REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
December 16, 2025
FROM
REBECCA SUAREZ, Interim Director, Department of Risk Management
SUBJECT
Title
Business Associate Agreement with Public Risk Innovation, Solutions, and Management
End
RECOMMENDATION(S)
Recommendation
Approve non-financial Business Associate Agreement for the duration of the Joint Powers Authority Agreement between San Bernardino County and Public Risk Innovation, Solutions, and Management to maintain compliance with the Health Insurance Portability and Accountability Act to safeguard Protected Health Information that will be accessed by Public Risk Innovation, Solutions, and Management and their contracted third parties to perform audits of the Department of Risk Management’s claims data.
(Presenter: Rebecca Suarez, Interim Director, 386-8723)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Improve County Government Operations.
Operate in a Fiscally-Responsible and Business-Like Manner.
FINANCIAL IMPACT
Approval of this item will not result in the use of Discretionary General Funding (Net County Cost). The Public Risk Innovation, Solutions, and Management (PRISM) Business Associate Agreement (BAA) is non-financial in nature and does not commit the County to make any purchases.
BACKGROUND INFORMATION
On March 25, 2014 (Item No. 49), the Board approved a Joint Powers Authority Agreement (JPA) between San Bernardino County (County) and the California State Associate of Counties - Excess Insurance Authority (CSAC-EIA), which granted eligibility for the County to purchase insurance through CSAC-EIA shared limits programs. The MOU remains in effect until the County cancels its membership or until the CSAC-EIA Board of Directors cancels the County’s participation with a majority vote. In 2020, CSAC-EIA changed its name to Public Risk Innovation, Solutions, and Management (PRISM).
Article 8 (l) of the JPA authorizes the PRISM Board of Directors to require PRISM to review, audit, report upon, and make recommendations with regard to the safety or claims administration functions of any member, insofar as those functions affect the liability or potential liability of PRISM. A BAA between the County and PRISM is needed to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA) when PRISM or their contracted vendors require access to County’s claims data that contains Protected Health Information (PHI).
The BAA with PRISM will allow PRISM and their contractors to perform the reviews, audits and reports required by the JPA that may include PHI, as defined by the HIPAA rules. DRM recommends approval of the BAA to protect the privacy and to provide for the security of PHI disclosed to PRISM and their contractors in compliance with HIPAA law.
PROCUREMENT
Not Applicable
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Ross Trindle, Chief Assistant County Counsel, 387-5455) on November 25, 2025; Purchasing (Jessica Barajas, Supervising Buyer, 387-2065) on November 26, 2025; County Administrative Office (Victor Tordesillas, Deputy Executive Officer, 387-4717, and Anja Jacobsen, Executive Administrative Analyst, 387-9647) on November 26, 2025; County Administrative Office (Diane Rundles, Assistant Executive Officer, 387-5572) on December 01, 2025; Finance and Administration (Ivan Ramirez, Administrative Analyst, 387-4020) on November 25, 2025.