AMD 2 RE RESEARCH ANALYSIS WITH TAPI.PDF

CONTRACT NO: C86-15-093-3-00 (860-14-020) AMENDMENT NO: 2
AMENDMENT TO
CONTRACT
Between
MARICOPA COUNTY
By and Through
DEPARTMENT OF PUBLIC HEALTH
and
The Arizona Partnership for Immunization (TAPI)
I. The above named contract is hereby amended as specified below:
A. Cover Page, line 6, of the original contract shall be deleted and replaced with the
following: “…the 30th day of December, 2015.”
B. Exhibit A, Total Amount on the Pricing/Compensation page of the original
contract, shall be changed to $168,269.12 which is an increase of $68,269.12.
C. Exhibit B of the original contract shall be deleted and replaced with the newly
added Exhibits B-1 and B-2 beginning on Page 3 of this amendment.
D. $25,000 of the $68,269.12 increase shall be used for the deliverables as shown
on the new Exhibit B-1.
E. $43,269.12 of the $68,269.12 increase shall be used for the deliverables as
shown on the new Exhibit B-2.
F. Under 6.25, Incorporation of Documents, 6.25.3., Exhibit C, Business Associate
Agreement shall be added.
II. All other terms and conditions of the original contract and its amendments shall
remain in full force and effect.
IN WITNESS WHEREOF, the parties agree to the changes indicated herein:
FOR AND ON BEHALF OF FOR AND ON BEHALF OF
MARICOPA COUNTY The Arizona Partnership for
Immunization (TAPI)
By: By:
Chairman, Board of Supervisors
Date Date
ATTEST ATTEST
Clerk of the Board
1

Date Date
APPROVED AS TO FORM APPROVED AS TO FORM
Attorney for Maricopa County
Date Date
2

EXHIBIT B-1
(on behalf of Maricopa County Public Health)
Chronic Disease – Total Budget $25K, Project Deadline 6/30/15
Conduct a review of Affordable Care Act policies related to the ability to provide health
care coverage to un-sentenced individuals detained in correctional facilities and bill
Marketplace insurance plans for related services. Conduct additional policy review
related to activities initiated by other federal/state/local entities to provide and/or procure
coverage for un-sentenced individuals detained in correctional facilities.
Analysis of the health care services provided to un-sentenced individuals detained in
correctional facilities who have the following chronic health conditions: hepatitis B (hep
B), hepatitis C (hep C) and diabetes and the costs related to testing and treatment
services provided to these individuals. Access to client data will be provided by MCJS.
Parameters of the scope of this analysis to be agreed upon by the vendor and MCDPH,
in consultation with the MCCHS.
1. Cost/Benefit Analysis of Providing ACA Coverage: Analysis of the potential ACA
eligibility of those un-sentenced individuals detained in correctional facilities who
have hepatitis B, hepatitis C and diabetes and are being treated for these
diseases and the costs associated with enrolling and maintaining individuals in
ACA coverage while detained. Analysis of costs associated with providing
individuals with three months of transitional coverage post-release.
2. Cost/Benefit Analysis/Third-Party Reimbursement Capacity Building at MCCHS:
Cost/benefit analysis of creating infrastructure at MCCHS to seek third-party
reimbursement for chronic disease testing and treatment services, including
costs associated with adding/implementing a claims module to the existing MCJS
electronic medical record system, employee-related costs, ACA premium
payment coordination, and costs/benefits of third-party coordination of
billing/claims/premium payment.
3. Development and presentation of recommendations.
3

Subtotal Subtotal per
Activity - per activity Category
HRS (or trips
or pages to
TAPI staff be copied) Rate Total $482.27
Chronic Disease - TAPI staff -
Oversight and implementation;
establishing contracts, 11.9434 $33.65 $401.90
coordinating meetings, etc Apr-
June 2015
Chronic Disease - 20% of salary
for Jennifer and Patty (Apr - June $80.38
2015) $482.27
1.1 Assessment Activity
for MCDPH $4,395.00
Chronic Disease - 1.1 One month
assessment of clients including
5 $40.00 $200.00
adding appropriate survey
questions, and analysis
Chronic Disease - 1.1 One month
assessment of clients including
10 $25.00 $250.00
time to administer questions and
perform data entry $450.00
Chronic Disease - 1.2
Cost/benefit to seek
reimbursement for Hep B and C
testing (insurance type and
coverage rate of clients, services, 15 $85.00 $1,275.00
provider, which services are
reimbursable, reimbursement
rate; expected reimbursement
revenue vs cost of billing) $1,275.00
Chronic Disease - 1.3 Evaluation
capacity building/technical
assistance needs (assessment of
4 $85.00 $340.00
clinic flow, staffing, training,
additional needs;
recommendations) $1,090.00
4

Chronic Disease - 1.3 Evaluation
capacity building/technical
5 $150.00 $750.00
assistance needs (clinic flow
assessment with recs)
Chronic Disease - 1.4 What
system issues need to be 3 $85.00 $255.00
addressed
1.4 What system issues need to
3 $150.00 $450.00
be addressed $705.00
Chronic Disease - 1.5 Develop
and present recommendations
5 $85.00 $425.00
(presentation to SW Center and
MCDPH)
Chronic Disease - 1.5 Develop
and present recommendation
3 $150.00 $450.00
(presentation to SW Center and
MCDPH) $875.00
2.1 Capacity Building
Assessment for MCCHS $17,850.00
Chronic Disease - 2.1 Policy
review of ACA (meetings with
stakeholders, contacting other
states, reviewing ACA 10 $100.00 $1,000.00
requirements, statutes program
policies, and legal issues; final
report)
$1,000.00
Chronic Disease - 2.2 Data
collection and analysis of MCJS
5 $150.00 $750.00
data (meeting to collect data
from MCJS)
Chronic Disease - 2.2 Data
collection and analysis of MCJS
data (meeting and work to collect
data from MCJS, analysis of the 40 $85.00 $3,400.00
costs of health care services
provided to presentenced
detainees)
$4,150.00
5

Chronic Disease - 2.3 C/b analysis
based on plan costs and health
expenditures (data collection,
20 $85.00 $1,700.00
meeting with partners, analysis
of costs to provide ACA
insurance)
Chronic Disease - 2.3 C/b analysis
based on plan costs and health
expenditures (data collection,
20 $150.00 $3,000.00
meeting with partners, analysis
of costs to provide ACA
insurance) $4,700.00
Chronic Disease - 2.4 Capacity
building cost benefit analysis
(comparison of 2.2 results, 2.3
results, clinic flow and staffing
40 $85.00 $3,400.00
assessment, cost of electronic
systems and billing systems,
needed resources in light of
potential for reimbursement)
Chronic Disease - 2.4 Capacity
building cost benefit analysis
(comparison of 2.2 results, 2.3
results, clinic flow and staffing
20 $150.00 $3,000.00
assessment, cost of electronic
systems and billing systems,
needed resources in light of
potential for reimbursement)
$6,400.00
Chronic Disease - 2.5
Development and Presentation
10 $85.00 $850.00
of Recommendations (Report and
Presentation)
Chronic Disease - 2.5
Development and Presentation
5 $150.00 $750.00
of Recommendations (Report and
Presentation) $1,600.00
Subtotal -Chronic Disease $22,727.27
Chronic Disease - Admin 10% of
$2,272.73
Charge Chronic Disease subtotal $2,272.73 $2,272.73
Total $25,000.00 $25,000.00 $25,000.00
6

EXHIBIT B-2
(on behalf of Maricopa County Correctional Health)
HIV – Total Budget: $47,596.03. Project deadline Dec 30, 2015
One month assessment of clients accessing outreach HIV testing services conducted at
Southwest Center for HIV (SWHIV), to determine the number of clients presenting for
HIV Testing services that:
 Have health care coverage
 Of these, how many would be willing to use their health care coverage to
cover costs related to HIV testing services
 Determine what entities are providing health care coverage
 Assess whether a sufficient number of clients with health care coverage
justify capacity building to seek third-party reimbursements
Additionally, collect limited demographic information (age, race, gender, etc.).
Cost/Benefit analysis of SWHIV to seek third-party reimbursement for HIV testing
services.
Evaluation of the capacity building/technical assistance needs of SWHIV to implement
third-party reimbursements for HIV services.
Assess what systems issues need to be addressed to support SWHIV to contract with
insurance companies to provider HIV preventative services.
Development and presentation of recommendations.
Conduct a review of Affordable Care Act policies related to the ability to provide and bill
Marketplace insurance plans for HIV testing and health care coverage to un-sentenced
individuals detained in Maricopa County adult correctional facilities. Conduct additional
policy review related to activities initiated by other federal/state/local entities (such as
Medicaid, Ryan White Programs, etc.) to provide and/or procure coverage for un-
sentenced individuals detained in correctional facilities.
Analysis of the health care services and related costs provided to all HIV positive
individuals that were newly diagnosed within the Maricopa County adult correctional
facilities by testing activities funded by the HIV Prevention Program in 2013
approximately 50 individuals), and those otherwise identified as HIV positive while
detained in Maricopa County adult correctional facilities. Access to client data will be
provided by Maricopa County Correctional Health Services (MCCHS). Parameters of
the scope of this analysis to be agreed upon by the vendor and the HIV Prevention
Program, in consultation with the MCCHS.
7

1. Cost/Benefit Analysis of Providing ACA Coverage: Analysis of the potential ACA
eligibility of all HIV positive individuals that were newly diagnosed by testing
activities funded by the HIV Prevention Program in 2013 (approximately 50
individuals), and the costs associated with enrolling and maintaining individuals
in ACA coverage while detained. Analysis of costs associated with providing
individuals with three months of transitional coverage post-release. Analysis to
be based on the client’s income, and the potential providers of ACA, Medicaid or
Ryan White medical care for HIV individuals.
2. Cost/Benefit Analysis/Third-Party Reimbursement Capacity Building at MCCHS:
Cost/benefit analysis of creating infrastructure at MCCHS to seek third-party
reimbursement for HIV testing and treatment services, including costs associated
with adding/implementing a claims module to the existing MCJS electronic
medical record system, employee-related costs, ACA premium payment
coordination, and costs/benefits of third-party coordination of
billing/claims/premium payment.
3. Development and presentation of recommendations.
8

Subtotal per Subtotal per
Activity - activity Category
HRS (or
trips or
pages to be
TAPI staff copied) Rate Total $4,726.32 $4,726.32
TAPI staff- Program
Oversight Apr - June 35 $40.87 $1,430.45
2015
TAPI staff -Oversight
andof implementation;
establishing contracts, 69 $33.65 $2,321.85
coordinating meetings,
etc Apr- June 2015
20% of salary for
Jennifer and Patty (Apr - $974.02
June 2015)
1.1 Assessment
Activity for
MCDPH $13,947.60
1.1 One month
assessment of clients
(20 days administering
survey and performing 192 $25.00 $4,800.00
data entry, 1 day of
training, 3 days of extra
data entry)
1.1 One month
assessment of clients
8 $40.00 $320.00
(QC by Kathy over 4
weeks)
1.1 One month
assessment of clients
20 $40.00 $800.00
(Final report analysis
and writing)
1.1 One month
assessment of clients
2,000 $0.50 $1,000.00
(Copying of survey
forms)
9

1.2 Cost/benefit to seek
reimbursement
(insurance type and
coverage rate of clients,
services, provider, which
services are 20 $85.00 $1,700.00
reimbursable,
reimbursement rate;
expected
reimbursement revenue
vs cost of billing) $1,700.00
1.3 Evaluation capacity
building/technical
assistance needs
(assessment of clinic 8 $85.00 $680.00
flow, staffing, training,
additional needs;
recommendations)
1.3 Evaluation capacity
building/technical
assistance needs (clinic 10 $150.00 $1,500.00
flow assessment with
recs) $2,180.00
1.4 What system issues
5 $85.00 $425.00
need to be addressed
1.4 What system issues
5 $150.00 $750.00
need to be addressed
1.5 Develop and present
recommendations
5 $33.65 $168.25
(presentation to SW
Center and MCDPH)
1.5 Develop and present
recommendations
10 $85.00 $850.00
(presentation to SW
Center and MCDPH)
1.5 Develop and present
recommendations
5 $40.87 $204.35
(presentation to SW
Center and MCDPH)
.1.5 Develop and
present
recommendation 5 $150.00 $750.00
(presentation to SW
Center and MCDPH) $1,972.60
10

2.1 Capacity
Building
Assessment for
MCCHS $24,595.20
2.1 Policy review of ACA
(meetings with
stakeholders, contacting
other states, reviewing
40 $100.00 $4,000.00
ACA requirements,
statutes program
policies, and legal
issues; final report)
2.2 Data collection and
analysis of MCJS data
5 $150.00 $750.00
(meeting to collect data
from MCJS)
2.2 Data collection and
analysis of MCJS data
(meeting and work to
collect data from MCJS,
40 $85.00 $3,400.00
analysis of the costs of
health care services
provided to
presentenced detainees)
$4,150.00
2.3 C/b analysis based
on plan costs and health
expenditures (data
collection, meeting with 20 $85.00 $1,700.00
partners, analysis of
costs to provide ACA
insurance)
2.3 c/b analysis
regarding capacity to bill
insurance (data
collection, meeting with 20 $150.00 $3,000.00
partners, analysis of
costs to provide ACA
insurance)
$4,700.00
11

2.4 Capacity building
cost benefit analysis
(comparison of 2.2
results, 2.3 results, clinic
flow and staffing
assessment, cost of 40 $85.00 $3,400.00
electronic systems and
billing systems, needed
resources in light of
potential for
reimbursement)
2.4 Capacity building
cost benefit analysis
(comparison of 2.2
results, 2.3 results, clinic
flow and staffing
assessment, cost of 40 $150.00 $6,000.00
electronic systems and
billing systems, needed
resources in light of
potential for
reimbursement)
$9,400.00
2.5 Development and
Presentation of
Recommendations 10 $40.87 $408.70
(Report and
Presentation) $408.70
2.5 Development and
Presentation of
Recommendations 10 $33.65 $336.50
(Report and
Presentation)
2.5 Development and
Presentation of
Recommendations 10 $85.00 $850.00
(Report and
Presentation)
2.5 Development and
Presentation of
Recommendations 5 $150.00 $750.00
(Report and
Presentation) $1,936.50
12

Subtotal $43,269.12
$35,501.03
Total $43,269.12 $43,269.12
13

EXHIBIT C, Business Associate Agreement
MARICOPA COUNTY
By and Through its
Department of Public Health (MCDPH)
And
By and Through its
Correction Health Services (MCCHS)
BUSINESS ASSOCIATE AGREEMENT
This Agreement sets out the responsibilities and obligations of The Arizona Partnership for Immunization
(“Business Associate” or “Associate”) as a business associate of the MARICOPA COUNTY, a covered entity, under
the Health Insurance Portability and Accountability Act (“HIPAA”), the Health Information Technology for Economic
and Clinical Health (“HITECH”) Act, and pursuant to the Contract or Engagement Letter between Associate and
MARICOPA COUNTY.
MARICOPA COUNTY may make available and/or transfer to Associate Protected Health Information (“PHI”) of
individuals in conjunction with Services, which Associate will use or disclose only in accordance with this Agreement.
Associate and MARICOPA COUNTY agree to the terms and conditions of this Agreement in order to comply with the
use and handling of PHI under the HIPAA Standards for Privacy of Individually Identifiable Health Information, 45
C.F.R. Part 160 and Part 164, Subpart E (“Privacy Standards”) and the HIPAA Security Standards, 45 C.F.R. Part
160 and Part 164, Subpart C (“Security Standards”), both as amended from time to time. Unless otherwise provided,
all capitalized terms in this Agreement will have the same meaning as provided under the Privacy Standards and
Security Standards. Associate and MARICOPA COUNTY will comply with the terms of this Agreement for the
duration of the Contract or Engagement Letter and for such other continuing periods as provided in this Agreement.
Upon the compliance date of any final regulation or amendment to final regulation promulgated by the Secretary of
Health and Human Services that affects Associate’s use or disclosure of PHI, the parties agree to take such
reasonable action as is necessary to amend this Agreement in order for MARICOPA COUNTY to comply with such
final regulation or amendment to final regulation.
Definitions for terms in this Agreement:
1. Business Associate or Associate means an entity that performs or assists in the performance of a function on
behalf of a Covered Entity, which involves the use, or disclosure of Individually Identifiable Health Information
as defined in 45 C.F.R. § 160.103. In addition, an Associate can be an entity that provides data transmission
services to a Covered Entity, is more than a mere conduit of information, and allows a Covered Entity to
access the maintained information in a manner beyond a random or infrequent basis. The terms “Business
Associate”, “Associate” and “Contractor” are synonymous. Notwithstanding this definition, if Contractor does
not have access to or create Protected Health Information under this Contract, Contractor is not an
Associate, and the terms of this Agreement do not apply to Contractor.
2. Contractors of Business Associate means a person or an entity to whom an Associate delegates a function,
activity, or service that the Associate has agreed to perform for a Covered Entity. A contractor of an
Associate which creates, receives, maintains, or transmits personal health information on behalf of the
business associate is itself a Business Associate and therefore will comply with the terms of this Agreement.
Maricopa County Business Associate Agreement 1
4/3/2015

EXHIBIT C, Business Associate Agreement
For purposes of this Agreement the term “Contractor” includes the Contractor, its employees, its
subcontractors and its agents.
3. Protected Health Information (“PHI”) means the health information that is created or received by a Covered
Entity; and relates to the physical condition, mental health or other health condition of an Individual, or to the
provision of health care to the Individual (including but not limited to the payment for such health care); and
identifies or can be used to identify the Individual as defined in 45 C.F.R. § 160.103.
4. Individual shall have the meaning set forth in 45 CFR §160.103, including a person who is the subject of the
Protected Health Information, and shall include an individual or entity who qualifies as a personal, legal
representative of the person, as the context requires.
5. Privacy Rule shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR
Parts 160 and 164, Subparts A and E, as may be amended, modified or superseded, from time to time.
6. Security Rule shall mean the Standards for Security of Individually Identifiable Electronic Health Information at
45 CFR Parts 160 and 164, Subparts A, C and E, as may be amended, modified or superseded, from time to
time.
7. Breach shall mean the acquisition, access, use or disclosure of Protected Health Information in a manner not
permitted by the HIPAA Privacy Rule, that compromises the security or privacy of the Protected Health
Information as defined, and subject to the exception given to such term in 45 C.F.R. § 164.402.
8. Breach Notification Rule shall mean the interim final rule related to breach notification for unsecured protected
health information at 45 C.F.R. Parts 160 and 164.
9. Covered Entity shall have the meaning given to such term in 45 C.F.R. § 160.103.
10. Designated Record Set shall have the meaning given to such term under the Privacy Rule at 45 C.F.R. §
164.501.
11. Security Incident shall have the meaning given to such phrase under the Security Rule at 45 C.F.R. § 164.304.
12. Unsecured PHI shall have the meaning given to such phrase under the Breach Notification Rule at 45 C.F.R. §
164.402.
13. Electronic Protected Health Information or ePHI shall have the same meaning given to such term under the
Security Rule, including, but not limited to, 45 C.F.R. § 160.103.
14. Electronic Media shall have the same meaning given to such term in 45 C.F.R. § 160.103.
15. Health Information Technology for Economic and Clinical Health (HITECH) Act, as codified at 42 U.S.C.
§§ 17921-17954.
16. Secretary shall mean the Secretary of the Department of Health and Human Services or his or her designee.
It is agreed by and between the parties that:
1. Uses and Disclosures of Protected Health Information. Associate will use and disclose PHI only for those
purposes necessary to perform its duties, obligations and functions under the Contract, or as otherwise
expressly permitted in this Agreement or as required by other law.
a. Associate will not use or further disclose any PHI in violation of this Agreement.
b. Associate may use PHI to perform data aggregation services as permitted by 45 C.F. R. § 164.504(e) (2)
(i) (B).
Maricopa County Business Associate Agreement 2
4/3/2015

EXHIBIT C, Business Associate Agreement
c. Associate agrees that anytime it provides PHI received from MARICOPA COUNTY to a Contractor, its
employees, subcontractor, or agent to perform Services for MARICOPA COUNTY, Associate first will
enter into a contract with such Contractor, employees, subcontractor or agent that contains the same
terms, conditions, and restrictions on the use and disclosure of PHI as contained in this Agreement.
d. If Associate maintains a Designated Record Set, MARICOPA COUNTY will provide Associate with copies
of applicable policies and procedures, which the Associate will comply with as related to an individual’s
right to access PHI; request an amendment to PHI; request confidential communications of PHI; or
request an accounting of disclosures of PHI.
2. Associate Use or Disclosure of Protected Health Information for its Own Purposes. Associate may use or
disclose PHI received from MARICOPA COUNTY for Associate’s management and administration, or to carry
out Associate’s legal and contractual responsibilities. Associate may disclose PHI received from MARICOPA
COUNTY to a third party for such purposes only if:
a. The disclosure is required by law; or
b. Associate secures written assurance from the receiving party that the receiving party will: (i) hold the PHI
confidentially; (ii) use or disclose the PHI only as required by law or for the purposes for which it was
disclosed to the recipient; and (iii) notify the Associate of any breaches in the confidentiality of the PHI.
c. Associate may use and disclose de-identified health information, if (i) the use is disclosed to MARICOPA
COUNTY and permitted by MARICOPA COUNTY in its sole discretion, (ii) that the de-identification is in
compliance with 45 C.F.R. § 164.502(d), and (iii) the de-identified health information meets the standard
and implementation specifications for de-identification under 45 C.F.R. § 164.514(a) and (b).
d. Associate shall use and disclose PHI only to the extent reasonably necessary to accomplish the intended
purpose of such PHI.
3. Safeguards. Associate will implement and maintain appropriate safeguards to prevent any use or disclosure of
PHI not otherwise permitted in this Agreement.
a. Associate also will implement administrative, physical and technical safeguards to protect the
confidentiality, integrity, and availability of any electronic protected health information (“e-PHI”), if any,
that Associate creates, receives, maintains, and transmits on behalf of MARICOPA COUNTY.
b. Upon request of MARICOPA COUNTY, Associate will provide evidence to MARICOPA COUNTY that
these safeguards are in place and are properly managed.
4. Reports of Improper Use or Disclosure of Secure or Unsecure Protected Health Information and of
Security Incidents and Breaches. Associate will report in writing to MARICOPA COUNTY any use or
disclosure of PHI, including any breach, not permitted by the contract between Associate and MARICOPA
COUNTY within five (5) days of Associate’s learning of such use, disclosure or breach or within five (5) days
following the exercise of reasonable diligence would have known of the improper use, disclosure, or breach.
5. Mitigation of potential harmful effects. Associate shall mitigate all potential harmful effects of a use or
disclosure of Protected Health Information by Business Associate in violation of the requirements of this
Agreement. Immediately following the Associate’s discovery of a Breach (or upon the Associate’s reasonable
belief that a Breach has occurred), Associate shall provide MARICOPA COUNTY with sufficient information to
permit MARICOPA COUNTY to comply with the Breach notification requirements set forth at 45 C.F.R.
§164.400 et seq.
a. Specifically, if the following information is known to (or can be reasonably obtained by) the Associate,
Associate will provide to MARICOPA COUNTY all available information that MARICOPA COUNTY is
Maricopa County Business Associate Agreement 3
4/3/2015

EXHIBIT C, Business Associate Agreement
required to include in its notification to the individual pursuant to the Breach Notification Rule, including
but not limited to:
i. contact information for individuals who were or who may have been impacted by the Breach (e.g.,
first and last name, mailing address, street address, phone number, email address);
ii. a brief description of the circumstances of the Breach, including the date of the Breach, the date of
discovery of the Breach, and the identity of who accessed and received the Unsecured PHI;
iii. a description of the types of unsecured PHI involved in the Breach (e.g., names, social security
number, date of birth, address(s), account numbers of any type, disability codes, diagnostic and/or
billing codes and similar information);
iv. a brief description of what the Associate has done or is doing to investigate the Breach, mitigate
harm to the individual impacted by the Breach, and protect against future Breaches; and
v. contact information for a liaison appointed by the Associate with whom MARICOPA COUNTY may
ask questions and learn additional information concerning the Breach.
b. Following a Breach, Associate will have a continuing duty to inform MARICOPA COUNTY of new
information learned by Associate regarding the Breach, including but not limited to the information
described in items (1) through (5), above.
c. Associate also will report in writing to MARICOPA COUNTY any Security Incident (successful or
unsuccessful) of which Associate becomes aware within five (5) business days of Associate learning of
such use or disclosure.
Specifically, Associate will report to MARICOPA COUNTY any unauthorized access, use, disclosure,
modification, or destruction of e-PHI or interference with system operations in an information system
containing e-PHI of which Associate becomes aware, provided that:
i. such reports will be provided only as frequently as the parties mutually agree, but no more than once
per month; and
ii. if the definition of “Security Incident” under the Security Standards is amended to remove the
requirement for reporting “unsuccessful” attempts to use, disclose, modify or destroy e-PHI, the
portion of this Section 5 addressing the reporting of unsuccessful, unauthorized attempts will no
longer apply as of the effective date of such amendment.
6. Obligations Regarding Associate Personnel. Associate will appropriately inform all of its employees, agents,
representatives, members of its workforce, and Contractors, its employees, subcontractors, or agents of
Associate (“Associate Personnel”), whose services may be used to satisfy Associate’s obligations under the
Contract and this Agreement of the terms of this Agreement. Associate represents and warrants that the
Associate Personnel are under legal obligation to Associate, by contract or otherwise, sufficient to enable
Associate to fully comply with the provisions of this Agreement. Associate will maintain a system of sanction for
any Associate Personnel who violates this Agreement.
7. Access to Protected Health Information.
a. MARICOPA COUNTY Access. Within five (5) business days of a request by MARICOPA COUNTY for
access to PHI received from MARICOPA COUNTY, Associate will make requested PHI available to
MARICOPA COUNTY.
b. Patient Access. If a Patient requests access to PHI directly from Associate, Associate will within five (5)
business days forward such request in writing to MARICOPA COUNTY. MARICOPA COUNTY will be
responsible for making all determinations regarding the grant or denial of a Patient’s request for PHI and
Maricopa County Business Associate Agreement 4
4/3/2015

EXHIBIT C, Business Associate Agreement
Associate will make no such determinations. Only MARICOPA COUNTY will release PHI to the Patient
pursuant to such a request.
8. Amendment of Protected Health Information.
a. MARICOPA COUNTY Request. Within five (5) business days of receiving a request from MARICOPA
COUNTY to amend an individual’s PHI received from MARICOPA COUNTY, Associate will provide such
information to MARICOPA COUNTY for amendment. Alternatively, if MARICOPA COUNTY request
includes specific information to be included in the PHI as an amendment, Associate will incorporate such
amendment within five (5) business days of receipt of the MARICOPA COUNTY request.
b. Individual Request. If an individual makes a request for amendment directly to Associate, Associate will
forward within five business days such request in writing to MARICOPA COUNTY. MARICOPA COUNTY
will be responsible for making all determinations regarding amendments to PHI and Associate will make
no such determinations.
9. Accounting of Disclosures; Requests for Disclosure.
a. Disclosure Records. Associate will keep a record of any disclosure of PHI received from MARICOPA
COUNTY that Associate makes to its employees, subcontractors, and agents, or other third parties other
than:
(1) Disclosures to health care providers to assist in the treatment of patients;
(2) Disclosures to others to assist MARICOPA COUNTY in paying claims;
(3) Disclosures to others to assist MARICOPA COUNTY in conducting its health care operations, as
defined in 45 C.F.R. § 164.501; or
(4) Disclosures made pursuant to an individual’s Authorization.
Associate will maintain this disclosure record for six (6) years from the termination of this Agreement.
Associate also agrees to maintain necessary and sufficient documentation of Disclosures of Protected Health
Information as would be required for MARICOPA COUNTY to respond to a request by an individual for an
accounting of Disclosures, in accordance with 45 CFR 164.528.
b. Data Regarding Disclosures. For each disclosure for which it is required to keep a record under
paragraph 8(a), Associate will record and maintain the following information:
(1) The date of disclosure;
(2) The name of the entity or person who received the PHI, and, the address of such entity or person, if
known.
(3) A description of the PHI disclosed; and
(4) A brief statement of the purpose of the disclosure.
c. Provision to MARICOPA COUNTY. Associate will provide to MARICOPA COUNTY its record of
disclosures under paragraph 8(a), if any, within thirty days of each disclosure. Within five business days
of receiving a notice from MARICOPA COUNTY of an individual’s request for an accounting, Associate
also will provide to MARICOPA COUNTY its disclosure record.
d. Patient Request to Associate. If a Patient requests and accounting of disclosures directly from
Associate, Associate will forward the request to MARICOPA COUNTY within five (5) business days of
Associate’s receipt of the request, and will make its records of disclosures available to MARICOPA
COUNTY as otherwise provided in this Section. MARICOPA COUNTY will be responsible to prepare and
Maricopa County Business Associate Agreement 5
4/3/2015

EXHIBIT C, Business Associate Agreement
for delivery of the records of disclosure to the Patient. Associate will not provide an accounting of its
disclosure directly to the Individual.
10. Notice of Privacy Practices. MARICOPA COUNTY shall provide Associate a copy of its Notice of Privacy
Practices (“Notice”) in accordance with 45 C.F.R. § 164.520 as well as any changes to the Notice. If
MARICOPA COUNTY’ Notice specifically affects Associate’s use or disclosure of PHI, MARICOPA COUNTY
shall inform Associate of the specific limitations. Associate shall abide by the limitations of MARICOPA
COUNTY’ Notice that affects its use or disclosure of PHI of which it has been specifically informed. Any use or
disclosure permitted by this Agreement may be amended by changes to MARICOPA COUNTY’ Notice if
MARICOPA COUNTY specifically informs Associate of the amendment: provided, however, that the amended
Notice shall not affect permitted uses and disclosures on which Associate relied prior to receiving notice of such
amended Notice.
11. Access to Books and Records.
a. MARICOPA COUNTY Access. Associate will, within five (5) business days of MARICOPA COUNTY
written request, make available during normal business hours at Associate’s offices, all records, books,
agreements, policies and procedures relating to the use or disclosure of PHI received from MARICOPA
COUNTY for the purpose of allowing MARICOPA COUNTY or its agents or auditors to determine
Associate’s compliance with this Agreement.
b. Government Access. Associate will make its internal practices, books, and records relating to the use
and disclosure of PHI received from, or created or received by Associate on behalf of, MARICOPA
COUNTY available to the Secretary of the Department of Health and Human Services to the extent
required for determining compliance with the Privacy Standards. Notwithstanding this provision, no
attorney-client, accountant-client or other legal privilege will be deemed waived by Associate or
MARICOPA COUNTY as a result of this Section.
12. Termination. MARICOPA COUNTY may immediately terminate the Contract, if any and this Agreement upon
written notice to Associate if MARICOPA COUNTY determines that the Associate or subcontractor(s) or
agent(s) of Associate has breached a material term of this Agreement. Alternatively, MARICOPA COUNTY may
elect to provide Associate with written notice of Associate’s or subcontractor(s)’ or agent(s)’ of Associate breach
of any term or condition of this Agreement and afford Associate the opportunity to cure the breach to the
satisfaction of MARICOPA COUNTY within thirty (30) days of the date of such notice. If Associate fails to timely
cure the breach, as determined by MARICOPA COUNTY at its sole discretion, MARICOPA COUNTY may
terminate the Contract and this Agreement.
13. Return or Destruction of Protect Health Information.
a. Return of PHI; Destruction. Within thirty (30) days of termination of the Contract or this Agreement,
Associate will return to MARICOPA COUNTY all PHI received from MARICOPA COUNTY or created or
received by Associate on behalf of MARICOPA COUNTY that Associate maintains in any form or format.
Associate will not maintain or keep in any form or format any portion of such PHI. Alternatively, Associate
may, upon MARICOPA COUNTY written consent, destroy all such PHI and provide written documentation
of such destruction. The requirement to return or destroy such PHI will apply to all agents or
subcontractors of Associate. Associate will be responsible for recovering any PHI from such agents or
subcontractors. If Associate cannot obtain the PHI from any agent or subcontractor, Associate will so
notify MARICOPA COUNTY and will require that such agents or subcontractors directly return PHI to
MARICOPA COUNTY or otherwise destroy such PHI, subject to the terms of this Section.
b. Alternative Measures. If Associate believes that returning or destroying PHI at the termination of the
Contract or this Agreement is infeasible, it will provide written notice to MARICOPA COUNTY within five
(5) business days of the effective date of termination of this Agreement. Such notice will set forth the
Maricopa County Business Associate Agreement 6
4/3/2015

EXHIBIT C, Business Associate Agreement
circumstances that Associate believes makes the return or destruction of PHI infeasible and the
alternative measures that Associate recommends for assuring the continued confidentiality and security
of the PHI. MARICOPA COUNTY promptly will notify Associate of whether it agrees that the return or
destruction of PHI is infeasible. If MARICOPA COUNTY agrees that return or destruction of PHI is
infeasible, Associate agrees to extend all protections, limitations and restrictions of this Agreement to
Associate’s use or disclosure of PHI retained after termination of this Agreement and to limit further uses
or disclosures to those purposes that make the return or destruction of the PHI infeasible. Any such
extended protections, limitations and restrictions will apply to any agents or subcontractors of Associate
for whom return or destruction of PHI is determined by MARICOPA COUNTY to be infeasible. If
MARICOPA COUNTY does not agree that the return or destruction of PHI from Associate or its agents or
subcontractors is infeasible, MARICOPA COUNTY will provide Associate with written notice of its
decision, and Associate, its agents and subcontractors will proceed with the return or destruction of the
PHI pursuant to the terms of this Section within fifteen (15) days of the date of MARICOPA COUNTY
notice.
14. Restrictions on Use or Disclosure of Protected Health Information. If MARICOPA COUNTY advises
Associate of any changes in, or restrictions to, the permitted use or disclosure of PHI received from MARICOPA
COUNTY, Associate will restrict the use or disclosure of such PHI consistent with the MARICOPA COUNTY
instructions.
15. Mitigation Procedures. Associate agrees to have procedures in place for mitigating, to the maximum extent
practicable, any deleterious effect from the use or disclosure of PHI received from MARICOPA COUNTY in a
manner contrary to this Agreement or the Privacy Standards.
16. Compliance with the HITECH Act. Associate will comply with the requirements of Title XII, Subtitle D of the
Health Information Technology for Economic and Clinical Health (HITECH) Act, codified at 42 U.S.C. §§ 17921-
17954, which are applicable to Associates, and will comply with all regulations issued by the Department of
Health and Human Services (HHS) to implement these referenced statutes, as of the date by which Associates
are required to comply with such referenced statutes and HHS regulations.
a. Associate will also comply with Section 13402 of the HITECH Act, codified at 42 U.S.C. § 17932, and
with all regulations issued by HHS to implement this statute, as of the date by which Associates are
required to comply with such referenced statutes and HHS regulations. Associate will make a report to
the MARICOPA COUNTY of any breach of unsecured protected health information, as required by 42
U.S.C. § 17932(b), within five (5) business days of Associate’s discovery of the breach. Associate will
indemnify MARICOPA COUNTY for any reasonable expenses MARICOPA COUNTY incurs in notifying
individuals of a breach caused by Associate or its subcontractors or agents.
17. Miscellaneous.
a. Compliance with Laws. The Parties acknowledge that state and federal laws relating to electronic data
security and privacy are rapidly evolving and that amendment of this Agreement may be required to
ensure compliance with such developments. Should such developments occur, and upon either Party’s
good faith request, the other Party agrees to enter good faith negotiations concerning the terms of an
amendment to this Agreement.
b. Construction of Terms. The terms of this Agreement will be construed in light of any applicable
interpretation or guidance on the Privacy Standards and Security Standards issued by the Department of
Health and Human Services and other applicable state or federal laws, rules and regulations as amended
from time to time.
Maricopa County Business Associate Agreement 7
4/3/2015

EXHIBIT C, Business Associate Agreement
c. No Third Party Beneficiaries. Nothing in this Agreement will confer upon any person other than the
parties and their respective successors or assigns, any rights, remedies, obligations, or liabilities,
whatsoever.
d. Assignment of Rights and Delegation of Duties. This Agreement is binding upon and inures to the
benefit of the Parties hereto and their respective successors and permitted assigns. However, neither
Party may assign any of its rights or delegate any of its obligations under this Agreement without prior
written consent of the other Party, which consent shall not be unreasonable withheld or delayed.
Notwithstanding any provisions to the contrary, however, MARICOPA COUNTY retains the right to assign
or delegate any of its rights and obligations hereunder to any of its wholly owned subsidiaries, affiliates or
successor companies. Assignments made in violation of this provision are null and void.
e. No Waiver. Failure or delay on the part of either Party to exercise any right, power, privilege or remedy
hereunder shall not constitute a waiver thereof. No provision of this Agreement may be waiver by either
Party except by a writing signed by an authorized representative of the Party making the waiver.
f. Severability. The provisions of this Agreement shall be severable, and if any provision of this Agreement
shall be held or declared to be illegal, invalid or unenforceable, the remainder of this Agreement shall
continue in full force and effect as though such illegal, invalid or unenforceable provision had not been
contained herein.
g. Entire Agreement. This Agreement constitutes the entire agreement between the parties with regard to
the Privacy Standards and Security Standards, there are no understandings or agreements relating to this
Agreement that are not fully expressed in this Agreement and no change, waiver or discharge of
obligations arising under this Agreement will be valid unless in writing and executed by the party against
whom such change, waiver or discharge is sought to be enforced.
h. Written Agreement. This Agreement is considered as an integral part of the underlying Contract, and is
incorporated as though fully set forth within the Contract. This Agreement will govern in the event of
conflict or inconsistency with any provision of Contract.
i. Choice of Law. This Agreement and the rights and obligations of the parties hereunder shall be
governed by and construed under the laws of the State of Arizona, without regard to applicable conflict of
law principles.
j. Counterparts. This Agreement may be executed in two or more counterparts, each of which shall be
deemed an original and when taken together shall constitute one agreement.
k. Facsimile and Electronic Signatures. Facsimile and electronic signatures shall be deemed to be
original signatures for all purposes of this Agreement.
l. Notices. Any notices required under this Agreement will be sent to the parties at the following address
by first class mail, fax or hand delivery:
Maricopa County Business Associate Agreement 8
4/3/2015

EXHIBIT C, Business Associate Agreement
MARICOPA COUNTY THE ARIZONA PARTNERSHIP FOR
BOARD OF SUPERVISORS IMMUNIZATIONS (‘Associates’)
301 W. Jefferson Street, 10th Floor 700 East Jefferson Street, Suite 100
Phoenix, AZ 85003 Phoenix, AZ 850134
(602) 506-3416 (602) 288-7568
Agreed to by MARICOPA COUNTY and Associate by:
MARICOPA COUNTY ASSOCIATE
_____________________________________ _________________________________
SIGNATURE DATE SIGNATURE DATE
Steve Chucri, Chairman, Board of Supervisors
PRINT NAME AND TITLE PRINT NAME AND TITLE
ATTEST:
_____________________________________
Clerk of the Board Date
APPROVE AS TO FORM:
_____________________________________
Attorney for Maricopa County Date
Maricopa County Business Associate Agreement 9
4/3/2015

EXHIBIT C, Business Associate Agreement
BUSINESS ASSOCIATE AGREEMENT
FOR RELEASE OF INFORMATION TO THIRD PARTIES
1. _______________________________ (“Associate”) is a business associate of MARICOPA COUNTY,
pursuant to the Agreement between Associate and MARICOPA COUNTY dated __________
(“Agreement”). Pursuant to that Agreement, Associate is required to comply with the requirements for the
use and handling of Protected Health Information (“PHI”) from MARICOPA COUNTY as set forth in the
Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. 164.501 et. seq. as amended
from time to time (“Privacy Standards”).
2. Associate is permitted to disclose PHI to _______________ (“Recipient”) for the necessary management
and administration of Associate and to carry out the legal responsibilities of the Associate, provided that
Recipient provides Associate with the following assurances for Recipient’s use and disclosure of PHI.
3. Associate seeks to disclose PHI to Recipient for the following management, administration or legal
responsibilities of Associate:
4. The disclosure of PHI to Recipient is conditioned upon Recipient’s assurance that, and Recipient agrees
that it will:
a. Hold the PHI confidentially and make no re-disclosure to any third party without Associate’s express
advance written consent;
b. Use or disclose the PHI only as required by law or for the purposes set forth above; and
c. Notify Associate in writing of any breaches in the confidentiality of the PHI within three days of
discovery of any such breach.
ASSOCIATE RECIPIENT
_____________________________________ _______________________________
SIGNATURE DATE SIGNATURE DATE
_____________________________________ ________________________________
PRINT NAME AND TITLE. PRINT NAME AND TITLE
Maricopa County Business Associate Agreement 10
4/3/2015