CM-2026-196 - 7/24/2026 BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement ("Agreement") is entered into on July 16th, 2026 (the
"Effective Date"), by and between City of Round Rock ("Covered Entity") and Gallagher Benefit
Services, Inc. (`Business Associate").
RECITALS
WHEREAS, Business Associate provides, or intends to provide, certain services to Covered
Entity described in an underlying agreement ("Underlying Agreement"), entitled "City of Round
Agreement for Employee Benefits Consulting Services with Gallagher Benefit Services,Inc.,"executed
on July 9,2026;
WHEREAS, to the extent that Covered Entity and Business Associate qualify as a "covered
entity" and "business associate"(as such terms are defined in 45 C.F.R. § 160.103) with regard to any
Protected Health Information ("PHI")processed as part of the Underlying Agreement, Covered Entity
and Business Associate mutually desire to outline their individual responsibilities with respect to the
use, disclosure and security of PHI under the Health Insurance Portability and Accountability Act of
1996, as codified at 42 U.S.C. § 1320d("HIPAA"),the Health Information Technology for Economic
and Clinical Health Act of 2009, as codified at 42 U.S.C. § 17901 et seq. ("HITECH Act"), and any
current and future regulations promulgated under HIPAA or the HITECH Act(HIPAA, HITECH Act,
and any current and future regulations promulgated under either are collectively referred to as the
"Regulations"); and
WHEREAS, in the event and only to the extent that the Regulations apply to any data received
by Business Associate from or on behalf of Covered Entity, Covered Entity and Business Associate
understand and agree that the Regulations require Covered Entity and Business Associate to enter into
this Business Associate Agreement,which shall govern the use,disclosure and security of PHI.
NOW,THEREFORE,the parties hereto agree as follows:
1. Definitions. When used in this Agreement and capitalized,the following terms have
the following meanings:
(a) "Breach" shall have the same meaning as the term "breach" in 45 C.F.R. §
164.402.
(b) "Electronic Protected Health Information"or"ePHI"shall mean Protected
Health Information transmitted by electronic media or maintained in electronic media.
(c) "Individual"shall have the same meaning as the term"individual"in 45 C.F.R.
§ 160.103 and shall include a person who qualifies as a personal representative in accordance
with 45 C.F.R. § 164.502(g).
(d) "Privacy Rule"shall mean the Standards for Privacy of Individual Identifiable
Health Information as set forth at 45 C.F.R. Parts 160 and 164 Subparts A and E.
(e) "Protected Health Information'or"PHI"shall have the same meaning as the
term "protected health information' in 45 C.F.R. § 160.103, limited to the information created
or received by Business Associate from or on behalf of Covered Entity.
(f) "Required by Law"shall have the same meaning as the term"required by law"
in 45 C.F.R. § 164.103.
Gallagher Business Associate Agreement
03052025
Page I of 8
(g) "Secretary"shall mean the Secretary of the Department of Health and Human
Services or their designee.
(h) "Security Incident" shall mean a successful unauthorized access, use,
disclosure, modification or destruction of Unsecured PHI;
(i) "Security Rule"shall mean the Standards for Security of ePHI, as set forth at
45 C.F.R. Parts 160 and 164 Subparts A and C.
{j) "Unsecured PHI" shall have the same meaning as the term "unsecured
protected health information" in 45 C.F.R. § 164.402.
Capitalized terms used but not defined in this Agreement shall have the same meaning as those
terms are defined in the Regulations.
2. Obligations and Activities of Business Associate Regarding PHI.
(a) Business Associate shall only use or disclose PHI as permitted or required by
this Agreement.
(b) Business Associate shall use appropriate safeguards to prevent use or disclosure
of the PHI other than as provided for by this Agreement.
(c) Business Associate agrees to take reasonable steps, including providing
adequate training to its employees, to ensure compliance with this Agreement and the
Regulations.
(d) Business Associate shall ensure that any agents and sub-contractors that create,
receive, maintain or transmit PHI on behalf of Business Associate agree to comply with
substantially the same restrictions,conditions and requirements that apply to Business Associate
with respect to such information. Business Associate shall enter into written agreements with
any such agents and subcontractors, and the terms of such agreements shall incorporate the
applicable requirements of,and otherwise comply with,the Regulations.
(e) Upon request of Covered Entity and to the extent that Business Associate
maintains PHI in a Designated Record Set that is not also in Covered Entity's possession,
Business Associate shall provide Covered Entity with access to the PHI in the Designated
Record Set in a reasonable time and manner as designated by Covered Entity, in order for
Covered Entity to comply with the requirements under 45 C.F.R. § 164.524.
(f) To the extent that Business Associate maintains PHI in a Designated Record
Set, Business Associate shall make any amendment to PHI in a Designated Record Set that
Covered Entity directs or agrees to pursuant to 45 C.F.R. § 164.526 in a reasonable time and
manner as designated by Covered Entity.
(g) Upon request of Covered Entity, Business Associate shall provide Covered
Entity with documentation of any disclosures by Business Associate that would be required for
an accounting of disclosures to an Individual under 45 C.F.R. § 164.528 in a reasonable time
and manner as designated by Covered Entity.
Gallagher Business Associate Agreement
03052025
Page 2 of 8
(h) Business Associate shall give notice to Covered Entity of any request under 45
C.F.R. §§ 164.524, 164.526 or 164.528 that it receives directly from an Individual in order for
Covered Entity to comply with its requirements under the Regulations.
(i) Business Associate shall have policies and procedures in place to ensure its
compliance with the Privacy Rule to Support Reproductive Health Care Privacy, 89 Fed. Reg.
32976 (2024), and to ensure it does not use or disclose PHI in violation of 45 C.F.R. §
164.502(a)(5)(iii).
{j) To the extent Business Associate performs any of Covered Entity's obligations
under the Privacy Rule, Business Associate shall comply with the requirements of the Privacy
Rule that apply to Covered Entity in the performance of such obligations.
(k) Business Associate shall make its internal practices,books and records relating
to the use and disclosure of PHI available to the Secretary, in a reasonable time and manner as
designated by the Secretary, for purposes of the Secretary determining Covered Entity's
compliance with the Regulations, subject to any attorney-client or other applicable legal
privileges.
3. Permitted Uses and Disclosures of PHI by Business Associate.
(a) Business Associate may use or disclose PHI to perform functions,activities or
services for,or on behalf of,Covered Entity, including as necessary to perform the services set
forth in the Underlying Agreement.
(b) Business Associate may use or disclose PHI as Required by Law.
(c) Business Associate must not use or disclose PHI in a manner that is prohibited
under the Privacy Rule,45 C.F.R. § 164.502(a)(5),or would otherwise violate the Privacy Rule
if done by Covered Entity, except for the specific uses and disclosures permitted in this
Agreement.
(d) Business Associate may use PHI for the proper management and administration
of Business Associate and to carry out the legal responsibilities of Business Associate.
(e) Business Associate may disclose PHI for the proper management and
administration of Business Associate and to carry out the legal responsibilities of Business
Associate if:
(i) Such disclosure is Required by Law,or
(ii) Business Associate obtains reasonable assurances from the person to whom
the information is disclosed that such information will remain confidential and
used or further disclosed only as Required by Law or for the purposes for which
it was disclosed to the person, and the person agrees to notify Business
Associate of any instances of which it is aware that the confidentiality of the
information has been Breached.
Gallagher Business Associate Agreement
03052025
Page 3 of 8
(f) Business Associate shall limit its uses and disclosures of,and requests for,PHI,
to the minimum amount of PHI necessary to accomplish the intended purpose of such use,
disclosure or request subject to the exceptions set forth in the Privacy Rule.
(g) Business Associate may de-identify PHI in accordance with 45 C.F.R. §
164.514(a)-(c) ("De-Identified Information") and may use and disclose such De-Identified
Information for lawful purposes provided that the De-Identified Information cannot be
reasonably linked to Covered Entity or any Individual.
(h) Business Associate may use PHI to provide Data Aggregation services related
to the health care operations of Covered Entity as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).
(i) Business Associate shall comply with any requests for restrictions on certain
uses and disclosures of PHI to which Covered Entity has agreed in accordance with 45 C.F.R.
§ 164.522 and of which Business Associate has been notified by Covered Entity.
0) In the event Business Associate receives a request for the use or disclosure of
PHI that is potentially related to Reproductive Health Care, as defined by 45 C.F.R. § 160.103
("RHI") and that may be prohibited under 45 C.F.R. § 165.502(a)(5)(iii), Business Associate
shall (i) notify Covered Entity of such request; and (ii) only use or disclose the RHI to the
requester if(1)Business Associate has reasonably determined that such use or disclosure is not
prohibited under 45 C.F.R§ 165.502(a)(5)(iii),and(2)where required, Business Associate has
received a signed attestation in the form required by 45 C.F.R. § 164.504 from the requestor that
the use or disclosure of RHI is not for a purpose prohibited by 45 C.F.R.§ 164.502(a)(5)(iii).
4. Obligations of Covered Entity Regarding PHI.
(a) Covered Entity agrees that the permitted and required uses and disclosures of
PHI by Business Associate pursuant to this Agreement are and, at the time of execution and
throughout the term of this Agreement,will be consistent with the form of the notice of privacy
practices that Covered Entity provides to Individuals in accordance with 45 C.F.R. § 164.520.
Covered Entity shall provide notice to Business Associate of any changes to its notice of privacy
practices if such changes affect Business Associate's permitted or required uses and disclosures
of PHI.
(b) Covered Entity shall provide notice to Business Associate of any changes in,or
revocation of, an authorization by an Individual to use or disclose PHI, if such changes affect
Business Associate's permitted or required uses and disclosures of PHI.
(c) Covered Entity shall provide notice to Business Associate of any restrictions to
the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 C.F.R.
§ 164.522, if such restrictions affect Business Associate's permitted or required uses and
disclosures of PHI.
(d) Covered Entity shall obtain any consent or authorization from Individuals that
may be required under the Regulations or otherwise Required by Law.
(e) Covered Entity shall only provide Business Associate with the minimum
amount of PHI necessary in order for Business Associate to perform the services set forth in the
Gallagher Business Associate Agreement
03052025
Page 4 of 8
Underlying Agreement,including,where possible,only providing Business Associate with PHI
that has been de-identified in accordance with 45 C.F.R. § 164.514(a)-(c).
(f) Covered Entity shall require its employees, agents and representatives to be
appropriately informed of its legal obligations pursuant to this Agreement and the Regulations
and will reasonably cooperate with Business Associate in the performance of the mutual
obligations under this Agreement.
5. Security of Protected Health Information.
(a) Business Associate has implemented policies and procedures to ensure that its
receipt, maintenance or transmission of PHI on behalf of Covered Entity complies with the
applicable administrative,physical and technical safeguards of the Security Rule.
(b) Business Associate shall ensure that its agents or subcontractors agree to
implement the applicable administrative,physical and technical safeguards ofthe Security Rule.
(c) Business Associate shall establish procedures to mitigate,to the extent possible,
any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business
Associate in violation of this Agreement.
(d) Business Associate agrees to notify Covered Entity as soon as practicable, but
not later than sixty(60)days after Discovery(as defined by 45 C.F.R.§ 164.410)of any Security
Incident or Breach of Unsecured PHI and,to the extent available to Business Associate,provide
the following information relating to a Breach of Unsecured PHI to Covered Entity:
(1) The date of the Breach;
(2) The date of the discovery of the Breach;
(3) A description of the type of Unsecured PHI that was involved;
(4) The identity of each Individual whose Unsecured PHI has been,or is
reasonably believed to have been,accessed,acquired or disclosed;and
(5) Any other information reasonably necessary to permit Covered Entity
to comply with the requirements of 45 C.F.R. Part 164 Subpart D.
(e) Covered Entity acknowledges and agrees that Covered Entity is independently
responsible for the security of all PHI in its possession, including all PHI that it receives from
any third party(including from Business Associate).
6. Term and Termination.
(a) Term. This Agreement shall be effective as of the Effective Date and shall
remain in effect until either(1) the Underlying Agreement expires or is terminated or(2) this
Agreement is terminated and all PHI is returned,destroyed or is otherwise protected as set forth
in Section 6(d).
(b) Termination for Cause by Covered Entity. Upon Covered Entity's
knowledge of a material breach by Business Associate, Covered Entity shall provide an
Gallagher Business Associate Agreement
03052025
Page 5 of 8
opportunity for Business Associate to cure the breach. If Business Associate does not cure the
breach within thirty(30)days from the date that Covered Entity provides notice of such breach
to Business Associate, Covered Entity shall have the right to immediately terminate this
Agreement and the Underlying Agreement.
(c) Termination by Business Associate. This Agreement may be terminated by
Business Associate upon thirty (30) days prior written notice to Covered Entity if Business
Associate, acting in good faith, believes that the requirements of any law, legislation, consent
decree,judicial action,governmental regulation or agency opinion(enacted,issued or otherwise
effective after the date of this Agreement and applicable to PHI or to this Agreement)cannot be
met by Business Associate in a commercially reasonable manner and without significant
additional expense.
(d) Effect of Termination. Upon termination of this Agreement for any reason,at
the written request of Covered Entity, Business Associate shall:
(1) Return or destroy all PHI received from Covered Entity, or created or
received by Business Associate on behalf of Covered Entity, without unreasonable
delay,except as set forth below;
(2) Retain a copy of any PHI only as necessary for Business Associate to
continue its proper management and administration of its business or to carry out its
legal responsibilities;
(3) Continue to use appropriate safeguards and comply with the Security
Rule with respect to the PHI for as long as Business Associate retains the PHI,and shall
not use or disclose the PHI other than the purposes for which it was retained;and
(4) Shall return or destroy all PHI retained by Business Associate when it
is no longer needed by Business Associate for its proper management and
administration of its business or to carry out its legal responsibilities.
(e) Survival. The obligations of Business Associate under this Section shall
survive the termination of the Agreement until all PHI is returned or destroyed.
7. Amendment.
The parties may agree to amend this Agreement from time to time as is necessary for compliance
with the requirements of the Regulations, other applicable laws, and any other respect that they deem
appropriate. This Agreement shall only be amended by written instrument executed by the parties.
8. Indemnification.
To the extent permitted by Texas law,each party agrees to indemnify,defend and hold harmless
the other party and its directors, officers, employees and agents, from any and all third-party losses,
damages, claims, fines, penalties, costs and expenses, arising from, in connection with, or based on a
breach of this Agreement or a violation of the Regulations by the indemnifying party; provided,
however, that any indemnification obligations shall be reduced to the extent such losses, damages,
claims, costs and expenses arise from or are caused by the acts or omissions of the other party or its
employees,agents or subcontractors. Each party shall promptly provide written notice to the other party
of any claimed indemnification obligations;
Gallagher Business Associate Agreement
03052025
Page 6 of 8
provided,. however, that the failure to give prompt notice shall only absolve or release the indemnifying
party from its indemnification obligations to the extent actual prejudice results from the failed or delayed
notice. The indemnification obligations provided for in this Section will commence on the Effective Tate
of this Agreement and will Survive its termination. The indernnifcation obligations provided for in this
Section are limited by Texas law.
9. Limitation of Liability.
Notwithstanding anything to the contrary in this Agreement, the parties agree that all liabilities
between them under this Agreement will be subject to the limitations and exclusions of liability in the
Underlying Agreement.
10. Severability.
'file parties intend this Agreement to be enforced as written. Should any provision of this.
Agreement be held unenforceable or invalid under the laws of any jurisdiction, then the parties agree
that the remaining provisions of the Agreement shall be severed therefrom and unaffected thereby, and
that this Agreement,without the unenforceable or invalid provisions,shall remain in full force and effect.
1.1. Notices.
(a) The following are the primary contacts for purposes of any co-operation,
Communications or notices with respect to this Agreement:
(1) City of bound sock contact:
Tyler Jarl, Human Resources Manager
512-341-3143 tjarl@rouiidrocktexas.gov
roundrocktexas.gov
(2) Gallagher contact for Security Incidents or Breaches of unsecured
PI-11: e -1 _security iILI,7.
Gallagher contact for all other communications or notices relating to
this Agreement: corn.
(b) Each party shall promptly notify the other if any of the above contact
information changes.
12. Regulato!a RegulatorCompliance.
The parties shall comply with their respective obligations under the Regulations.A reference in
this Agreement to a section in the Regulations means the referenced section or its successor, and for
which compliance is required to the extent that the Regulations apply to the party.
13. Headings and Captions.
The headings and captions of the various subdivisions of the Agreement are for convenience or
reference only and will in no way modify or affect the meaning or construction of,any of the terms or
provisions hereof.
Gallagher Business Associate Agrcerraent
Page 7 of 8
14. Entire Aureement.
This Agreement sets forth the entire understanding of the parties with respect to the subject
matter herein and supersedes all prior agreements, arrangements and communications, whether oral or
written, pertaining to the subject matter hereof. In the event of any conflict between the terms and
conditions of this Agreement and the Underlying Agreement,the terms and conditions of this Agreement
shall prevail.
15. Binding Effect.
The provisions of this Agreement shall be binding upon and shall inure to the benefit of both
parties and their respective successors and assigns.
16. No Waiver.
No change, waiver or discharge of any liability or obligation hereunder oil any one or more
occasions by either patty shall be deemed a waiver of performance of any continuing or other obligation,
or shall prohibit enforcement of any obligation, on any other occasion.
17. Governing Law.
This Agreement will be governed by and construed in accordance with the laws of the State of
Texas.
IN WITNESS WHEREOF, the parties have executed this Business Associate Agreement
as of the Effective Date.
BUSINESS ASSOCIATE:
Gallagher Bene iees, Inc,
By:
Xd)-
Narric 4a&s Wright
Tithe Area President
COVERED ENTITY:
City of Round Rock
By:
Name s Bennett
Title City Manager
Gallagher Business Associate Agreement
03052025
Page 8 of 8