BUSINESS ASSOCIATE AGREEMENT WITH DIGNITY HEALTH.DOCX

HIPAA BUSINESS ASSOCIATE AGREEMENT
This HIPAA Business Associate Agreement (the “Agreement”) is made and entered into by
and between Dignity Health, a California nonprofit public benefit corporation (formerly named Catholic
Healthcare West), on behalf of itself and all of its affiliates (collectively “Dignity Health” or “Covered
Entity”) and Maricopa County by and through its Department of Public Health (“Business Associate,”
as defined in HIPAA, defined below) effective as of the earlier of the date signed below or
(“Effective Date”). It supplements and is made a part of all agreements, oral or written, ,
including any past engagement for which Business Associate retains PHI (defined in paragraph
1(d) below ), any current engagement and any future engagement (collectively the
“Agreement”), by and between Dignity Health and Business Associate.
RECITALS
A. Under the above Agreement, Business Associate has access to data which may
include both Protected Health Information (“PHI,” defined below) and non-PHI disclosed
or made available by or on behalf of Covered Entity to Business Associate.
B. Covered Entity and Business Associate are required to comply with the Health
Insurance Portability and Accountability Act (“HIPAA,” defined below) and other laws
which protect the privacy and security of patients’ PHI.
C. HIPAA requires the parties to enter into a contract containing specific
requirements to protect the security and privacy of patients’ PHI.
In consideration of the foregoing and the mutual promises and exchange of information pursuant
to this Agreement, the parties agree by incorporating all of the following into the Agreement:
1. General Provisions, Including Definitions. The recitals are incorporated by reference
into this Agreement. This Agreement is intended to apply all services provided to Dignity
Health by Business Associate, as of the Effective Date, whether or not such engagement has
been reduced to writing, and supersedes any form of business associate agreement, exhibit or
provision that the parties may have heretofore entered into. In this Agreement, Dignity Health
shall have all the rights, duties and obligations of the “Covered Entity” as defined under
HIPAA (defined below), and Business Associate shall have all the rights, duties and obligations
of the “Business Associate” as defined under HIPAA (defined below). All capitalized terms
not defined herein shall have the meaning ascribed to them by HIPAA (defined below),
including Business Associate, Covered Entity, Data Aggregation and Designated Record Set.
(a) “Breach” shall mean the unlawful or unauthorized access to, viewing,
acquisition, use or disclosure of PHI.
(b) “HIPAA” shall mean the Health Insurance Portability and Accountability Act of
1996 (Public Law 104-191), Title XIII of the American Recovery and Reinvestment Act of 2009
(Public Law 111-005) and the rules, guidance and regulations promulgated thereunder, as
amended from time to time, including 45 Code of Federal Regulations, Parts 160 and 164.
(c) “Patient” shall have the same meaning as the term “individual” under HIPAA
and shall include a person who qualifies as a personal representative.
Page 1 of 8

(d) “Protected Health Information” (“PHI”) shall have the meaning given to such
term under HIPAA and shall include any information, whether oral or recorded in any form or
medium, limited to the information created or received by Business Associate from or on behalf
of Covered Entity (i) that relates to the past, present or future physical or mental health condition
of the patient, the provision of health care to patient, or the past, present or future payment for
the provision of health care to patient; and (ii) that identifies the patient or with respect to which
there is a reasonable basis to believe the information can be used to identify the patient.
(e) “Secretary” shall mean the Secretary of the U.S. Department of Health and
Human Services or her/his designee.
(f) “Security Incident” shall mean any accidental, malicious or natural act that: (i)
Results in a Breach of any PHI or credit card information; or (ii) Adversely impacts the
functionality of the Dignity Health network; or (iii) Permits unauthorized access to the Dignity
Health network; or (iv) Involves the loss or loss of control of a Dignity Health owned or
managed information technology resource; or (v) Involves the use of Dignity Health technology
resources for illegal purposes or to launch attacks against other individuals or organizations; or
(vi) Impacts the integrity of Dignity Health’s files or databases including, but not limited to: (1)
interface failures; (2) inadequate testing or change control procedures; or (3) other failures which
result in the deletion or unauthorized changes to an electronic database. A “Security Incident”
shall not include any attempted access of system operations in an information system by a Packer
Internet Groper (PING) program.
(g) “State” shall mean the state in which the Covered Entity is located.
(h) “Subpart E” shall mean 45 Code of Federal Regulations, Part 164, Subpart E,
which consists of Sections 164.500 et seq., as amended from time to time.
2. Permitted Uses and Disclosures by Business Associate
(a) For Covered Entity. Except as otherwise limited in the Agreement, Business
Associate (i) shall create, maintain, transmit, access, use or disclose PHI only for the benefit of
Covered Entity and to perform functions, activities, or services as specified in the Agreement,
and (ii) shall not use or disclose PHI in a manner that would violate HIPAA if done by Covered
Entity. To the extent Business Associate is to carry out one or more of Covered Entity’s
obligations under Subpart E of 45 CFR Part 164, Business Associate shall comply with the
requirements of Subpart E that apply to Covered Entity in the performance of such obligations.
(b) Minimum Necessary. Business Associate shall use only the minimum amount of
PHI necessary to perform the specified functions, activities or services, in accordance with
Covered Entity’s minimum necessary policies and procedures. In the event of inadvertent access
by Business Associate to more than the minimum necessary amount of Covered Entity’s PHI,
Business Associate will: (i) treat all such PHI in accordance with the Agreement; (ii) promptly
notify Covered Entity, in accordance with paragraph 3(d) below, of such access; (iii) erase,
delete, and/or return such PHI as quickly as possible; and (iv) take all necessary actions to
prevent further unauthorized access to PHI beyond the minimum necessary amount.
(c) Management of Business Associate. Except as otherwise limited in the
Agreement, Business Associate may use or disclose PHI for its proper management and
administration or to carry out its legal responsibilities, provided that (i) the disclosure is required
Page 2 of 8

by law, or (ii) the Business Associate obtains reasonable assurances from the person to whom the
information is disclosed that such information shall remain confidential and be used or further
disclosed solely as required by law or for the purpose of assisting Business Associate to meet
Business Associate’s obligations under the Agreement. Business Associate shall require any
person to whom PHI is disclosed under this subsection to notify Business Associate of any
instance of which it is aware in which the confidentiality or security of the PHI has been
breached.
(d) Data Aggregation. Except as otherwise permitted in the Agreement, Business
Associate may use PHI to provide Data Aggregation services only for Covered Entity.
(e) Compliance with State Laws. Business Associate may use, disclose and access
PHI only as permitted by State law, unless such State law is contrary to HIPAA and is preempted
by HIPAA in accordance with 45 Code of Federal Regulations Sections 160.201 et seq.
3. Obligations of Business Associate
(a) Use. Business Associate shall not use or disclose PHI other than as permitted or
required by the Agreement, or as required by law.
(b) Safeguards. Business Associate shall use appropriate safeguards to prevent use
or disclosure of PHI other than as provided for by the Agreement. Business Associate shall
implement administrative, physical and technical safeguards that reasonably and appropriately
protect the confidentiality, security, integrity and availability of PHI that it receives, maintains,
transmits or creates on behalf of Covered Entity and that comply with the requirements of
HIPAA. In addition, if Business Associate conducts credit card transactions (i) such safeguards
shall consist of or include the recommendations of the Payment Card Industry Data Security
Standards, found at https://www.pcisecuritystandards.org and (ii) Business Associate shall not
store security code (i.e. CVC) information or credit card magnetic strip information in any form.
(c) Mitigation. Business Associate shall promptly mitigate, to the extent practicable,
any harmful effect of a use or disclosure of PHI by Business Associate in violation of the
Agreement.
(d) Notify Covered Entity. Business Associate shall promptly notify Covered Entity
of any Security Incident or Breach in writing in the most expedient time possible, and not to
exceed twenty-four (24) hours in the event of a Breach, following Business Associate’s initial
awareness of such Security Incident or Breach. Notwithstanding any notice provisions in the
Agreement, such notice shall be made to the Dignity Health Chief Privacy Administrator or
his/her designee by means of fax to (415) 591-6279 or by email to
privacy.office@dignityhealth.org. Business Associate shall cooperate in good faith with
Covered Entity in the investigation of any Breach or Security Incident.
(e) Breach Notification. Following notification to Covered Entity of a Breach,
Business Associate shall promptly cooperate with Covered Entity in determining which entity
shall provide any required Breach notification. If the parties agree that Business Associate shall
provide any required Breach notification, Business Associate shall provide such notification
timely and provide Covered Entity with documentation of Business Associate’s actions,
including documentation of the names and addresses of those to whom the notifications were
provided.
Page 3 of 8

(f) Access. If Business Associate holds PHI in Designated Record Sets as
determined by Covered Entity, Business Associate shall provide prompt access to the PHI to
Covered Entity whenever so requested by Covered Entity, or, if directed by Covered Entity, to a
Patient in order to meet the requirements of HIPAA and State Law, as applicable. If requested,
such access shall be in electronic format. If Patient requests directly from Business Associate (i)
to inspect or copy his or her PHI, or (ii) requests its disclosure to a third party, the Business
Associate shall promptly notify Covered Entity's facility privacy official of such request.
(g) Amendments. Business Associate shall promptly make amendment(s) to PHI
requested by Covered Entity and shall do so in the time and manner requested by Covered Entity
to enable it to comply with HIPAA and State Law, as applicable. If Patient requests an
amendment to his or her PHI, directly from Business Associate, the Business Associate shall
promptly notify Covered Entity's facility privacy official of such request and await such official's
denial or approval of the request.
(h) Internal Records. Business Associate shall promptly make its internal practices,
books, records, including its policies and procedures, relating to the use, disclosure, or security
of PHI that the Business Associate received from, maintained or created for or on behalf of
Covered Entity, available to Covered Entity or the Secretary, in a time and manner designated by
Covered Entity or the Secretary, to enable the Secretary to determine compliance with HIPAA.
(i) Accountings. Business Associate shall document all disclosures of PHI and
information related to such disclosures as required under HIPAA in order that it may provide an
accounting of such disclosures as Covered Entity directs. Business Associate shall: (i) Provide
an accounting as required under HIPAA to those Patients who direct their requests to Business
Associate; or (ii) Provide the accounting information required under HIPAA to Covered Entity,
if so requested by Covered Entity, in the time and manner specified by Covered Entity.
(j) Preservation. Business Associate shall cooperate with Covered Entity and its
medical staff to preserve and protect the confidentiality of PHI accessed or used pursuant to the
Agreement and shall not disclose or testify about such information during or after the termination
of the Agreement, except as required by law.
(k) Destruction. If, during the term of the Agreement, Business Associate wishes to
destroy the PHI, it shall notify Covered Entity in writing about its intent to destroy data at least
ten (10) days before such date of destruction, and shall comply with the requirements for
destruction of PHI found in Section 5(a) of this Agreement. If Covered Entity requests the return
of any PHI, Business Associate shall comply as requested.
(l) HIPAA Compliance. Business Associate shall comply with 45 Code of Federal
Regulations Part 164, Subpart C with respect to electronic PHI. The written policies and
procedures and documentation required to be maintained by Business Associate under the
Agreement, and HIPAA shall be made available to Covered Entity, upon Covered Entity’s
request.
(m) Subcontractors. Business Associate shall ensure that any agent including a
subcontractor that creates, receives, maintains, or transmits PHI on behalf of Covered Entity or
Business Associate agrees in a written contract with Business Associate to the same restrictions
and conditions that apply to Business Associate with respect to such information. In performing
Page 4 of 8

services under this Agreement, Business Associate shall use agents, employees and/or
subcontractors that are domiciled only within the United States of America and its territories.
Notwithstanding anything to the contrary in the Agreement, Business Associate shall not use any
agent or subcontractor to perform any service requiring access to PHI under this Agreement
without the express written consent of an authorized representative of Covered Entity.
4. Effect of Breach of Obligations. If Business Associate breaches any of its
obligations, Covered Entity shall have the option to do the following:
(a) Cure. Provide Business Associate an opportunity to cure the breach, to the extent
curable, and end the violation within a reasonable time specified by Covered Entity. If Business
Associate does not cure the breach or end the violation as and within the time specified by
Covered Entity, or if the breach is not curable, Covered Entity may terminate its obligations to
Business Associate, including, but not limited to, its future payment obligations and obligations
to provide information, materials, equipment or resources to Business Associate; or
(b) Termination. Immediately terminate the Agreement, if Covered Entity
reasonably determines that Business Associate (1) has acted with gross negligence in performing
its obligations; (2) is in violation of the law; (3) willfully has violated or is violating the privacy
and security provisions of this Agreement or HIPAA; or (4) is unable to provide, if requested,
written assurances to Covered Entity of its ability to protect the confidentiality and security of
the PHI. Such termination of the Agreement shall be without prejudice to other legal remedies
available to Covered Entity.
5. Effect of Termination
(a) Disposition of PHI. Upon termination of the Agreement and subject to Section
5(b) below, Business Associate shall promptly return to Covered Entity a copy of all PHI,
including derivatives thereof, and shall take all reasonable steps to promptly destroy all other
PHI held by Business Associate by: (i) shredding; (ii) securely erasing, or (iii) otherwise
modifying the information in those records to make it unreadable or undecipherable through any
means. This provision shall apply to PHI in the possession of subcontractors or agents of
Business Associate. At Covered Entity’s request, Business Associate shall certify in writing that
it has complied with the requirements of this Section.
(b) Infeasible; Survival. If the return or destruction of PHI is infeasible, Business
Associate shall promptly notify Covered Entity of the conditions that make such return or
destruction infeasible. Upon mutual determination by the parties that return or destruction of
PHI is infeasible, the obligations of the Business Associate under this Agreement shall survive
the termination of this Agreement. Business Associate shall limit the further use or disclosure of
all PHI to the purposes that make its return or destruction infeasible. If Business Associate
subsequently wishes to destroy PHI, Business Associate shall notify Covered Entity in writing
about its intent to destroy data at least ten (10) days before such date of destruction, and shall
comply with Section 5(a) above. If Covered Entity requests the return of any PHI, Business
Associate shall comply as requested.
6. Credit Monitoring. In the event that either party is required by law to notify individuals
whose PHI was inappropriately accessed, used, or disclosed by Business Associate, its
employees, subcontractor(s) or its agents, and the PHI contains: (i) the individual’s first initial or
first name, last name, and social security number; (ii) the individual’s first initial or first name,
Page 5 of 8

last name, and driver’s license or state identification card; (iii) the individual’s first initial or first
name, last name, account number, credit or debit card number, in combination with any required
security code, access code, or password that would permit access to an individual's financial
account; and/or (iv) the individual’s first initial or first name, last name, and PHI, then Business
Associate and Covered Entity shall work together to structure a credit monitoring offering
commensurate to the risk posed by the breach and Business Associate shall, in any event, pay the
costs of credit monitoring for one (1) year for such individuals and the costs and fees related to
timely notification in accordance with law.
7. Amendment. The parties agree to promptly modify or amend this Agreement to permit
parties to comply with any new laws, rules or regulations that might modify the terms and
conditions herein.
8. General. The Agreement, including any attachments hereto are intended to be construed
in harmony with each other, but in the event that any provision in an Amendment conflicts with
the provisions of the Agreement, or its other attachments, the provisions in an Amendment shall
be deemed to control and such conflicting provision or part thereof shall be deemed removed and
replaced with the governing provision herein to the extent necessary to reconcile the conflict,
except that the insurance provisions of an Amendment (if any) and the Agreement are to be read
as separate, concurrent obligations such that Business Associate shall comply with each
obligation and one shall not replace the other. Except as amended by an Amendment, all other
terms of the Agreement remain in full force and effect. An Amendment supersedes and replaces
all previous oral or written Business Associate agreements, amendments, or exhibits between
Business Associate and Covered Entity pertaining to protection of PHI. An Amendment may be
signed in two or more counterparts, all of which taken together shall be deemed to be one
Amendment. Signatures submitted via facsimile or electronic (scanned) means shall be deemed
original signatures of the parties and shall be valid and binding upon the parties hereto
9. Audits. Upon reasonable notice to Business Associate, Covered Entity shall have the
right to inspect and audit Business Associate’s privacy and security controls relating to Business
Associate’s compliance with the terms of the Agreement, and HIPAA. Business Associate may
impose reasonable restrictions upon Covered Entity’s access to Business Associate’s premises
information systems, including but not limited to limiting access only to those information
systems which contain Covered Entity’s PHI and limiting access to ensure Business Associate’s
compliance with existing confidentiality obligations to its other customers. Such audits shall
occur no more often than once per year or after any Breach or Security Incident and only upon a
good faith belief by Covered Entity that Business Associate is not in compliance with its
obligations under the Agreement, or HIPAA relating to Covered Entity’s PHI. All audits shall
be conducted with the least interruption to Business Associate’s normal business operations as
feasible. Covered Entity shall be responsible for all costs incurred in order to perform the audit.
10. No Third Party Beneficiary. The provisions and covenants set forth in this Agreement
are expressly entered into only by and between Business Associate and Covered Entity, and are
only for their benefit. Neither Business Associate nor Covered Entity intends to create or
establish any third party beneficiary status or right (or the equivalent thereof) in any other third
party and no such third party shall have any right to enforce or enjoy any benefit created or
established by the provisions and covenants in this Agreement.
11. Insurance. Business Associate shall obtain and continuously maintain the following
insurance coverages for Business Associate and its employees, agents and independent
Page 6 of 8

contractors in the following amounts: (a) not less than One Million Dollars ($1,000,000) per
occurrence and Two Million Dollars ($2,000,000) annual aggregate of commercial general
liability insurance; and (b) Two Million Dollars ($2,000,000) per occurrence and Four Million
Dollars ($4,000,000) annual aggregate of errors and omissions insurance. The general liability
or the errors and omissions insurance shall cover, among other things, Breaches. Business
Associate shall provide Covered Entity with certificates of insurance or other written evidence of
the insurance policy or policies required herein prior to the effective date of the Agreement and
as of each annual renewal of such insurance policies during the term of the Agreement. Further,
in the event of any modification, termination, expiration, non-renewal or cancellation of any of
such insurance policies, Business Associate shall give written notice thereof to Covered Entity
not more than ten (10) days following Business Associate’s receipt of such notification.
[SIGNATURE PAGE TO FOLLOW.]
Page 7 of 8

AGREED AND ACCEPTED:
Name of Covered Entity: Name of Business Associate
Dignity Health Maricopa County Department of Public
Health
___________________________________
Authorized Signature ___________________________________
Authorized Signature
___________________________________
Print Name ______________________________
Print Name
___________________________________
Print Title ___________________________________
Print Title
___________________________________
Date ___________________________________
Date
IN WITNESS WHEREOF, the parties agree to enter into this Agreement:
FOR AND ON BEHALF OF
MARICOPA COUNTY
By________________________________
Chairman, Board of Supervisors
__________________________________
Date
ATTEST:
__________________________________
Clerk of the Board
__________________________________
Date
APPROVED AS TO FORM:
__________________________________
Deputy Attorney for Maricopa County
__________________________________
Date
Page 8 of 8