CONFIDENTIALITY PLAN MC SIGNED.PDF

CONFIDENTIALITY PJ.AN FOR RE-ENTRY COMMUNITY LINKAGES GRANT
1. Introduction
The Maricopa County Special Health Care District (1.1),a, Maricopa Integrated Health System (MIHS), a political
subdivisiort of the State of Arizona, as the potential Grantee under the Re-Entry Community Linkages (RE-LINK)
Grant from the Department of Health and Human Services (HHS) Office of Minority Health, submits this
Confidentiality Plan (Plan) as required by the Funding Opportunity Announcement
If awarded, MIHS win contract with TVlaricopa County (MC) and Keogh Health Connection (KI-IC) to act as its local
partners in administering the Grant In the Greater Phoenix Area. The Plan between MINS, MC, and ti-IC
recognizes MC and KHC as the local partners/business associates as defined in the HIPAA Privacy and Security
Rules. Accordingly, this Plan will include a Memorandum of Understanding (MOU) and/or Business Associate
Agreement (BM) specifying the obligations of the parties arising out of the business associate relationship.
This plan describes how WEIS, MC, and ITIC will protect the confidentiality and security of information related to
the RE-LINK Grant that identifies individual patients/clients of the local partners/business associates. Such
information will be referred to as 'individual information`. 1
2. Purposes for Which Individual Information May Be Collected
The activities or purposes for which MIHS, MG, or MC may collect individual information from focal
partners/business associates in the course of administering the Grant can be summarized as follows:
• Calculating the amount of Grant funds to be paid to sub-awandees;
• Auditing and reviewing local partners/business associates' compliance with the requirements of the
Grant, including the allowabliity of their expenditures of Grant funds;
• Compliance with program integrity and Surveillance and Util ization Review Systems (SURS)
requirements; and
• Monitoring of local partners/business associates 'fiscal integrity and quality assurance programs.
All of these activities and purposes fall within the HIPAR Privacy Rule's definitions of "b'eatment, payment and
health care operations" and/or "health oversight".
3. Collection and Flow of Individual Information
It is anticipated that most of the collection of individual information from local partners/business associates for
purposes of the Grant will be conducted by MC and Kl-IC staff, with the information then flowing from MC and KHC
to WHS. Information may be collected directly by MIHS staff, as when MIHS itself audits the records of local
partners/business associates.
4. Confidential Treatment of Individual Information
MIHS, MC, and KI-IC will maintain the confidentiality of all individual information related to the Grant which they
obtain or use. MIHS, as a HIPAA covered entity, MC and KHC, as its local partners and business associates, will
comply with the provisions of the HIPAA Privacy and Security Rules and with any other applicable provisions of
federal or Arizona statutes or regukations.
If awarded, MHS, MC, and 1<1-IC will obtain, use and retain the least amount of individual information that will
accomplish the intended purpose, in compliance with the "minimum necessary principle embodied in the HIPAA
Privacy Rule. Aggregate information, summary encounter data and de-identified data will be collected and used to
the greatest extent that is feasible without renderirxj the information meaningless or useless. When NHS, MC, or
MIHS, MC, and Kt-to also will protect the confidenhafity and security of other types of informatou as may be appropriate, such as
proprietary Information and certain personal informafion about individual owners, officers or personnel of participating clinics; however,
those matters are beyond the scope of this Plan,

KHC personnel need to examine individual information in a visit to a clinic site, they will copy or record as little of
that information as necessary, and they will take asdittle of that information back to their workplace as necessary.
5. Disclosure of Individual Information by MIHS,MC. and KHC
M1HS, MC, and KHC will not disclose individual information related to the RE-LINK Grant, either directly or
indirectly, except for purposes that are directly connected with the conduct of the Grant, The only such potential
disclosures that might be anticipated at this time would be disclosures to CMS and the U. S. Department of Health
and Human Services; in all of those cases, the purpose would be directly connected with the conduct of the Grant
and would involve oversight
For any other disclosure of individual information beyond that allowed by HIPAA. rules and regulations, the HIPAA
compliant authorization must be obtained. Although a patient/client would have the right to request and authorize
MIHS, MC, or KHC to make such a disclosure, there would seem to be no significant fiketihood that such a request
would be made.
in any event, all disclosures of individual Information to entities other than Mil-IS, MC, or KFIC will be made by
NHS. If MC and KeIC receive a request for such disclosure, it will refer the request to MIHS for response and
disposition.
6. Storage, Use and Handling of Individual Information by NHS
A. Paper Records
1. Physical Location of Paper Records; 2601 E. Roosevelt St., Phoenix, AZ 85008
2. Safeguards to Prevent Accidental or Improper Disclosure of information from Paper Records: MIHS will
store files and documents containing confidential Information in lacked rooms or storage systems when
available. In workplaces where lockable storage is not available, MIHS staff Will take reasonable efforts to
ensure the safeguarding of confidential information. MIHS will ensure files and documents containing
confidential information awaiting disposal or destruction in desk-site containers, storage rooms, or
centralized waste/shred bins are appropriately labeled, disposed of on a regular basis, and all reasonable
measures are taken to minimize access, MU-IS will ensure shredding or other authorized methods of
disposal of files and documents containing confidential information is performed on a timely basis,
documented and consistent with all applicable record retention requirements. MIHS will faster workforce
awareness of the potential for inadvertent disclosure of confidential information.
3. Personnel With Access to Information in Paper Records: M1HS staff associated with RELINK including
Senior Grants Manager, Program Coordinator, Patient Navigator, Commenity Health Worker, Grants and
Research Accountant, and physicians and/or other clinical staff. All MU-IS employees must complete
annual HIPAA training.
B. Electronic Records
1. Physical Location of Computers or Servers Storing Electronic Records and of Terminals from Which
Records Can Be Accessed: Main hospital (2601 E. Roosevelt St., Phoenix, AZ 85008) and all other MU-1S
locations.
2. Safeguards to Prevent Accidental or Improper Disclosure of Information from Electronic Records:
Medical records and other programmatic cannot be accessed by individuals who do not have a job-related
reason for accessing particular confidential information. These files are secured on encrypted servers,
accessed through password protected computers. M il-IS will ensure that all confidential information stored
on personal computers, laptops (including hard drives, disks, CDs, tapes, and other similar devices), PDAs
and other similar devices is destroyed on a timely basis, documented and consistent with all applicable
record retention requirements and all such devices must be completely wiped clean of all confidential
information prior to disposal of the device. MIHS will foster workforce awareness of the potential for

inadvertent disclosure of confidential information contained within personal computers, laptops, PDAs and
other similar devices.
3. Personnel With Access to information in Electronic Records: MU-IS staff associated with RELINK who
have completed EPIC training and granted access by MIHS IT security. Staff includes Senior Grants
Manager, Program Coordinator, Patient Navigator, Community Health Worker, and physicians andfor other
din cat staff.
7. Storage, Use and Handling, of Individual Information by MG
A, Paper Records
1. Physical Location of Paper Records: Maricopa County Adult Probation (620W Jackson St # 3098,
Phoenix, AZ 85003)
2. Safeguards to Prevent Accidental or Improper Disclosure of Information from Paper Records: Electronic
equipment, records, and manuals, as well as confidential paper records, are kept In secured locations.
Employees are trained on confidentiality of case information and there are written policies regarding the
protection and disseminator' of such information, including protected health information. Probation officers
seek consent from probationers for release of protected health information in order to coordinate with care
providers during the course of probation supervision.
3. Personnel With Access to Information in Paper Records: Adult Probation employees, who receive
Terminal Operator Certification Training that pertains to access, handling, and dissemination of criminal
justice record information and are re-certified every two years. Each employee passed an initial criminal
background check and Is subject to periodic criminal background checks.
B. Electronic- Records
1. Physical Location of Computers or Sewers Storing Electronic Records and of Terminals from Which
Records Can Be Accessed: Maricopa County Adult Probation (620W Jackson St # 3098, Phoenix, AZ
85003)
2. Safeguards to Prevent Accidental or Improper Disclosure of information from Electronic Records;
Federal and state laws and regulations restrict access to and dissemination of criminal justice record
information. Records and computer systems containing these items are kept in secured locations and are
only handled by authorized persons. Computer workstations with access to criminal justice records
systems are networked through an Arizona Department of Public Safety (DPS) approved encrypted
network with a DPS approved frewall. Adult Probation employees receive initial and ongoing training on
automated systems containing confidential adult probation and court case information, An individual user
name and password are required to access electronic records. Court Technology Services and systems
security officials implement and maintain procedures and tools to secure protected information, including
the use of encryption and firewalls. Electronic equipment, records, and Manuals, as well as confidential
paper records, are kept in secured locations. Employees are trained on oonfelentiality of case information
and there are written policies regarding the protection and dissemination of such information, including
protected health information. Probation officers seek consent from probationers for release of protected
health information in order to coordinate with care providers during the course of probation supervision.
3, Personnel With Access to Information in Electronic Records: Adult Probation employees, who receive
Terminal Operator Certification Training that pertains to access, handling, and dissemination of criminal
justice record information and are re-certified every two years. Each employee passed an initial criminal
background check and is subject to periodic criminal background checks.
B. Storage, Use and Handling of Individual Information by KHC
A. Paper Records
1. Physical Location of Paper Records: 3620 N. 4th Ave., Suite 2-2, Phoenix, AZ 85013

2. Safeguards to Prevent Accidental or Improper Disclosure of Information from Paper Records: The KHC
office suite shall be secured by a door lock and buzzer system. Management will have keys to the front
door, internal door to the Office Suite and certain office doors. The doors to the Executive Director's and
Business and Financial Manager offices are separately keyed. The building grants after-hours access only
by personal identification cards that have been specially authorized, and the betiding provides on-site
security seven days per week. At no time shall paper reports or printouts containing PHI or other
confidential information be left unsecured, unattended, or allowed to leave the KHC Office Suite. Any paper
reports or printouts that are no longer needed must be shredded and securely disposed of as soon as
possible.
3. Personnel With Access to Information in Paper Records; KEIC staff responsible for application assistance
B. Electronic Records
1. Physical Location of Computers or Servers Storing Electronic Records and of Terminals from Which
Records Can Be Accessed: 3620 N. 4th Ave., Suite 2-2, Phoenix, AZ 85013
2. Safeguards to Prevent Accidental or Improper Disclosure of Information from Electronic Records:
Network and server passwords of each Authorized Data User shall be distinct and revised on a regular
basis. All PHI provided to 1<1-IC must be securely transmitted, stored, and maintained with access granted
only to authorized personnel:1) Data must be stored electronically on KHC's server, IL) Electronic data
submissions at a minimum should utilize 256-bit encryption in transmission to guard against unauthorized
access or modification of data, lii.) The only permitted means of secure transmission of data to and from
KHC are via: File Transfer Protocol (FTP), encrypted flash drive and encrypted attachment to an email. All
remote access to the server outside of the KHC network is prohibited. The 1<1-IC firewall blocks all outside
attempt to connect to the KHC server.
3. Personnel With Access to Information in Electronic Records: All persons accessing data via the KI-IC
server must be approved and verified as Authorized Data Users at regular intervals (but no less frequently
than annually) by qualified KliC management after successful completion of annual HIPAA Compliance
and Privacy Training and annual completion of a Confidentiality Agreement.
9. Security and Confidentiality for Grantees
If awarded, Plan will include a Memorandum of Understanding (MOU) and/or Business Associate Agreement (BAA)
le5.z5s/C_ 4//4Jke /(/
Signature Date
Dr. David tMsinger, MD, FACP Jennifer M. Hawkins. MA
MINS Chairman of Department of Medicine Maricopa County HCI Administrator
Signature Date
Saundra Johnson
KHC Executive Director