MOU RE HOSPITAL DISCHARGE DATA WITH ADHS.DOC

MEMORANDUM OF UNDERSTANDING
FOR THE SHARING OF HOSPITAL DISCHARGE DATA
BETWEEN
ARIZONA DEPARTMENT OF HEALTH SERVICES AND
MARICOPA COUNTY
by and through its Department of Public Health
WHEREAS, the Arizona Department of Health Services (ADHS) is a division of the State of Arizona established to
promote and protect public health and welfare through the operation of health related programs within the state.
WHEREAS, the Maricopa County by and through its Department of Public Health (MCDPH) is a division of Maricopa
County government established to promote and protect public health and welfare through the operation of health related
programs within the county.
WHEREAS, the MCDPH is a public health authority pursuant to the requirements of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. 104-191) (HIPAA) and applicable law.
WHEREAS, ADHS and MCDPH recognize the need to set forth and define the terms under which ADHS will provide
data files to M C D P H containing public health records of Maricopa C ounty residents for the development of
community health profiles and other general public health surveillance activities and Public Health Practice performed by MCDPH.
NOW, THEREFORE, in consideration of the mutual promises and representations set forth in this Memorandum of
Understanding (MOU), M C D P H and ADHS mutually agree as follows:
1. DEFINITIONS. Capitalized terms used herein shall have the meanings set forth in this Section 1.
1.1. "Authorized Persons" means Maricopa County D e p a r t m e n t o f P u b l i c Health employees or
contractors who have a need to know or otherwise access Personally Identifying Information to enable the
M C D P H to perform its mission in conformance with the requirements of this MOU and who are bound in
writing by confidentiality obligations sufficient to protect Personally Identifying Information in accordance
with t h e terms and conditions of this MOU and applicable law.
1.2. “Hospital Discharge Data” means the health information organized and maintained by ADHS from hospital
discharge reports received by ADHS under A.A.C. R9-11-402 and A.A.C. R9-11-502 and applicable law,
including, but not limited to, patient names,
mailing addresses and geocodes, dates of birth, gender, race, ethnicity, discharge status, disease codes,
procedures performed and such other Hospital Discharge information reported to ADHS under applicable
law. Hospital discharge data is limited to records of inpatient stays and emergency department visits.
1.2. "Personally Identifying Information" means information provided to M C D P H , or at the direction of,
ADHS that:
1.2.1 Identifies or can be used to identify an individual (including, without limitation, names, signatures,
addresses, telephone numbers, e-mail addresses and other unique identifiers); or
1.2.2 Can be used to authenticate an individual (including, without limitation, employee identification
numbers, government-issued identification numbers, passwords or PINs, financial account numbers,
credit report information, biometric or health data, answers to security questions and other
personal identifiers). ADHS’ business contact information is not by itself deemed to be Personal
Information.
Page 9 of 11
HU556022

1.4. “Public Health Practice” means interventions and/or health surveillance designed solely to enhance the
well-being of the specific subject population identified in this MOU, and which have reasonable expectation
of success.
1.5. “Research” means a systematic investigation, including research development, testing and evaluation,
designed to develop or contribute to generalizable knowledge. Activities which meet this definition constitute
research for purposes of this MOU, whether or not they are conducted or supported under a program which is
considered research for other purposes. For example, some demonstration and service programs may include
research activities.
1.6. "Security Breach" means:
1.6.1 Any act or omission that materially compromises either the security, confidentiality or integrity of
Personally Identifying Information or the physical, technical, administrative or organizational
safeguards put in place by the County Health Agency or any Authorized Persons that relate to the
protection of the security, confidentiality or integrity of Personal Information, or
1.6.2 Receipt of a complaint in relation to the privacy practices of M C D P H or any Authorized
Persons or a breach or alleged breach of this MOU relating to such privacy practices.
2. PURPOSE AND SCOPE OF AGREEMENT
2.1. Purpose
Subject to availability of data and ADHS resources, ADHS agrees to provide M C D P H with Hospital
Discharge Data on Maricopa County residents in a mutually agreeable format.
2.2. Scope
Section 2.1 notwithstanding, the Parties agrees that MCDPH does not require, and ADHS shall not provide
M C D P H (except upon specific request) with data files containing any of the following information related
to any individual county resident:
2.2.1 Signatures, telephone numbers, e-mail addresses;
2.2.2 Employee identification numbers, passwords or PINs, credit report information, answers to security
questions and other similar personal identifiers;
2.2.3 Individual's government-issued identification number (including driver’s license number or state-issued
identified number); and
2.2.4 Financial account number, credit card number, debit card number, credit report information, with or
without any required security code, access code, personal identification number or password that
would permit access to an individual’s financial account or accounts.
2.2.5. Selection Criteria
ADHS will select records to give to M C D P H if the record meets this criterion: the patient’s
reported address is within the boundaries of Maricopa County, and/or the facility’s reported address is
within the boundaries of the county, as determined by ADHS. Data elements that ADHS will provide in
the data sets may include any data element permitted by this MOU and that is specifically requested by
MCDPH for inclusion.
Page 9 of 11
HU556022

2.2.6. Data Requests
To request data MCDPH must submit a request in writing to ADHS.
2.3. Inadvertent Disclosure
In the event that MCDPH is inadvertently provided with data files containing any of the information listed
in subsection 2.2, MCDPH will notify ADHS of the disclosure and delete or destroy such data files upon
ADHS’s request.
3. NO SUPERSESSION OF PAST AGREEMENTS
This MOU is not intended to and shall not supersede or replace any currently valid MOU in place between the MCDPH
and ADHS.
4. TERM OF THE AGREEMENT
The Term of this MOU shall commence upon signature of both parties and shall continue for a period of three (3)
years thereafter, unless terminated, canceled or extended as otherwise provided herein.
5. CONTRACT EXTENSION
By mutual written contract amendment, this MOU may be extended for two (2) years. The total MOU term,
including extension, shall not exceed a total of five (5) years from the effective date of the MOU, unless mutually
agreed to by the Parties.
6. TERMINATION
6.1. This MOU remains in effect as provided in Sections 4 and 5 or until the MOU is otherwise terminated
under the following terms and conditions:
6.1.1. Termination without Cause
Both ADHS and M C D P H may terminate this MOU at any time with thirty (30) calendar days’ notice,
in writing, specifying the termination date. Such notices shall be given by personal delivery or by certified
mail, return receipt requested.
6.1.2. Termination for Default
The ADHS reserves the right to terminate the MOU in whole or in part due to the failure of
MCDPH to comply with any material obligation, term or condition of this MOU. ADHS agrees to
provide M C D P H with written notice detailing the area of alleged lack of compliance or non-
performance and to provide MCDPH with thirty (30) days to correct the alleged lack of compliance
or non-performance prior to termination for default.
6.1.3. Cancellation for Conflict of Interest
Pursuant to A.R.S. § 38-511, ADHS may cancel this MOU within three (3) years after MOU
execution without penalty or further obligation if any person significantly involved in initiating,
negotiating, securing, drafting or creating the MOU on behalf of ADHS is, or becomes at any
time while the MOU or an extension of the MOU are in effect, an employee of or a consultant to
any other party to this MOU with respect to the subject matter of the MOU. The cancellation shall
be effective upon receipt of the written notice of cancellation, unless the notice specifies a later time.
Page 9 of 11
HU556022

7. SECURITY OF CONFIDENTIAL INFORMATION
7.1. MCDPH shall monitor the use of all Hospital Discharge Data disclosed by ADHS under this MOU,
including but not limited to Personal Identifying Information, and to carefully restrict the use and disclosure
of such information as provided for herein.
7.2. Survival of Duty to Protect Confidential Information
It is understood and agreed by the Parties that the obligations set forth in this Section 7, shall survive the
expiration or termination of this MOU, except as expressly provided for herein.
7.3. Minimum Safeguards for PHI
MCDPH shall carefully restrict use and access of ADHS Personally Identifying Information solely to Authorized
Persons and shall ensure that MCDPH implements the following minimum safeguards to prevent a Security
Breach in a manner consistent with the requirements of this MOU or applicable law. MCDPH safeguards
shall, at the minimum, require that MCDPH and its Authorized Persons:
7.3.1. Prohibit Personally Identifying Information supplied under the terms of this MOU from being
released or disclosed to anyone not working on M C D P H data collection and analysis as an
Authorized Person.
7.3.2. Ensure that any Authorized Persons, including any agent, or subcontractor to MCDPH, to whom
MCDPH provides confidential medical information, or Personally Identifying Information under this
MOU, agrees to the same restrictions and conditions that apply through this MOU to MCDPH with
respect to such information.
7.3.3. Secure all printouts containing individual identifiers or confidential data in a locked vault, file
cabinet or other method reasonably necessary to protect the confidential information.
7.3.4. Store all Hospital Discharge Data shared pursuant to this MOU only on secured servers or encrypted
devices within M C D P H , which, at the termination of this MOU, shall be securely deleted upon the
conclusion of this MOU consistent with the requirements of this MOU and applicable law.
7.3.5. Provide ADHS with a description of the security measures that are in place to maintain the
confidentiality of the data being received under this MOU. M C D P H will consider the items
described in the document titled "Security Considerations for Applicants" prepared by the ADHS
HSRB (See http://www.azdhs.gov/ops/oacr/documents/HSRB_SecurityChecklist.pdf).
7.3.6. Provide ADHS, upon request, with evidence that all Authorized Persons who have access to the
Hospital Discharge Data shared under this MOU have participated in any required training and signed
any documents that are necessary to keep both MCDPH and ADHS in compliance with HIPAA,
including but not limited to, Business Associate Agreement, user confidentiality affirmation
statement, HIPAA training certification or other HIPAA related compliance documents, if applicable.
7.3.7. Provide or continue to provide the ADHS with a copy of M C D P H ’ s procedure for the
notification of ADHS of any Security Breach, which shall include a requirement that any user of the
Hospital Discharge Data shared under this MOU shall immediately notify a designated individual at
MCDPH of any known or reasonably suspected Security Breach.
7.3.8. Maintain a log of all encrypted devices and identification numbers of those devices that are
Page 9 of 11
HU556022

authorized to transmit, receive or store the Hospital Discharge Data shared under this MOU, until the
data is destroyed. The ADHS may request a copy of the log at any time during the term of the
MOU or until the data is destroyed.
7.3.9. Make clear to all Authorized Persons and other MCDPH employees with a need to know
that MCDPH is prohibited from storing Hospital Discharge Data on non- encrypted flash drives, CDs,
external drives, smart phones or other non- networked hard drives.
7.3.10. Provide ADHS prompt proof of the complete destruction of the original data and any copies or
subsidiary data sets containing Personally Identifying Information that are developed from the
original data upon the conclusion of this MOU or at such time that such destruction is required by
applicable law.
7.3.11. Take all reasonable steps to ensure that Authorized Persons who have access to the Hospital
Discharge Data shared under this MOU shall maintain the same in strict confidence after the termination
of this MOU; provided that MCDPH’s obligations hereunder shall not apply to information that:
7.3.11.1.1.777777 Was already known to the receiving party prior to the time of first
disclosure, as demonstrated by contemporaneous, written documentation; or
7.3.11.1.2.777777 Is received without any obligation of confidentiality from a third party
having a legal right to disclose the same; or
7.3.11.1.3.777777 Is independently developed by the receiving party by individuals
without access to such information, as demonstrated by contemporaneous, written
documentation; or
7.3.11.1.4.777777 Is required to be disclosed by the receiving party pursuant to a
legally enforceable order, subpoena, or other regulation (ORDER), provided,
however, that the receiving party promptly notifies the disclosing party In
advance of such disclosure and discloses only that information necessary to
comply with said ORDER.
7.4. Security Breach
In the event of a Security Breach, pursuant to A.R.S. § 44-7501, M C D P H and ADHS agree to collaborate
with each other on the investigation, mitigation, remediation and, if necessary, breach notification of citizens.
Pursuant to A.R.S. § 41- 3507, the MCDPH and ADHS shall notify the Arizona Strategic Enterprise Technology
(ASET) Statewide Information Security and Privacy Office (SISPO) immediately upon becoming aware or receiving
notice of a Security Breach.
8. NON-DISCRIMINATION
The Parties shall comply with Executive Order 75-5 as modified by Executive Order 2009-09, which
mandates that all persons, regardless of race, color, religion, sex, age, national origin or political affiliation, shall
have equal access to employment opportunities, and all other applicable State and Federal employment laws,
rules, and regulations, including the Americans with Disabilities Act. The Parties shall take affirmative action to
ensure that applicants for employment and employees are not discriminated against due to race, creed, color, religion,
sex, national origin or disability.
9. RECORDS AND RIGHT OF INSPECTION
Under A.R.S. § 35-214 and § 35-215, M C D P H sh a l l retain all data and other records (“records”) relating
to the MOU for a period of five (5) years after the completion of the MOU. All records shall be subject to
Page 9 of 11
HU556022

inspection and audit by ADHS at reasonable times. MCDPH shall provide ADHS the right of access to
M C D P H and those servers or drives used for the storage of Personally Identifying Information, at all reasonable
times, in order to monitor and evaluate performance, compliance, and/or quality assurance under this MOU.
10. ARBITRATION
The parties to this MOU agree to resolve all disputes arising out of or relating to this MOU, after exhausting
applicable administrative review, through arbitration to the extent required by A.R.S. §12-1518
11. AMENDMENT OR MODIFICATIONS
No amendment or modifications to this MOU, including any amendment or modification of this Section, shall be
effective unless the same is in writing signed by the Parties.
12. ARIZONA LAW
The law of Arizona applies to this MOU including, where applicable, the Uniform Commercial Code as adopted
by the State of Arizona.
13. RELATIONSHIP OF PARTIES
MCDPH warrants that it is acting as an independent entity under this MOU. Neither party to this MOU shall be
deemed to be the employee or agent of the other party to the MOU.
14. SEVERABILITY
The Provisions of this MOU are severable. Any term or condition deemed illegal or invalid shall not affect any
other term or condition of the MOU.
15. NO PAROLE EVIDENCE
This MOU is intended by the parties to be a final and complete expression of their agreement. No course of prior
dealings between the p a r t i e s and n o u s a g e o f the trade shall supplement or explain any terms used in this
document.
16. NO WAIVER
Either Party’s failure to insist on strict performance of any term or condition of the MOU shall not be deemed a
waiver of that term or condition even if the party accepting or acquiescing in the nonconforming performance
knows of the nature of the performance and fails to object to it.
17. HEADINGS
Headings are for organizational purposes only and shall not be interpreted as having legal significance or meaning.
18. ADVERTISING AND PROMOTION OF CONTRACT
MCDPH shall not advertise, publish, or re-release any information for commercial benefit concerning this MOU
without the prior written approval of an ADHS Procurement Officer and the ADHS Human Subject Review Board
(HSRB).
Page 9 of 11
HU556022

19. DATA USE AND OWNERSHIP
19.1. MCDPH will use the Hospital Discharge Data exclusively for
19.1.1 Community health profiles;
19.1.2 Health surveillance activities; or
19.1.3 Public health interventions designed solely to enhance the well-being of Maricopa county
residents; or
19.1.4 Other uses approved by the Department.
19.2. MCDPH must request approval from ADHS HSRB to use data for the development of research
studies as defined in this MOU. If it is unclear to M C D P H w hether the data use is research
or public health practice or both, then M C D P H must request clarification from ADHS HSRB.
19.3. MCDPH activities using the ADHS data that generate external papers, reports, presentations, or
publications for dissemination outside of MCDPH must have specific written review and clearance
from the data owner at ADHS before release. M CD P H shall allow thirty (30) calendar days for
ADHS review.
19.5. ADHS shall be cited as the source of the data in all tables, reports, presentations, and scientific
papers, and M C D P H or its corresponding authors shall be cited as the source of
interpretations, calculations, and/or manipulations of the data.
20. NOTICES, CORRESPONDENCE AND REPORTS
20.1.Notices, correspondence and reports from Maricopa County Department of Public Health to ADHS shall be
sent to:
ARIZONA DEPARTMENT OF HEALTH SERVICES
Bureau Chief, Bureau of Public Health Statistics 150 N. 18th
Avenue, Suite 550
Phoenix, AZ 85007
Phone: (602)542-7333
20.2.Notices, correspondence, and reports from ADHS to Maricopa County Department of Public Health shall be
sent to:
Dr. Bob England, Director
Maricopa County Department of Public Health
Attn: Director
4041 N. Central Ave. Phoenix, AZ
85012
Phone: 602-506-6900
Signatures/Approvals:
Page 11 of 11
HU556022

Maricopa County Department of Public Health Arizona Department of Health Services:
Dr. Bob England, Director Chief Procurement Officer
Date:
Page 11 of 11
HU556022

IN WITNESS WHEREOF, the parties agree to enter into this
Agreement:
FOR AND ON BEHALF OF
MARICOPA COUNTY
By________________________________
Chairman, Board of Supervisors
__________________________________
Date
ATTEST:
__________________________________
Clerk of the Board
__________________________________
Date
APPROVED AS TO FORM:
__________________________________
Deputy Attorney for Maricopa County
__________________________________
Date
Page 11 of 11
HU556022