REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF SAN BERNARDINO COUNTY
AND RECORD OF ACTION
November 17, 2026
FROM
LAURA FEINGOLD, County Counsel
SUBJECT
Title
Business Associate Agreements with Filevine, Inc. and Vineskills, Inc.
End
RECOMMENDATION(S)
Recommendation
1. Approve non-financial Business Associate Agreement with Filevine, Inc., including non-standard terms, to ensure the security of protected health information, effective from November 17, 2026 and continuing until terminated by either party.
2. Approve non-financial Business Associate Agreement with Vineskills, Inc., including non-standard terms, to ensure the security of protected health information, effective from November 17, 2026 and continuing until terminated by either party.
(Presenter: Laura Feingold, County Counsel, 387-5455)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Provide for the Safety, Health and Social Service Needs of County Residents.
FINANCIAL IMPACT
Approval of this item will not result in the use of Discretionary General Funding (Net County Cost), as the Business Associate Agreements (BAA) with Filevine, Inc. (Filevine) and Vineskills, Inc. (Vineskills) are non-financial in nature.
BACKGROUND INFORMATION
County Counsel (CCL) provides legal services to the County Board of Supervisors (Board), County departments, commissions, special districts, school districts and joint powers authorities, and represents the County in litigation. CCL manages legal matters across numerous civil practice areas and jurisdictions, each with its own legal documentation requirements, deadlines, and workflows. Some of these documents may include protected health information (PHI) that is protected under the Health Insurance Portability and Accountability Act (HIPAA).
On September 1, 2026 (Item No. 28), the Board approved Agreement No. 26-829 with Filevine for subscription licenses for case and document management software and support services, and Agreement No. 26-830 with Vineskills for data migration, implementation, and consulting services.
Filevine is a cloud-based legal practice management platform that provides case and document management, time and billing, accounting, task tracking, and reporting tools, and will replace the case management system currently used by CCL. Vineskills is Filevine’s implementation and optimization partner and will provide data migration and support services for CCL’s transition to Filevine.
Approval of the BAAs with Filevine and Vineskills will ensure that Filevine and Vineskills protect the confidentiality of PHI in CCL files. Under the HIPAA, covered entities (such as CCL) that contract with a service provider that maintains, uses, accesses, or transmits PHI are required to enter into a BAA. The purpose of a BAA is to set clear obligations for safeguarding that information, limiting its use and disclosure, and requiring appropriate security, breach reporting, and compliance measures. In healthcare, BAAs are important because they extend privacy and security protections to the broader network of service providers, such as billing companies, cloud hosts, and analytics vendors, who may access patient data. As a core element of HIPAA compliance, a BAA documents each party’s responsibilities, helps ensure administrative, physical, and technical safeguards are in place, and provides accountability through terms addressing subcontractors, incident response, and termination for noncompliance. CCL determined that a BAA was required to be in place before Vineskills could begin file transfers during the implementation process. Once the files have been transferred into the Filevine platform, it is necessary for a BAA to be in place with Filevine to ensure HIPAA-compliance.
The Filevine BAA is based on the County standard form, which the parties negotiated to include terms that differ from the standard County contract standard contract terms. The non-standard terms include the following:
1. Filevine limits its liability for costs associated with a breach to the aggregate purchase contract price, excluding failure to comply with applicable law.
• The County standard Business Associate Agreement requires the BA to be responsible for reasonable costs associated with a breach, including postage, alternative means of notice, media notification, and credit monitoring services.
• Potential Impact: The County may be liable for costs associated with a breach of its ePHI caused by Filevine unless the breach was caused by Filevine’s failure to comply with applicable laws, which may exceed the total amount of the underlying purchase contract.
2. Filevine modified the indemnification provision to limit it to third-party claims that are caused by Filevine’s material breach of the Agreement or its negligent or willful acts, up to the aggregate purchase contract price.
• The County standard Business Associate Agreement requires the BA to indemnify, defend and hold the County harmless from claims and expenses (including costs for reasonable attorney fees) that are caused by the BA with respect to the use, access, maintenance or disclosure of ePHI.
• Potential Impact: The County may not contractually require Filevine to defend or reimburse the County for claims made against the County except those that result from Filevine’s negligent or willful acts or breach of the BAA and subject to the limit of the total purchase contract price, which may exceed the total amount of the underlying purchase contract.
The Vineskills BAA is based on the County standard form, which the parties negotiated to include terms that differ from the standard County contract standard contract terms. The non-standard terms includes the following:
1. Vineskills modified the indemnification provision to limit it to third-party claims and fines, or penalties imposed by a government that are caused by its gross negligence, willful misconduct or breach of County PHI, and requires the County’s reasonable assistance in the defense.
• The County standard BAA requires the BA to indemnify, defend and hold the County harmless from claims and expenses (including costs for reasonable attorney fees) that are caused by the BA with respect to the use, access, maintenance or disclosure of ePHI.
• Potential Impact: The County may not contractually require Vineskills to defend or reimburse the County for claims made against the County except those that result from a higher threshold of intentional or criminal acts or omissions by Vineskills resulting in a breach of ePHI, which may exceed the total amount of the underlying purchase contract.
2. Vineskills’ liability to the County under the Vineskills BAA is limited to $1 million for costs associated to breach and under its indemnification obligations and the limits of its insurance for gross negligence or willful misconduct.
• The County standard Business Associate Agreement does not include a limitation of liability.
• Potential Impact: Costs and expenses related to the breach caused by Vineskills could exceed the liability cap and the Agreement amount, leaving the County financially liable for the excess.
CCL recommends approval of the BAAs with Filevine and Vineskills, as the agreements will enable CCL to provide for the safety, health and social needs of County residents by protecting PHI.
PROCUREMENT
Not applicable.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Supervising Deputy County Counsel, 387-5455, and Eva Magana, Chief of County Counsel’s Administration, 387-5455) on November 6, 2026; County Finance and Administration (Penelope Chang, Principal Administrative Analyst, 387-4866) on November 6, 2026; and Risk Management (Arrissia Beaven, Staff Analyst II 909-386-9030) on November 9, 2026.