REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
September 1, 2026
FROM
ANDREW GOLDFRACH, ARMC Chief Executive Officer, Arrowhead Regional Medical Center
SUBJECT
Title
Business Associate Agreement with Varonis Systems, Inc.
End
RECOMMENDATION(S)
Recommendation
Approve non-financial Business Associate Agreement with Varonis Systems, Inc., including non-standard terms, to ensure the security of protected health information, effective September 1, 2026 and continuing until all obligations have been met under Agreement No. 24-650, or until terminated by either party.
(Presenter: Andrew Goldfrach, ARMC Chief Executive Officer, 580-6150)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Provide for the Safety, Health and Social Service Needs of County Residents.
FINANCIAL IMPACT
Approval of this item will not result in the use of Discretionary General Funding (Net County Cost) as this Business Associate Agreement (BAA) with Varonis Systems, Inc. (Varonis) is non-financial in nature.
BACKGROUND INFORMATION
On July 23, 2024 Item (No. 14), the Board of Supervisors approved Agreement No. 24-650 with Varonis, for Subscription Services for security software to protect and control access to patient data, in the amount of $2,432,755, for a period of July 23, 2024 through July 22, 2029. The software automatically scans files, emails, and databases to identify sensitive information, such as protected health information (PHI) necessitating the recommended BAA.
Approval of the BAA with Varonis will ensure that Varonis protects the confidentiality of PHI of patients at Arrowhead Regional Medical Center (ARMC). Under the Health Insurance Portability and Accountability Act (HIPAA), covered entities, such as ARMC, that contract with a service provider that maintains, uses, accesses, or transmits PHI are required to enter into a BAA. The BAA establishes each party’s obligations for safeguarding that information, limiting its use and disclosure, and requiring appropriate security, breach reporting, and compliance measures. In healthcare, BAAs are important because they extend privacy and security protections to the broader network of service providers, such as billing companies, cloud hosts, and analytics vendors, who may access patient data. As a core element of HIPAA compliance, the BAA documents each party’s responsibilities, helps ensure administrative, physical, and technical safeguards are in place, and provides accountability through terms addressing subcontractors, incident response, and termination for noncompliance.
The BAA will remain in effect until all obligations have been met under Agreement No. 24-650. While Agreement No. 24-650 expires July 22, 2029, the term of the BAA may extend beyond that date as certain contractual obligations, such as indemnification and warranty obligations, survive the contract’s expiration.
The BAA is Varonis’ standard BAA, as negotiated by the parties, which includes terms that differ from the standard County contract and omits certain County standard contract terms. The non-standard and missing terms include the following:
1. The County is required to indemnify Varonis against all third-party claims to the extent caused by or resulting from the County’s material breach of the Agreement, gross negligence, or willful misconduct.
• The County standard contract does not include any indemnification or defense by the County of a contractor.
• Potential Impact: By agreeing to indemnify Varonis, the County could be contractually waiving the protection of sovereign immunity. Claims that may otherwise be barred against the County, time limited, or expense limited could be brought against Varonis without such limitations and the County could be responsible to defend and reimburse Varonis for costs, expenses, and damages, which could exceed the total Agreement amount.
2. Varonis does not agree to provide appropriate liability insurance coverage.
• The County standard BAA requires the BA to provide appropriate liability insurance coverage to cover claims and demands made for loss to any person arising from the breach of the security, privacy, or confidentiality obligations of BA under the BAA and under HIPAA provisions.
• Potential Impact: The County has no assurance that Varonis will be financially responsible for claims that may arise under the BAA, which could result in expenses to the County that exceed the total the total amount of the underlying purchase contract.
ARMC recommends approval of the BAA, including the non-standard terms, as it will enable the hospital to provide for the safety, health and social needs of County residents by protecting patient information.
PROCUREMENT
Not applicable.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Supervising Deputy County Counsel, 387-5455) on July 13, 2026; Risk Management (Stephanie Pacheco, Staff Analyst II, 386-9039) on July 30, 2026; ARMC Finance (Chen Wu, Finance and Budget Officer, 580-3165) on August 7, 2026; and County Finance and Administration (Jenny Yang, Administrative Analyst, 387-4884) on August 10, 2026.