CHOICES NETWORK OF ARIZONA INC (CHOICES) AND MARIOPCA COUNTY (CHS).PDF

ELECTRONIC HEALTH RECORD AGREEMENT
BETWEEN
CHOICES Network of Arizona, Inc. (CHOICES) AND
Marieopa County (CHS)
1. PARTIES, The parties to this Agreement (the "Parties") are CHOICES Network of Arizona,
Inc. (CHOICES"), and Maricopa County through its Department of Correctional Health
Services ("CHS").
2. DEFINITIONS. For purposes of this Agreement, the terms listed below are defined as follows:
"Authorized Use" means the access given to CHS to Protected Health Information (as defined in the Parties'
attached Business Associate Agreement, hereinafter "PHI"), that CHS would not be entitled to or otherwise
have, for the sole purpose of coordinating behavioral health services to RBHA Clients assigned to and
served by CHOICES.
"RBHA Clients" means a person determined to be Seriously Mentally ill in accordance with policies issued
by the Arizona Department of Health Services, Division of Behavioral Health Services (ADHS/DBHS) and
eligible to receive behavioral health services paid for, in whole or in part, from funds available to the
ADHS/DRHS's designated Regional Behavioral Health Authority (RBHA).
3. PURPOSE OF THIS AGREEMENT. This Agreement will govern the operation and Parties'
participation in the CHOICES' ClaimTrak Electronic Health Records system (ClaimTrak). This
Agreement will enable CHOICES and CHS to coordinate care of CHOICES' RBI-IA Clients.
4. TERM. This Agreement is effective April 1,2014, and shall remain in full force and effect until June 30,
2014.
5. LIMITED USE. CHS shall have "Read Only" access to PHI in ClaimTrak for the purpose of
Authorized Use. CHS agrees that it will, and will cause its employees to:
(1) not use any PHI outside the scope of Authorized Use; and
(2) treat all PHI accessed in ClaimTrak as confidential as required by state and federal laws at all times; and
(3) only access records in ClaimTrak when working in the course and scope of providing and/or coordinating
treatment and care for RBHA Clients.
6. RESTRICTION ON REDISCLOSURE. CHS will instruct their staff concerning the confidential nature of
PHI and the applicable prohibition against its disclosure.
7. ENTIRE AGREEMENT. Other than the Parties' attached Business Associate Agreement, which is
incorporated by reference here, this Agreement is the final, complete and exclusive statement and expression
of the agreement among the Parties hereto relating to the subject matter of this Agreement; it being
understood that there are no oral representations, understandings or agreements covering the same subject
matter as this Agreement. This Agreement supersedes, and cannot be varied, contradicted or supplemented
by, evidence of any prior or contemporaneous discussions, correspondence or oral or written agreements of
any kind.
THE INDIVIDUALS SET FORTH BELOW have the authority to bind their respective parties and
execute this Agreement by affixing their signatures to this Agreement,
C OICES ` etwork 0 401 * - ,_ Marieopa County
..00,-;-)x- ,. -7. / / ._. , I /- 1--7
Signature Da e Signature '1- .-Y -TV- Date j
-
Ron Smith, CEO Tom 1Tegeler, Director Correctional Health Services

.till(1111
BUSINESS ASSOCIATE AGREEMENT
This HIPAA Business Associate Agreement (the "Agreement") is entered into on March
27, 2014 ("Effective Date") by and between CHOICES Network of Arizona, Inc. ("Covered
Entity"), and Maricopa County Correctional Health Services ("Business Associate") (each a
"Party" and collectively the "Parties").
1. BACKGROUND
Business Associate performs functions, activities or services for, or on behalf of Covered
Entity and Business Associate creates, receives, maintains, or transmits Protected Health
Information ("PHI"), including Electronic Protected Health Information ("EPH"), in order to
perform such functions, activities or services (referred to collectively as the "Services"). The
purpose of this Agreement is to set forth the terms and conditions of disclosure of PHI by
Covered Entity to Business Associate, to set forth the terms and conditions of Business
Associate's use and disclosure of PHI, and to ensure the confidentiality, integrity and availability
of EPHI that Business Associate creates, receives, maintains or transmits on behalf of Covered
Entity. It is the intent of Covered Entity and Business Associate that this Agreement will meet
the requirements of the Health Insurance Portability and Accountability Act of '1996 ("HIPAA"),
the applicable provisions of the Health Information Technology for Economic and Clinical Health
Act ("HITECH Act") of the American Recovery and Reinvestment Act of 2009, Public Law 111-5,
the Privacy Rule, and the Security Rule, including the Final Omnibus Rule, 45 C.F.R. Parts 160
and 164.
2. DEFINITIONS
Terms used, but not otherwise defined, in this Agreement shall have the same meaning
as those terms in HIPAA, the H1TECH Act, the Privacy Rule, and the Security Rule. Following
are some of the key terms of this Agreement.
2.1 Individual. "Individual" shall have the same meaning as the term "individual" in
45 C.F.R. § 160.103 and shall include a person who qualifies as a personal representative in
accordance with 45 C.F.R. § 164.502(g).
2.2 Limited Data Set. "Limited Data Set" shall have the same meaning as a "limited
data set" described in 45 C.F.R. § 164.514(e)(2).
2.3 Minimum Necessaty. "Minimum Necessary" shall have the same meaning as
"minimum necessary" described in 45 C.F.R. § 164.502(b) and Section 13405(b) of the H1TECH
Act.
2.4 Privacy Rule. "Privacy Rule" shall mean the Standards for Privacy of Individually
Identifiable Health Information at 45 C.F.R. Parts 160 and Part 164, subparts A and E.
2.5 Security Rule, "Security Rule" shall mean the Security Standards for the
Protection of EPHI at 45 C.F.R. Parts 160 and 164, subparts A and C.
2.6 Protected Health Information. "Protected Health Information" or 'PHI' shall have
the same meaning as the term "protected health information" in 45 C.F.R. § 160.103, but shall

be limited to the information created, received, maintained, or transmitted by Business
Associate on behalf of Covered Entity.
2.7 Electronic Protected Health Information. "Electronic Protected Health
Information" or "EPHI" shall have the same meaning as the term "electronic protected health
information' in 45 C.F.R. § 160.103, but shall be limited to the EPH1 that Business Associate
creates, receives, maintains, or transmits on behalf of Covered Entity.
2.8 Required By Law. "Required By Law" shall have the same meaning as the term
"required by law" in 45 C.F.R. § 164.103.
2.9 Secretary. "Secretary" shall mean the Secretary of the United States Department
of Health and Human Services or his designee.
2.10 Security Incident. "Security Incident" shall have the same meaning as "security
incident" in 45 C.F.R. § 164.304.
2.11 Subcontractor. "Subcontractor" shall have the same meaning as "subcontractor"
in 46 C.F.R. § 160.103.
3. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE
3.1 Use and Disclosure. Business Associate agrees to not use or disclose PHI other
than as permitted or required by this Agreement and any underlying agreement(s) related to the
Services, or as Required By Law. Business Associate shall also comply, where applicable, with
the Privacy Rule and the Security Rule.
3.2 Safeguards. Business Associate agrees to use appropriate safeguards and
comply, where applicable, with 45 C.F.R. Part 164 Subpart C with respect to EPHI, to prevent
use or disclosure of the information other than as provided for by this Agreement.
3,3 Business Associate's Reporting Obligations.
(a) Reports of Non-Permitted Use or Disclosure. Business Associate agrees to
report to Covered Entity any use or disclosure of the PHI not provided for by
this Agreement without unreasonable delay and in no case longer than five
(5) calendar days after discovery. Where applicable, such report shall
comply with the requirements outlined in Sections 3.3(b) and 3.3(c),
(b) Reports of Breach of Unsecured PHI.
1. For purposes of this section, "Breach" and "Unsecured PHI" shall have the
same meaning as "breach" and "unsecured protected health information,"
respectively, as such terms are defined by 45 C.F.R. § 164.402.
2. Following the discovery of a Breach of Unsecured PHI, Business
Associate shall notify Covered Entity of the Breach. Such notification shall
be made as soon as reasonably practicable after discovering the Breach,
but no later than five (5) calendar days after its discovery.
Page 2 of 8
NialaTolder RedirecLion\ gailg\DasktoNtwaiting exmition1EHR conirnels for CHOICES 12014 3 27 - BAA - CHOICES
Correctional Health Services.docx

3. Business Associate's notice shall include, to the extent possible, the
identification of each individual whose Unsecured PHI has been, or is
reasonably believed by Business Associate to have been, accessed,
acquired, used, or disclosed during or as a result of the Breach. Business
Associate shall also provide Covered Entity with at least the following
information: a description of the Breach, including the date of Breach and
the date of discovery of the Breach, if known; a description of the types of
Unsecured PHI involved in the Breach; any steps Individuals should take
to protect themselves from potential harm resulting from the Breach; a
brief description of what Business Associate is doing to investigate the
Breach, to mitigate harm to Individuals, and to protect against any further
Breaches; and any other information requested by Covered Entity related
to the Breach. Business Associate shall supplement such notice with
additional information as it becomes available, even if such information
becomes available after Individuals have been notified of the Breach.
4. Business Associate agrees to cooperate with Covered Entity in the
investigation of a Breach of Unsecured PHI and to cooperate with and
participate in, to the extent requested by Covered Entity, the notification of
Individuals, the media, and the Secretary of any Breach of Unsecured PHI.
5. In the event that: (1) a Breach of Unsecured PHI occurs because of the
action or inaction of Business Associate, its employees, agents,
representatives, or Subcontractors; or (ii) a Breach occurs involving
Unsecured PHI in Business Associate's possession, or PHI created,
maintained, transmitted, or received by Business Associate or its
employees, agents, representatives, or Subcontractors, Business
Associate agrees that Covered Entity may, in its sole discretion, require
Business Associate to provide such notification as may be required of
Covered Entity by 45 C.F.R. §§ 164.404, 164.406, and 164.408 at
Business Associate's sole cost and expense. Covered Entity shall have
the right to review, direct, and approve or reject the contents or manner of
such notification.
(c) Reports of Security Incidents. Business Associate agrees to report to
Covered Entity any Security Incident of which it becomes aware without
unreasonable delay and in no case longer than five (5) calendar days after
discovery. Where applicable, such report shall comply with the requirements
outlined in Sections 3.3(a) and 3.3(b).
3.4 Subcontractors. Business Associate agrees to ensure that any Subcontractor
that creates, receives, maintains, or transmits PHI (including EPHI) on behalf of Business
Associate agrees to the same restrictions and conditions that apply through this Agreement to
Business Associate with respect to such information, including but not limited to, compliance
with the applicable requirements of 45 C.F.R. Parts 160 and 164. Such agreement between
Business Associate and the Subcontractor must be made in writing and must comply with the
terms of this Agreement and the requirements outlined in 45 C.F.R. §§ 164.504(e) and 164.314.
3.5 Designated Record Set.
(a) If Business Associate maintains PHI in a Designated Record Set, Business
Page 3 of 8
VidatalFolder Redireclion \gailgllle3kt*Awaiting exccution\EHR cotaracis for C11OICESI2014 3 27 - BAA - CHOICES
Correctional Health Serviees.doex

Associate agrees to provide access, at the request of Covered Entity and in
the time and manner designated by Covered Entity, to PHI in a Designated
Record Set, to Covered Entity or, as directed by Covered Entity, to an
Individual in order to meet the requirements under 45 C.F.R. § 164.524.
(b) If Business Associate maintains PHI in a Designated Record Set, Business
Associate agrees to make available such PHI for amendment arid incorporate
any amendment(s) to PHI in a Designated Record Set that Covered Entity
directs or agrees to pursuant to 45 C.F.R. § 164.526 at the request of
Covered Entity or an Individual, and in the time and manner designated by
Covered Entity.
3.6 Accounting of Disclosures.
(a) Business Associate agrees to document such disclosures of PHI and
information related to such disclosures as would be required for Covered
Entity to respond to a request by an Individual for an accounting of
disclosures of PHI in accordance with 45 C.F.R. § 164.528.
(b) Business Associate agrees to provide to Covered Entity or an Individual, in
the time and manner designated by Covered Entity, information collected in
accordance with Section 3.6(a) of this Agreement, to permit Covered Entity to
respond to a request by an Individual for an accounting of disclosures of PHI
in accordance with 45 C.F.R. § 164.528.
3.7 Compliance with Law. To the extent Business Associate is to carry out Covered
Entity's obligations under HIPAA, Business Associate will comply with HIPAA's requirements
that apply to Covered Entity in the performance of such obligation.
3,8 Internal Practices. Business Associate agrees to make internal practices, books,
and records, including policies and procedures, relating to the use and disclosure of PHI
received from, or created or received by Business Associate on behalf of, Covered Entity
available to Covered Entity, or to the Secretary, in a time and manner selected by Covered
Entity or designated by the Secretary, for purposes of the Secretary determining Covered
Entity's and Business Associate's compliance with the Privacy Rule and Security Rule.
3.9 Mitigation. Business Associate agrees to mitigate, to the extent practicable, any
harmful effect that is known to Business Associate of a use or disclosure of PHI by Business
Associate in violation of the requirements of this Agreement.
3.10 Prohibition on the Sale of PHI. Business Associate agrees that it shall not,
directly or indirectly, receive remuneration in exchange for any PH! of Covered Entity except as
otherwise permitted by the Privacy Rule and as approved in writing by Covered Entity.
3.11 Conditions on Marketing and Fundraising Communications. Business Associate
shall not use or disclose PHI for the purpose of making a communication about a product or
service that encourages recipients of the communication to purchase or use the product or
service or for fundraising communications unless such communication is permitted by the
Privacy Rule and as approved in writing by Covered Entity.
4. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE
Page 4 of 8
AdataWolder RcdirectionSgaiteDesktoplAwailing executionEHR contraDls for CHOICES‘2014 3 27 - BAA - CHOICES
Correctional Health Services.docx

4.1 Genera! Use and Disclosure.
(a) Except as otherwise limited in this Agreement, Business Associate may use
or disclose PHI to perform Services for, or on behalf of, Covered Entity as
such services may be specified in any underlying agreement(s), provided that
such use or disclosure would not violate the Privacy Rule or the Security Rule
if done by Covered Entity.
(b) Business Associate must request, use, and disclose only the Minimum
Necessary PHI to accomplish the intended purpose of the request, use, or
disclosure. The Party disclosing PHI shall determine what constitutes the
Minimum Necessary to accomplish the intended purpose of the disclosure.
4.2 Specific Use and Disclosure.
(a) Business Associate may use or disclose PHI to carry out Business
Associate's legal responsibilities and for the proper management and
administration of Business Associate, provided that any such disclosures are
Required by Law, or Business Associate obtains written assurances from the
person to whom the information is disclosed that it will remain confidential
and used or further disclosed only as Required by Law or for the purpose for
which it was disclosed to the person, and the person notifies Business
Associate of any instances of which it becomes aware in which the
confidentiality of the information has been breached.
(b) Business Associate may use PHI to provide Data Aggregation services to
Covered Entity as permitted by 45 C.F.R. §164.504(e)(2)(i)(B).
(c) Business Associate may use and disclose PHI to report violations of law to
appropriate state and federal authorities, to the extent permitted or required
by 45 C.F.R. § 164.502(j)(1) and state law.
5. OBLIGATIONS OF COVERED ENTITY
5.1 Privacy Practices. Upon request, Covered Entity shall provide Business
Associate with the notice of privacy practices that Covered Entity produces in accordance with
45 C.F.R. § 164.520 and shall provide Business Associate with any changes to such notice to
the extent such changes affect Business Associate's permitted or required uses and
disclosures.
5.2 Notice of Changes and Restrictions. Covered Entity shall notify Business
Associate of any changes in, or revocation of, permission by Individual to use or disclose PHI, if
such changes affect Business Associate's permitted or required uses and disclosures. Such
notification shall include any restriction that Covered Entity has agreed to in accordance with 45
C.F.R. § 164,522, If Business Associate receives a request to restrict the disclosure of PHI
directly from an Individual, Business Associate shall promptly notify Covered Entity of such
request and Covered Entity shall be responsible for making the determination, in accordance
with the Privacy Rule, as to whether Business Associate shall comply with the Individual's
request.
Page 5 of 8
Mdritraolder Redirection*VDeskloplAwaiting executionTHR comrarls for CHOICES12014 3 27 - BAA - CHOICES
Correctional Health Services.docx

5.3 Permissible Requests by Covered Entity. Covered Entity shall not request
Business Associate to use or disclose PHI in any manner that would not be permissible under
the Privacy Rule or the Security Rule if done by Covered Entity, except that Business Associate
may use or disclose PHI for data aggregation or management and administrative activities of
Business Associate.
6. TERM AND TERMINATION
6.1 Term. This Agreement shall be effective upon the Effective Date and shall
remain in effect for the duration of the Services giving rise to the necessity of a Business
Associate Agreement, and until all of the PHI provided by Covered Entity to Business Associate,
or created or received by Business Associate on behalf of Covered Entity, is destroyed or
returned to Covered Entity, or, if it is infeasible to return or destroy PHI, protections are
extended to such information, in accordance with Section 6.3(b).
6.2 Termination.
(a) Termination Resulting from the End of Services, This Agreement shall
terminate in the event that the underlying agreement(s) under which Covered
Entity discloses PHI to Business Associate terminates for any reason, or if
the Services that give rise to the necessity of a Business Associate
Agreement terminate for any reason.
(b) Termination for Cause. Upon either Party's knowledge of a material breach
of this Agreement by the other Party, the non-breaching Party must either:
1. Provide an opportunity for the breaching Party to cure the breach or end
the violation, and if the breaching Party does not cure the breach or end
the violation within the time specified by the non-breaching Party, the
non-breaching Party shall terminate this Agreement and any underlying
agreement(s); or
2. Immediately terminate this Agreement and any underlying agreement(s).
6.3 Return or Destruction of PHI.
(a) Except as provided in paragraph (b) of this section, upon termination of this
Agreement for any reason, Business Associate shall return or destroy all PHI
received from Covered Entity, or created or received by Business Associate
on behalf of Covered Entity, that Business Associate still maintains in any
form, This provision shall also apply to PHI that is in the possession of
Subcontractors of Business Associate. Business Associate shall retain no
copies of the PHI.
(b) In the event that Business Associate determines that returning or destroying
the PHI is infeasible, Business Associate shall provide to Covered Entity
notification of the conditions that make return or destruction infeasible. Upon
mutual agreement of the Parties that return or destruction of PHI is infeasible,
Business Associate and its Subcontractors shall extend the protections of this
Agreement to such PHI and limit further uses and disclosures of such PHI to
those purposes that make the return or destruction infeasible, for so long as
Page 6 of 8
VdatalFolcier RadirectionlgaileDeskloplAwaiting execution \EIIR contracts for C1IOICES12014 32? - BAA - CHOICES
Correctional Health Services.docx

Business Associate and/or its Subcontractors maintain such PHI.
7. INDEMNIFICATION
Business Associate shall indemnify and hold harmless Covered Entity from any and all
claims, causes of action, and demands whatsoever made for loss, damage, or injury to any
person arising from a breach by Business Associate, or its Subcontractors, of its obligations
under this Agreement.
8. MISCELLANEOUS
8.1 Regulatory References. A reference in this Agreement to a section in the Privacy
Rule, the Security Rule, HIPAA, or the HITECH Act, or any other reference to a law or
regulation, means the section or law as in effect as of the date of this Agreement or as
subsequently amended.
8.2 Amendment. The Parties agree to take such action as is necessary to amend
this Agreement from time to time to comply with the requirements of the Privacy Rule, the
Security Rule, HIPAA, and the HITECH Act.
8.3 Survival. The respective rights and obligations of Business Associate under
Section 6.3 and Section 7 of this Agreement shall survive the termination of this Agreement.
8.4 Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a
meaning that permits compliance with the Privacy Rule, the Security Rule, HIPAA, and the
HITECH Act.
8.5 Relationship to Other Agreement Provisions. In the event that a provision of this
Agreement is contrary to a provision of an underlying agreement or agreements under which
Covered Entity discloses PHI to Business Associate, the provision of this Agreement shall
control. Otherwise, this Agreement shall be construed under, and in accordance with, the terms
of such underlying agreement or agreements between the Parties.
8.6 Prior Business Associate Agreements. Consistent with Section 8.5, this
Agreement shall supersede any and all prior business associate agreement(s), or terms of other
agreements addressing the privacy and security of PHI, between the Parties.
8.7 Modification of Agreement. No alteration, amendment or modification of the
terms of this Agreement shall be valid or effective unless in writing and signed by Business
Associate and Covered Entity.
8.8 Relationship of Parties. Business Associate, in furnishing services to Covered
Entity, is acting as an independent contractor, and Business Associate has the sole right and
obligation to supervise, manage, contract, direct, procure, perform, or cause to be performed, all
work to be performed by Business Associate under this Agreement. Business Associate is not
an agent of Covered Entity, and has no authority to represent Covered Entity as to any matters,
except as expressly authorized in this Agreement.
8.9 Notices. Any notices required or permitted to be given under this Agreement by
either Party shall be given in writing: (a) by personal delivery; (b) by electronic facsimile with
confirmation sent by United States first class mail; (c) by bonded courier or nationally
Page 7 of 8
WlatalFolder ftcdirectionlgailg\ Desktop \Awaiting executicoVEHR contracts for CHOICES \2014 3 27 - BAA - CHOICES
Correctional Health Services.doex

recognized overnight delivery service; or (d) by United States first class registered or certified
mail, postage prepaid, return receipt requested, addressed to the Parties at the addresses set
forth below or to such other addresses as the Parties may request in writing by notice pursuant
to this Section 8.9. Notices shall be deemed received on the earliest of personal delivery, upon
the next business day after delivery by electronic facsimile with confirmation that the
transmission was completed or upon receipt by any other method of delivery.
Covered Entity: CHOICES Network of Arizona, Inc., c/o Ron Smith, 3003 N Central
AV #305, Phoenix AZ, 85012
Business Associate:
Maricopa County Correctional Health Services
Attn —
Street address
City, State, and Zip
8.10 Counterparts. This Agreement may be executed in two (2) or more counterparts,
each of which shall be deemed an original and when taken together shall constitute one
agreement.
8.11 Governing Law. This Agreement will be governed by and construed in
accordance with the laws of Arizona.
8.12 No Offshore Work. In performing the Services for, or on behalf of, Covered
Entity, Business Associate shall not, and shall not permit any of its Subcontractors, to transmit
or make available any PHI to any entity or individual outside the United States without the prior
written consent of Covered Entity.
IN WITNESS WHEREOF, the Parties hereto have caused this Agreement to be
executed by their duly authorized officers and made effective as of the Effective Date.
CHOICES Network of Arizona, Inc. Maricopa County
Covere0.-Entity Correctional Health Services
Business Associate
By:
/
Ron Smith, CEO
"-Print Name: /..,4 pAr' /
Date: 2
Title: -4.- r 11--(Wk
LUj
Date:
Page 8 of 8
\\data\ Folder RedirectionlgailgOeskiap1Awaiting execution\EFIR contracts for CHOICES‘2014 327 - BAA - CHOICES
Correctional Health Serviecs.doex