BOS042623MCDPH COMPUTER USE AGREEMENT - FINAL COPY FOR SIGNATURE.PDF
Extracted text (via pymupdf)
14693 characters
1 CONFIDENTIAL STATEMENT AND COMPUTER SYSTEMS ACCEPTABLE USAGE AGREEMENT Between MARICOPA COUNTY By and through the DEPARTMENT OF PUBLIC HEALTH 4041 N. Central Avenue, #1400, Phoenix, Arizona 85012 And HONORHEALTH 8125 N. Hayden Road, Scottsdale, AZ 85258 The Maricopa County Department of Public Health and HonorHealth enter into this Agreement (the “Agreement”) effective ________________ (“Effective Date”). HonorHealth and the Maricopa County Department of Public Health shall be referred to individually as a “Party,” or collectively as the “Parties.” This Agreement is hereby made and entered into by and between the Maricopa County Department of Public Health, hereinafter referred to as MCDPH and HonorHealth, hereinafter referred to as HH. A. PURPOSE The Division of Epidemiology and Informatics of MCDPH routinely requests and receives medical records from hospitals and healthcare providers in the course of disease investigations mandated under the AZ Administrative Code Title 9, Chapter 6. MCDPH is also charged with reviewing all records related to suicide per Arizona Revised Statutes (A.R.S.) § 36-199.01 and opioid fatalities per A.R.S. Title 36, Chapter 1, Article 6 as part of its responsibility for leading the Suicide Mortality Review Board and a county requirement to continue to lead the Opioid Fatality Review Board. The purpose of this Agreement is a non-financial Confidential Statement and Computer Systems Acceptable Usage Agreement governing access by MCDPH to certain HH information, including confidential patient information available electronically, to carry out MCDPH’s duties pursuant to the authority cited herein. HH will allow MCDPH access and permit MCDPH’s physicians, healthcare providers and employees to access patient information to provide patient care, disease control services, review of suicide records and review of opioid fatality records. For the purposes of this Agreement “Confidential Information” shall be defined as proprietary information about HH and its affiliates from any source and in any form, including, paper record, verbal communication, audio recording, and electronic display, which contains information that HH treats as confidential through its policies, procedures or practices and which is not generally known to competitors or been voluntarily disclosed to the public; patient information, including information in medical records, billing records, payment or credit card, and conversations about patients; or business information of third parties having a relationship with HH, including information about third-party software and other licensed products or processes, operations, 2 quality improvement, peer review, education, billing, reimbursement, administration, or research (such as utilization reports, survey results, and related presentations). B. MCDPH SHALL 1. FOR JOB RELATED PURPOSES ONLY. MCDPH employees will only access, use and disclose Confidential Information for legitimate, job-related reasons and strictly on a need-to-know basis, and that MCDPH employees will limit access, use and disclosure to the minimum amount necessary to accomplish the intended purpose of such access, use and disclosure or as otherwise required by law. This may include clinical abstraction of charts. MCDPH employees will not access, use, or disclose patient information for personal family members, friends, roommates, neighbors, co-workers, VIPs, or others for whom MCDPH employees do not have a specific job duty related reason to access such records or have not been otherwise required by law to disclose such records to. MCDPH employees will also not access any personal patient information in the HH EMR. MCDPH employees understand that the MyChart function is to be used for any access to personal patient information. 2. PROTECTED HEALTH INFORMATION PRIVACY/SECURITY. MCDPH employees will protect the privacy, confidentiality, and security of patient information, including information in electronic medical records (“EMR”), in accordance with legal requirements, state statutes and Maricopa County policies. 3. TRAINING. MCDPH employees will provide evidence of completed HIPAA privacy and security training or will complete HH’s HIPAA privacy and security training. 4. PROTECTION OF USERNAME AND PASSWORD. MCDPH employees will not disclose to another person their username and/or password and will not use another person’s username and/or password for accessing the EMR or other Confidential Information. MCDPH employees will not leave a secured computer program unattended while still signed on. MCDPH employees understand they are responsible for any access to patient information made to the HH EMR through the use of usernames and passwords. 5. SOCIAL ENGINEERING. Email is a primary attack method of cybercriminals and they continuously use email to attack and steal login credentials. MCDPH employees agree to process email with extreme caution by never entering a username and password and clicking an email link. 6. SECURED APPLICATIONS AND RESTRICTED AREAS. MCDPH employees will not access, or otherwise attempt to access, a secured computer program or restricted area without proper authorization or for purposes other than official HH business. 7. NO UNAUTHORIZED COPY/ALTERATION/DESTRUCTION. MCDPH employees will not copy, alter, or destroy Confidential Information unless such action is part of their job or the services that they are responsible for providing to HH, in which case MCDPH employees will only copy, alter, or destroy Confidential Information in accordance with applicable legal requirements, state statutes and Maricopa County policies. 8. NO SOCIAL MEDIA/BLOGGING. MCDPH employees will not post or discuss Confidential Information of any type on any social media sites, blogs, discussion groups or similar sites. 9. AUDITING. MCDPH employees understand that access to and use of HH information systems is audited on an ongoing basis. 10. OWNERSHIP OF INFORMATION. HH will retain ownership of all rights, title, and interest in and to the Confidential Information and no rights are transferred to MCDPH by virtue of MCDPH’s access to such information. 3 11. Reporting of Issues. MCDPH employees will immediately report to their supervisor any known or suspected (a) use of their password by someone other than themselves, or (b) inappropriate access, use or disclosure of Confidential Information. If an HH sponsor/supervisor is not available, MCDPH employees will report the concern through the HH Ethics and Compliance Line service by phone at 844-732-6241 or via the Internet at www.honorhealth.ethicspoint.com. 12. SAFEGUARDING HH PROPERTY. MCDPH employees will safeguard from loss, theft, or unauthorized use, disclosure and access all HH owned equipment/property that is placed in control of an MCDPH employee and on which Confidential Information is stored or through which Confidential Information may be accessed. 13. USE OF PERSONAL EQUIPMENT/PROPERTY. MCDPH employees will not store or transmit Confidential Information via their personal equipment/property unless permitted by and in accordance with applicable HH Policies. If any patient information is stored or transmitted with equipment/property possessed by an MCDPH employee, said employee will ensure that all such Confidential Information is properly encrypted in accordance with HIPAA encryption standards. MCDPH employees will contact the HH Information Security Officer at 623-683-4174 for more information, as necessary. MCDPH employees will not send Confidential Information to personal emails or messaging services (e.g., email, text ) either in the body of the message or as an attachment. 14. NO USE OF MOBILE DEVICE/REMOVABLE MEDIA. MCDPH employees will not maintain Confidential Information on any mobile device (laptop, smartphone, tablet, etc.) that is not encrypted, will not electronically transmit Confidential Information in an unsecured manner or to an unencrypted mobile device and will not copy and store any Confidential Information on any removable media (e.g., flash drives, CDs, DVDs). 15. NO RECORDINGS. MCDPH employees will not take photographs, make videos, record audio, or make other recordings of patients, staff, or visitors except in accordance with applicable legal requirements, state statutes and Maricopa County policies. 16. RETURN OF INFORMATION/CONTINUING OBLIGATIONS. MCDPH employees will return all Confidential Information to HH and will not take any HH Confidential Information with them when work at HH ends. MCDPH employees understand that even after work ends, MCDPH employees will continue to be required to keep all Confidential Information to which they had access confidential. C. HH SHALL 1. Provide MCDPH access to Confidential Information, including Confidential Information available electronically for legitimate, job-related reasons and strictly on a need-to-know basis to carry out MCDPH’s duties pursuant to the authority cited herein. 2. Permit MCDPH and its physicians, healthcare providers and employees to access patient information to provide patient care, disease control services, review of suicide records and review of opioid fatality records. D. MODIFICATION OR AMENDMENT Modifications within the scope of the instrument shall be made by mutual consent of the parties, by the issuance of a written modification or amendment, signed and dated by all parties, prior to any changes being enacted. 4 E. TERMINATION Any of the parties, in writing, may terminate the instrument in whole or in part, at any time before the date of expiration. F. CLIENT CONFIDENTIALITY Both parties understand and concur that this Agreement is subject to all State and Federal laws protecting client confidentiality. Client/patient confidentiality will be maintained equally for all individuals presenting for services whether being provided by HH or MCDPH. The use or disclosure by either party of any information concerning an eligible individual served under this Agreement is limited to the fulfillment of this Agreement. G. LAWS, RULES, AND REGULATIONS Both parties understand and concur that this Agreement is subject to all State and Federal laws, rules and regulations that pertain hereto. H. PARTICIPATION IN SIMILAR ACTIVITIES This Agreement in no way restricts MCDPH or HH from participating in similar activities with other public or private agencies, organizations, or individuals. I. NON-LIABILITY Neither MCDPH, HH, nor their respective officers and employees shall be liable for any act or omission by the other party or other party’s subcontractor, employee, officer, agent, or representative occurring in fulfillment of this Agreement. J. INDEMNITY MCDPH agrees to indemnify, hold harmless, and defend HH, its officers and employees from and against any and all claims, damages, suits and proceedings regardless of the merits, from liability, punitive damages, costs or expense of every type, all or any part thereof arising out of or in connection with or by reason of any negligent act or omission of MCDPH or any subcontractors or anyone directly or indirectly employed by either MCDPH or any subcontractors in the performance of this Agreement. MCDPH and its subcontractors shall reimburse HH for its costs, including attorney’s fees for defense of any litigation arising from such claim. MCDPH shall include a clause to this effect in all subcontracts inuring to the benefit of HH. Similarly, HH agrees to indemnify, hold harmless, and defend MCDPH, its officers and employees from and against any and all claims, damages, suits and proceedings regardless of the merits, from liability, punitive damages, costs or expense of every type, all or any part thereof arising out of or in connection with or by reason of any negligent act or omission of HH or any subcontractors or anyone directly or indirectly employee by HH or any subcontractors in the performance of this Agreement. HH and its subcontractors shall reimburse MCDPH for its costs, including attorney’s fees for defense of any litigation arising from such claim. HH shall include a clause to this effect in all subcontracts inuring to the benefit of MCDPH and Maricopa County. K. COMMUNICATION Each party agrees to notify the other, in writing of changes in policy which may affect this Agreement. Notification is to be made to the attention of the principal contacts identified in Section L below. 5 L. STATUTORY RIGHT OF CANCELLATION FOR CONFLICT OF INTEREST Pursuant to A.R.S. § 38-511, the County may cancel this Agreement without penalty or further obligation, within three years after the execution of this Agreement, if any person significantly involved in initiating, negotiating, securing, drafting, or creating this Agreement on behalf of the County is, at any time while this Agreement or any extension of this Agreement is in effect, an employee or an agent of any other Party to this Agreement in any capacity or is a consultant to any other Party to this Agreement with respect to the subject matter of this Agreement. In addition, the County may recoup any fee or commission paid or due to any person significantly involved in initiating, negotiating, securing, drafting, or creating this Agreement on behalf of the County from any other Party to this Agreement arising as the result of this Agreement. M. PRINCIPAL CONTACT The principal contacts of this Agreement are: Maricopa County Department of Public Health: Jessica White, DrPH, MS, MLS (ASCP)cm Phone: 602-329-0254 FAX: 602-506-6885 Email: Jessica.White@Maricopa.gov HonorHealth: Erin Davis Phone: 480-587-5102 Email: eridavis@honorhealth.com IN WITNESS WHEREOF, the parties agree to the terms contained herein: FOR AND ON HALF OF FOR AND ON BEHALF OF MARICOPA COUNTY HONORHEALTH By____________________________ By John Neil, MD Chairman, Board of Supervisors EVP, Chief Physician Executive & Network Strategy Officer ______________________________ Date Date ATTEST: ______________________________ Clerk of the Board ______________________________ Date 6 APPROVED AS TO FORM APROVED AS TO FORM ______________________________ _______________________________ Attorney for Maricopa County ______________________________ _______________________________ Date Date