REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
November 17, 2026
FROM
ANDREW GOLDFRACH, ARMC Chief Executive Officer, Arrowhead Regional Medical Center
SUBJECT
Title
Non-Financial Business Associate Agreement with Canon Medical Systems USA, Inc.
End
RECOMMENDATION(S)
Recommendation
Approve non-financial Business Associate Agreement with Canon Medical Systems USA, Inc., including non-standard terms, to ensure the security of protected health information, effective upon execution through October 31, 2029.
(Presenter: Andrew Goldfrach, ARMC Chief Executive Officer, 580-6150)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Provide for the Safety, Health and Social Service Needs of County Residents.
FINANCIAL IMPACT
Approval of this item will not result in the use of Discretionary General Funding (Net County Cost) as this Business Associate Agreement (BAA) with Canon Medical Systems USA, Inc. (Canon) is non-financial in nature.
BACKGROUND INFORMATION
Approval of the BAA with Canon will incorporate a safeguard for patient health information. A BAA is a legally binding contract between Arrowhead Regional Medical Center (ARMC) and a third-party business associate, such as Canon, that ensures that the business associate properly protects and safeguards any protected health information provided by the healthcare provider to the business associate to provide the services required from the business associate.
On September 26, 2023 (Item No. 7) the Board of Supervisors (Board) approved the Service Agreement No. 23-1059 with Canon Medical Systems USA, Inc., including non-standard terms, for maintenance, repairs, and parts for five Canon Medical Imaging Equipment Systems, in the amount of $3,145,736, for the period of October 16, 2023 through October 31, 2029. During a review by ARMC compliance it was determined that protected heath information may be accessed during maintenance and service support, so a BAA was needed.
The BAA is ARMC’s standard agreement, negotiated by the parties to include non-standard terms, as follows:
1. Canon’s liability to the County for the costs associated to breach, direct liability, and indemnification provisions of the BAA is limited to $1 million per occurrence.
• The County standard BAA does not include a limitation of liability.
• Potential Impact: Costs and expenses related to breach caused by Canon could exceed the liability cap and the Agreement amount leaving the County financially liable for the excess.
ARMC recommends approval of the BAA as it will enable the hospital to provide for the safety, health and social needs of County residents by protecting patient information.
PROCUREMENT
Not applicable.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Supervising Deputy County Counsel, 387-5487) on October 14, 2026; Risk Management (Noel Cantrell, Administrative Supervisor, 386-8890) on October 16, 2026; ARMC Finance (Chen Wu, Finance and Budget Officer, 580-3165) on October 21, 2026; and County Finance and Administration (Jenny Yang, Administrative Analyst, 387-4884) on October 22, 2026.