach, including postage, alternative means of notice, media notification, and credit monitoring services.
• Potential Impact: The County may be liable for all costs associated with a breach of its ePHI caused by Baxter, which may exceed the total amount of the underlying purchase contract.
2. Baxter does not agree to indemnify the County.
• The County standard Agreement requires the BA to indemnify, defend and hold the County harmless from claims and expenses (including costs for reasonable attorney fees) that are caused by the BA with respect to the use, access, maintenance or disclosure of ePHI.
• Potential Impact: The County may not contractually require Baxter to defend or reimburse the County for claims made against the County as a result of Baxter’s actions resulting in a breach of ePHI, which may exceed the total amount of the underlying purchase contract.
3. Baxter does not agree to provide appropriate liability insurance coverage.
• The County standard Agreement requires the BA to provide appropriate liability insurance coverage to cover claims and demands made for loss to any person arising from the breach of the security, privacy, or confidentiality obligations of BA under the Agreement and under HIPAA provisions.
• Potential Impact: The County has no assurance that Baxter will be financially responsible for claims that may arise under the Agreement, which could result in expenses to the County that exceed the total the total amount of the underlying purchase contract.
ARMC recommends approval of the Agreement with Baxter, including the non-standard terms, as it will enable the hospital to provide for the safety, health and social services needs of county residents and protect patient information.
PROCUREMENT
Not applicable.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Supervising Deputy County Counsel, 387-5465) on September 23, 2025; Risk Management (Stephanie Pacheco, Staff Analyst II, 386-9039) on September 24, 2025; ARMC Finance (Chen Wu, Finance and Budget Officer, 580-3165) on October 24, 2025; and County Finance and Administration (Jenny Yang, Administrative Analyst, 387-4884) on October 30, 2025.