Extracted text (via pymupdf_layout)
10752 characters
J-119 DSA (02/2013) ARIZONA DEPARTMENT OF ECONOMIC SECURITY Attachment 8 Information Security Administration, 1720W. Madison St., Site 820Z Phoenix, AZ 85007 Phone: (602) 771-2670 • Fax: (602) 364-0481 DATA-SHARING REQUEST/AGREEMENT BETWEEN REQUESTING ENTITY: Maricopa County Administred by its Human Services Department Community Services Division (DES Division/Administration/Program/Offiee Nome or External Organization Name) AND DATA MANAGER: ARIZONA DEPARTMENT OF ECONOMIC SECURITY Division of Aging and Adult Services (Division/Adminisiratio»/Program/Office Name) Effective Date: Agreement No.: Equal Opportunity Employer/Program This document available M alternative formats by contacting: (602) 771-2670. J-119 DSA (02/2013) - PAGE 2 Agreement No.: SECTION I. REQUEST (Completed by Requesting Entity) Use attachment if necessary la. PURPOSE OF THIS REQUEST (What information is being requested and why? How will it be used? Give details/specifics.) Information regarding a specific client may be provided to the Maricopa County Human Services Department — Community Services Division (MCHSD-CSD), when a client has submitted a complaint with ADES or has concerns. MCHSD-CSD will also sbmit personally identifiable information to APES. The information will be included in reports that are required to be submitted to APES. lb. INFORMATION TECHNOLOGY AND CONNECTIVITY All information transmited will be through secure email, mail, or telephone. • Client information will only be transmitted if requested by the other party. Maricopa County has a "Secure email system", information requested/transmitted via email shall be sent by either an encrypted email by adding the -Encrypt- flag to the beginning of the subject of an externally-bound email -or- by using the secure ad hoc FTP system. The ad hoc FTP system is used to transmit large file attachments securely between two or more parties. Encrypted email will be used for basic private messaging between parties and for smaller attachments. Emails are scanned by Ironport Spam Quarantine and FireEye Threat Intelligence systems that prevent malicious email. Email servers are located in secure locations, accessed only by badge personnel. • Information transmitted via mail shall be sent certified/return receipt. • Telephone conversations regarding a specific client shall be held in areas that reduce the opportunity to be overheard, personal identifing information shall be kept to a minimum. The requester enters all information required for successful communication between the requesting entity and the DES IT Staff Contact Name (1): Sandra A. Mendez Phone: (602) 506-4936 Contact Name (2): Tina Tegtmeyer Phone: (602) 506 -4844 Contact Address: 234 N. Central Ave. #3000 Phoenix, AZ 85004 Contact (1) E -Mail Address: Contact (2) E -Mail Address: MendezS002@mail.maricopa.gov TegtmeyerT®mail.maricopa.gov Contact Fax No: (602) 506-4749 J-119 OSA (0212013) - PAGE 3 Agreement No.: SECTION I. (cont.) REQUEST (Completed by Requesting Entity) Use attachment If necessary 2. CITE LAW, REGULATION, DIRECTIVE OR OTHER BASIS FOR THIS REQUEST ADES Contract Number DE111071001 ADES15-089115 MCHSD-CSD administers the Community Action Program (CAP) through Case Management and Community Services in Maricopa County, excluding the City of Phoenix. The Goal of CAP is to reduce poverty and conditions that are often associated with poverty. MCHSD-CSD provides utility, rent, mortgage assistance to eligible low-income residents in Maricopa County. 3. WILL OTHER ENTITIES INTERFACE WITH YOUR AGENCY? Dyes LSI No If Yes, identify entity and reason(s): 4. WILL !INFORMATION BE DISCLOSED/SHARED WITH ANOTHER ENTITY? • Yes El No If Yes, identify entity and reason(s) for disclosure: 5. WILL DES DATA BE REPACKAGED/INCLUDED IN OTHER DATA BASES, FILES, TAPES, ETC. • Yes F14. No If Yes, identify entity and reason(s): 6. DESIRED OUTPUT (Printout, tape, termoiraf accessfrimplay, etc.) Client files confidential and are maintained in locked cabinets. 7. DESCRIBE SAFEGUARDS IN PLACE TO GUARD AGAINST UNAUTHORIZED ACCESS/DISCLOSURE OF THE INFORMATION MCHSD-CSD complys with all applicable DES IT and security policies to ensure the protection of confidential data. Client data is maintained in locked cabinets. Access to offices is restricted to employees with specified badge access to our floor. Non-employees and general public must pass through our building security station with guards. All staff complete security training. Employees are required to maintain all access codes and passwords condidential. PRINT NAME AND TITLE OF AUTHORIZED CONTACT PHONE NO. (602) 606-6911 DATE FAX (602) 506-2613 Bruce Liggett, Human Services Director E-MAIL MAILING ADDRESS/SITE CODE CITY STATE ZIP CODE 234 N. Central Ave #3000 Phoenix AZ 85004 J-119 DSA (02/2013) - PAGE 4 Agreement No.: SECTION IL STIPULATIONS REGARDING THE USE OF INFORMATION STIPULATIONS APPLICABLE TO THE REQUESTING ENTITY: 1. Disclosure of the data provided to the Requesting Entity is not permitted unless specifically authorized. 2. Repackaging or redistribution of data or screens, or creation of separate files will not be permitted unless specifically authorized. 3. The data shall be used only to assist in valid administrative needs as stated in Section I, item 1 of this Agreement. 4. All data shall be stored in a physically secure facility. 5. All data in electronic fomat shall be stored or processed so that unauthorized persons cannot retrieve the information by means of a computer, remote access, or other means. 6. Only authorized staff will be given access needed to accomplish the purpose(s) specified in Section I, item 1 of this Agreement. 7. All staff shall attend an authorized data security awareness training class, where they will be instructed on confidentiality, privacy laws and penalties imposed when compliance is breached. All staff with access to DES systems and/or applications must complete an annual recertification security awareness training class as scheduled by DES. 8. A Request for Terminal Access and Other Activity (J-125) shall be used to request specific access for each authorized staff member and must be signed by the staff supervisor or designee. 9. All authorized staff is required to sign a User Affirmation Statement (J-I29), as a condition for using requested data. This affirmation statement must be resigned at three (3) year intervals as scheduled by DES. 10. Any personnel changes requiring change or removal of access as described in Section I, item I of this Agreement, shall be reported promptly to the respective data security analyst. 11. Federal and state audit and data security personnel may have access to offices and records of the requesting entity to monitor or verify compliance with this agreement. 12. This Data-Sharing Agreement will remain in effect for 10 years from the effective date unless otherwise stipulated in Section III or overridden by the Contract, a Memorandum Of Understanding or an InterAgency Agreement. If length is overridden by another document, please reference the document in Section III. STIPULATIONS APPLICABLE TO PROVIDER: 1. DES will use the Requesting Entity employee identifying information solely for the purpose of establishing on-line access. 2. Only authorized DES employees will have access to requesting agency employee data. 3. In accordance with applicable federal, state, and/or local Privacy regulations, DES will protect all information collected from the Requesting Entity. STIPULATIONS APPLICABLE TO HIPAA — HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT: 1. All staff shall attend an authorized HIPAA awareness training class, where they will be instructed on confidentiality, privacy, information safeguards and penalties imposed when compliance is breached. 2. If applicable, there is a "Business Associate Contract" [45 CFR 164.502(e), 154.504(e). 164.532(d) & (e)] on file and will be attached to this data sharing agreement as an addendum. J-119 DSA (02/2013) - PAGE 5 Agreement No.: SECTION III. ADDITIONAL INFORMATION Print Name PHONE NO. DATE Signature ( ) - SECTION IV (A). RECOMMENDATIONS (Completed by the data managing program) • Recommend APPROVAL • Request is not recommended for approval. Print Name SITE CODE PHONE NO. DATE ( ) Signature SECTION IV (B). HIPAA RECOMMENDATIONS (Completed by the HIPAA DIVISION PRIVACY OFFICER) • Recommend APPROVAL Request is not recommended for approval. Print Name SITE CODE PH ONE NO. DATE ( ) - Signature J-119 DSA (0212013)- PAGE 6 Agreement No.: SECTION V. APPROVAL (Completed by the requesting entity and the data managing Program) I attest to the correctness of the information provided in Section 1 and agree to the stipulations and costs listed in Section 11 and III. I agree to comply with all provisions of the DES Data Security Policy. Should any violations of the DES Data Security Policy occur, this Agreement may be terminated. I further understand that DES will periodically review the terms of the Agreement to ensure it conforms with DES Policies and Procedures. In the event changes in either federal or state law or regulations Occur that conflict with the terms of the Agreement or render the terms of the Agreement void, impracticable, or otherwise impossible, this Agreement will terminate immediately. A new Agreement or an amendment to the existing Agreement will be initiated to provide for any changes, which cannot be accommodated within the provisions of the existing Agreement. The Requesting Entity shall hold harmless and indemnify the State of Arizona and its Department of Economic Security for any liability resulting from acts or ommissions attributable to the Requesting Entity. IN WITNESS HERETO, the PARTIES have executed this Agreement by signature of their duly authorized officials: For the Requesting Entity: Entity Name Maricopa County Approved as to Form: Print Signatory Name Steve chucri Title Chairman, Maricopa County Board of Supervisors • Maricopa County Attorney Attested to: Signature Date Maricopa County Clerk of the Board For the Department of Economic Security: Entity Name Division of Aging and Adult Services Print Signatory Name Title Signature Dale SECTION VI. APPROVAL (Completed by the Information Security Administration) This signed Agreement meets all requirements necessary to permit the controlled sharing of the DES data while simultaneously providing for the protection of the data. I certify that: • THIS AGREEMENT CONFORMS to DES Information Security Policy. • THIS AGREEMENT DOES NOT CONFORM to the DES Information Security Policy. Implementation of this Agreement cannot proceed until the following action is taken: Carl Carpenter DES Chief Information Security Officer (Signalure) (T(le) (DA f)