PEOPLE OF COLOR NETWORK.PDF

1
People of
C 01cr
Network
For 14ealthy Cyrrynunitios
HIPAA BUSINESS ASSOCIATE AGREEMENT / QUALIFIED SERVICE ORGANIZATION
This Business Associate Agreement ("Agreement") is entered this date
April 1st , 2014 between Maricopa County through its Department of Correctional
Health Services ("Vendor," "Business Associate" or "BA;" and "Qualified Service
Organization" or "QSO") and People of Color Network (PCN) ("Covered Entity" or
"CE").
RECITALS
A. PCN is a Covered Entity as defined by the Health Insurance Portability and Accountability
Act of 1996, P.L. 104-191, as amended ("HIPAA") and its implementing regulations and is
subject to other state and federal laws that protect the privacy, security and confidentiality of
individually identifiable health or personal information.
B. MARICOPA COUNTY THROUGH ITS DEPARTMENT OF CORRECTIONAL HEALTH
SERVICES is a Business Associate of PCN as defined by H1PAA and is subject to other state
and federal laws that protect the privacy, security and confidentiality of individually
identifiable health or personal information.
C. PCN and BA are required to comply with HIPAA as amended by the Health Information
Technology for Economic and Clinical Health Act, Title XIII of the American Recovery and
Reinvestment Act of 2009 (1-l1TECH") and the HIPAA and H1TECH implementing
regulations: the "Standards for Privacy of Individually Identifiable Health Information" (45
C.F.R. Parts 160 and 164, Subparts A and E) (the "Privacy Standards"), the "Security Standards
for the Protection of Electronic Protected Health Information" (45 C.F.R. Parts 160 and 164,
Subpart C) (the "Security Standards") and the "Breach Notification for Unprotected Health
Information Interim Final Rule" (45 C.F.R. Parts 160 and 164, Subpart D) (the "Breach
Notification Requirements") and related guidance and policies, including but not limited to, the
rules changes as published in the Federal Register, 78 FR 5565, also called the "Omnibus Rule,"
collectively referred to in this Agreement as the "H1PAA Standards." The parties further
acknowledge that the Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part
2, applies to this Agreement.
D. The parties have a separate Limited Access Data Sharing Agreement ("Services
Agreement") between them. The Services Agreement may require BA to have access to,
create, or amend Protected Health Information ("PHI"), including Electronic Protected
Health Information ("EPHI"), in order to perform its services under that Agreement. This
Business Associate Agreement sets forth the responsibilities and obligations of Business
Associate to Covered Entity under the HIPAA Standards regarding the use, disclosure and
security of PHI that Business Associate creates, receives, maintains or transmits or has access
to on behalf of Covered Entity.

NOW THEREFORE, for good and valuable consideration the receipt and sufficiency of which
is hereby acknowledged, the parties hereby agree as follows:
1. Definitions.
Terms in this Agreement shall have the same meaning as in the HIPAA Standards. If for any
reason ambiguity or conflict occurs between the definitions set forth in this Agreement and
the H1PAA Standards, the definition in the HIPAA Standards shall apply or govern.
1.1. Breach means the acquisition, access, use, or disclosure of protected health
information in a manner not permitted under the Privacy Standards which
compromises the security or privacy of the protected health information subject to
the exclusions in 45 C.F.R. § 164.402.as set forth in the HIPAA Standards.
1.2. Business Associate. "Business Associate" means Vendor as the specific provider of
services in accordance with the term as defined in the H1PAA Standards.
1,3. Disclosure. "Disclosure" shall have the same meaning as the term "disclosure" in the
H1PAA Standards.
1.4. Electronic Media. "Electronic media" shall have the same meaning as the term
"electronic media" in the HIPAA Standards.
1.5. Individual. "Individual" shall have the same meaning as the term "individual" in the
HIPAA Standards, including a person who qualifies as a personal representative.
1.6. Limited Data Set. "Limited data set" shall have the same meaning as the term
"limited data set" in the HIPAA Standards, including 45 CFR § 164.514(e)(2).
1.7. Minimum Necessary. "Minimum necessary" shall have the meaning set forth in the
HIPAA Standards.
1.8. Patient. "Patient" means individuals receiving treatment from PCN and for
purposes of BA's obligations for the privacy and security of PHI under this
Agreement shall include family members or other individuals whose PHI becomes
known to PCN in the course of providing treatment to patients. Patients may also be
referred to as "individuals receiving services," enrollees, "members," or similar
terms.
1.9. Patient Record "Patient Record" means any item, collection, or grouping of
information that includes Protected Health Information that is created, maintained,
collected, or used by PCN.
1.10. Protected Health Information. "Protected Health Information" or "PHI" means
information, whether oral or recorded in any form or medium, including
demographic information, that: (i) relates to the past, present or future physical or
mental health or condition of an individual, the provision of health care to an
individual, or the past, present or future payment for the provision of health care to

an individual; (ii) identifies the individual, or for which there is a reasonable basis
for believing that the information can be used to identify the individual; and (iii) is
received by Business Associate from or on behalf of Provider, or is created by
Business Associate for Provider, or is made accessible to Business Associate by
Provider. PHI includes, without limitation, "Electronic Protected Health
Information" ("EPHI"), as defined by the HEPAA Standards.
1.11, Qualified Service Organization. "Qualified Service Organization," in accordance
with 42 C.F.R. Part 2, § 2.1, is a covered entity that "holds itself out as providing,
and provides, alcohol or drug abuse diagnosis, treatment, or referral for treatment,"
and that the QS0 is fully bound by the relevant law and policy of 42 C.F.R. Part 2
and if necessary will resist in judicial proceedings any efforts to obtain access to
patient records excepted as permitted by 42 C.F.R. Part 2.
1.12. Secretary. "Secretary" shall mean the Secretary of the United States Department of
Health and Human Services or designee.
1.13. Security Event. "Security Event" shall mean an immediately reportable Security
Incident, Breach, or similar event, including but not limited to:
a. A suspected unauthorized or impermissible penetration of Business Associate's
information system of which Business Associate becomes aware, whether
Business Associate is able to determine if PCN's confidential data was
compromised, accessed, stolen, used, disclosed, modified or destroyed;
b. Any indication, evidence, or other security documentation that Business
Associate's network resources, software, network, routers, firewalls, database,
and application servers, intrusion detection systems or other security
appliances or applications may have been or actually damaged, modified,
taken over by proxy or otherwise compromised and that Business Associate
cannot refute within forty eight (48) hours of becoming aware of such
indication; these potential categories shall evolve with the most current
technology and security as deployed by Business Associate;
c. A Breach of the security of the Business Associate's information systems
(as understood in the broadest sense); or
d. The unauthorized acquisition, access to or use, disclosure, modification or
destruction of unencrypted PH or other confidential information of Provider
by an employee or authorized user of Business Associate's system(s) that
materially compromises the security, confidentiality or integrity of PHI or
other confidential information of Provider. If PHI or other confidential
information acquired, including but not limited to access to or use, disclosure,
modification or destruction of such data, is in an encrypted or de-identified
format but the decryption key, which would allow the decoding of the data,
or for identification otherwise, is also taken, the parties shall treat the
acquisition as a breach for purposes of determining the appropriate response.

1.14. Security Incident. "Security incident" shall mean the attempted or successful
unauthorized access, use, disclosure, modification, or destruction of electronic or
paper PHI or interference with PCN's or BA's information system or network
operations in an information system, whether accidental, malicious, or by natural act,
including but not limited to (i) any breach of PCN or BA data, (ii) use of PCN's or
BA's technology resources for illegal purposes or to launch attacks against other
individuals or organizations, or (iii) any act that impacts the integrity of PCN's or
BA's files or databases as set forth in the HIPAA Standards.
1.15. Subcontractor. "Subcontractor" means a person or entity to whom BA delegates a
function, activity or service other than in the capacity or a member of its workforce
as set forth in the HIPAA Standards. 1.15 Unsecured Protected Health Information.
"Unsecured Protected Health Information or "Unsecured PHI" means information
that is not secured through the use of a technology or methodology identified by the
Secretary in the "Guidance Specifying the Technologies and Methodologies That
Render Protected Health Information Unusable, Unreadable, or Indecipherable to
Unauthorized Individuals for Purposes of the Breach Notification Requirements
Under [HfIECH]," 74 Fed. Reg. 19006 (April 27, 2009) available at
http://www.hhs.gov/ocr/privacy/hipaa or subsequent applicable guidance materials
or regulations (the "Guidance").
1.16. Workforce. "Workforce" shall have the same meaning as "workforce" in 45 CFR §
160,103.
2. Business Associate's Obligations.
2.1. Business Associate Subject to Same Standards and Same Penalties as Provider.
Business Associate will comply with the use and disclosure requirements of the Privacy
and Security Standards regarding administrative, physical and technical safeguards for
PHI and EPHI of Individuals and Patients as defined under this Agreement.
2.2. Permitted Uses and Disclosures. Business Associate shall use or disclose PHI solely as
necessary to perform the services set forth in the Services Agreement, and as permitted or
required by this Agreement or required by law.
2.3. Safeguards. Business Associate shall use appropriate privacy and security measures to
prevent the use or disclosure of PHI other than as permitted under this Agreement or
required by governing law. Such measures shall include, but not be limited to: (i)
implementing and maintaining appropriate administrative, physical, and technical
safeguards that reasonable and appropriately protect the confidentiality, integrity, and
availability of any EPHI that it creates, receives, maintains, or transmits on behalf of
PCN, as required by the Privacy and security Standards; and (ii) taking measures to
ensure compliance with standards and implementation specifications with respect to the
administrative, physical, and technical safeguards, as required by the HIPAA Standards,
including but not limited to 45 C.F.R. §§ 164.308, 164.310, 164.312 and 164.316, the

Guidance, and any subsequent rules, guidance's, or policies. Business Associate shall
meet all of the requirements of the Security Standards, including administering
administrative, physical and technical safeguards. Business Associate shall conform to
42 C.F.R. Part 2.
2.4 Mitigation. If Business Associate uses or discloses PHI in a manner other than as
permitted under this Agreement, Business Associate shall use its best efforts to mitigate
the effects of the use or disclosure. These efforts shall include, but are not limited to,
ensuring that the improper use of PHI is discontinued immediately, seeking return or
destruction of the improperly disclosed PHI, and ensuring that any person to whom PHI
was improperly disclosed will not re-disclose such information.
2.5 Duly to Report. Business Associate shall immediately notify PCN of any use or
disclosure of PHI of which Business Associate is aware that is not expressly authorized
under this Privacy Agreement, whether made by Business Associate, its employees,
representatives, agents, or subcontractors. Business Associate shall also immediately
notify PCN of any attempted or successful unauthorized access, use, disclosure,
modification, or destruction of information, or interference with the system operations in
an information system. Business Associate shall provide in such notice the remedial or
other actions taken to correct the unauthorized use or disclosure. For purposes of this
Agreement, "immediately" shall mean within 24 hours of discovery, when practicable.
2.6 Agents. Business Associate shall ensure that its employees, agents, subcontractors, or
other third parties with whom Business Associate does business comply with Business
Associate's obligations under this Agreement. Business Associate will additionally
ensure that each subcontractor provides it with satisfactory written assurances (Business
Associate Agreement) that it is aware of and will comply with the requirements of the
Privacy and Security Standards in the same manner as required by Business Associate
under this Agreement.
2.7 Access to Patient Record Business Associate understands that an Individual has the
right to access the PHI in accordance with 45 C.F.R. § 164,524. If an Individual requests
access to EPHI directly from Business Associate, Business Associate will notify PCN of
the request within five (5) business days of the request by facsimile, telephone, or
electronic mail. PCN in its sole discretion will decide whether to respond to the request
or grant Business Associate authority to respond to the request. Business Associate may
charge Provider for the reasonable costs of copying only if Provider is allowed under
state and federal law to recoup such costs from the Individual.
2.8 Amendments to Patient Record. Business Associate understands that an Individual may
have the right to amend PHI in its records of PCN. Business Associate agrees to make
amendments to an Individual's PHI within ten (10) business days of receipt of a written
request or instruction from PCN. If the Individual makes a request directly to amend
PHI directly to Business Associate and not to PCN, Business Associate shall notify PCN
of the request within five (5) business days, buts shall not make the requested
amendment until PCN approves the amendment.

2.9 Duty to Document Disclosures.
a. Business Associate will document each disclosure it makes of PHI to any other
person, including PCN that is not permitted or required by this agreement or by
HIPAA standards. The documentation shall include:
i. The date of the disclosure;
ii. The name of the person receiving the PHI, and, if known, the address of
such person;
iii. A brief description of the PHI disclosed; and
iv. A brief statement of the purpose of the disclosure or, instead of such
statement, a copy of the request for disclosure.
b. Notwithstanding Section 2.9(a), Business Associate is not required to document the
following disclosures:
i. Unless otherwise required by Section 2.10, disclosures made for the purpose of
or incidental to, carrying out treatment, payment, or health care operations;
ii. Disclosures made prior to April 14, 2003;
Disclosures made to provide the Individual with access to its PHI under
Section 2.7;
iv. Disclosures made pursuant to an Individual's written authorization;
v. Disclosures required by law for national security or intelligence purposes;
vi, Disclosures to correctional institutions or law enforcement officials having
lawful custody of an Individual;
vii. Disclosures made as part of a limited data set to the extent permitted under the
HIPAA Standards;
viii. Disclosures made to persons involved in the Individual's care to the
extent permitted under the HIPAA Standards or other governing law; and
ix. Disclosures made for notification purposes such as in an emergency to the
extent permitted under the H1PAA Standards or other governing law.
2.10 Accounting of Disclosures. Business Associate understands that an Individual has
the right to an accounting of disclosures of PHI not kept in electronic format for
six (6) years from the disclosure date and, for PHI kept as EPHI, for three (3)
years from disclosure date. Business Associate will maintain an accounting of

disclosures of PHI as required by 45 C.F.R.§164.528 for the applicable time periods
and will provide PCN the documentation and accounting within 14 business days of
receipt of PCN's written request.
2.11 Minimum Necessary. Business Associate represents and warrants that it will use
and disclose PHI in accordance with the Privacy Standard's "minimum
necessary" standards.
2.12 Other Uses and Disclosures. Business Associate will not use or disclose
Protected Health Information in any manner that would not be permissible under
the HIPAA Standards or 42 C.F.R. Part 2 if used or disclosed by PCN.
2.13 Books and Records and Internal Practices. Business Associate agrees to make all
internal practices, books, and records relating to the use and disclosure of PHI
available to PCN or to the Secretary of the U.S. Department of Health and Human
Services (the "Secretary"), in a time and manner reasonably designated by PCN or
the Secretary for the purposes of the Secretary determining PCN's compliance
with HIPAA Standards and 42 C.F.R. Part 2.
a. Business Associate's Obligations Regarding Unsecured Protected Health
Information. In addition to the requirements of Section 2.5, Business
Associate shall comply with the following obligations regarding Unsecured
PHI .Notifieation to PCN. Business Associate will notify PCN of any
Security Event, Security Incident or Patient whose unsecured P1-11 has been,
or is reasonably believed by Business Associate to have been, inappropriately
accessed, disclosed, or used. Such notification shall include the names and
contact information of the Patients involved and shall be made without
unreasonable delay, but in no case later than 20 days following discovery of
any Security Event or Security Incident, or other impermissible access,
disclosure, or use of PHI under this section, unless delayed for law
enforcement purposes. No later than 30 days after discovery, Business
Associate will conduct a risk assessment in accordance with the H1PAA
Standards to assess whether a Breach has occurred and shall provide PCN
with its risk assessment and conclusions.
b. Notification of Individual or Patient. If PCN and Business Associate agree
that a Breach has occurred, PCN in its sole discretion will decide whether
PCN or Business Associate will notify the Individual or Patient. If PCN
determines that Business Associate should notify the Individual or Patient,
notification must be made by first class mail or by email (if the Individual or
Patient has indicated a preference to receive information by email) as soon as
possible, but in any event, no later than 60 days following the discovery of
the breach. Business Associate shall obtain PCN's advance approval of the
form and content of the written notification. If PCN decides it should make
the notification as the Covered Entity, Business Associate shall reimburse
PCN for all costs of the notification, including PCN's administrative costs.

c. Posting Notice of Breach. In the event the breach involves 10 or more
Individuals or Patients whose contact information is out of date, at PCN's
request, Business Associate will post a notice of the breach on the home page
of its website or in a major print or broadcast media. Business Associate shall
obtain PCN's advance approval of the form and content of the notice before
its posting.
d. Contacting Media Outlets. If a breach involves more than 500 Individuals in a
single state or jurisdiction, PCN will send a notice to prominent media outlets.
Business Associate shall not notify media outlets directly unless expressly
required to make such notification by the HIPAA Standards or other
governing law. Notice to the Secretary. If a breach involves more than 500
Individuals and Patients, Business Associate will immediately notify PCN and
PCN shall notify the Secretary. Business Associate shall not notify the
Secretary unless expressly required to make such notification by the HIT'AA
Standards or other governing law.
e. Contents of Notice, The notices required under this Section shall include
the following:
i. A brief description of the breach, including the date of the breach and the
date of its discovery, if known;
A description of the types of unsecured PHI involved in the
breach;
iii. Steps the Individual or Patient should take to protect hirriselVherself
from potential harm resulting from the breach;
iv. A brief description of actions Business Associate is taking to investigate
the breach, mitigate losses, and protect against further breaches; and
v. Contact information, including a toll-free telephone number, email
address, website or postal address to permit Patient to ask questions or
obtain additional information.
f. Annual Report to Secretary and Maintenance of Log. Business Associate
shall maintain a monthly log of all breaches involving less than 500
Individuals containing the information required by the Secretary for
annual reports of breaches affecting fewer than 500 Individuals. Business
Associate shall provide PCN with the log upon request. Business Associate
will not submit annual reports to the Secretary unless required by law
3. Obligations of PCN.
3.1 Notice of Privacy Practices. To the extent that such limitation or restriction may

affect Business Associate's use or disclosure of PHI, PCN shall provide Business Associate with a
copy of its Notice of Privacy Practices, and notify Business Associate of:
a. Any limitation(s) in its Notice of Privacy Practices;
b. Any changes in, or revocation of, permission by an Individual to use or
disclose PHI; and
c. Any restriction to the use or disclosure of PHI to which PCN has agreed, to
the extent that such restriction may affect Business Associate's use or
disclosure of PHI.
3.2 Permissible Requests. PCN shall not request Business Associate to use or
disclose PHI in any manner that would not be permissible under the Privacy Rule
if used or disclosed by PCN.
4. Term and Termination.
4.1 Term. The Term of this Agreement shall be effective as of the effective date of
the Services Agreement and shall continue in effect until all obligations of the
parties have been met , unless terminated by mutual agreement of the parties or
as provided in Section 4.
4.2 Termination for Cause. PCN may immediately terminate this Agreement and the
Services Agreement if, after providing Business Associate written notice of the
existence of a material breach of this Agreement, Business Associate fails to, or is
unable to, cure the breach upon mutually agreeable terms within 10 days.
4.3 Effect of Termination,
a. Except as provided in Section 4.3(b), upon expiration or termination of the
Services Agreement for any reason, Business Associate shall return or destroy
all PI-II, including PI-H that is in the possession of subcontractor or agents of
Business Associate, Business Associate shall retain no copies of PHI.
b. To the extent that it is not feasible for Business Associate to return or destroy
all PHI, then
i. Business Associate's obligations under this Agreement shall continue for
as long as Business Associate maintains such PHI; and
ii. Business Associate's further uses and disclosures of PHI shall be limited
to those purposes permitted by law, and shall be in strict compliance with
HIPAA Standards for Business Associate to return or destroy the
information for as long as Business Associate maintains such PHI.
06/27/2013

5. Miscellaneous Provisions.
5.1 Indemnification. The parties agree to indemnify, defend and hold harmless each
other and each other's respective employees, directors, officers, subcontractors,
agents, or other members of its workforce, each of the foregoing referred to as an
"indemnified party," against all actual and direct losses suffered by the
indemnified party and all liability to third parties arising from or in connection
with negligence or wrongful acts or omissions, including failure to perform its
obligations under the Privacy Regulation, by the indemnifying party or its
employees, directors, officers, subcontractors, agents, or other members of its
workforce. Accordingly, on demand, the indemnifying party shall reimburse any
indemnified party for any and all actual and direct losses, liabilities, lost profits,
fines, penalties, costs, or expenses (including reasonable attorneys' fees) which
may for any reason be imposed upon any indemnified party by reason of any suit,
claim, action, proceeding or demand by any third party which results from the
indemnifying party's breach of this agreement. The parties' obligation to
indemnify any indemnified party shall survive the expiration or termination of
this agreement. The scope of the indemnification obligation set forth herein shall
not extend to the sole negligence of either party.
5.2 Notice. Notices, requests, and other communications that are required to be in
writing must be personally delivered, mailed by prepaid certified mail, return receipt
requested, or sent by overnight carrier, and must be addressed as follows. Such
notice shall be effective upon being mailed or personally delivered.
If to Provider:
People of Color Network Inc.
Attn: CEO
4520 North Central Avenue Suite 620
Phoenix, AZ 85012
If to Business Associate:
Maricopa County Department of Correctional Health Services
Attn: CFO Correctional Health Services
234 North Central Avenue Suite 5000
Phoenix, AZ 85004
5.3 Mutual Representation and Warranty. Business Associate and PCN each
represents and warrants to the other that all of its employees, agents,
representatives and members of its workforce, whose services may be used to
fulfill obligations under this Agreement or the Services Agreement, are or shall
be appropriately trained so that the parties comply with the terms of this
Agreement and are under legal obligation to fully comply with all provisions
of this Agreement.
5.4 No Third Party Beneficiaries. Nothing express or implied in this Agreement is
intended to confer, or shall confer, any rights, remedies, or liabilities upon any
person other than Business Associate, its Subcontractors and PCN.

5.5 Effect ofAssignment. This Agreement shall be binding upon and shall inure to the
benefit of PCN and its respective transferees, successors and assigns. Business
Associate shall not have the right to assign or transfer this Agreement, or Business
Associate's rights and obligations hereunder, without PCN's prior written consent.
Upon assignment or transfer of this Agreement, Business Associate shall return or
destroy all PHI in accordance with the terms set forth in Section 4.3
5.6 Regulatory References. A reference in this Agreement to a section in HIPAA, as
amended or any of its rules means the section or definition as in effect or as
amended.
5.7 Amendment. Any and all amendments to the HIPAA Standards subsequent to the
effective date of this Agreement shall be considered by the parties to be in full
force and effect as if incorporated into this Agreement. Business Associate and
PCN agree to take prompt action to amend this Agreement as is necessary for
PCN to comply with the requirements of the HIPAA Standards and 42 C.F.R.
Part 2.
5.8 Survival. The respective rights and obligations of Business Associate under this
Agreement shall survive the termination of this Agreement and the Services
Agreement.
5.9 Interpretation. Any ambiguity in this Agreement shall be resolved to permit
PCN to comply with the HIPAA Standards.
5.10 Captions and Headings. The captions and headings in this Agreement are
included for convenience and reference only, and shall in no way be held or
deemed to define, limit, describe, explain, modify, amplify or add to the
interpretation, construction or meaning of, or the scope or intent of, this
Agreement.
[Signature Page Follows]

IN WITNESS WHEREOF, Provider and Business Associate have executed or caused
the execution of this Agreement as of the dates set forth below:
Provider:
PCN, Le.C.
By:
Its: P .6c-it"A— 6 CEO
Date: April 1st, 2014
Business Associate:
MARICOPA COUNTY
THROUGH ITS
DEPARTMENT OF
CORRECTIONAL
HEALTH SERVICES,
inc.
-7:11
10(b. tt 6(
Date: i L l

People of
Color
Network
For Healthy Communities
Limited Access Data Sharing Agreement
Dated ADM 1st , 2014
This Limited Access Data Sharing Agreement is by and between People of Color Network
("PNO" or "PCN") and Maricopa County through its Department of Correctional Health
Services ("CHS").
PCN and CHS, both covered healthcare entities (the "Parties"), hereby set forth an agreement for
limited access to the PCN electronic health record and data sharing by PCN with CHS so that the
needs of shared service Clients/Patients are met. The Parties recognize and acknowledge that the
sharing of data is essential for the continuity of care of individuals served by both Parties. The
limited time frame reflects a transition period wherein this type of special arrangement is necessary
to meet this overarching goal. In recognition of the special circumstances underlying this
Agreement, the Parties acknowledge and agree to the following:
1. Contemporaneous with entering into this Agreement, the Parties have entered into the
attached Business Associate/Qualified Service Organization Agreement ("BA/QSOA").
The BA/QSOA conforms to expected standards in the health care industry when entities
receive, transmit, manage, and otherwise share protected health information. The
BA/QSOA acknowledges PCN as the "Covered Entity" and CHS as the "Business
Associate." While, as stated, both Parties recognize one another as covered entities, both
intend to articulate the privacy and security standards to which CHS will conform its use of
the data and electronic health record access accorded to it by this Agreement.
2. The Parties recognize and acknowledge each and every privacy law and regulation affecting
PCN impacts CHS likewise. Thus, PCN anticipates and CHS agrees and acknowledges that
every CHS employee authorized to access PCN data will be instructed concerning the
confidential nature of Protected Health Information (as defined in the BA/QS0A,
hereinafter "PHI").
3. PCN hereby grants, at no cost, a limited software use and record access license to CHS for
the term of this Agreement. CHS may only have limited access to PCN's electronic health
records and use PCN's software for purposes of treatment and care coordination of RBHA
Clients, and may not, directly or indirectly: (a) license, sell, or lease PCN's software or
access PCN's electronic health records for commercial gain; (b) disassemble, decompile, or
reverse engineer PCN's software; (c) use PCN's electronic health record system to generate
software reports; or (d) have access to the SQL back-end. CHS's access to PCN's electronic
health records is limited to a "read only" file. Any attempt by CHS to circumvent the read
only nature of the data provided, in any way, will immediately void and terminate this
Agreement. CHS further agrees that the foregoing grant of license does not in any way
transfer to CHS any other proprietary rights possessed by PCN or any third party vendor
(including NextGen Healthcare and Topaz Information, LLC) with respect to PCN's
software or the electronic health records. CHS may only make copies of electronic health
records under written approval from PCN. CHS shall ensure that any copyright notice or
other indicia of PCN's software or its software supplier's rights are included in any copies
Version 1— 03/2014 Page 1

People of
Color
74' Network
For Healthy Communities
Limited Access Data Sharing Agreement
of the electronic health records made. For purposes of this Agreement, "REIHA Clients"
means a person determined to be Seriously Mentally Ill in accordance with policies issued
by the Arizona Department of Health Services, Division of Behavioral Health Services
(ADHS/DBHS) and eligible to receive behavioral health services paid for, in whole or in
part, from funds available to the ADHS/DBHS's designated Regional Behavioral Health
Authority (RBHA).
4. CHS shall receive NextGen/Topaz User logins for CHS staff. CHS agrees to notify PCN in
the event a login must be terminated.
5. This Agreement shall commence on April 1, 2014 and continue in effect until June 30, 2014.
In the event that the Mercy Maricopa Integrated Care Health Information Exchange is not
available to CHS on July 1, 2014, this Agreement shall automatically renew for one month
through July 31, 2014. Further extensions beyond July 31, 2014 will be mutually agreed to
by the Parties in writing.
6. PCN has the sole discretion whether and how the limited access and data sharing agreement
shall end if terminated prior to termination date of July 1, 2014, provided that PCN gives
CHS ten (10) calendar days' prior written notice.
7. PCN agrees to provide CHS, at no cost, with limited technical assistance, as may be
requested, relevant to CHS's obligations in managing its privacy and security policies and
procedures and use of the relevant data. PCN will provide CHS with initial setup and
training support on the use of its software and electronic health records system. PCN further
agrees to provide CHS the system administration services necessary for secure access and
routine operation of such software and record system consistent with the objectives of this
Agreement. CHS agrees to provide the necessary hardware, equipment and accessibility to
support its use of the record system.
B. Neither party to this Agreement agrees to indemnify the other party or hold harmless the
other party from liability hereunder. However, if the common law or a statute provides for
either a right to indemnify and/or a right to contribution to any party to this Agreement, then
the right to pursue one or both of these remedies is preserved.
9. CHS shall not allow any use of FCN's software, electronic health records or PHI by any
other division, unit, employee, or other affiliated entity or individual connected with CHS
without PCN's express written consent; provided, however, that CHS may allow its
employees and agents to use PIR's software, electronic health records and PHI to carry out
the purposes of this Agreement, consistent with its terms and conditions. The parties
acknowledge that PCN owns the electronic health records being accessed by CBS through
PCN's software to meet the objectives of this Agreement.
10. PCN does not and cannot warrant the electronic health records and the software that is the
platform for the electronic health records. CBS recognizes that it uses the electronic health
record data at its own risk. PCN does not and cannot warrant any particular fitness of
Version 1.- 03/2014 Page 2

People of
Color
Network
For Healthy Communitiss
Limited Access Data Sharing Agreement
purpose or warranty of merchantability or "up time" of the electronic health records for
CHS's use.
11, This Agreement may be executed in two (2) or more counterparts, each of which shall be
deemed an original and when taken together shall constitute one agreement,
12. This Agreement shall be governed by and construed in accordance with the laws of Arizona.
13. Notices. All notices that are re quired or permitted to be given by one party to the other in
connection with this Agreement shall be in writing to the addresses below:
If to Business Associate:
Maricopa County Department of Correctional Health Services
Attn: CFO Correctional Health Services Administration
234 N. Central Ave., Suite 5000
Phoenix, AZ 85004
If to Covered Entity:
People of Color Network
Attn: Tomas Leon
4520 N Central Ave. Ste. 620
Phoenix, AZ 85012
[SIGNATURES FOLLOW]
The Parties have caused this A greement to be executed b y their duly authorized representatives as
of the date first written above.
People of Color Network Maricopa County
M. Tomas Leon President/CEO
Name and Title Name & Title , 7
Signature S ignatu re / v
April 1st, 2014 Ludk,i
Date Date , •
Version 1- 03/2014 Page 3