MARICOPA COUNTY AMENDMENT 5 BAA 091514 RH.PDF

L-7409
Amendment 5
Customer: Maricopa County Change Order Number: QUO-15376-L7R9J6
C-41-09-002-1-05
This Amendment (this “Amendment”) is effective as of the date of full execution of this Amendment between
Maricopa County (“Customer”) and IO Capital Princess, LLC, a Delaware limited liability company
(“Licensor”). Customer and Licensor entered into that certain Lease and Master Services Agreement dated
August 4, 2008 as amended hereby and by any prior amendments (collectively, the “Agreement”). In
consideration of the mutual promises and covenants herein contained, and for good and valid consideration, the
receipt and sufficiency of which are hereby acknowledged, the Agreement is hereby amended as follows:
1. SubSection 1.1 of Attachment B shall be deleted in its entirety and replaced as follows:
““Agreement” means the IO Data Centers Lease and Master Services Agreement, including the cover page,
Attachments A through E, and any riders, exhibits or addenda attached thereto. The terms and conditions of
Attachment A shall prevail in the event of any inconsistency between Attachment A and any other portion of
this Agreement. The terms and conditions of Attachment B shall prevail in the event of any inconsistency
between Attachment E and Attachment B and any other portion of this Agreement.”
2. The parties agree to incorporate the attached Attachment E entitled “Business Associate Agreement” into the
Agreement.
3. All capitalized terms used in this Amendment and not otherwise expressly defined herein shall have the
meanings ascribed to such terms in the Agreement.
4. Except as expressly modified herein, all terms and conditions of the Agreement remain in full force and effect
and are hereby ratified and affirmed.
IN WITNESS WHEREOF, the parties hereto have entered into this Amendment as of the date set forth below.
IO CAPITAL PRINCESS, LLC MARICOPA COUNTY
By:______________________________________ By:_______________________________________
Printed Name:____________________________ Printed Name:_____________________________
Title:___________________________________ Title:____________________________________
Date:_____________________, 2014 Date:_____________________, 2014
ATTEST:
_____________________________________
Clerk of the Board Date
Approved as to Form:
__________________________________
Deputy County Attorney Date

L-7409
LICENSE AND MASTER SERVICES AGREEMENT
ATTACHMENT E - BUSINESS ASSOCIATE AGREEMENT
C-41-09-002-1-05
This Business Associate Agreement (“BAA”) dated September 5, 2014 (“Effective Date”) by and between IO Capital Princess, LLC
(“IO” and “Business Associate”) and Maricopa County (“Customer” and “Covered Entity”) (collectively the “Parties”). This BAA is
incorporated by this reference into the Lease and Master Services Agreement dated August 4, 2008, as amended, (“Agreement”) by
and between the Parties as if fully set forth therein. All terms not defined herein will have the same meanings set forth in the
Agreement.
WHEREAS, Business Associate and Covered Entity have entered into the Agreement pursuant to which Business
Associate provides Related Data Center Services to Covered Entity that may result in Covered Entity transmitting to Covered Entity’s
Customer Equipment located within Covered Entity’s Customer Area within Business Associate’s data center facility certain
information that is protected by state and/or federal law;
WHEREAS, pursuant to the Administrative Simplification provisions of the HIPAA (as defined below), the U.S. Department
of Health & Human Services (“HHS”) promulgated the Standards for Privacy of Individually Identifiable Health Information (the
“Privacy Standards”) requiring certain individuals and entities subject to the Privacy Standards to protect the privacy of certain
individually identifiable health information;
WHEREAS, pursuant to HIPAA, HHS has issued Security Standards (the “Security Standards”) for the protection of
electronic protected health information; and
WHEREAS, in order to protect the privacy and security of Protected Health Information created or maintained by or on
behalf of the Covered Entity, the Privacy Standards and Security Standards require Covered Entity and IO to enter into a business
associate agreement to the extent IO’s Related Data Center Services require the use or disclosure of Personal Health Information.
NOW THEREFORE, in consideration of the mutual promises set forth in this BAA and the Agreement, and other good and valuable
consideration, the sufficiency and receipt of which are hereby severally acknowledged, the parties agree as follows:
1. Business Associate Obligations and Activities. Business Associate hereby agrees:
1.1 to comply with the requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its
implementing regulations (45 C.F.R. §§ 160-64) (the “HIPAA Rules”) and the Health Information Technology for Economic
and Clinical Health Act, Public Law 111-005 (“HITECH”), as may be amended from time to time. The terms “Protected
Health Information” (“PHI”) and “electronic Protected Health Information” (“electronic PHI”) shall have the meanings set forth
in 45 C.F.R. §160.103. The terms “Personal Information” and “Personally Identifiable Information” (collectively, “PII”) shall
have the meaning set forth in 32 C.F.R. §310.4. PHI, electronic PHI and PII shall be collectively referred to as “PHI”.
Additionally, the following terms used in this BAA shall have the same meaning as those terms in the Privacy, Security,
Breach Notification and Enforcement Rules at 45 CFR §160 and §164 (the “HIPAA Rules”): Designated Record Set,
Disclosure, Individual, Required by Law, Secretary, Subcontractor, and Use.
1.2 not to Use or Disclose PHI other than as permitted or required by this BAA or as Required by Law.
1.3 to Use appropriate safeguards to prevent Use or Disclosure of PHI.
1.4 to report to Covered Entity within five (5) calendar days any Use or Disclosure of PHI not provided for by this BAA of which
Business Associate becomes aware.
1.5 to ensure that any Subcontractors that Business Associate uses who create, receive, maintain, or transmit PHI on behalf of
Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate.
1.6 where applicable to make available any PHI in a Designated Record Set to Covered Entity to satisfy Covered Entity’s
obligations regarding an Individual’s right of access and right to amend such PHI. For the avoidance of doubt, Business
Associate will promptly forward any Individual’s requests for access and amendment to an Individual’s PHI to Covered Entity
and Covered Entity shall not require Business Associate to access, use or disclose any PHI.
1.7 to maintain and make available the information required to provide an accounting of Disclosures to Covered Entity and
Business Associate will promptly forward any Individual’s requests for an accounting of Disclosures to Covered Entity.
1.8 to make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the
HIPAA Rules.
2. Permitted Uses and Disclosures.
2.1 Business Associate shall only Use or Disclose PHI as necessary to perform the Related Data Center Services and as
Required by Law. Covered Entity shall ensure that Covered Entity encrypts all data transmitted into Business Associate’s

data center facility and acknowledges and agrees that Business Associate shall not have the ability to access or Use
Covered Entity’s PHI.
2.2 Covered Entity acknowledges and agrees that all PHI in Business Associate’s data center is located on Covered Entity’s
Customer Equipment and is under the sole control of Covered Entity. Business Associate shall not have the right to access,
disclose, return or destroy such PHI.
3. Term and Termination.
3.1 This BAA shall be effective as of the Effective Date and shall expire on the late of: (i) the date the Agreement is terminated
or expires; or (ii) the date that all of the PHI provided by Covered Entity to Business Associate, or created, received,
maintained or transmitted by either Covered Entity or Business Associate on behalf of Covered Entity, is destroyed or
returned to Covered Entity. Notwithstanding the foregoing, Business Associate acknowledges and agrees that all PHI is
under the sole control of Covered Entity and Business Associate shall not have the right to access, disclose, return or
destroy such PHI. For the avoidance of doubt, termination of this BAA by Covered Entity shall not affect the Term of the
Agreement.
3.2 The obligations of Covered Entity and Business Associate under this Section 3 shall survive the termination of this BAA for
any reason and shall continue so long as Business Associate maintains any of Covered Entity’s PHI.
IN WITNESS THEREOF, the parties hereto have caused this BAA to be executed by their respective duly authorized representatives.
IO Capital Princess, LLC Maricopa County
By: _______________________________________ By: _______________________________________
Title: _____________________________________ Title: ______________________________________
Date: _____________________________________ Date: ______________________________________
ATTEST:
_____________________________________
Clerk of the Board Date
Approved as to Form:
_____________________________________
Deputy County Attorney Date