Extracted text (via pymupdf_layout)
16314 characters
J-119 DSA (7-17) ARIZONA DEPARTMENT OF ECONOMIC SECURITY Page 1 of Ei Information Risk Management 3443 North Central, Mail Drop 1426, Phoenix, Arizona 85012 Phone: (602) 771-2676 Fax: (602) 364-0481 DATA SHARING REQUEST/AGREEMENT BETWEEN REQUESTING ENTITY: DES Division/Administration/Program/Office Name or External Organization Name: Maricopa County Department of Public Health AND DATA MANAGER: ARIZONA DEPARTMENT OF ECONOMIC SECURITY Division/Administration/Program/Office Name: Aging and Adult Services — Refugee Resettlement Program (RRP) DSA Effective Date: 10/01/2019 DSA Agreement No.: Contract Start Date: 10/01/2019 Contract No.: CTR044928 Contract Max End Date: 09/30/2022 UID: (If applicable) Equal Opportunity Employer/Program • Under Titles VI and VII of the Civil Rights Act of 1964 (Title VI & VII), and the Americans with Disabilities Act of 1990 (ADA), Section 504 of the Rehabilitation Act of 1973, the Age Discrimination Act of 1975, and Title II of the Genetic Information Nondiscrimination Act (GINA) of 2008; the Department prohibits discrimination in admissions, programs, services, activities, or employment based on race, color, religion, sex, national origin, age, disability, genetics and retaliation. To request this document in alternative format or for further information about this policy, contact (602) 771-2670; TTYTTDD Services: 7-1-1. • Free language assistance for DES services is available upon request. • Disponible en espariol en linea o en la oficina local. J-119 DSA (7-17) - Page 2 of 8 Agreement No. SECTION I. REQUEST (Completed by Requesting Entity) Use attachment if necessary 1a. PURPOSE OF THIS REQUEST (What information is being requested and why? How will it be used? Define business need. Give details/specifics.) To facilitate the transfer of personally identifiable data between RRP and RRP contracted and sub-contracted service providers to allow for eligibly verification of clients, enrollment into RRP funded services, and completion of mandated federal reporting. lb. INFORMATION TECHNOLOGY AND CONNECTIVITY TYPE (VPN, DVD, Citrix, Mainframe, etc.; or some other alternative way of accessing application/data?) Select all approriate and explain in detail below: Citrix I I VPN-Client I I Main Frame I I Secure-FTP Secure-Email • Other All data shall be transmitted solely through the Arizona Refugee Resettlement Program Online Data system (ARRPODS). lc. INFORMATION TYPE BEING ACCESSED (Personal Identifiable Information, FBI, SSA, HIPAA , define) Personally identifiable information (P11), including client alien numbers. ld. WILL THIS INFORMATION BE RETAINED? 0 Yes El No If Yes, where and how? Data shall only be made available to the contracted and sub-contracted entities throughout the duration of their contracts with DES/DAAS/RRP. PLEASE SELECT THE TYPE OF INFORMATION REQUESTED AND SPECIFIC FIELDS: HIPAA I I PCI I I PHI Pll I I Full Name • Home Address • SSN or National Identification Number Vehicle Registration Plate Driver's License Number Fingerprints Credit Card Numbers Digital Identity • Date of Birth Birth Place • Gender/Race Heath/Medical Records Wage/Tax Info. • Phone Number Criminal Record Medical Benefits Eligibility Records The requester enters all information required for successful communication between the requesting entity and the DES IT Staff. Contact Name (1): Charles Shipman Phone- (602) 542-6614 Contact Name (2): Christopher Tremel Phone: (520) 872-9222 Contact Address: 1789W Jefferson Phoenix AZ Contact (1) E-Mail Address: Contact (2) E-Mail Address: Contact Fax No: J-119 DSA (7-17) - Page 4 of 8 Agreement No. SECTION II STIPULATIONS REGARDING THE USE OF INFORMATION STIPULATIONS APPLICABLE TO THE REQUESTING ENTITY: 1 Disclosure of the data provided to the Requesting Entity is not permitted unless specifically authorized. 2. Repackaging or redistribution of data or screens, or creation of separate files will not be permitted unless specifically authorized. 3. The data shall be used only to assist in legal valid business needs as stated in Section I, item la of this Agreement. 4. All data shall be stored in a physically secure logically encrypted facility/system following the physical security regulations and standards based on the type of data appropriate and related standards. HIPAA / PHI / Pll / PCl/ PUB-1075 etc. 5. All data in electronic format shall be safeguarded and stored, processed and monitored so that unauthorized persons cannot compromise the information. 6. DES shall be notified within 24 hours when an information breach occurs. Notification must be in accordance with timelines based on State and Federal law. 7. Only authorized staff will be given access to accomplish the purpose(s) specified in Section I, item 1a of this Agreement. 8. Staff shall view, read or attend an authorized data security awareness training class, where they will be instructed on confidentiality, privacy laws and penalties imposed when there in any non compliance. All staff with access to DES systems and/or applications must complete an annual recertification security awareness training class as scheduled by DES. 9. A Request for Terminal Access and/or other Activity (J 125) shall be used to request specific access for each authorized staff member and must be signed by the staff supervisor or designee. 10. All authorized staff are required to sign a User Affirmation Statement (J 129), as a condition for using requested data. This affirmation statement must be resigned at three (3) year intervals as scheduled by DES. 11. Any changes requiring additional access or removal of access as, shall be reported promptly to the respective data security analyst. 12. Federal and state audit and data security personnel may have access to offices and records of the requesting entity to monitor or verify compliance with this Agreement. 13. This Data Sharing Agreement will remain in effect for 10 years from the effective date unless otherwise stipulated in Section III or overridden by the Contract, a Memorandum of Understanding or an InterAgency Agreement. If duration is overridden by another document, please reference the document in Section III. 14. Upon Contract Termination, Media Sanitization procedures shall be adhered to in accordance to Arizona Statewide Policy — P8250v 1.0 - The Business Unit shall sanitize digital and non-digital information system media containing Confidential information prior to disposal, release of organizational control, or release for reuse using defined sanitization techniques and procedures in accordance with the Media Protection Standard S8250. [NIST 800-53 MP-6] [HIPAA 164.310(d)(2)(i)] [HIPAA 164.310(d)(2)(ii)] [IRS Pub 1075] 15. All DES Contracts retention terms and conditions will be adhered to as written unless otherwise stated on DES Retention Policy [(DES 1-37-12-(01)(02)(03)] is applicable. 16. Requesting entity is responsible for all costs and licenses associated with securely connecting to DES and for maintaining confidential standards. STIPULATIONS APPLICABLE TO PROVIDER: 1 DES will use the Requesting Entity employee identifying information solely for the purpose of establishing access. 2. Only authorized DES employees will have access to requesting agency employee data. 3. In accordance with applicable federal, state, and/or local privacy regulations, DES will protect all information collected from the Requesting Entity. STIPULATIONS APPLICABLE TO HIPAA— HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT 1. All staff shall attend an authorized HIPAA awareness training class, where they will be instructed on confidentiality, privacy, information safeguards and penalties imposed when compliance is breached. 2. If applicable, a "Business Associate Contract" [45 CFR 164.502(e), 154.504(e). 164.532(d) & (e)] on file and it will be attached to this data sharing agreement as an addendum. STIPULATIONS APPLICABLE TO DIVISION DATA OWNERS: 1. DES Division Security Rep shall verify external or internal requesters and submit service desk ticket (SD) and attach the received (J-125 from external customers only) and process account. SD ticket must contain DSA# and all contents of attached J-125 in the SD summary field. DES Division Security Reps shall monitor and manage all accounts which have access to their data or with who this DSA in partnership. J-119 DSA (7-17) - Page 5 of 8 Agreement No TERMINATION OF AGREEMENT ONLY: a. Information will be returned based on Contract terms and conditions. O Yes b. Information will be truncated (erased/deleted). O Yes c. Information in physical form shall be shredded. O Yes d. All of the above. O Yes External Agency POC (Print Name) . Phone Number: Signature . Date: SECTION IV (A). RECOMMENDATIONS Meted by the Data Managing Program/DATA 0 Recommend APPROVAL Request is not recommended for approval Print Name: Chaes Shipman Phone Number: (602) 542-6614 Date: 09/06/2019 e:laVeL} 6287 Signature: Mail Drop: SECTION IV (B). PRIVACY RECOMME TION (Completed by the division HIPAA or PRIV Recommend APPROVAL Request is not recommended for approval Print Name: Phone Number: Date: Signature: Mail Drop: SECTION IV (C). DES PRISE SERVICE DELIVERY (Completed by DTS E DELIVERY MANAGER ) Recommend APPROVAL Request is not recommended for approval Print Name . Phone Number: Date . Signature: Mail Drop. Maricopa County by and through the Department of Public Health Bill Gates, Chairman Board of Supervisors ATTEST: APPROVED AS TO FORM: _______________________________ _______________________________ Office of the Clerk of the Board Attorney for Maricopa County _______________________________ _______________________________ Date Date J-119 DSA (7-17) - Page 7 of 8 ROUTING INSTRUCTIONS FOR J-119 DATA- SHARING AGREEMENT BETWEEN DES ENTITIES: 1. Section I, ll and III are completed, contact information is provided and the document is signed by the requesting Division or Program Assistant Director, Program Administrator, or designee. The requesting entity Division or Program Security Analyst sends the document to the Data Managing Division/Program Security Analyst. The DSA/PSA from the Data Managing Division/Program will complete Section III and the recommendation in Section IV. If applicable, the Division HIPAA Privacy Officer will complete the recommendation in Section IV. Reason must be given if request is not recommended for approval. Section V is signed and dated by the Data Managing Assistant Director, Program Administrator or designee. EXCEPTION: All DERS Ul Data Sharing Agreements will follow their own established process. 2. The data managing Division/Program Security Analyst forwards the Agreement to the Enterprise Delivery Team for signature and approval of Information technology connectivity. Enterprise service delivery team sends DSA back to the Division/Program security team for final signatures. The Agreement is signed, and dated by the Information Security Administrator. The original Agreement is sent back to the Division/Program entered into the tracking list. The Agreement is scanned PDF to the network share, for all data sharing agreements. DSA is not final until fully signed by all parties. NOTE: When the Agreement is modified during the approval process, both entities must review the modifications and re-sign/date the document. DATA-SHARING AGREEMENT BETWEEN DES AND AN EXTERNAL ENTITY: 1. Section I, II and III are completed by the requesting entity, contact information is provided and the document is signed by the requesting entity and Division or Program Assistant Director, Program Administrator, or designee. The Division or Program Security Analyst sends the document out for signatures. If applicable, the Division HIPAA Privacy Officer will complete the recommendation in Section IV. Reason must be given if request is not recommended for approval. Section V is signed and dated by the requesting entity administrator and Data Managing Assistant Director, Program Administrator or designee. EXCEPTION: All DERS Ul Data Sharing Agreements will follow their own established process. 2. The data managing Division/Program Security Analyst forwards the Agreement to the Enterprise Delivery Team for signature and approval of Informaton technology connectivity. Enterprise service delivery team sends DSA back to the Division/Program security team for final signatures. The Agreement is signed, and dated by the Information Security Administrator. The original Agreement is sent back to the Division/Program entered into the tracking list. The Agreement is scanned PDF to the network share, for all data sharing agreements. DSA is not final until fully signed by all parties. NOTE: When the Agreement is modified during the approval process, both entities must review the modifications and re-sign/date the document. J-119 DSA (7-17) - Page 8 of 8 DATA SHARING AGREEMENT WITH INTERNAL (if applicable) EXTERNAL CONTRACTS BETWEEN ENTITIES PROCEDURES: STEP BY STEP 1. From the Contracts Division for which the Contract has been originally created, the authorized Contracts person shall contact the Security Representative from the specific Agency for which the Contract was created, notify that a Data Sharing Agreement (DSA) is needed and being requested and a copy must be sent to the Security Representative to start the process of creating a DSA. a. NOTE: A DSA request will not be honored without a valid Contract (number) (if applicable) accompanying the DSA. 2. Any external Contracts agreed upon by DES that include the sharing of information require a J-119 — Data Sharing Agreement (DSA). The normal longevity of the J-119 DSA is 10 years. The newly agreed upon Contract terms and conditions supersedes the longevity of the DSA length of 10 years to align with the Contracts terms, conditions, and longevity. a. Example: If a newly accepted Contract of 2 years needs a DSA, the DSA will align with the Contracts longevity of 2 years. A DSA is created. b. If at the end of the 2 years the contract is renewed for 1 more year, then the contract's personnel shall inform the Agency's Security Team of the contract extension. Agency's Security Team will update the DSA tracking database to reflect the contract extension. The DSA can be renewed every year(s) up to 10 years (the total life-cycle of a DSA) before a new DSA is created. i. J-119A (Amendment Form) is required when additional access to other information not stipulated in the original DSA is being requested. For any extensions/changes of a DSA along with the following requirements: 1. J-119A must document the changes to the original DSA. 2. J-119A must document the new Contract Number. 3. Document any and all changes made on the renewed Contract that involve terms and conditions in the sharing of information. 4. Assign an agreement number to the DSA and put the Contract number on the first page of the DSA (preferably typed). 5. DSA with other hand written notes, directions, alterations and scratch offs will not be accepted by I RM. 6. Security Representative will enter all data into the DSA Database and will select status field "pending signatures to IRM." Words of CAUTION: a. Security Representative that has created the DSA will have to reproduce the DSA once again to be compliant, no exceptions. b. A DSA that is attached to a Contract will not be approved by IRM without a valid contract number. 3. When the Security Representative has completed all the applicable/signatures, the DSA agreement is enterd into the Data Security Warehouse Database by the Security Representative with a status of "Pending-IRM Approval." Afterwards the DSA agreement is sent to IRM, to DES Information SecurityAdministrator, 1720W. Madison St., Phoenix, AZ 85007 (Site Code 829Z), for final review and approval. The agreement is then signed and dated by the Information Security Administrator. 4. The original agreement is filed in the DES Data Managing Division/Program and the IRM Security Representative confirms all data in the DSA database. The Agreement is not final until signed by the IRM Security Representative, the DES Executor, and the Requesting Entity(s). 5. A final digital copy of all signatures of essential personnel mentioned above is required to IRM for IRM Security Administrator to change the DSA to ACTIVE with in the database.