MERCY MARICOPA WEB PORTAL (COUNTY HEALTH SERVICES).PDF

mercy maricopa j-1- mercy maricopa
" 1-* integrated care P7 advantage HMO SNP
Business Associate Secure Web Portal
Registration Form
Thank you for your interest in registering for the Mercy Maricopa Integrated Care and the Mercy
Maricopa Advantage Business Associate web portal. We are committed to protecting the privacy of our
members and Business Associates who use our website. During registration, we ask you for specific
information about you and your Authorized Representatives. We will use the information you submit
to us for the purpose of managing your access to the website. We do not disclose any of the
information you provide to us to any outside parties, except to manage the health plan or when
applicable law may require it.
Registration Instructions: The information below and acceptance of the attached agreement is
required to complete registration.
Business Associate Name: Maricopa County
Business Associate Office Name: Maricopa County Correctional Health Services
Business Associate Tax ID if (TIN) (if applicable):
We caution against using your SSN in lieu of a TIN, as it presents unnecessary risks to your identity
Address: 234 N. Central Avenue, Suite 5000 I City: Phoenix I State: AZ I Zip: 85004
Phone #: ( 602 ) 506-2906 Fax #: ( 602 ) 506-2577
Business Associate must designate one primary representative (see Business Associate Web Portal
Agreement attached for full definition). Please indicate the full name of the primary representative
below:
Primary Representative Name: Maricopa County Customer Service Center Manager (currently, Steve
Szoradi)
Phone #: ( 602 ) 506-8223 Fax #: ( 602 ) 506-5864
E-Mail address at Business Associate's office: helpdesk@mail.maricopa.gov
To submit a request for registration, please fax your completed form and attached agreement to
Mercy Maricopa Integrated Care or Mercy Maricopa Advantage at 860-975-0841.
Business Associate Primary Representative Signature Date
Business Associate Representative Printed Name
Page 1 of 14

IMPORTANT: A signed Business Associate's Web Portal Agreement (attached) must accompany this
form before registration can be completed. Thank you.
Business Associate's Web Portal Agreement
Introduction
This Business Associate's Web Portal Agreement ("Agreement") contains the terms and conditions that
govern the use of this web portal service by Business Associate to access information relating to Mercy
Maricopa Integrated Care and Mercy Maricopa Advantage member/enrollee eligibility information.
Term
This Agreement is effective as of April 8, 2014 and shall continue in effect until February 11, 2017.
Extensions beyond February 11, 2017 will be mutually agreed to by the Parties in writing.
Definitions
When used in this Agreement, all capitalized terms shall have the following meanings:
• "Administrator" means any Aetna administrator, such as Aetna Medicaid Administrators, LLC,
and any owners, affiliates or direct or indirect subsidiaries that administer or maintain the
Service for a Plan.
• "Authorized Representative" means an Employee of Business Associate that Business Associate
has authorized to use the Web Portal Service under this Agreement on Business Associate's
behalf. Business Associate shall identify each authorized representative on the roster form
provided in Attachment A to this agreement. Addition or removal of an Authorized
Representative(s) shall be submitted, in writing, by the Primary Representative and shall
include the information requested in Attachment A.
• "Business Associate" means Maricopa County through its Department of Correctional Health
Services as per the current Business Associate Agreement ("BAA") in effect between Maricopa
County and Mercy Maricopa Integrated Care. The Business Associate Agreement is attached to
this Agreement as Attachment B.
• "Government Sponsor" means a state agency or other governmental entity authorized to offer,
issue and/or administer one or more plans, and which, to the extent applicable, has contracted
with Plan to administer all or a portion of such Plan(s).
• "Member/enrollee" includes, a person determined to be Seriously Mentally III in accordance
with policies issued by the Arizona Department of Health Services, Division of Behavioral Health
Services (ADHS/DBHS) and eligible to receive behavioral health services paid for, in whole or in
part, from funds available to the ADHS/DBHS's designated Regional Behavioral Health Authority
(RBHA)
Page 2 of 14

• "Plan" means "Mercy Maricopa Integrated Care" and "Mercy Maricopa Advantage" and any
owners, affiliates or direct or indirect subsidiaries.
• "Primary Representative" means the Authorized Representative in the Business Associate's
office who has responsibility for adding, deleting and maintaining the names of Business
Associate's Authorized Representatives
• "Service" means the web portal service under this Agreement and the website that supports it.
Use of the Web Portal Service
The Service provides internet access to information on the Plan's members'/enrollees' eligibility and
enrollment. The Plan and its Administrator agree to permit Business Associate and its Primary
Representative and Authorized Representatives to use the Service, provided they comply with the
terms and conditions of this Agreement. Business Associate shall use the Service solely in connection
with its obligations under state and federal law, including court orders, for the provision of judicial
and/or health care services to Plan members/enrollees. Business Associate shall not access the
records or information of Plan members/enrollees to whom the Business Associate does not provide
judicial and/or health care services. The Primary Representative and each Authorized Representative
shall use the Service solely in the course and scope of employment or agency with Business Associate.
Business Associate shall use, and shall cause the Primary Representative and each Authorized
Representative to use, the Service subject to the following:
1. The terms and conditions of this Agreement; and
2. The applicable provisions of the BAA, including, but not limited to, use and disclosure of
Protected Health Information under the HIPPA Privacy Standards, and member/enrollee
eligibility and enrollment verification for the purposes identified in this Agreement.
3. In the event of a conflict between a term and condition under this Agreement and a provision
under the BAA, the terms of the BAA shall govern.
Business Associate shall require the Primary Representative and each Authorized Representative to:
1. Keep confidential and not disclose the Business Associate's Service password to any person
except Business Associate or the Primary Representative;
2. Use the Service solely in connection with Business Associate's judicial or health care services to
the Plan's members/enrollees and within the course and scope of employment or agency with
Business Associate; and
3. Use the Service pursuant to the terms and conditions of this Agreement.
Upon learning that any Primary Representative or Authorized Representative has violated (1), (2) or
(3), changes job responsibilities such that access is no longer necessary, or no longer works for or
represents Business Associate, Business Associate shall immediately notify the Plan as soon as
possible and no later than two (2) business days. The Plan will revoke such Primary Representative's
or Authorized Representative's authority to use the Service.
Page 3 of 14

Changes to the Web Portal Service or This Agreement
Administrator may, at any time, make changes to the Service, the terms and conditions in this
Agreement, or any other policies or conditions that govern the use of the Service at any time. Business
Associate's continued access or use of the Service site shall be deemed Business Associate's
notification and acceptance of these changes.
No Warranties or Liabilities
There is no implied warranty of any kind under this Agreement, including any representation of
accuracy, completeness, or appropriateness or fitness for a particular part of the Service, and non-
infringement. Business Associate assumes full responsibility for using the Service, and understands and
agrees that neither the Plan nor Administrator are responsible or liable for any claim, loss, or damage
resulting from, or related to, Business Associate's use. Business Associate uses the Service at its own
risk, and agrees to use the Service on an "AS IS" and an "AS AVAILABLE" basis. Neither Plan nor
Administrator will be liable for any delay, difficulty in use, inaccuracy or incompleteness of information,
computer virus, malicious code, loss of data, compatibility issues, or otherwise. Plan and Administrator
will not be liable for any direct, indirect, incidental, consequential, or punitive damages arising out of
the Business Associate's use of, or access to, the Service, or any link provided to another site, even if
Plan or Administrator was advised of the possibility of such damages, or even if such damages were
foreseeable.
Ownership, License and Restrictions on Use of Materials
All rights, title and interest (including all copyrights, trademarks and other intellectual property rights)
in the Service belong to the Plan or Administrator. In addition, the names, images, pictures, logos, and
icons are proprietary marks that belong to the Plan or Administrator. Except as expressly provided
below, nothing contained herein shall be construed as conferring any license or right, by implication,
estoppels or otherwise, under copyright or other intellectual property rights.
The Business Associate is hereby granted, at no cost to Business Associate, a nonexclusive,
nontransferable, limited license to view and use information retrieved from the Service solely in
connection with its obligations under state and federal law, including court orders, for the provision of
judicial and/or health care services to Plan members/enrollees.
Except as expressly provided above, no part of the information in or about the Service, including but
not limited to materials retrieved from it and the underlying code, may be reproduced, republished,
copied, transmitted, or distributed in any form or by any means. In no event shall materials from
this site be stored in any information storage and retrieval system without prior written permission
from Administrator or Plan.
Business Associate's use of the site allows Plan and Administrator to gather certain limited information
about the Business Associate and its usage of the Service. Business Associate agrees and consents to
the use of such information in aggregated form.
Site System Integrity
The Business Associate may not use any device, software routine or agent to interfere or attempt to
interfere with the proper working of the Service. The Business Associate may not take any action which
imposes an unreasonable or disproportionately large load on Administrator's or Plan's infrastructure.
Page 4 of 14

The Business Associate may not disclose or share its password to or with third parties, or allow its
password to be used, for any unauthorized purpose. The Business Associate shall take reasonable
precautions to secure its password from any unauthorized use. The Business Associate may not
attempt to log in with a user name or password other than its own. The Business Associate shall
require its Primary Representative and Authorized Representative to take the same precautions and
follow the same requirements identified in this Agreement.
Continuous, uninterrupted access to the Service is not guaranteed. Numerous actions beyond our
control may interfere with the Service.
Confidential Information
"Confidential Information" is any information that identifies a member and relates to the member's
participation in a Plan, the member's physical or mental health or condition, the provision of health
care to the member, or payment for the provision of health care to the member. Confidential
information includes, without limitation, "individually identifiable health information," as defined in 45
C.F.R. § 160.103 of HIPAA and "non-public personal information," as defined in laws or regulations
promulgated under the Gramm-Leach-Bliley Act of 1999.
Business Associate acknowledges that Administrator or Plan will provide confidential information to
Business Associate solely for those Business Associate's uses expressly defined herein. Business
Associate agrees to comply with the Business Associate's Agreement executed prior to or concurrently
with this Agreement.
Governing Law and Venue
The laws of the State of Arizona govern this Agreement, without regard to conflict of law principals,
and the Business Associate's access to and use of the Service under this Agreement. The Business
Associate submits to the exclusive jurisdiction of the courts in the State of Arizona and waives any
jurisdictional venue or inconvenient forum objections to such court.
Before Business Associate may seek legal recourse for any harm Business Associate believes it has
suffered from use of the Service, Business Associate will give Plan or Administrator written notice
specifying the harm and allow Plan or Administrator thirty (30) days from the date of notice to cure the
harm. Business Associate must initiate any cause of action under this Agreement or related to the
Service within one (1) year after the claim has arisen, or Business Associate is barred from pursuing any
cause of action.
Termination
Business Associate acknowledges and agrees that Plan or Administrator may issue Business Associate a
warning, temporarily suspend, or indefinitely suspend, Business Associate's access to the Service if, in
the sole discretion of Plan or Administrator, Business Associate breaches this Agreement.
Notwithstanding the foregoing, Plan and Administrator reserve the right to immediately suspend or
deny, in their singular or joint discretion, Business Associate's access to all, or any portion of, the
Service if required to do so to prevent violation of law, court order, Government Sponsor requirement,
or threat to the Service. Business Associate agrees that neither Plan nor Administrator shall be liable
to Business Associate or any third-party for any termination of Business Associate's access to the
Service under the circumstances set forth herein.
Page 5 of 14

Except where required to be maintained or retained by state or federal law, upon termination of this
Agreement, Business Associate agrees to destroy, as required by the BAA, all information and
materials, in any format or capacity, obtained or retained from the Service.
Notices
All notices that are required or permitted to be given by one party to the other in connection with this
Agreement shall be in writing to the addresses below:
If to Business Associate:
Maricopa County Department of Correctional Health Services
Attn: CFO Correctional Health Services Administration
234 N. Central Ave., Suite 5000
Phoenix, AZ 85004
If to the Plan:
Mercy Maricopa Integrated Care
Web Portal Administration
Attn: Woodrow Terrell
4350 E. Cotton Center Blvd., Bldg D.
Phoenix, AZ 85040
Fax: 860-975-0841
The person(s) signing this Agreement warrants that he or she has full authority to do so and that the
signature below binds the Business Associate, including the Business Associate's owners, employees,
agents and representatives, on whose behalf the person below signs.
Accepted:
Steve Chucri, Chairman Date
Maricopa County Board of Supervisors
Attested to:
Fran McCarroll, Clerk of the Board
Approved as to Form
Deputy County Attorney
Page 6 of 14

Attachment A
Business Associate Web Portal
Employee Roster
Last Name First Name Title Reason for Access Phone No.
1
2
3
4
5
6
7
8
Page 7 of 14

Attachment B
BUSINESS ASSOCIATE AGREEMENT
HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)
This Business Associate Agreement (the "Agreement") is made and entered into this 8th day of
April, 2014 (the "Effective Date"), by and between Mercy Maricopa Integrated Care ("Mercy
Maricopa"), organized under the laws of Arizona and having its principal address at 4350 E Cotton
Center Blvd., Building D, Phoenix, AZ 85040 (hereinafter the "Covered Entity") and Maricopa
County, a political subdivision of the State of Arizona, by and through its Department of
Correctional Health Services having its principal address at 234 N. Central Ave., Suite 5000, Phoenix,
AZ 85004 (hereinafter the "Business Associate"). In conformity with the regulations at 45 C.F.R. Parts
160-164 (the "Privacy and Security Rules"), Covered Entity will provide Business Associate with access
to, or have Business Associate create, maintain, transmit and/or receive certain Protected Health
Information (as defined below), thus necessitating a written agreement that meets the applicable
requirements of the Privacy and Security Rules. Covered Entity and Business Associate agree as
follows:
1. Definitions. The following terms shall have the meaning set forth below:
(a) ARRA. "ARRA" means the American Recovery and Reinvestment Act of 2009
(b) Breach. "Breach" has the same meaning as the term "breach" in 45 C.F.R. 164.402.
(c) C. F. R. "C.F. R." means the Code of Federal Regulations.
(d) Designated Record Set. "Designated Record Set" has the meaning assigned to such term in 45 C.
F. R. 160.501.
(e) Discovery. "Discovery" shall mean the first day on which a Breach is known to Business
Associate (including any person, other than the individual committing the breach, that is an
employee, officer, or other agent of Business Associate), or should reasonably have been known
to Business Associate, to have occurred.
(f) Electronic Protected Health Information. "Electronic Protected Health Information" means
information that comes within paragraphs 1 (i) or 1 (ii) of the definition of "Protected Health
Information", as defined in 45 C. F. R. 160.103.
(g) Individual. "Individual" shall have the same meaning as the term "individual" in 45 C. F. R.
160.103 and shall include a person who qualifies as personal representative in accordance with
45 C. F. R. 164.502 (g).
(h) Protected Health Information. "Protected Health Information" shall have the same meaning as
the term "Protected Health Information", as defined by 45 C. F. R. 160.103, limited to the
information created or received by Business Associate from or on behalf of Covered Entity.
(i) Required by Law. "Required by Law" shall have the same meaning as the term "required by
law" in 45
C. F. R. 164.103.
(j) Secretary. "Secretary" shall mean the Secretary of the Department of Health and Human
Services or his designee.
(k) Security Incident. "Security Incident" shall have the same meaning as the term "security
incident" in 45 C.F.R. 164.304.
(1) Standard Transactions. "Standard Transactions" means the electronic health care transactions for
which HIPAA standards have been established, as set forth in 45 C. F. R., Parts 160-162.
(m)Unsecured Protected Health Information. "Unsecured Protected Health Information" means
Protected Health Information that is not secured through the use of a technology or methodology
specified by guidance issued by the Secretary from time to time.
Page 8 of 14

2. Obligations and Activities of Business Associate.
(a) Business Associate agrees to not use or further disclose Protected Health Information other than
as permitted or required by this Agreement or as Required by Law. Business Associate shall also
comply with any further limitations on uses and disclosures agreed by Covered Entity in
accordance with 45 C.F.R. 164.522 provided that such agreed upon limitations have been
communicated to Business Associate in accordance with Section 4.1(c) of this Agreement.
(b) Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the
Protected Health Information other than as provided for by this Agreement, including but not
limited to the safeguards described in Section 2(m) of this Agreement.
(c) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known
to Business Associate of a use or disclosure of Protected Health Information by Business
Associate in violation of the requirements of this Agreement.
(d) Business Associate agrees to promptly report to Covered Entity any use or disclosure of the
Protected Health Information not provided for by this Agreement of which it becomes aware.
(e) Except as provided in 45 C.F.R. 164.412 (allowing an additional 30 days to report in the event of
a law enforcement delay), Business Associate agrees to report to Covered Entity any Breach of
Unsecured Protected Health Information without unreasonable delay and in no case later than 30
calendar days after Discovery of a Breach. Such notice shall include the identification of each
Individual whose Unsecured Protected Health Information has been, or is reasonably believed by
Business Associate, to have been, accessed, acquired, or disclosed in connection with such
Breach. In addition, Business Associate shall provide any additional information reasonably
requested by Covered Entity for purposes of investigating the Breach. Business Associate's
notification of a Breach under this section shall comply in all respects with each applicable
provision of Section 13400 of Subtitle D (Privacy) of ARRA, 45 CFR 164.410, and related
guidance issued by the Secretary from time to time. Without limiting Covered Entity's remedies
under Section 6 or any other provision of this Agreement, in the event of a Breach involving
Unsecured Protected Health Information maintained, used or disclosed by Business Associate,
Business Associate shall reimburse Covered Entity for the reasonable cost of providing any
legally required notice to affected Individuals.
(f) In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business
Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit
Protected Health Information on behalf of Business Associate agree in writing to the same
restrictions and conditions that apply through this Agreement to Business Associate with respect
to such information. In no event shall Business Associate, without Covered Entity's prior
written approval, provide Protected Health Information received from, or created or received by
Business Associate on behalf of Covered Entity, to any employee or agent, including a
subcontractor, if such employee, agent or subcontractor receives, processes or otherwise has
access to the Protected Health Information outside of the United States.
(g) Business Associate agrees to provide access, at the request of Covered Entity, and in the time
and manner designated by Covered Entity, to Protected Health Information in a Designated
Record Set, to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet
the requirements under 45 C.F.R. 164.524. Covered Entity's determination of what constitutes
"Protected Health Information" or a "Designated Record Set" shall be final and conclusive. If
Business Associate provides copies or summaries of Protected Health Information to an
Individual it may impose a reasonable, cost-based fee in accordance with 45 C.F.R. 164.524
(c)(4).
(h) Business Associate agrees to make any amendment(s) to Protected Health Information in a
Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 C.F.R. 164.526
Page 9 of 14

at the request of Covered Entity or an Individual, and in the time and manner designated by
Covered Entity. Business Associate shall not charge any fee for fulfilling requests for
amendments. Covered Entity's determination of what Protected Health Information is subject to
amendment pursuant to 45 C.F.R. 164.526 shall be final and conclusive.
(0 Business Associate agrees to make (i) internal practices, books, and records, including policies
and procedures, relating to the use and disclosure of Protected Health Information received from,
or created or received by Business Associate on behalf of, Covered Entity, and (ii) policies,
procedures, and documentation relating to the safeguarding of Electronic Protected Health
Information available to the Covered Entity, or at the request of the Covered Entity to the
Secretary, in a time and manner designated by the Covered Entity or the Secretary, for purposes
of the Secretary determining Covered Entity's or Business Associate's compliance with the
Privacy and Security Rules.
(j) Business Associate agrees to document such disclosures of Protected Health Information as
would be required for Covered Entity to respond to a request by an Individual for an accounting
of disclosures of Protected Health Information in accordance with 45 C.F.R. 164.528.
(k) Business Associate agrees to provide to Covered Entity, upon request by Covered Entity, the
information collected in accordance with Section 2(j) of this Agreement, to permit Covered
Entity to timely respond to a request by an Individual for an accounting of disclosures of
Protected Health Information in accordance with 45 C.F.R. 164.528.
(1 ) Business Associate acknowledges that it shall request from the Covered Entity and so disclose to
its affiliates, agents and subcontractors or other third parties, (i) the information contained in a
"limited data set," as such term is defined at 45 C.F.R. 164.514(e)(2), or, (ii) if needed by
Business Associate, to the minimum necessary to accomplish the intended purpose of such
requests or disclosures. In all cases, Business Associate shall request and disclose Protected
Health Information only in a manner that is consistent with guidance issued by the Secretary
from time to time
(m)With respect to Electronic Protected Health Information, Business Associate shall implement and
comply with (and ensure that its subcontractors implement and comply with) the administrative
safeguards set forth at 45 C.F.R. 164.308, the physical safeguards set forth at 45 C.F.R. 310, the
technical safeguards set forth at 45 C.F.R. 164.312, and the policies and procedures set forth at
45 C.F.R. 164.316 to reasonably and appropriately protect the confidentiality, integrity, and
availability of the Electronic Protected Health Information that it creates, receives, maintains, or
transmits on behalf of Covered Entity. Business Associate acknowledges that, (i) the foregoing
safeguard, policies and procedures requirements shall apply to Business Associate in the same
manner that such requirements apply to Covered Entity, and (ii) Business Associate may be
liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and
1320d-6, as amended from time to time, for failure to comply with the safeguard, policies and
procedures requirements and any guidance issued by the Secretary from time to time with respect
to such requirements.
(n) With respect to Electronic Protected Health Information, Business Associate shall ensure that
any subcontractors that create, receive, maintain, or transmit Electronic Protected Health
Information on behalf of Business Associate, agree to comply with the applicable requirements
of Subpart C of 45 C.F.R. Part 164 by entering into a contract that complies with 45 C.F.R.
Section 164.314.
(o) Business Associate shall report to Covered Entity any Security Incident of which it becomes
aware, including Breaches of Unsecured Protected Health Information as required by 45 C.F.R.
Section 164.410.
(p) If Business Associate conducts any Standard Transactions on behalf of Covered Entity, Business
Associate shall comply with the applicable requirements of 45 C.F.R. Parts 160-162.
Page 10 of 14

(q) During the term of this Agreement, Business Associate may be asked to complete a security
survey and/or attestation document designed to assist Covered Entity in understanding and
documenting Business Associate's security procedures and compliance with the requirements
contained herein. Business Associate's failure to complete either of these documents within a
reasonable timeframe specified by Covered Entity shall constitute a material breach of this
Agreement.
(r) Business Associate acknowledges that, as of the Effective Date of this Agreement, it may be
liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and
1320d-6, as amended from time to time, for failure to comply with any of the use and disclosure
requirements of this Agreement and any guidance issued by the Secretary from time to time with
respect to such use and disclosure requirements.
(s) To the extent Business Associate is to carry out one or more of Covered Entity's obligation(s)
under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of
Subpart E that apply to Covered Entity in the performance of such obligation(s).
3. Permitted Uses and Disclosures by Business Associate.
3.1 General Use and Disclosure. Except as otherwise limited in this Agreement, Business
Associate may use or disclose Protected Health Information to perform its obligations and
services to Covered Entity, provided that such use or disclosure would not violate the Privacy
and Security Rules if done by Covered Entity or the minimum necessary policies and procedures
of the Covered Entity.
3.2 Specific Use and Disclosure Provisions.
(a) Except as otherwise prohibited by this Agreement, Business Associate may use Protected
Health Information for the proper management and administration of the Business Associate
or to carry out the legal responsibilities of the Business Associate.
(b) Except as otherwise prohibited by this Agreement, Business Associate may disclose
Protected Health Information for the proper management and administration of the Business
Associate, provided that disclosures are Required By Law, or Business Associate obtains
reasonable assurances from the person to whom the information is disclosed that it will
remain confidential and used or further disclosed only as Required By Law or for the purpose
for which it was disclosed to the person, and the person notifies the Business Associate of
any instances of which it is aware in which the confidentiality of the information has been
breached in accordance with the Breach and Security Incident notifications requirements of
this Agreement.
(c) Business Associate shall not directly or indirectly receive remuneration in exchange for any
Protected Health Information of an Individual without Covered Entity's prior written
approval and notice from Covered Entity that it has obtained from the Individual, in
accordance with 45 C.F.R. 164.508, a valid authorization that includes a specification of
whether the Protected Health Information can be further exchanged for remuneration by
Business Associate. The foregoing shall not apply to Covered Entity's payments to Business
Associate for services delivered by Business Associate to Covered Entity.
(d) Business Associate shall not de-identify any Protected Health Information except as
authorized by Covered Entity to provide data aggregation services to Covered Entity as
permitted by 42 C.F.R. 164.504(e)(2)(i)(B).
(e) Business Associate may use Protected Health Information to report violation of law to
appropriate Federal and State authorities, consistent with 164.502 (j)(1).
Page 11 of 14

4. Obligations of Covered Entity.
4.1 Provisions for Covered Entity to Inform Business Associate of Privacy Practices and
Restrictions.
(a) Covered Entity shall notify Business Associate of any limitation(s) in Covered Entity's
notice of privacy practices that Covered Entity produces in accordance with 45 C.F.R.
164.520 (as well as any changes to that notice), to the extent that such limitation(s) may
affect Business Associate's use or disclosure of Protected Health Information.
(b) Covered Entity shall provide Business Associate with any changes in, or revocation of,
permission by Individual to use or disclose Protected Health Information, to the extent that
such changes affect Business Associate's use or disclosure of Protected Health Information.
(c) Covered Entity shall notify Business Associate of any restriction to the use or disclosure of
Protected Health Information that Covered Entity has agreed to in accordance with 45 C.F.R.
164.522, to the extent that such restriction may affect Business Associate's use or disclosure
of Protected Health Information.
4.2 Permissible Requests by Covered Entity. Except as may be set forth in Section 3.2, Covered
Entity shall not request Business Associate to use or disclose Protected Health Information in
any manner that would not be permissible under the Privacy and Security Rules if done by
Covered Entity.
5. Term and Termination.
(a) Term. The provisions of this Agreement shall take effect on the Agreement's Effective Date
and shall terminate on February 11, 2017 unless extended by a written agreement of the
parties, but in no event shall this Agreement terminate no sooner than when all of the
Protected Health Information provided by Covered Entity to Business Associate, or created,
maintained, transmitted or received by Business Associate on behalf of Covered Entity, is
destroyed or returned to Covered Entity, or, in accordance with Section 5(c)(2).
(b) Termination for Cause. Without limiting the termination rights of the Parties pursuant to the
Agreement and upon Covered Entity's knowledge of a material breach of this
Agreement by Business Associate, Covered Entity shall either:
(i) Provide an opportunity for Business Associate to cure the breach or end the violation, or
terminate the Agreement if Business Associate does not cure the breach or end the violation
within 60 days of the date of notice of the breach or violation by Covered Entity,
(ii) Immediately terminate the Agreement, if cure of such breach is not possible.
(c) Effect of Termination.
(1) Except as provided in Section 5(c)(2), upon termination of this Agreement, for
any reason, Business Associate shall return or destroy all Protected Health
Information received from Covered Entity, or created, maintained, transmitted or
received by Business Associate on behalf of Covered Entity. This provision shall
apply to Protected Health Information that is in the possession of subcontractors
or agents of Business Associate. Business Associate shall retain no copies of the
Protected Health Information.
(2) In the event the Business Associate determines that returning or destroying the
Protected Health Information is infeasible, Business Associate shall provide to
Covered Entity notification of the conditions that make return or destruction
infeasible. Upon mutual agreement of the Parties that return or destruction of
Protected Health Information is infeasible, per Section 5(a) above, Business
Associate shall continue to extend the protection of this Agreement to such
Protected Health Information and limit further uses and disclosures of such
Page 12 of 14

Protected Health Information for so long as Business Associate maintains such
Protected Health Information.
6. Indemnification. Business Associate shall indemnify and hold harmless Covered Entity and any
of Covered Entity's affiliates, directors, officers, employees and agents from and against any claim,
cause of action, liability, damage, cost or expense (including reasonable attorneys' fees) arising out of or
relating to any non-permitted use or disclosure of Protected Health Information, failure to safeguard
Electronic Protected Health Information, or other breach of this Agreement by Business Associate or
any affiliate, director, officer, employee, agent or subcontractor of Business Associate. The scope of
Business Associate's indemnification obligation under this Section does not extend to the acts or
omissions of Covered Entity and its affiliates, directors, officers, employees, agents and subcontractors.
7. Notices. Any notices or communications to be given under this Agreement shall be made to the
address and/or fax numbers given below:
To Business Associate: To Covered Entity:
Maricopa County Mercy Maricopa Integrated Care
Department of Correctional Health Services do Aetna Inc.
Attn: Lisa Tempauer, Legal Services Administrator Attn: Nicole Tomasek, RE6A
234 N. Central Ave., Suite 5000 151 Farmington Avenue
Phoenix, AZ 85004 Hartford, CT 06156
Phone: (602) 506-2831 Email: TomasekN(&,aetna.com
E-mail: L.Timpauer@mail.maricopa.gov
Each Party named above may change its address upon thirty (30) days written notice to the other Party.
8. Miscellaneous.
(a) Regulatory References. A reference in this Agreement to a section in the Privacy and
Security Rules means the section as in effect or as amended, and for which compliance is
required.
(b) Amendment. Upon the enactment of any law or regulation affecting the use or disclosure
of Protected Health Information or the safeguarding of Electronic Protected Health
Information, or the publication of any decision of a court of the United States or any state
relating to any such law or the publication of any interpretive policy or opinion of any
governmental agency charged with the enforcement of any such law or regulation, either
Party may, by written notice to the other Party, amend the Agreement in such manner as
such Party determines necessary to comply with such law or regulation. If the other Party
disagrees with such amendment, it shall so notify the first Party in writing within thirty
(30) days of the notice. If the Parties are unable to agree on an amendment within thirty
(30) days thereafter, then either of the Parties may terminate the Agreement on thirty (30)
days written notice to the other Party.
(c) Survival. The respective rights and obligations of Business Associate under Sections 5(c)
and 6 of this Agreement shall survive the termination of this Agreement.
(d) Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning
that permits Covered Entity to comply with the Privacy and Security Rules. In the event
of any inconsistency or conflict between this Agreement and any other agreement
between the Parties, the terms, provisions and conditions of this Agreement shall govern
and control.
Page 13 of 14

(e) No third party beneficiary. Nothing express or implied in this Agreement is intended to
confer, nor shall anything herein confer, upon any person other than the Parties and the
respective successors or assigns of the Parties, any rights, remedies, obligations, or
liabilities whatsoever.
(0 Governing Law. This Agreement shall be governed by and construed in accordance with
federal law and the laws of Arizona, as applicable.
IN WITNESS WHEREOF, the Parties have hereto by their duly authorized representatives executed this
Agreement.
Maricopa County
Authorized Signature
Eddy Broadway Steve Chucri
Print Name Print Name
CEO Chairman, Maricopa County Board of Supervisors
Title Title
b6 - 2cI- IS
Date Date
Attested to:
Fran McCarroll, Clerk of the Board
Approved as to Form
Deputy County Attorney
Page 14 of 14