To: Board of Supervisors
From: Dr. Grant Colfax, Health Services Director
Report Title: Business Associate Agreement #77-800 with NDCHealth Corporation (dba RelayHealth)
☒Recommendation of the County Administrator ☐ Recommendation of Board Committee
RECOMMENDATIONS:
RATIFY the December 31, 2025 execution of Business Associate Agreement #77-800, which includes a limitation of liability provision, between Contra Costa Health Plan (CCHP) and NDC Health Corporation (dba RelayHealth), as required by the Centers for Medicare and Medicaid, for the disclosure of protected health information for data aggregation purposes. The Business Associate Agreement, effective January 1, 2026, will be coterminous with the Centers for Medicare and Medicaid requirement to disclose data to RelayHealth.
FISCAL IMPACT:
No fiscal impact.
BACKGROUND:
As a Health Plan, CCHP is required to comply with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). HIPAA safeguards the privacy and confidentiality of health information. Health Plans, including CCHP, must contract with other companies to perform accounting, legal, clerical and similar business functions. To perform these business functions, the contractors necessarily have access to the health information of a Health Plan’s members. For this reason, HIPAA requires Health Plans such as CCHP to enter into a Business Associate Agreement with their contractors. The Business Associate Agreement (BAA) contractually obligates the contractor (Business Associate) to safeguard the member’s health information to the same degree and extent as CCHP and deems the Business Associate directly liable for improper disclosures.
NDCHealth Corporation (“RelayHealth”) is a Centers for Medicare and Medicaid (CMS) intermediary that aggregates data from Prescription Part D plans. CCHP’s Pharmacy Benefit Manager (PBM), PerformRx, is required by CMS to send relevant CCHP member data to RelayHealth for aggregation. CMS requires CCHP, as the Prescription Part D sponsor, to enter a stand-alone BAA with the CMS intermediary, RelayHealth. Pursuant to the terms of the BAA, it will be construed and the rights of the parties will be determined under the laws of the State of Georgia. RelayHealth’s liability will be limited to incidents where it has acted with an intent to commit fraud or with reckless disregard of its obligations under the BAA.
CONSEQUENCE OF NEGATIVE ACTION:
If execution of the Business Associate Agreement is not authorized, CCHP and its Pharmacy Benefit Manager will be out of compliance with a priority CMS requirement for Prescription Part D sponsors.