REVISED MARICOPA_BAA_CDCF_EFF09.06.22.DOCX

BUSINESS ASSOCIATE AGREEMENT 
BETWEEN
MARICOPA COUNTY DEPARTMENT OF 
PUBLIC HEALTH
AND
I.
PURPOSE
THE CDC FOUNDATION
Maricopa County Department of Public Health (hereafter referred to as “Covered Entity”) and the CDC 
Foundation (hereafter referred to as “Business Associate”) desire to enter into this Business Associate 
Agreement (hereafter, “BA Agreement” or “the Agreement”) for the purpose of protecting the privacy and 
security of clients’ health information under the Health Insurance Portability and Accountability Act of 1996 
(HIPAA), including all pertinent regulations ( 45 CFR Part 160 and Part 164), as amended by Subtitle D of 
the Health Information Technology for Economic and Clinical Health Act HITECH), Title XIII of the 
American Recovery and Reinvestment Act of 2009 (Pub. L. 111-5).
II.
DEFINITIONS Terms used, but not otherwise defined, in this Agreement shall have the same meanings as 
set forth in HIPAA and HITECH. A change to HIPAA or HITECH which modifies any defined term, or 
which alters the regulatory citation for the definition, shall be deemed incorporated into this Agreement.
a.
Breach. “Breach” shall have the meaning given under HITECH Section 13400, 42 U.S.C § 17921, and 
45 CFR §164.402.
b.
Data Aggregation. “Data Aggregation” shall have the meaning given under the Privacy Rule, including, 
but not limited to, 45 CFR §164.501.
c.
Designated Record Set. “Designated Record Set” shall have the same meaning as the term “designated 
record set” in 45 CFR §164.501.
d.
Disclose” and “Disclosure” shall have the meaning given in 45 CFR §160.103.
e.
Electronic Protected Health Information. "Electronic Protected Health Information" (referred to below 
as EPHI) shall have the same meaning as the term "electronic protected health information" in 45 CFR
§ 160.103.
f.
HIPAA. “HIPAA” shall mean the Health Insurance Portability and Accountability Act of 1996, Public 
Law 104-91, as amended, and related HIPAA regulations (45 CFR Parts 160-164.)
g.
HITECH. “HITECH” shall mean the Health Information Technology for Economic and Clinical Health 
Act, found in Title XIII of the American Recovery and Reinvestment Act of 2009, Public Law 111-005.
h.
Individual. "Individual" shall have the same meaning as the term "individual" in 45 CFR § 160.103 and 
shall include a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g).
i.
Memorandum of Agreement (MOA).  “MOA” shall mean the Memorandum of Agreement entered into 
between Covered Entity and Business Associate for the purpose of supporting public health workforce 
staffing initiatives.
j.
Privacy Rule. “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health 
Information codified at 45 CFR Part 160 and Part 164, Subparts A and E and any other applicable 
provisions of HIPAA, or amendments thereto, including HITECH.
k.
Protected Health Information. "Protected Health Information" (referred to below as PHI) shall have the 
same definition contained in 45 CFR §160.103. For purposes of this Agreement, PHI is limited to the 
information created or received by Business Associate from or on behalf of Covered Entity. “Protected

Health Information" includes, without limitation, "Electronic Protected Health Information," as defined 
below.

l.
Required By Law. “Required By Law” shall have the meaning given to the term under the Privacy Rule, 
including but not limited to, 45 CFR §164.103, and any additional requirements created under HITECH.
m. Secretary. "Secretary" shall mean the Secretary of the U. S. Department of Health and Human Services 
or his/her designee.
n.
Security Incident. “Security Incident” shall have the meaning given in 45 CFR §164.304.
o.
Security Standards. “Security Standards” shall mean the Standards for the Protection of Electronic 
Protected Health Information that are codified at 45 CFR Part 160 and Part 164, Subparts A and C, and 
any other applicable provision of HIPAA, or amendments thereto, including HITECH.
p.
Unsecured PHI. ‘Unsecured PHI” shall mean PHI that is not secured through the use of a technology or 
methodology specified by the Secretary in guidance or as otherwise defined in Section 13402 of 
HITECH.
q.
“Use” or “Uses” shall have the meaning given in 45 CFR §160.103.
III.
USE OR DISCLOSURE OF PHI BY BUSINESS ASSOCIATE
a.
Except as otherwise limited in this Agreement, Business Associate may use or disclose PHI to perform 
functions, activities, or services for, or on behalf of, Covered Entity as specified in the MOA, or as 
otherwise provided by law, if such use or disclosure would not violate the Privacy Rule or the Security 
Standards if done by Covered Entity.
b.
Except as otherwise limited in this Agreement, Business Associate may use PHI for the proper 
management and administration of the Business Associate or to carry out the legal responsibilities of the 
Business Associate, and may disclose PHI for those purposes provided that as to any such disclosure: 1) 
the disclosure is required by law; or 2) Business Associate obtains reasonable assurances from the person 
to whom the information is disclosed that it will remain confidential and will be used or further disclosed 
only as required by law or for the purpose for which it was disclosed to the person, and the person notifies 
the Business Associate of any instances of which the person is aware in which the confidentiality of the 
information has been breached.
c.
Business Associate will notify the Covered Entity of any breach of confidentiality or security by a person 
to whom the Business Associate has disclosed PHI pursuant to this Section and will mitigate and/or 
assist the person and the Covered Entity in mitigating any harmful effects resulting from the breach of 
information.
d.
Except as otherwise limited in this Agreement, Business Associate may use PHI to provide Data 
Aggregation services to Covered Entity as permitted by 42 CFR § 164.504(e)(2)(i)(B).
e.
Business Associate may use PHI to report violations of law to appropriate Federal and State authorities, 
consistent with § 164.502(j)(1).
f.
Business Associate may disclose PHI to any of its subcontractors for use in filling the obligations of this 
Agreement as long as the subcontractor agrees in writing to the restrictions and conditions in this 
Agreement with respect to PHI.
g.
Business Associate may disclose PHI to another entity as authorized by the Covered Entity in a separate 
written agreement or amendment to this Agreement if such disclosure of PHI would not violate the 
Privacy Rule or HITECH if done by Covered Entity itself.
h.
Business Associate, upon entering into an agreement using PHI for any of its functions and activities on 
behalf of the Covered Entity or in its general operations, will make available that agreement to the 
Covered Entity upon request.
IV.
DUTIES OF BUSINESS ASSOCIATE RELATIVE TO PHI
a.
Business Associate shall comply with the Confidentiality provision contained in the MOA and any 
Confidentiality Agreement signed by the Business Associate pursuant to that MOA for so long as this BA 
Agreement remains in effect.

b.
Business Associate shall not use or disclose PHI other than as permitted or required by this Agreement 
or as required by law. Business Associate will not use PHI in any manner that would constitute a 
violation of the Privacy Rule, Security Standards, HIPAA, or HITECH if so, used by Covered Entity.
c.
Business Associate shall develop, implement, maintain, and use appropriate safeguards to prevent any 
use or disclosure of PHI or EPHI other than as provided by this Agreement, and shall implement 
administrative, physical, and technical safeguards to comply with the Security Standards as required by 
45 CFR Sections 164.308, 164.310, 164.312 and 164.316 in order to protect the confidentiality, integrity, 
and availability of EPHI or PHI that Business Associate creates, receives, maintains, or transmits, to the 
same extent as if Business Associate were a Covered Entity, pursuant to HITECH Section 13401, 42
U.S.C. § 17931. These safeguards are required regardless of the mechanism used to transmit the 
information.
d.
Business Associate shall adopt the effective and appropriate technical safeguards and technology and 
methodology standards provided in any guidance issued by the Secretary pursuant to HITECH Sections 
13401-13402, 42 U.S.C. §§ 17931-17932.
e.
Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to 
Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements 
of this Agreement or of a Breach of Unsecured PHI, pursuant to 45 CFR § 164.530(f) and HITECH
§13402.
f.
Business Associate shall notify Covered Entity by the most expedient manner within one business day 
of any use or disclosure of PHI or EPHI not authorized by this Agreement or in violation of any 
applicable federal or state laws or regulations of which Business Associate becomes aware, or of any 
suspected or actual Security Incident or Breach, unless delayed in accordance with 45 CFR §164.412. 
Business Associate shall notify Covered Entity immediately upon the law enforcement delay being lifted.
g.
In addition to the notification required by IV(f), Business Associate will provide written notification of 
a Breach of Unsecured PHI to Covered Entity without unreasonable delay and in no event later than 5 
calendar days after discovery of the Breach. A Breach of Unsecured PHI shall be treated as discovered 
by the Business Associate as of the first day on which such breach is known to Business Associate or, 
by exercising reasonable diligence, would have been known to the Business Associate. Notification of 
a Breach of Unsecured PHI required by this paragraph shall comply with HITECH Section 13402, 42
U.S.C. § 17932, and 45 CFR § 164.410. The Breach notice shall include, to the extent possible, the 
identification of each individual whose Unsecured PHI has been or is reasonably believed by the 
Business Associate to have been, accessed, acquired, or disclosed during the Breach. Business Associate 
shall provide Covered Entity with the following information at the time of the Breach notification or 
promptly thereafter as soon as information becomes available:
1.
A brief description of what happened, including the date of the Breach and the date of the discovery 
of the Breach, if known, and the nature of the non-permitted use or disclosure.
2.
A description of the unsecured PHI that was involved in the Breach (such as whether full name, 
social security number, date of birth, home address, account number, diagnosis, disability code, or 
other types of information were involved).
3.
Who made the non-permitted use or disclosure.
4.
Who received the non-permitted use or disclosure.
5.
Any steps individuals should take to protect themselves from potential harm resulting from the 
Breach; and
6.
What Business Associate is doing to investigate the Breach, to mitigate harm to individuals, and to 
protect against any further breaches.
h.
Business Associate shall ensure that any agent or subcontractor to whom it provides PHI received from 
Covered Entity, or that creates, receives, maintains, or transmits PHI on behalf of Business Associate,

agrees to the same restrictions and conditions that apply through this Agreement to Business Associate 
with respect to such information, including this paragraph, and agrees to implement reasonable and 
appropriate safeguards to protect such PHI, including the safeguards required by paragraph IV(c) and 
IV(d) above with respect to PHI. Business Associate shall implement and maintain sanctions against 
agents and subcontractors that violate such restrictions and conditions and shall mitigate the effects of 
such violation.
i.
Business Associate shall provide access, at the request of Covered Entity, and in the time and manner 
designated by Covered Entity, to PHI in a Designated Record Set, to Covered Entity or, as directed by 
Covered Entity, to an Individual in order to fulfill the requirements of 45 CFR § 164.524 if the Business 
Associate has PHI in a designated record set. If Business Associate receives a request directly from an 
Individual, Business Associate will direct the Individual to the Covered Entity.
j.
Business Associate shall make any amendment(s) to PHI in a Designated Record Set that the Covered 
Entity directs or agrees to pursuant to 45 CFR § 164.526 at the request of Covered Entity or an Individual, 
and in the time and manner designated by Covered Entity, if Business Associate has PHI in a Designated 
Record St. Business Associate shall not amend PHI received from the Covered Entity or created and/or 
provided to the Business Associate on behalf of the Covered Entity unless the amendment is directed by 
or consented to by the Covered Entity. If an Individual requests an amendment of PHI directly from 
Business Associate or any of its agents or subcontractors, Business Associate will direct Individual to 
Covered Entity. The Business Associate shall provide a copy of the amended PHI to the Covered Entity.
k.
Business Associate agrees to document such disclosures of PHI and information related to such 
disclosures as would be required for Covered Entity to respond to a request by an Individual for an 
accounting of disclosures of PHI in accordance with 45 CFR § 164.528. Business Associate agrees to 
collect and maintain disclosure information as it relates to PHI including: (i) the date of disclosure; (ii) 
the name of the entity or person who received the PHI and, if known, the address of the entity or person:
(iii) a brief description of the PHI disclosed; and (iv) a brief statement of purpose of the disclosure that 
reasonably informs the Individual of the basis for the disclosure, or a copy of the written request for 
disclosure under 45 CFR § 164.502(a)(2)(ii) or 164.512, if any. Business Associate will maintain records 
related to disclosures of PHI for at least six (6) years after the date of the disclosure. The provisions of 
this subparagraph shall survive termination of this Agreement.
l.
Business Associate will provide to Covered Entity or an Individual, in the time and manner designated 
by Covered Entity, information collected in accordance with Section IV(k) of this Agreement, to permit 
Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in 
accordance with 45 CFR § 164.528. In addition, Business Associate agrees to make PHI available for 
purposes of accounting of disclosures as required by Section 164.528 of the Privacy Rule and Section 
13405(c)(3) of HITECH, 42 U.S.C. § 17935(c)(3). If the request for an accounting is delivered directly 
to Business Associate or its agents or subcontractors, Business Associate shall within five (5) days of a 
request forward it to Covered Entity in writing.
m. Business Associate shall comply with any requests for restrictions on certain disclosures of PHI pursuant 
to Section 164.522 of the Privacy Rule to which Covered Entity has agreed and of which Business 
Associate is notified by Covered Entity
n.
Business Associate shall comply, pursuant to HITECH and its implementing regulations, with all 
additional requirements of the Privacy Rule, including those contained in 45 CFR 164.502(e) and 
164.504(e)(1)(ii) at such time as the requirements are applicable to Business Associate, pursuant to 
HITECH Section 13404, 42 U.S.C. § 17934.
o.
If applicable, and if requested by Covered Entity, Business Associate will provide a copy of Covered 
Entity’s Notice of Privacy Practices to the client at the time of first contact and maintain documentation 
of the client’s receipt of the Notice.
p.
Business Associate shall make its internal practices, books, and records, including policies and 
procedures and PHI, relating to the use and disclosure of PHI received from, or created or received by 
Business Associate on behalf of, Covered Entity available to the Secretary for purposes of the Secretary 
determining compliance with the Privacy Rule. Business Associate shall comply and cooperate with any 
request for documents or other information from the Secretary directed to Covered Entity that seeks 
documents or other information held by Business Associate. Business Associate shall provide to 
Covered Entity a copy of any PHI that Business Associate provides to the Secretary concurrently with 
providing such PHI to the Secretary.

q.
Business Associate and its agents and subcontractors may only request, use, or disclose the minimum 
amount of PHI necessary to accomplish the purpose of the request, use, or disclosure pursuant to this 
Agreement and consistent with Covered Entity’s minimum necessary policies and procedures. Except as 
otherwise permitted by HIPAA standards, until the effective date on which the Secretary issues guidance 
on what constitutes “minimum necessary,” when using or disclosing PHI or responding to a request for 
PHI, Business Associate and its agents or subcontractors must limit such PHI, to the extent practicable, 
to a Limited Data Set, or if more information than a Limited Data Set is required, to the minimum 
necessary to accomplish the intended purpose of such use, disclosure or request. After the effective date 
on which the Secretary issues guidance on what constitutes “minimum necessary,” Business Associate 
and its agents or subcontractors shall only request, use, and disclose the minimum amount of PHI 
necessary to accomplish the purpose of the request, use or disclosure, and shall comply with the 
Secretary’s guidance on what constitutes “minimum necessary.” See HITECH Section 13405, 42 U.S.C.
§ 17935.
r.
Business Associate shall provide Covered Entity reasonable access to its premises for review and 
demonstration of its internal practices and procedures for safeguarding PHI of Covered Entity for 
purposes of determining that Business Associate has complied with this Agreement and HITECH; 
provided that 1) the Parties mutually agree in advance upon the scope, location and timing of such access, 
and 2) Covered Entity shall protect confidential and proprietary information of Business Associate to 
which Covered Entity has access.
s.
Business Associate acknowledges that Business Associate has no ownership rights with respect to the 
PHI.
t.
If Business Associate knows of a pattern of activity or practice of Covered Entity that constitutes a 
material breach or violation of Covered Entity’s obligations under the Agreement or other arrangement, 
Business Associate must take reasonable steps to cure the breach or end the violation. If the steps are 
unsuccessful, Business Associate must terminate the Agreement or other arrangement if feasible, or, if 
termination is not feasible, report the problem to the Secretary. Business Associate shall provide written 
notice to Covered Entity of any pattern of activity or practice of the Covered Entity that Business 
Associate believes constitutes a material breach or violation of the Covered Entity’s obligations under 
the Agreement within five (5) days of discovery and shall meet with Covered Entity to discuss and 
attempt to resolve the problem as one of the reasonable steps to cure the breach or end the violation.
u.
Business Associate acknowledges that if it violates any of the requirements provided under this Business 
Associate Agreement, Business Associate will be subject to the same civil and criminal penalties that a 
Covered Entity would be subject to if such Covered Entity violated the same requirement.
v.
The additional requirements of HITECH that relate to privacy and security and that are made applicable 
with respect to covered entities shall also be applicable to Business Associate and shall be and by this 
reference are incorporated into this Agreement.
w.
Business Associate will contact the Covered Entity’s Privacy Officer Christina Mrukowicz at 
christina.mrukowicz@maricopa.gov at any time clarification or guidance is needed regarding 
compliance with the terms of this Agreement.
x.
Business Associate shall not use or disclose PHI for fundraising or marketing purposes.
y.
Business Associate may not enter into any agreements with its agents or subcontractors pertaining to its 
obligations under this Agreement without the express written consent of Covered Entity.
V.
DUTIES OF COVERED ENTITY
a.
If applicable, Covered Entity shall provide the Business Associate with a copy of its policies and 
procedures implementing the Privacy Rule, including the Notice of Privacy Practices.
b.
Covered Entity shall notify Business Associate of any limitation(s) in Covered Entity’s Notice of Privacy 
Practices in accordance with 45 CFR § 164.520, to the extent that such limitation may affect Business 
Associate's use or disclosure of PHI.
c.
Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by an 
Individual to use or disclose PHI, to the extent that such changes may affect Business Associate's use or 
disclosure of PHI, within a reasonable period of time after Covered Entity becomes aware of such 
changes to or revocation of permission.

d.
Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that 
Covered Entity has agreed to or must comply with in accordance with 45 CFR § 164.522 and HITECH
§ 13405(a), 42 USC § 17935(a), to the extent that such restriction may affect Business Associate's use 
or disclosure of PHI.
e.
Covered Entity will not request Business Associate to use or disclose PHI in any manner that would not 
be permissible under the Privacy Rule if done by Covered Entity.
VI.
TERM AND TERMINATION
a.
Term. The Term of this Agreement shall be effective as of September 6, 2022, and shall terminate on 
July 31, 2023, or on the date Covered Entity terminates for cause as authorized in paragraph (b) of this 
Section, whichever is sooner. This agreement may be renewed annually unless terminated by either 
Party, by providing thirty (30) days written notice of termination to the other party.
b.
Termination for Cause. Upon Covered Entity's knowledge of a material breach of this Agreement by 
Business Associate, Covered Entity shall do any of the following:
1.
Provide an opportunity for Business Associate to cure the breach or end the violation and terminate 
this Agreement and MOA if Business Associate does not cure the breach or end the violation within 
the time specified by Covered Entity.
2.
Immediately terminate this Agreement and MOA if Business Associate has breached a material term 
of this Agreement and cure is not feasible.
3.
If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.
4.
Immediately stop all further disclosures of PHI to Business Associate pursuant to each agreement 
between Covered Entity and Business Associate that is the subject of such breach, until the breach 
is cured.
c.
Effect of Termination.
1.
Except as provided in paragraph (2) of this section, upon termination of this Agreement for any 
reason or upon written demand from Covered Entity, Business Associate shall return or destroy all 
PHI received from Covered Entity or created or received by Business Associate on behalf of 
Covered Entity. This provision shall apply to PHI that is in the possession of subcontractors or 
agents of Business Associate. Business Associate shall retain no copies, including backups, of the 
PHI. If the return or destruction of PHI held by the Business Associate is not permissible pursuant 
to applicable law, the Business Associate will extend the protections of this Agreement to the PHI 
and limit further uses and disclosures to those purposes that make the return or destruction of the 
PHI infeasible.
2.
In the event that Business Associate determines that returning or destroying the PHI is infeasible, 
Business Associate shall provide to Covered Entity notification of the conditions that make return 
or destruction infeasible. Upon mutual agreement of the parties that return, or destruction of PHI is 
infeasible, Business Associate shall extend the protections of this Agreement to such PHI and limit 
further uses and disclosures of such PHI to those purposes that make the return or destruction 
infeasible, for so long as Business Associate maintains such PHI.
d.
Continuing Privacy Obligation. Business Associate’s obligation to protect the privacy of PHI is 
continuous and survives any termination, cancellation, expiration, or other conclusion of this Agreement 
or any other agreement between Business Associate and Covered Entity.
VII.
INDEMNIFICATION (the following does not apply to other government agencies or political 
subdivisions)
Business Associate agrees to indemnify and hold harmless Covered Entity from any claims, demand, suit, 
loss, liability, or administrative penalties that the Covered Entity may sustain as a result of the Business 
Associate’s breach of this Agreement, including any breach of confidentiality by a person to whom the 
Business Associate has disclosed information pursuant to this Agreement; provided, however, that the 
Business Associate shall not hold the Covered Entity harmless from any claims, demands or causes of action

arising or resulting directly or indirectly from negligence of the Covered Entity, its officers, agents, 
representatives or employees, or any person or entity not subject to the Business Associate’s supervision or 
control. This indemnification shall include reasonable expenses including attorney’s fees incurred by 
defending such claims and damages incurred by reason of the Business Associate’s failure to comply with 
applicable laws and regulations or for damages caused by the Business Associate, its employees and/or 
agents, including subcontractors. As a condition precedent to asserting a right of indemnity, the Covered 
Entity shall provide timely written notice to the Business Associate of the assertion of the claim to which the 
right of indemnification is claimed to exist.
VIII.
MISCELLANEOUS
a.
Regulatory References. A reference in this Agreement to a section in the Privacy Rule or the Security 
Standards means the section as in effect or as amended.
b.
Amendment. The Parties agree to take such action as is necessary to amend this Agreement to comply 
with the requirements of the Privacy Rule, the Security Standards, HIPAA, HITECH, or any other state 
or federal law affecting this Agreement. If a Party believes in good faith that any provision of this 
Agreement fails to comply with the then-current requirements of HITECH or its regulations, such Party 
shall notify the other Party in writing. For a period of thirty days, the Parties shall address such concern 
in good faith and amend the terms of the Agreement if necessary to bring it into compliance. If, after 
such thirty-day (30) period, the Agreement fails to comply with HIPAA, the Privacy Rule, the Security 
Standards or HITECH, then either Party has the right to terminate upon written notice to the other Party.
c.
Survival. The respective rights and obligations of Business Associate under Section VI(c) and VI(d) of 
this Agreement shall survive termination of this Agreement.
d.
Interpretation. Any ambiguity in this Agreement shall be resolved to permit Covered Entity to comply 
with the Privacy Rule and the Security Standards.
e.
All notices pursuant to this Agreement must be given in writing and shall be effective when received if 
hand-delivered or upon dispatch if sent by reputable overnight delivery service, facsimile, or U.S. Mail 
to the appropriate address or facsimile number. Notification of any unauthorized use or disclosure of 
PHI or of a Breach of Unsecured PHI under paragraphs IV(f) and IV(g) shall be made to Christina 
Mrukowicz at christina.mrukowicz@maricopa.gov or Jessica White at jessica.white@maricopa.gov.
f.
Business Associate and Covered Entity agree that Individuals who are the subject of PHI are not third- 
party beneficiaries of this Agreement.
g.
The parties acknowledge that state and federal laws relating to electronic data security and privacy are 
evolving and that amendment of this Agreement may be required to provide for procedures to ensure 
compliance with such developments. The parties specifically agree to take such action as is necessary to 
implement the standards and requirements of HIPAA and HITECH and other applicable laws relating to 
the security or confidentiality of PHI. The parties understand and agree that Covered Entity must receive 
satisfactory written assurance from Business Associate that Business Associate will adequately 
safeguard all PHI that it receives or creates pursuant to this Agreement. Upon Covered Entity’s request, 
Business Associate agrees to promptly enter into negotiations with Covered Entity concerning the terms 
of any amendment to the Agreement embodying written assurances consistent with the standards and 
requirements of HIPAA and HITECH or other applicable laws. Covered Entity may terminate this 
Agreement and MOA upon thirty (30) days written notice if (i) Business Associate does not promptly 
enter into negotiations to amend this Agreement when requested by Covered Entity pursuant to this 
Section, or (ii) Business Associate does not enter into an amendment to this Agreement providing 
assurances regarding the safeguarding of PHI that Covered Entity, in its sole discretion, deems sufficient 
to satisfy the standards and requirements of HIPAA and HITECH.
h.
If any provision of this Agreement violates any applicable statute, ordinance, or rule of law in any 
jurisdiction that governs this Agreement, such provision shall be ineffective to the extent of such 
violation without invalidating any other provision of this Agreement.
i.
This Agreement may not be amended, altered, or modified except by written agreement signed by 
Business Associate and Covered Entity.
j.
No provision of this Agreement may be waived except by an agreement in writing signed by the waiving 
party. A waiver of any term or provision shall not be construed as a waiver of any other term or provision.

k.
The persons signing below have the right and authority to execute this Agreement for their respective 
entities and no further approvals are necessary to create a binding Agreement.
l.
Neither Covered Entity nor Business Associate shall use the names or trademarks of the other party or 
of any of the respective party’s affiliated entities in any advertising, publicity, endorsement, or promotion 
unless prior written consent has been obtained for the particular use contemplated.
m. All references to specific statutes, codes, or regulations shall be deemed to be references to those statutes, 
codes, or regulations as they may be amended from time to time.
n.
Neither party is an employee, agent, partner, or joint ventures of the other. Neither party has the right or 
authority to control or direct the activities of the other or the right or authority to bind the other to any 
agreement with a third party or to incur any obligation or liability on behalf of the other party, unless 
expressly authorized in this or another agreement between the parties.
o.
Notice is given that pursuant to A.R.S. § 38-511 the County may cancel any Contract without penalty or 
further obligation within three years after execution of the Contract, if any person significantly involved 
in initiating, negotiating, securing, drafting or creating the Contract on behalf of the County is at any 
time while the Contract or any extension of the Contract is in effect, an employee or agent of any other 
party to the Contract in any capacity or consultant to any other party of the Contract with respect to the 
subject matter of the Contract.  Additionally, pursuant to A.R.S § 38-511 the County may recoup any 
fee or commission paid or due to any person significantly involved in initiating, negotiating, securing, 
drafting or creating the Contract on behalf of the County from any other party to the Contract arising as 
the result of the Contract.
IN WITNESS WHEREOF, the parties have executed this Agreement.
Maricopa County Department of Public Health
BY:
CDC Foundation
BY: 
Christina Mrukowicz
DATE: 
 
MAILING ADDRESS:
Monique S. Patrick, COO
DATE: 
MAILING ADDRESS:

FOR MARICOPA COUNTY:
Clint Hickman, Chairman
Date
ATTEST:
Clerk of the Board
Date
APPROVE AS TO FORM:
Attorney for Maricopa County
Date