SOUTHWEST NETWORK INC AND MARICOPA COUNTY.PDF

111I 1111111B1111 A aumkt...9rAtma • A A _ .p k a 1_ •
BETWEEN
SOUTHWEST NETWORK, INC.
AND
MARICOPA COUNTY
1. PARTIES. The parties of this Agreement (the "Parties") are Southwest Network,
Inc. ("Southwest"), and Maricopa County through its Department of
Correctional Health Services ("CHS").
2. DEFINITIONS. For purposes of this Agreement, the terms listed below are defined as
follows:
"Authorized Use" means the access given to CHS to Protected Health Information (as defined in
the Parties' attached Business Associate Agreement, hereinafter "PHI"), that CHS would not be
entitled to or otherwise have, for the sole purpose of coordinating behavioral health services to
RBHA Clients assigned to arid served by Southwest.
"RBHA Clients" means a person determined to be Seriously Mentally El in accordance with
policies issued by the Arizona Department of Health Services, Division of Behavioral Health
Services (ADHS/DBHS) and eligible to receive behavioral health services paid for, in whole or in
part, from funds available to the ADHS/DBHS's designated Regional Behavioral Health
Authority (RBIIA).
3. PURPOSE OF THIS AGREEMENT. This Agreement will govern the operation and
Parties' participation in Southwest's Electronic Health Record database system (the
"EHR"). This Agreement will enable Southwest and CHS to coordinate care of RBHA
Clients,
4. TERM. This Agreement is effective April 1,2014, and shall remain in full force and effect until
June 30, 2014. In the event that the Mercy Maricopa Integrated Care Health Information
Exchange is not available to CHS on July 1, 2014, this Agreement shall automatically renew for
one month through July 31, 2014. Further extensions beyond July 31, 2014 will be mutually
agreed to by the Parties in writing.
5. LIMITED USE. CHS is hereby granted, at no cost to CHS, "Read Only" access to PHI in
the EBR for the purpose of Authorized Use. CHS agrees that it will, and will cause its
employees to:
(1) not use any PIE outside the scope of Authorized Use;
(2) treat all RH accessed in the EHR as confidential as required by state and federal laws at all
times; and
(3) only access records in the EHR when working in the course and scope of providing and/or
coordinating treatment and care for RBHA Clients.
6. RESTRICTION ON REDISCLOSURE. CHS will instruct their staff concerning the confidential
nature of PHI and the applicable prohibition against its disclosure.
7. ENTIRE AGREEMENT. Other than the Parties' attached Business Associate Agreement, which
is incorporated by reference here, this Agreement is the final, complete and exclusive statement
and expression of the agreement among the Parties hereto relating to the subject matter of this
Agreement; it being understood that there are no oral representations, understandings or
agreements covering the same subject matter as this Agreement. This Agreement supersedes, and
cannot be varied, contradicted or supplemented by evidence of any prior or contemporaneous
discussions, correspondence or oral or written agreements of any kind.

1:317F7' 71-g VT 17:1= OLTLIM U (2) or I tore counterparts, each of
which shall be deemed an original and when taken together shall constitute one agreement.
9. GOVERNING LAW. This Agreement shall be governed by and construed in accordance with the
laws of Arizona.
THE INDIVIDUALS SET FORTH BELOW have the authority to bind their respective parties
and execute this Agreement by affixing their signatures to this Agreement.
Southwest ork Inc. Iaricopa County
t
c3/3
)(.(
Signature Date Signature Date
T
Title: d.E0 Torn Tegeler, Director
Correctional Health Services

Business Associate Agreement
Provisions
This Business Associate Agreement is by and between Southwest Network, Inc. and Marieopa County through its
Department of Correctional Health Services and shall be effective on the date set forth as the Effective Date on the Execution
Page of this Agreement.
This HIPAA Business Associate Agreement 1. Breach of the Security of the Business
("Agreement") is made by and between Southwest Associate's Information System. "Breach of the
Network, Inc. ("Covered Entity") and Maricopa County Security of the Business Associate's Information System"
through its Department of Correctional Health Services shall mean the unauthorized acquisition, including but not
("Business Associate"). limited to, access to, use, disclosure, modification or
destruction, of unencrypted computerized data that
A. Background materially compromises the security, confidentiality, or
integrity of PHI maintained by or on behalf of the
1. Business Associate. Business Covered Entity under the terms of this Agreement.
Associate performs functions, activities or services for, or
on behalf of Covered Entity, and Business Associate 2. Individual. "Individual" shall have the
receives, has access to or creates protected health same meaning as the term "individual" in 45 CFR §
information in order to perform such functions, activities 160.103 and shall include a person who qualifies as a
or services. personal representative in accordance with 45 CFR §
164.502(g).
2. Covered Entity. Covered Entity is a
Arizona 501(c) 3 corporation in the business of providing 3. Protected Health Information.
behavioral health care and related services to its patients. "Protected Health Information" shall have the same
meaning as the term "protected health information" in 45
3_ Relationship. Business Associate will CFR § 160.103, but shall be limited to the information
provide psychiatric care, coordination and treatment for created or received by Business Associate from or on
Covered Entity's incarcerated members/recipients. behalf of Covered Entity.
4. Purpose. The purpose of this 4. Required By Law. "Required By
Agreement is to set forth the terms and conditions of Law" shall have the same meaning as the term "required
disclosure of protected health information (PHI) by by law" in 45 CFR § 160.103.
Covered Entity to Business Associate. It is the intent of
Covered Entity and Business Associate that this 5. Secretary. "Secretary" shall mean the
Agreement will meet the requirements of the privacy Secretary of the Department of Health and Human
regulations, security regulations, and standard transaction Services or his designee.
regulations promulgated under the Health Insurance
Portability and Accountability Act of 1996 ("HIPAA") 6. Security Event. "Security Event" shall
(the "Privacy Rule," "the Security Rule" and the mean (as defined below) an immediately reportable subset
"Transactions Rule"), 45 C.F.R. part 160, part 164, of security incidents which would include:
subparts A, C, and E, and part 162 as amended.
a. A suspected unauthorized or
5. Consideration. In consideration of the impermissible penetration of Business
mutual promises and agreements contained in this Associate's information system of which the
document, the parties have entered into this Agreement. Business Associate becomes aware, whether or
not Business Associate is able to determine if
6. Definitions. Terms used, but not Covered Entity's confidential data was
otherwise defined, in this Agreement shall have the same compromised or otherwise accessed, stolen,
meaning as those terms in 45 C.F.R. §§ 160.103, 162.103, used, disclosed, modified or destroyed;
164.103, 164.304 and 164.501.
b. Any indication, evidence, or
other security documentation that Business
Associate's network resources, software,
B. Definitions network routers, firewalls, database and

application servers, intrusion detection systems parties' Limited Access and Data Sharing Agreement), or
or other security appliances may have been as Required By Law. In case of any conflict between this
damaged, modified, taken over by proxy or Agreement and the Service Agreements, this Agreement
otherwise compromised and that Business shall govern.
Associate cannot refute within FORTY-EIGHT
(48) HOURS of becoming aware of such 3. Compliance with Security Rule.
indication; Business Associate agrees to fully comply with the
requirements under the Security Rule applicable to
c. A breach (to be afforded the "business associates" as that term is defined in the
same meaning as under HIPAA) of the security Security Rule. In case of any conflict between this
of the Business Associate's information system; Agreement and Service Agreements, this Agreement shall
and/or govern.
d. The unauthorized acquisition, 4. Privacy Safeguards. Business
access to or use, disclosure, modification or Associate agrees to use appropriate safeguards to prevent
destruction of unenciypted PHI or other use or disclosure of PHI other than as provided for by the
confidential information of Covered Entity by an Service Agreement(s), this Agreement or as Required by
employee or authorized user of Business Law. This includes the implementation of administrative,
Associate's system(s) that materially physical and technical safeguards to reasonably and
compromises the security, confidentiality or appropriately protect the Covered Entity's PHI against
integrity of PHI or other confidential any reasonably anticipated threats or hazards, utilizing the
information of Covered Entity. If data acquired, technology commercially available to the Business
including but not limited to access to or use, Associate. The Business Associate shall maintain
disclosure, modification or destruction of such appropriate documentation of its compliance with the
data, is in an encrypted format but the decryption Privacy Rule, including, but not limited to, its policies,
key, which would allow the decoding of the data, procedures, records of training and sanctions of members
is also taken, the patties shall treat the of its workforce.
acquisition as a breach for purposes of
determining the appropriate response. 5. Security Safeguards. Business
Associate agrees to implement administrative, physical,
7. Security Incident. "Security Incident" and technical safeguards that reasonably and
shall mean the attempted or successful unauthorized appropriately protect the confidentiality, integrity, and
access, use, disclosure, modification, or destruction of availability of the electronic PHI that it creates, receives,
information or interference with system operations in an maintains, or transmits on behalf of Covered Entity as
information system. required by the Security Rule. This includes specifically,
but is not limited to, the utilization of technology
8. Unsecured PHI. "Unsecured PHI" commercially available at the time to the Business
shall mean PHI that is not rendered unusable, unreadable, Associate, to protect the Covered Entity's PHI against any
or indecipherable to unauthorized individuals through the reasonable anticipated threats or hazards. The Business
use of a technology or methodology specified by the Associate understands that it has an affirmative duty to
Secretary. perform a regular review or assessment of security risks,
conduct active risk management and supply best efforts to
C. Obligations and Activities of Business ensure that only authorized persons and devices access its
Associate computing systems and information storage, and that only
authorized transactions are allowed. The Business
1. No Unauthorized Use or Disclosure of Associate will maintain appropriate documentation of its
PHI. Business Associate agrees to not use or disclose compliance with the Security Rule.
PHI other than as permitted or required by the Agreement
or as Required By Law. 6. Mitigation of Damages. Business
Associate agrees to mitigate, to the extent practicable, any
2. Compliance with Privacy Rule. harmful effect that is known to Business Associate of a
Business Associate agrees to fully comply with the use or disclosure of PHI by Business Associate in
requirements under the Privacy Rule applicable to violation of the requirements of this Agreement.
"business associates" as that term is defined in the
Privacy Rule, and agrees to not use or further disclose 7. Report of Unauthorized Use or
PHI other than as permitted or required by this Disclosure. Business Associate agrees to require its
Agreement, the Service Agreements (which includes the employees, agents, and subcontractors to promptly report
2

to Business Associate any use or disclosure of PHI in with Section (C)(12) of this Agreement, to permit
violation of this Agreement, and to report to Covered Covered Entity to respond to a request by an Individual
Entity any use or disclosure of the PHI not provided for for an accounting of disclosures of PHI in accordance
by this Agreement. Business Associate shall report such with 45 CFR § 164.528. The Covered Entity shall
violation to Covered Entity immediately upon becoming forward the Individual's request requiring the
aware. participation of the Business Associate to the Business
Associate in a timely manner, after which the Business
8. Agents and Subcontractors. Business Associate shall provide such information as follows:
Associate agrees to ensure that any agent, including a
subcontractor, to whom it provides PHI received from, or a. If Covered Entity directs
created or received by Business Associate on behalf of Business Associate to provide accounting of
Covered Entity, agrees to the same restrictions and disclosures of the Individual's PHI directly to the
conditions that apply through this Agreement to Business Individual, the Business Associate shall have
Associate with respect to such information. sixty (60) days from the date of the Individual's
request to provide access to or deliver such
9. Right to Access PHI. If Business information to the Individual. The Covered
Associate has PHI in a Designated Record Set which the Entity shall provide notice to the Business
Covered Entity does not also retain, Business Associate Associate in time to allow the Business
agrees to provide access, at the request of Covered Entity, Associate a minimum of thirty (30) days to
and in the time and manner reasonably designated by timely complete the Individual's request.
Covered Entity, to PHI in a Designated Record Set, to
Covered Entity or, as directed by Covered Entity, to an b. If the Covered Entity elects to
Individual in order to meet the requirements under 45 provide the accounting to the Individual, the
CFR § 164.524 and AAC R9-21 as applicable. Business Associate shall have thirty (30) days
from date of Covered Entity's notice of request
10. Amendments to PHI in the to provide information for the accounting to the
Designated Record Set. If Business Associate has PHI Covered Entity, allowing Covered Entity to
in a Designated Record Set, which Covered Entity does timely respond to the Individual within the sixty
not also retain, Business Associate agrees to make it (60) day period.
available for amendment by the Covered Entity, as
directed by the Covered Entity pursuant to 45 CFR § c. If either of the Parties is unable
164.526 and to incorporate amendment(s) to PHI to complete the response to the request in the
provided to it by Covered Entity. times provided above, the Party shall notify the
Individual with a written statement of the
11. Access to General Documents by reasons for the delay and the date by which the
Covered Entity and HHS. Business Associate agrees to Party will complete its action on the request.
make internal practices, books, and records, including The Patties may extend the response time once,
policies and procedures and PHI, relating to the use and for no more than thirty (30) additional calendar
disclosure of PHI received from, or created or received by days.
Business Associate on behalf of, Covered Entity available
to the Covered Entity, or to the Secretary, in a time and d. The accounting of disclosures
manner as designated by Covered Entity or the Secretary, shall include at least the following: 1) date of the
for purposes of the Secretary determining Covered disclosure; 2) name of the third party to whom
Entity's compliance with the Privacy Rule. the PHI was disclosed; 3) if known, the address
of the third party; 4) brief description of the
12., Recording of Designated Disclosures disclosed information; and 5) brief explanation
of PHI. Business Associate agrees to document its of the purpose and basis for such disclosure.
disclosures of PHI and information related to such
disclosures as would be required for Covered Entity to e. The Parties shall provide one
respond to a request by an Individual for an accounting of (1) accounting in any twelve (12) month period
disclosures of PHI in accordance with 45 CFR § 164.528. to the Individual without charge. The Parties
may charge a reasonable, cost-based fee for each
13. Accounting of Disclosures. Business subsequent request for an accounting by the
Associate agrees to provide to Covered Entity or to an same Individual if he/she is provided notice and
Individual, in time and manner as reasonably designated the opportunity to modify his/her request. Such
by Covered Entity information collected in accordance charges shall not exceed any applicable State
3

statutes or rules. Notification for the purposes of Security Incidents and
Security Events shall be in writing, made by certified mail
14. Alternative Communication. If or overnight parcel immediately upon becoming aware of
requested by Covered Entity, Business Associate agrees the event, with supplemental notification by fax, email
to implement reasonable alternative means or locations of and/or telephone as soon as practicable to:
communication with individuals as necessary to honor a
request granted by Covered Entity pursuant to 45 C.F.R. Privacy Officer
§§ 164.522 or 164.526. Southwest Network, Inc.
2700 North Central Avenue, Suite 1050
15. Redirecting Requests. Except as Phoenix, AZ 85004
otherwise provided in the Agreement or any other Phone: 602.266.8402, extension 1444
agreement between Covered Entity and Business Fax: 602.264.0887
Associate, in the event Business Associate receives an Email: swn nrivacvsouthwestnetwork.o rg
access, amendment, disclosure accounting, confidential
communications or other similar request directly from an
individual, Business Associate will redirect the individual 19. HITECH Act Compliance. The
to appropriate Covered Entity personnel. Health Information Technology for Economic and
Clinical Health Act (HITECH Act) was adopted as part of
16. Security Compliance Review Upon the American Recovery and Reinvestment Act of 2009.
Request. Business Associate agrees to make its internal The HITECH Act and its implementing regulations
practices, books, and records, including policies and impose new requirements on Business Associates with
procedures relating to the security of electronic PHI respect to privacy, security, and breach notification.
received from, created or received by Business Associate These provisions of the HITECH Act and the regulations
on behalf of Covered Entity, available to Covered Entity applicable to Business Associates are collectively referred
or to the Secretary or Secretary's designee, in a time and to as the "HITECH BA Provisions". The HITECH BA
manner designated by the requestor for purposes of Provisions shall apply commencing on February 17,2010,
determining Covered Entity's or Business Associate's or such other date as may be specified in the applicable
compliance with the Security Rule. regulations, whichever is later (Applicable Effective
Date). Business Associate hereby acknowledges and
17. Reporting of Security Incidents. The agrees that to the extent it is functioning as a Business
Business Associate shall track all security incidents as Associate of Covered Entity, Business Associate will
defined by HIPAA and shall periodically report such comply with the HITECH BA Provisions and with the
security incidents in summary fashion as may be obligations of a Business Associate as proscribed by
requested by the Covered Entity, but not less than HIPAA and the HITECH Act, commencing on the
annually within sixty (60) days of the anniversary of this Applicable Effective Date of each such provision.
Agreement. Covered Entity shall not consider as security Business Associate and Covered Entity further agree that
incidents, for the purpose of reporting, external activities the provisions of HIPAA and HITECH Act that apply to
(port enumeration, etc.) typically associated with the Business Associates and that are required to be
"footprinting" of a computing environment as long as incorporated by reference in a business associate
such activities have only identified but not compromised agreement are incorporated into this Agreement between
the logical network perimeter, including but not limited to Business Associate and Covered Entity as if set forth in
externally facing firewalls and web servers. The Business this Agreement in their entirety and are effective as of the
Associate shall reasonably use its own vulnerability Applicable Effective Date and as amended.
assessment of damage potential and monitoring to define
levels of Security Incidents and responses for Business D. Permitted Uses and Disclosures by Business
Associate's operations. However, the Business Associate Associate
shall expediently notify the Covered Entity's Privacy
Officer of an Security Incident which would constitute a 1. Use for Proper Management and
Security Event as defined by this Agreement, including Administration. Except as otherwise limited in this
any Breach of the Security of the Business Associate's Agreement, Business Associate may use PHI for the
Information System immediately upon becoming aware of proper management and administration of the Business
any unauthorized acquisition, including but not limited to, Associate or to carry out the legal responsibilities of the
use, disclosure, modification, or destruction of PHI by an Business Associate.
employee or otherwise authorized user of its system.
2. Disclosure for Proper Management
18. Contact for Security Event Notice. and Administration. Except as otherwise limited in this
Agreement, Business Associate may disclose PHI for the
4

proper management and administration of the Business PHI, to the extent that such changes may affect Business
Associate, provided that disclosures are Required By Associate's use or disclosure of PHI.
Law, or Business Associate obtains reasonable assurances
from the person to whom the information is disclosed that 3. Notify of any Restrictions on Use or
it will remain confidential and used or further disclosed Disclosure of PHI. Covered Entity shall notify Business
only as Required By Law or for the purpose for which it Associate of any restriction to the use or disclosure of PHI
was disclosed to the person, and the person notifies the that Covered Entity has agreed to in accordance with 45
Business Associate of any instances of which it is aware CFR § 164.522, to the extent that such restriction may
in which the confidentiality of the information has been affect Business Associate's use or disclosure of PHI.
breached.
F. Permissible Requests by Covered Entity.
3. Data Aggregation. Except as Covered Entity shall not request Business Associate to
otherwise limited in this Agreement, Business Associate use or disclose PHI in any manner that would not be
may use PHI to provide Data Aggregation services to permissible under the Privacy Rule if done by Covered
Covered Entity as permitted by 45 CFR § Entity.
164.504(e)(2)(i)(B).
G. Term and Termination
4. Report Violations of Law. Business
Associate may use PHI to report violations of law to 1. Term. This Agreement shall be
appropriate Federal and State authorities, consistent with effective as of April 1, 2014, and shall terminate when all
45 CFR § 164.502(j)(1). of the PHI provided by Covered Entity to Business
Associate, or created or received by Business Associate
5. Use and Disclosure in Connection on behalf of Covered Entity, is destroyed or returned to
with Standard Transactions. If Business Associate Covered Entity, or, if it is infeasible to return or destroy
conducts Standard Transactions (as defined in 45 C.F.R. PHI, protections are extended to such information, in
Part 162) for or on behalf of Covered Entity, Business accordance with the termination provisions in this
Associate will comply, and will require each Section.
subcontractor or agent involved with the conduct of such
Standard Transactions to comply with each applicable 2. Termination for Cause. Upon
requirement of 45 C.F.R. Part 162. Business Associate Covered Entity's knowledge of a material breach by
will not enter into, or permit its subcontractors or agents Business Associate, Covered Entity shall either:
to enter into, any agreement in connection with the
conduct of Standard Transactions for or on behalf of a. Provide an opportunity for
Covered Entity that: (i) changes the definition, data Business Associate to cure the breach or end the
condition, or use of a data element or segment in a violation and terminate this Agreement if
Standard Transaction; (ii) adds any data elements or Business Associate does not cure the breach or
segments to the maximum defined data set; (iii) uses any end the violation within the time specified by
code or data element that is marked "not used" in the Covered Entity;
Standard Transactions implementation specification or is
not in the Standard Transactions implementation
specification; or (iv) changes the meaning or intent of the b. Immediately terminate this
Standard Transactions implementation specification. Agreement if Business Associate has breached a
material term of this Agreement and cure is not
possible; or
E. Obligations of Covered Entity
c. If neither termination nor cures
1. Notify of Limitations in Notice of are feasible, Covered Entity shall report the
Privacy Practices. Covered Entity shall notify Business violation to the Secretary.
Associate of any limitation(s) in its notice of privacy
practices of Covered Entity in accordance with 45 CFR § 3. Effect of Termination.
164.520, to the extent that such limitation may affect
Business Associate's use or disclosure of PHI. a. Return or Destroy All PHI.
Except as provided in paragraph (2) of this
2. Notify of Changes by Individual's section, upon termination of this Agreement, for
Permission to Use and Disclose PHI. Covered Entity any reason, Business Associate shall return or
shall notify Business Associate of any changes in, or destroy all PHI received from Covered Entity, or
revocation of, permission by Individual to use or disclose created or received by Business Associate on
5

behalf of Covered Entity. This provision shall 2. Amendment. The Parties agree to take
apply to PHI that is in the possession of such action as is necessary to amend this Agreement from
subcontractors or agents of Business Associate. time to time as is necessary for Covered Entity to comply
Business Associate shall retain no copies of the with the requirements of the Privacy Rule, the Security
PHI except as required by law. Rule, the Transactions Rule and the Health Insurance
Portability and Accountability Act of 1996, Pub_ L. No. 1
b. Return or Destruction of 104-191.
PHI Not Feasible. In the event that Business
Associate determines that returning or destroying 3. Survival. The respective rights and
the PHI is infeasible, Business Associate shall obligations of Business Associate under Section (G)(3) of
provide to Covered Entity notification of the this Agreement shall survive the termination of this
conditions that make return or destruction Agreement.
infeasible. Upon written notification that return
or destruction of PHI is infeasible, Business 4. Interpretation. Any ambiguity in this
Associate shall extend the protections of this Agreement shall be resolved to permit Covered Entity to
Agreement to such PHI and limit further uses comply with the Privacy Rule.
and disclosures of such PHI to those purposes
that make the return or destruction infeasible, for
so long as Business Associate maintains such
PHI.
H. Miscellaneous
1. Regulatory References. A reference in
this Agreement to a section in the Privacy Rule, the
Security Rule, or the Transactions Rule means the section
as in effect or as amended.
[ Remainder of this page intentionally left blank— Signatures to follow I
6

IN WITNESS WHEREOF, intending to be legally bound, the parties hereto have executed this
Agreement as of the dates specified.
MARICOPA COuNry SOUTHWEST NETWORK, INC.
Signature
Amy B. Henning
Name Name
17- i Cu /16C t-C j Chief Executive Officer
Title Title
Date Date Executed by Southwest Network, Inc.
April 1. 2014
Effective Date of Agreement
SWN.XXX}DCBA.MMfDDNYYY
7