REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
October 6, 2026
FROM
ANDREW GOLDFRACH, ARMC Chief Executive Officer, Arrowhead Regional Medical Center
SUBJECT
Title
Business Associate Agreement with iRhythm Technologies, Inc.
End
RECOMMENDATION(S)
Recommendation
Approve non-financial Business Associate Agreement with iRhythm Technologies, Inc., to ensure the security of protected health information, effective October 6, 2026 and continuing until terminated by either party.
(Presenter: Andrew Goldfrach, ARMC Chief Executive Officer, 580-6150)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Provide for the Safety, Health and Social Service Needs of County Residents.
FINANCIAL IMPACT
Approval of this item will not result in the use of Discretionary General Funding (Net County Cost) as this Business Associate Agreement (BAA) with iRhythm Technologies, Inc. (iRhythm) is non-financial in nature.
BACKGROUND INFORMATION
Arrowhead Regional Medical Center (ARMC) is seeking to establish a partnership with iRhythm utilizing a direct-bill model for its Zio Monitor that is placed on the patient’s chest to continuously record the heart’s electrical activity. ARMC and iRhythm will operate under a shared billing arrangement, with monitors provided on consignment and no acquisition cost to ARMC under this model. The patient will be billed by ARMC for the placement of the device and iRhythm will bill the patient directly for the processing of the heart monitoring.
Approval of the BAA with iRhythm is necessary to ensure that iRhythm protects the confidentiality of protected health information (PHI) of patients at ARMC under this new partnership for the Zio Monitor. Under the Health Insurance Portability and Accountability Act (HIPAA), covered entities (such as ARMC) that contract with a service provider that maintains, uses, accesses, or transmits PHI are required to enter into a BAA. The purpose of the BAA is to set clear obligations for safeguarding that information, limiting its use and disclosure, and requiring appropriate security, breach reporting, and compliance measures. In healthcare, BAAs are important because they extend privacy and security protections to the broader network of service providers, such as billing companies, cloud hosts, and analytics vendors, who may access patient data. As a core element of HIPAA compliance, a BAA documents each party’s responsibilities, helps ensure administrative, physical, and technical safeguards are in place, and provides accountability through terms addressing subcontractors, incident response, and termination for noncompliance.
ARMC recommends approval of the BAA, as it will enable the hospital to provide for the safety, health and social needs of County residents by protecting patient information.
PROCUREMENT
Not applicable.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Supervising Deputy County Counsel, 387-5455) on September 9, 2026; ARMC Finance (Chen Wu, Finance and Budget Officer, 580-3165) on September 11, 2026; and County Finance and Administration (Jenny Yang, Administrative Analyst, 387-4884) on September 14, 2026.