BUSINESS ASSOC AGMT WITH FALCON PRACTICE MGMT.PDF

MARICOPA COUNTY
By and Through its
Department of Public Health (MCDPH),
Clinical Services
BUSINESS ASSOCIATE AGREEMENT
This Agreement sets out the responsibilities and obligations of Logsdon, Michelle d/b/a Falcon Practice
Management, (Business Associate" or "Associate") as a business associate of the MARICOPA COUNTY, a covered
entity, under the Health Insurance Portability and Accountability Act ("HIPAA"), the Health information Technology for
Economic and Clinical Health ("HITECH") Act, and pursuant to the Contract or Engagement Letter between
Associate and MARICOPA COUNTY.
MARICOPA COUNTY may make available and/or transfer to Associate Protected Health Information ("PHI") of
individuals in conjunction with Services, which Associate will use or disclose only in accordance with this Agreement.
Associate and MARICOPA COUNTY agree to the terms and conditions of this Agreement in order to comply with the
use and handling of PHI under the HIPAA Standards for Privacy of Individually Identifiable Health Information, 45
C.F.R. Part 160 and Part 164, Subpart E ("Privacy Standards") and the H1PAA Security Standards, 45 C.F.R. Part
160 and Part 164, Subpart C ("Security Standards"), both as amended from time to time. Unless otherwise provided,
all capitalized terms in this Agreement will have the same meaning as provided under the Privacy Standards and
Security Standards. Associate and MAR1COPA COUNTY will comply with the terms of this Agreement for the
duration of the Contract or Engagement Letter and for such other continuing periods as provided in this Agreement.
Upon the compliance date of any final regulation or amendment to final regulation promulgated by the Secretary of
Health and Human Services that affects Associate's use or disclosure of PHI, the parties agree to take such
reasonable action as is necessary to amend this Agreement in order for MARICOPA COUNTY to comply with such
final regulation or amendment to final regulation.
Definitions for terms in this Agreement:
1. Business Associate or Associate means an entity that performs or assists in the performance of a function on
behalf of a Covered Entity, which involves the use, or disclosure of Individually Identifiable Health Information
as defined in 45 C.F.R. § 160.103. In addition, an Associate can be an entity that provides data transmission
services to a Covered Entity, is more than a mere conduit of information, and allows a Covered Entity to
access the maintained information in a manner beyond a random or infrequent basis. The terms "Business
Associate", "Associate" and "Contractor" are synonymous. Notwithstanding this definition, if Contractor does
not have access to or create Protected Health Information under this Contract, Contractor is not an
Associate, and the terms of this Agreement do not apply to Contractor.
2. Contractors of Business Associate means a person or an entity to whom an Associate delegates a function,
activity, or service that the Associate has agreed to perform for a Covered Entity. A contractor of an
Associate which creates, receives, maintains, or transmits personal health information on behalf of the
business associate is itself a Business Associate and therefore will comply with the terms of this Agreement.
For purposes of this Agreement the term "Contractor" includes the Contractor, its employees, its
subcontractors and its agents.
Maricopa County Business Associate Agreement 1
4/3/2015

3. Protected Health Information ("PHI") means the health information that is created or received by a Covered
Entity; and relates to the physical condition, mental health or other health condition of an Individual, or to the
provision of health care to the Individual (including but not limited to the payment for such health care); and
identifies or can be used to identify the Individual as defined in 45 C.F.R. § 160.103.
4. Individual shall have the meaning set forth in 45 CFR §160.103, including a person who is the subject of the
Protected Health Information, and shall include an individual or entity who qualifies as a personal, legal
representative of the person, as the context requires.
5. Privacy Rule shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR
Parts 160 and 164, Subparts A and E, as may be amended, modified or superseded, from time to time.
6. Security Rule shall mean the Standards for Security of Individually Identifiable Electronic Health Information at
45 CFR Parts 160 and 164, Subparts A, C and E, as may be amended, modified or superseded, from time to
time.
7. Breach shall mean the acquisition, access, use or disclosure of Protected Health Information in a manner not
permitted by the HIPAA Privacy Rule, that compromises the security or privacy of the Protected Health
Information as defined, and subject to the exception given to such term in 45 C.F.R. § 164.402.
8. Breach Notification Rule shall mean the interim final rule related to breach notification for unsecured protected
health information at 45 C.F.R. Parts 160 and 164.
9. Covered Entity shall have the meaning given to such term in 45 C.F.R. § 160.103.
10. Designated Record Set shall have the meaning given to such term under the Privacy Rule at 45 C.F.R. §
164.501.
11. Security Incident shall have the meaning given to such phrase under the Security Rule at 45 C.F.R. § 164.304.
12. Unsecured PHI shall have the meaning given to such phrase under the Breach Notification Rule at 45 C.F.R. §
164.402.
13. Electronic Protected Health Information or ePHI shall have the same meaning given to such term under the
Security Rule, including, but not limited to, 45 C.F.R. § 160.103.
14. Electronic Media shall have the same meaning given to such term in 45 C.F.R. § 160.103,
15. Health Information Technology for Economic and Clinical Health (HITECH) Act, as codified at 42 U.S.C.
§§ 17921-17954.
16. Secretary shall mean the Secretary of the Department of Health and Human Services or his or her designee.
It is agreed by and between the parties that:
1. Uses and Disclosures of Protected Health Information. Associate will use and disclose PHI only for those
purposes necessary to perform its duties, obligations and functions under the Contract, or as otherwise
expressly permitted in this Agreement or as required by other law.
a. Associate will not use or further disclose any PHI in violation of this Agreement.
b. Associate may use PHI to perform data aggregation services as permitted by 45 C.F. R. § 164.504(e) (2)
(I) (B).
c. Associate agrees that anytime it provides PHI received from MARICOPA COUNTY to a Contractor, its
employees, subcontractor, or agent to perform Services for MARICOPA COUNTY, Associate first will
Maricopa County Business Associate Agreement 2
4/3/2015

enter into a contract with such Contractor, employees, subcontractor or agent that contains the same
terms, conditions, and restrictions on the use and disclosure of PHI as contained in this Agreement.
d. If Associate maintains a Designated Record Set, MARICOPA COUNTY will provide Associate with copies
of applicable policies and procedures, which the Associate will comply with as related to an individual's
right to access PHI; request an amendment to PHI; request confidential communications of PHI; or
request an accounting of disclosures of PHI.
2. Associate Use or Disclosure of Protected Health Information for its Own Purposes. Associate may use or
disclose PHI received from MARICOPA COUNTY for Associate's management and administration, or to carry
out Associate's legal and contractual responsibilities. Associate may disclose PHI received from MARICOPA
COUNTY to a third party for such purposes only if:
a. The disclosure is required by law; or
b. Associate secures written assurance from the receiving party that the receiving party will: (i) hold the PHI
confidentially; (ii) use or disclose the PHI only as required by law or for the purposes for which it was
disclosed to the recipient; and (iii) notify the Associate of any breaches in the confidentiality of the PHI,
c. Associate may use and disclose de-identified health information, if (i) the use is disclosed to MARICOPA
COUNTY and permitted by MARICOPA COUNTY in its sole discretion, (ii) that the de-identification is in
compliance with 45 C.F.R. § 164.502(d), and (iii) the de-identified health information meets the standard
and implementation specifications for de-identification under 45 C.F.R. § 164.514(a) and (b).
d. Associate shall use and disclose PHI only to the extent reasonably necessary to accomplish the intended
purpose of such PHI.
3. Safeguards. Associate will implement and maintain appropriate safeguards to prevent any use or disclosure of
PHI not otherwise permitted in this Agreement.
a. Associate also will implement administrative, physical and technical safeguards to protect the
confidentiality, integrity, and availability of any electronic protected health information (e-PHI"), if any,
that Associate creates, receives, maintains, and transmits on behalf of MARICOPA COUNTY.
b. Upon request of MARICOPA COUNTY, Associate will provide evidence to MARICOPA COUNTY that
these safeguards are in place and are properly managed.
4. Reports of Improper Use or Disclosure of Secure or Unsecure Protected Health Information and of
Security Incidents and Breaches. Associate will report in writing to MARICOPA COUNTY any use or
disclosure of PHI, including any breach, not permitted by the contract between Associate and MARICOPA
COUNTY within five (6) days of Associate's learning of such use, disclosure or breach or within five (5) days
following the exercise of reasonable diligence would have known of the improper use, disclosure, or breach.
6. Mitigation of potential harmful effects. Associate shall mitigate all potential harmful effects of a use or
disclosure of Protected Health Information by Business Associate in violation of the requirements of this
Agreement. Immediately following the Associate's discovery of a Breach (or upon the Associate's reasonable
belief that a Breach has occurred), Associate shall provide MARICOPA COUNTY with sufficient information to
permit MARICOPA COUNTY to comply with the Breach notification requirements set forth at 45 C.F.R.
§164.400 et seq.
a. Specifically, if the following information is known to (or can be reasonably obtained by) the Associate,
Associate will provide to MARICOPA COUNTY all available information that MARICOPA COUNTY is
required to include in its notification to the individual pursuant to the Breach Notification Rule, including
but not limited to:
Maricopa County Business Associate Agreement 3
4/3/2015

L contact information for individuals who were or who may have been impacted by the Breach (e.g.,
first and last name, mailing address, street address, phone number, email address);
ii. a brief description of the circumstances of the Breach, including the date of the Breach, the date of
discovery of the Breach, and the identity of who accessed and received the Unsecured PHI;
iii. a description of the types of unsecured PHI involved in the Breach (e.g., names, social security
number, date of birth, address(s), account numbers of any type, disability codes, diagnostic and/or
billing codes and similar information);
iv, a brief description of what the Associate has done or is doing to investigate the Breach, mitigate
harm to the individual impacted by the Breach, and protect against future Breaches; and
v. contact information for a liaison appointed by the Associate with whom MARICOPA COUNTY may
ask questions and learn additional information concerning the Breach,
b. Following a Breach, Associate will have a continuing duty to inform MARICOPA COUNTY of new
information learned by Associate regarding the Breach, including but not limited to the information
described in items (1) through (5), above.
c. Associate also will report in writing to MARICOPA COUNTY any Security Incident (successful or
unsuccessful) of which Associate becomes aware within five (5) business days of Associate learning of
such use or disclosure.
Specifically, Associate will report to MARICOPA COUNTY any unauthorized access, use, disclosure,
modification, or destruction of e-PHI or interference with system operations in an information system
containing e-PHI of which Associate becomes aware, provided that:
i. such reports will be provided only as frequently as the parties mutually agree, but no more than once
per month; and
ii. if the definition of "Security Incident" under the Security Standards is amended to remove the
requirement for reporting "unsuccessful" attempts to use, disclose, modify or destroy e-PHI, the
portion of this Section 5 addressing the reporting of unsuccessful, unauthorized attempts will no
longer apply as of the effective date of such amendment.
6. Obligations Regarding Associate Personnel. Associate will appropriately inform all of its employees, agents,
representatives, members of its workforce, and Contractors, its employees, subcontractors, or agents of
Associate ("Associate Personnel"), whose services may be used to satisfy Associate's obligations under the
Contract and this Agreement of the terms of this Agreement. Associate represents and warrants that the
Associate Personnel are under legal obligation to Associate, by contract or otherwise, sufficient to enable
Associate to fully comply with the provisions of this Agreement. Associate will maintain a system of sanction for
any Associate Personnel who violates this Agreement.
7. Access to Protected Health Information.
a. MARICOPA COUNTY Access. Within five (5) business days of a request by MARICOPA COUNTY for
access to PHI received from MARICOPA COUNTY, Associate will make requested PHI available to
MAR ICOPA COUNTY.
b. Patient Access. If a Patient requests access to PHI directly from Associate, Associate will within five (5)
business days forward such request in writing to MARICOPA COUNTY. MARICOPA COUNTY will be
responsible for making all determinations regarding the grant or denial of a Patient's request for PHI and
Associate will make no such determinations. Only MARICOPA COUNTY will release PHI to the Patient
pursuant to such a request.
Maricopa County Business Associate Agreement 4
4/3/2015

8. Amendment of Protected Health Information.
a. MARICOPA COUNTY Request. Within five (5) business days of receiving a request from MARICOPA
COUNTY to amend an individual's PHI received from MARICOPA COUNTY, Associate will provide such
information to MARICOPA COUNTY for amendment. Alternatively, if MARICOPA COUNTY request
includes specific information to be included in the PHI as an amendment, Associate will incorporate such
amendment within five (5) business days of receipt of the MARICOPA COUNTY request.
b. Individual Request. If an individual makes a request for amendment directly to Associate, Associate will
forward within five business days such request in writing to MARICOPA COUNTY. MARICOPA COUNTY
will be responsible for making all determinations regarding amendments to PHI and Associate will make
no such determinations.
9. Accounting of Disclosures; Requests for Disclosure.
a. Disclosure Records. Associate will keep a record of any disclosure of PHI received from MARICOPA
COUNTY that Associate makes to its employees, subcontractors, and agents, or other third parties other
than:
(1) Disclosures to health care providers to assist in the treatment of patients;
(2) Disclosures to others to assist MARICOPA COUNTY in paying claims;
(3) Disclosures to others to assist MARICOPA COUNTY in conducting its health care operations, as
defined in 45 C.F.R. § 164.501; or
(4) Disclosures made pursuant to an individual's Authorization.
Associate will maintain this disclosure record for six (6) years from the termination of this Agreement.
Associate also agrees to maintain necessary and sufficient documentation of Disclosures of Protected Health
Information as would be required for MAR1COPA COUNTY to respond to a request by an individual for an
accounting of Disclosures, in accordance with 45 CFR 164.528.
b. Data Regarding Disclosures. For each disclosure for which it is required to keep a record under
paragraph 8(a), Associate will record and maintain the following information:
(1) The date of disclosure;
(2) The name of the entity or person who received the PHI, and, the address of such entity or person, if
known.
(3) A description of the PHI disclosed; and
(4) A brief statement of the purpose of the disclosure.
c. Provision to MARICOPA COUNTY. Associate will provide to MARICOPA COUNTY its record of
disclosures under paragraph 8(a), if any, within thirty days of each disclosure. Within five business days
of receiving a notice from MARICOPA COUNTY of an individual's request for an accounting, Associate
also will provide to MARICOPA COUNTY its disclosure record.
d. Patient Request to Associate. If a Patient requests and accounting of disclosures directly from
Associate, Associate will forward the request to MARICOPA COUNTY within five (5) business days of
Associate's receipt of the request, and will make its records of disclosures available to MARICOPA
COUNTY as otherwise provided in this Section. MARICOPA COUNTY will be responsible to prepare and
for delivery of the records of disclosure to the Patient. Associate will not provide an accounting of its
disclosure directly to the Individual.
Maricopa County Business Associate Agreement 5
4/3/2015

10. Notice of Privacy Practices. MARICOPA COUNTY shall provide Associate a copy of its Notice of Privacy
Practices (Notice") in accordance with 45 C.F.R. § 164.520 as well as any changes to the Notice. If
MARICOPA COUNTY Notice specifically affects Associate's use or disclosure of PHI, MARICOPA COUNTY
shall inform Associate of the specific limitations. Associate shall abide by the limitations of MARICOPA
COUNTY' Notice that affects its use or disclosure of PHI of which it has been specifically informed. Any use or
disclosure permitted by this Agreement may be amended by changes to MARICOPA COUNTY' Notice if
MARICOPA COUNTY specifically informs Associate of the amendment: provided, however, that the amended
Notice shall not affect permitted uses and disclosures on which Associate relied prior to receiving notice of such
amended Notice.
11. Access to Books and Records.
a. MARICOPA COUNTY Access. Associate will, within five (5) business days of MARICOPA COUNTY
written request, make available during normal business hours at Associate's offices, all records, books,
agreements, policies and procedures relating to the use or disclosure of PHI received from MARICOPA
COUNTY for the purpose of allowing MARICOPA COUNTY or its agents or auditors to determine
Associate's compliance with this Agreement.
b. Government Access. Associate will make its internal practices, books, and records relating to the use
and disclosure of PHI received from, or created or received by Associate on behalf of, MARICOPA
COUNTY available to the Secretary of the Department of Health and Human Services to the extent
required for determining compliance with the Privacy Standards. Notwithstanding this provision, no
attorney-client, accountant-client or other legal privilege will be deemed waived by Associate or
MARICOPA COUNTY as a result of this Section.
12. Termination. MARICOPA COUNTY may immediately terminate the Contract, if any and this Agreement upon
written notice to Associate if MARICOPA COUNTY determines that the Associate or subcontractor(s) or
agent(s) of Associate has breached a material term of this Agreement. Alternatively, MARICOPA COUNTY may
elect to provide Associate with written notice of Associate's or subcontractor(s)' or agent(s)' of Associate breach
of any term or condition of this Agreement and afford Associate the opportunity to cure the breach to the
satisfaction of MARICOPA COUNTY within thirty (30) days of the date of such notice. If Associate fails to timeiy
cure the breach, as determined by MARICOPA COUNTY at its sole discretion, MARICOPA COUNTY may
terminate the Contract and this Agreement.
13. Return or Destruction of Protect Health Information.
a. Return of PHI; Destruction. Within thirty (30) days of termination of the Contract or this Agreement,
Associate will return to MARICOPA COUNTY all PHI received from MARICOPA COUNTY or created or
received by Associate on behalf of MARICOPA COUNTY that Associate maintains in any form or format.
Associate will not maintain or keep in any form or format any portion of such PHI. Alternatively, Associate
may, upon MARICOPA COUNTY written consent, destroy all such PHI and provide written documentation
of such destruction. The requirement to return or destroy such PHI will apply to all agents or
subcontractors of Associate. Associate will be responsible for recovering any PHI from such agents or
subcontractors. If Associate cannot obtain the PHI from any agent or subcontractor, Associate will so
notify MARICOPA COUNTY and will require that such agents or subcontractors directly return PHI to
MARICOPA COUNTY or otherwise destroy such PHI, subject to the terms of this Section.
b. Alternative Measures. If Associate believes that returning or destroying PHI at the termination of the
Contract or this Agreement is infeasible, it will provide written notice to MARICOPA COUNTY within five
(5) business days of the effective date of termination of this Agreement. Such notice will set forth the
circumstances that Associate believes makes the return or destruction of PHI infeasible and the
alternative measures that Associate recommends for assuring the continued confidentiality and security
of the PHI. MARICOPA COUNTY promptly will notify Associate of whether it agrees that the return or
Maricopa County Business Associate Agreement 6
4/3/2015

destruction of PHI is infeasible. If MARICOPA COUNTY agrees that return or destruction of PHI is
infeasible, Associate agrees to extend all protections, limitations and restrictions of this Agreement to
Associate's use or disclosure of PHI retained after termination of this Agreement and to limit further uses
or disclosures to those purposes that make the return or destruction of the PHI infeasible. Any such
extended protections, limitations and restrictions will apply to any agents or subcontractors of Associate
for whom return or destruction of PHI is determined by MARICOPA COUNTY to be infeasible. If
MARICOPA COUNTY does not agree that the return or destruction of PHI from Associate or its agents or
subcontractors is infeasible, MARICOPA COUNTY will provide Associate with written notice of its
decision, and Associate, its agents and subcontractors will proceed with the return or destruction of the
PHI pursuant to the terms of this Section within fifteen (15) days of the date of MARICOPA COUNTY
notice.
14. Restrictions on Use or Disclosure of Protected Health Information. If MARICOPA COUNTY advises
Associate of any changes in, or restrictions to, the permitted use or disclosure of PHI received from MARICOPA
COUNTY, Associate will restrict the use or disclosure of such PHI consistent with the MARICOPA COUNTY
instructions.
15. Mitigation Procedures. Associate agrees to have procedures in place for mitigating, to the maximum extent
practicable, any deleterious effect from the use or disclosure of PHI received from MARICOPA COUNTY in a
manner contrary to this Agreement or the Privacy Standards.
16. Compliance with the HITECH Act. Associate will comply with the requirements of Title XII, Subtitle D of the
Health Information Technology for Economic and Clinical Health (HITECH) Act, codified at 42 U.S.C. §§ 17921-
17954, which are applicable to Associates, and will comply with all regulations issued by the Department of
Health and Human Services (HHS) to implement these referenced statutes, as of the date by which Associates
are required to comply with such referenced statutes and HHS regulations.
a. Associate will also comply with Section 13402 of the HITECH Act, codified at 42 U.S.C. § 17932, and
with all regulations issued by HHS to implement this statute, as of the date by which Associates are
required to comply with such referenced statutes and HHS regulations. Associate will make a report to
the MARICOPA COUNTY of any breach of unsecured protected health information, as required by 42
U.S.C. § 17932(b), within five (5) business days of Associate's discovery of the breach. Associate will
indemnify MARICOPA COUNTY for any reasonable expenses MARICOPA COUNTY incurs in notifying
individuals of a breach caused by Associate or its subcontractors or agents.
17. Miscellaneous.
a. Compliance with Laws. The Parties acknowledge that state and federal laws relating to electronic data
security and privacy are rapidly evolving and that amendment of this Agreement may be required to
ensure compliance with such developments. Should such developments occur, and upon either Party's
good faith request, the other Party agrees to enter good faith negotiations concerning the terms of an
amendment to this Agreement.
b. Construction of Terms. The terms of this Agreement will be construed in light of any applicable
interpretation or guidance on the Privacy Standards and Security Standards issued by the Department of
Health and Human Services and other applicable state or federal laws, rules and regulations as amended
from time to time.
c. No Third Party Beneficiaries. Nothing in this Agreement will confer upon any person other than the
parties and their respective successors or assigns, any rights, remedies, obligations, or liabilities,
whatsoever.
d. Assignment of Rights and Delegation of Duties. This Agreement is binding upon and inures to the
benefit of the Parties hereto and their respective successors and permitted assigns. However, neither
Maricopa County Business Associate Agreement 7
4/3/2015

Party may assign any of its rights or delegate any of its obligations under this Agreement without prior
written consent of the other Party, which consent shall not be unreasonable withheld or delayed.
Notwithstanding any provisions to the contrary, however, MARICOPA COUNTY retains the right to assign
or delegate any of its rights and obligations hereunder to any of its wholly owned subsidiaries, affiliates or
successor companies. Assignments made in violation of this provision are null and void.
e. No Waiver. Failure or delay on the part of either Party to exercise any right, power, privilege or remedy
hereunder shall not constitute a waiver thereof. No provision of this Agreement may be waiver by either
Party except by a writing signed by an authorized representative of the Party making the waiver.
f. Severability. The provisions of this Agreement shall be severable, and if any provision of this Agreement
shall be held or declared to be illegal, invalid or unenforceable, the remainder of this Agreement shall
continue in full force and effect as though such illegal, invalid or unenforceable provision had not been
contained herein.
g. Entire Agreement. This Agreement constitutes the entire agreement between the parties with regard to
the Privacy Standards and Security Standards, there are no understandings or agreements relating to this
Agreement that are not fully expressed in this Agreement and no change, waiver or discharge of
obligations arising under this Agreement will be valid unless in writing and executed by the party against
whom such change, waiver or discharge is sought to be enforced.
h. Written Agreement. This Agreement is considered as an integral part of the underlying Contract, and is
incorporated as though fully set forth within the Contract. This Agreement will govern in the event of
conflict or inconsistency with any provision of Contract.
i. Choice of Law. This Agreement and the rights and obligations of the parties hereunder shall be
governed by and construed under the laws of the State of Arizona, without regard to applicable conflict of
law principles.
Counterparts. This Agreement may be executed in two or more counterparts, each of which shall be
deemed an original and when taken together shall constitute one agreement.
k. Facsimile and Electronic Signatures. Facsimile and electronic signatures shall be deemed to be
original signatures for all purposes of this Agreement.
I. Notices. Any notices required under this Agreement will be sent to the parties at the following address
by first class mail, fax or hand delivery:
For County: For Associate: Contact and Notice info
MARICOPA COUNTY Michelle Logsdon, CPC, CCS-P, CPB
BOARD OF SUPERVISORS President
301 W. Jefferson Street, 10 th Floor 525 Lacey Road, Suite E
Phoenix, AZ 85003 Forked River, NJ 08731
(602) 506-3416 (609) 242-5088
Maricopa County Business Associate Agreement 8
4/3/2015

Agreed to by MARICOPA COUNTY and Associate by:
MARICOPA COUNTY
SIGNATURE DATE
Clint Hickman, Chairman, Board of Supervisors Michelle Logsdon, CPC, CCS-P, CPB, President
PRINT NAME AND TITLE PRINT NAME AND TITLE
ATTEST:
Clerk of the Board Date
APPROVE AS TO FORM:
Attorney for Maricopa County Date
Maricopa County Business Associate Agreement 9
4/3/2015

BUSINESS ASSOCIATE AGREEMENT
FOR RELEASE OF INFORMATION TO THIRD PARTIES
1. Logsdon, Michelle d/b/a Falcon Practice Management ("Associate") is a business associate of MARICOPA
COUNTY, pursuant to the Agreement between Associate and MARICOPA COUNTY dated October 31,
2014 ("Agreement"). Pursuant to that Agreement, Associate is required to comply with the requirements for
the use and handling of Protected Health Information ("PHI") from MARICOPA COUNTY as set forth in the
Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. 164,501 et. seq. as amended
from time to time ("Privacy Standards").
2. Associate is permitted to disclose PHI to ("Recipient") for the necessary
management and administration of Associate and to carry out the legal responsibilities of the Associate,
provided that Recipient provides Associate with the following assurances for Recipient's use and disclosure
of PHI.
3. Associate seeks to disclose PHI to Recipient for the following management, administration or legal
responsibilities of Associate:
4. The disclosure of PHI to Recipient is conditioned upon Recipient's assurance that, and Recipient agrees
that it will:
a. Hold the PH1 confidentially and make no re-disclosure to any third party without Associate's express
advance written consent;
b. Use or disclose the PHI only as required by law or for the purposes set forth above; and
c. Notify Associate in writing of any breaches in the confidentiality of the PHI within three days of
discovery of any such breach.
ASSOCIATE RECIPIENT
SIGNATURE DATE
PRINT NAME AND TITLE. PRINT NAME AND TITLE
Maricopa County Business Associate Agreement 10
4/3/2015