PARTNERS IN RECOVERY LLC AND MARICOPA COUNTY.PDF

Limited Access and Data Sharing Agreement
Dated April 1, 2014
Between Partners in Recovery, LLC and Maricopa County
Partners in Recovery, LLC ("PNO"or "P1R") and Maricopa County through its Department of Correctional
Health Services ("CHS"), both covered healthcare entities (the "Parties"), hereby set forth an agreement
for limited access to the P1R electronic health record and data sharing by PIR with CHS so that the needs
of shared service recipients are met. The Parties recognize and acknowledge that the sharing of data is
essential for the continuity of care of Individuals served by both Parties. The limited time frame reflects
a transition period wherein this type of special arrangement is necessary to meet this overarching goal.
In recognition of the special circumstances underlying this Agreement, the Parties acknowledge and
agree to the following:
1. Contemporaneous with entering into this Agreement, the Parties will enter into the attached
Business Associate/Quallfied Service Organization Agreement ("BA/QS0A"). The BA/QSOA
conforms to expected standards in the health care industry when entities receive, transmit,
manage, and otherwise share protected health information. The BA/QSOA acknowledges PIR as
the "Covered Entity" and CHS as the "Business Associate." While, as stated, both Parties
recognize one another as covered entities, both intend to articulate the privacy and security
standards to which CHS will conform Its use of the data and electronic health record access
accorded to it by this Agreement.
2. The Parties recognize and acknowledge each and every privacy law and regulation affecting PIR
impacts CHS likewise. Thus, PIR anticipates and CHS agrees and acknowledges that every CHS
employee authorized to access PIR data will be instructed concerning the confidential nature of
Protected Health Information (as defined in the BA/QS0A, hereinafter "PHI").
3. PIR hereby grants, at no cost to CHS, a limited software use and record access license to CHS for
the term of this Agreement. CHS may only have limited access to PIR's electronic health records
and use PIR's software for purposes of treatment and care coordination of RHBA Clients, and
may not, directly or indirectly: (a) license, sell, or lease P1R's software or access PIR's electronic
health records for commercial gain; (b) disassemble, decompile, or reverse engineer P1R's
software; (c) use PIR's electronic health record system to generate software reports; or (d) have
access to the SQL back-end (i.e., source code). CHS's access to P1R's electronic health records Is
limited to a "read only" file. Any attempt by CHS to circumvent the read only nature of the data
provided, in any way, will immediately void and terminate this Agreement. CHS further agrees
that the foregoing grant of license does not in any way transfer to CHS any other proprietary
rights possessed by PHI or any third party vendor (including NextGen Healthcare and Topaz
Information, LLC) with respect to PIR's software or Documentation (i.e., training documentation
proprietary to Topaz Information, LLC). CHS may only make copies of such Documentation
under written approval from PIR. CHS shall ensure that any copyright notice or other indicia of
PIR's software or its software supplier's rights are included in any copies of the Documentation
made. For purposes of this Agreement, "RBHA Clients" means a person determined to be
Seriously Mentally Ill in accordance with policies Issued by the Arizona Department of Health
Services, Division of Behavioral Health Services (ADHS/DBHS) and eligible to receive behavioral
health services paid for, in whole or in part, from funds available to the ADHS/DBHS's designated
Regional Behavioral Health Authority (RBHA).
Page 1 of 3

4. CHS shall receive 63 NextGen/Topaz User logins for CH5 staff. CHS agrees to notify PIR in the
event a login must be terminated.
5. This Agreement shall commence on April 1, 2014 and continue in effect until June 30, 2014. In
the event that the Mercy Maricopa Integrated Care Health Information Exchange is not available
to CHS on July 1, 2014, this Agreement shall automatically renew for one month through July 31,
2014. Further extensions beyond July 31, 2014 will be mutually agreed to by the Parties in
writing.
6. PIR has the sole discretion whether and how the limited access and data sharing agreement
shall end if terminated prior to termination date of July 1, 2014, provided that PIR gives CHS ten
(10) calendar days' prior written notice.
7. PIR agrees to provide CHS, at no cost, with limited technical assistance, as may be requested,
relevant to CHS's obligations in managing its privacy and security policies and procedures and
use of the relevant data. P1R will provide CHS with initial setup and training support on the use
of its software and electronic health records system. PIR further agrees to provide CHS the
system administration services necessary for secure access and routine operation of such
software and record system consistent with the objectives of this Agreement. CHS agrees to
provide the necessary hardware, equipment and accessibility to support its use of the record
system.
8. Neither party to this Agreement agrees to indemnify the other party or hold harmless the other
party from liability hereunder. However, if the common law or a statute provides for either a
right to indemnify and/or a right to contribution to any party to this Agreement, then the right
to pursue one or both of these remedies is preserved.
9. CHS shall not allow any use of PlR's software, electronic health records or PHI by any other
division, unit, employee, or other affiliated entity or individual connected with CHS without PIR's
express written consent; provided, however, that CHS may allow its employees and agents to
use PIR's software, electronic health records and PHI to carry out the purposes of this
Agreement, consistent with its terms and conditions. The parties acknowledge that PIR owns
the electronic health records being accessed by CHS through PIR's software to meet the
objectives of this Agreement.
10. P1R does not and cannot warrant the electronic health records and the software that is the
platform for the electronic health records. CHS recognizes that it uses the electronic health
record data at its own risk.
11. Notices. All notices that are required or permitted to be given by one party to the other in
connection with this Agreement shall be in writing to the addresses below:
If to CHS:
Maricopa County Department of Correctional Health Services
Attn: CFO Correctional Health Services Administration
234 N. Central Ave., Suite 5000
Phoenix, AZ 85004
Page 2 of 3

If to PIR:
Partners In Recovery, LW
Attn: Christina Dye, CEO
924 N. Country Club Dr.
Mesa, AZ 85201
(SIGNATURES FOLLOW]
The Parties have caused this Agreement to be executed by their duly authorized representatives as of
the date first written above.
Partners In Recovery, LIC Maricopa County
CEO
e and Title
o /3J No Li
Date Date
Page 3 of 3

HIPAA BUSINESS ASSOCIATE AND
QUALIFIED SERVICE ORGANIZATION AGREEMENT
MARICOPA COUNTY through its DEPARTMENT OF CORRECTIONAL HEALTH
SERVICES, a covered healthcare entity (hereinafter "Business Associate") acknowledges that it
is a Business Associate of PARTNERS IN RECOVERY, LLC (hereinafter "Covered Entity )"
"Organization," "Provider," or "PIR") (both referred to as "the Parties") as defined by the
standards for Privacy of Individually Identifiable Health Information under the Health Insurance
Portability and Accountability Act of 1996 ("HIPAA"), as amended by Sections 13400 through
13424 of the Health Information Technology for Economic Clinical Health Act (the "HITECH
Act"), which was enacted as part of the American Recovery and Reinvestment Act of 2009
("ARRA"), the rules changes as published in the Federal Register, 78 FR 5565, also called the
"Omnibus Rule" and Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part
2. In accordance with the terms set forth in this Business Associate Agreement ("Agreement"),
MARICOPA COUNTY through its DEPARTMENT OF CORRECTIONAL HEALTH
SERVICES and PARTNERS IN RECOVERY, LLC shall use reasonable best efforts to protect
the privacy of Protected Health Information, including, but not limited to, the following terms.
BACKGROUND
Business Associate provides emergency/crisis behavioral health services and coordination of
care services for persons receiving services through Covered Entity. Such services, activities and
functions necessitate Business Associate access to the Covered Entity's Electronic Medical
Record, It is the intent of Covered Entity and Business Associate that this agreement meets the
requirements of the Privacy and Security Rules, as they are commonly known by and applied to
the health care industry, and that both parties adopt and incorporate any future amendments to
federal privacy and security law, rule and policy as if such were set forth herein,
1. Definitions.
Terms used but not otherwise defined in this Agreement shall have the same meaning as those
terms in the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Privacy
Rule and Security Rule, 45 CFR Parts 160 and 164. If for any reason ambiguity occurs between
this agreement and federal law, rule and policy, the parties adopt the definition used in federal
law, rule and policy, particularly the most recent "Omnibus Rule,"
1.1 Business Associate. "Business Associate" means MARICOPA COUNTY through
its DEPARTMENT OF CORRECTIONAL HEALTH SERVICES as the specific
provider of services in accordance with the term as defined in 45 CFR § 160.103.
1,2 Disclosure. "Disclosure" shall have the same meaning as the term "disclosure" in
45 CFR § 160.103.
1,3 Electronic Media. "Electronic media" shall have the same meaning as the term
"electronic media" in 45 CFR § 160.103.
Page 1 of 10
Partners in Recovery Business Associate Agreement

1,4 Genetic Information. "Genetic information" shall have the same meaning as the
term "genetic information" in 45 CFR § 160.103.
1.5 Individual. "Individual" shall have the same meaning as the term "individual" in
45 CFR § 160.103 and shall include a person who qualifies as a personal
representative in accordance with 45 CFR § 164,502(g).
1.6 Limited Data Set. "Limited data set" shall have the same meaning as the term
"limited data set" in 45 CFR § 164.514(e)(2).
1,7 Minimum Necessary. "Minimum necessary" shall have the meaning set forth in
the Privacy Rule, as supplemented by ARRA and any subsequent guidance or rule.
1.8 Patient. "Patient" means a patient of Covered Entity. In the business activities
conducted between the parties, patients may be called different names to reduce
the stigma associated with the services rendered by the Covered Entity. Thus,
patients may be called "individuals receiving services" Or "members" when the
parties use the software provided by Covered Entity, as two examples.
1,9 Patient Record. "Patient Record" means any item, collection, or grouping of
information that includes Protected Health Information or Electronic Protected
Health Information. that is created, maintained, collected, used, or distributed by -
Provider.
1.10 Personal Health Records. "Personal Health Records" means electronic records of
personal health information, regardless of whether the information has been
created or received by Provider, health plan, employer, or health care
clearinghouse, in order to distinguish it from individually identifiable health
information that is created or received by Provider, health plan, employer, or
health care clearinghouse. Personal Health Records includes the kinds of records
managed, shared and controlled by or primarily for the Patient, but not records
managed by or primarily for commercial enterprises, such as life insurance
companies.
1.11 Privacy Rule. "Privacy Rule" shall mean the standards for Privacy of Individually
Identifiable Health Information contained in 45 CFR Parts 160 and 164, Subparts
A and E.
1.12 Protected Health Information. "Protected Health Information" and/or "PHI"
means information, whether oral or recorded in any form or medium, including
demographic information, that: (i) relates to the past, present or future physical or
mental health or condition of an individual, the provision of health care to an
individual, or the past, present or future payment for the provision of health care to
an individual; (ii) identifies the individual, or for which there is a reasonable basis
for believing that the information can be used to identify the individual; and (iii) is
received by Business Associate from or on behalf of Provider, or is created by
Business Associate for Provider, or is made accessible to Business Associate by •
Page 2 of 10
Partners in Recovery Business Associate Agreement

Provider. PHI includes, without limitation, "Electronic Protected Health
Information" and/or "EPHI", as that term is defined at 45 CFR § 160.1.03.
1.13 Provider. "Provider" means PIR acting as a Covered Entity.
1.14 Secretary. "Secretary" shall mean the Secretary of the United States Department
of Health and Human Services or his designee.
1.15 Security Event. "Security Event" shall mean an immediately reportable security
incident (as defined below) or breach (to be afforded the same meaning given to
such term under HIPAA), which includes but is not limited to:
a. A suspected unauthorized or impermissible penetration of Business
Associate's information system of which Business Associate becomes
aware, whether Business Associate is able to determine if Provider's
confidential data was compromised, accessed, stolen, used, disclosed,
modified or destroyed;
b. Any indication, evidence, or other security documentation that Business
Associate's network resources, software, network, routers, firewalls,
database, and application servers, intrusion detection systems or other
security appliances or applications may have been or actually damaged,
modified, taken over by proxy or otherwise compromised and that
Business Associate cannot refute within forty eight (48) hours of
becoming aware of such indication; these potential categories shall evolve
with the most current technology and security as deployed by Business
Associate;
c. A breach of the security of the Business Associate's information systems
(as understood in the broadest sense); and/or
d. The unauthorized acquisition, access to or use, disclosure, modification or
destruction of unencrypted PHI or other confidential information of
Provider by an employee or authorized user of Business Associate's
system(s) that materially compromises the security, confidentiality or
integrity of PHI or other confidential information of Provider. If PHI or
other confidential information acquired, including but not limited to access
to or use, disclosure, modification or destruction of such data, is in an
encrypted or de-identified format but the decryption key, which would
allow the decoding of the data, or for identification otherwise, is also
taken, the parties shall treat the acquisition as a breach for purposes of
determining the appropriate response.
1.16 Security Incident. "Security incident" shall have the same meaning as "security
incident" in 45 CFR 164.304.
Page 3 of 10
Partners in Recovery Business Associate Agreement

1.17 Security Rule. "Security Rule" means the Security Standards for the Protection of
Electronic Protected Health Information contained in 45 CFR Parts 160 and 164,
Subparts A and C.
1.18 Services Agreement. "Services Agreement" means the Limited Access and Data
Sharing Agreement by and between Provider and Business Associate having an
effective date of April 1, 2014 and subsequent amendments.
1.19 Standard. "Standard" shall have the same meaning as "standard" in 45 CFR §
160.103.
1.20 Subcontractor. "Subcontractor" shall have the same meaning as "subcontractor' in
45 CFR 160.103.
1.21 Treatment, Payment, or Health Care Operations. "Treatment, Payment, or Health
Care Operations" shall have the same meaning as "treatment, payment, or health
care operations" in 45 CFR § 164.506.
1.22 Unsecured Protected Health Information. "Unsecured Protected Health
Information: and/or "Unsecured PHI" means information that is not secured
through the use of a technology or methodology identified by the Secretary to
render the Protected Health Information unusable, unreadable and indecipherable
to unauthorized users,
1.23 Workforce. "Workforce" shall have the same meaning as "workforce" in 45 CFR
§ 160.103.
2. Business Associate's Obligations.
2.1 Business Associate Subject to Same Standards and Same Penalties as Provider
Business Associate will comply with the use and disclosure provision of the
Privacy Rule and the security standards regarding administrative, physical and
technical safeguards of the Security Rule. As set forth in the HITECH Act,
Business Associate will be subject to civil and criminal penalties for violation of
the Privacy Rule or the Security Rule. This agreement and the standards
described by this agreement and the relevant law also apply to any of Business
Associate's subcontractors.
2.2 Permitted Uses and Disclosures. Business Associate shall use or disclose PHI
solely as necessary to carry out the purposes set forth in the Services Agreement,
and as permitted or required by this Agreement or as required by law.
2.3 Safeguards. Business Associate shall use appropriate privacy and security
measures to prevent the use or disclosure of PHI other than as permitted under
this Agreement or permitted by HIPAA.
2.4 Mitigation. If Business Associate uses or discloses PHI in a manner other than as
permitted under this Agreement, Business Associate shall use its reasonable best
Page 4 of 10
Partners In Recovery Business Associate Agreement

efforts to mitigate the effects of the use or disclosure. These efforts shall include,
but are not limited to, ensuring that the improper use of PHI is discontinued
immediately, seeking return or destruction of the improperly disclosed PHI, and
ensuring that any person to whom PHI was improperly disclosed will not
redisclose such information.
2.5 Dui), to Report. Business Associate shall immediately notify Provider of any use
or disclosure of PHI of which Business Associate is aware that is not expressly
authorized under this Agreement, whether made by Business Associate, its
employees, representatives, agents, or subcontractors. Business Associate shall
also immediately notify Provider of any attempted or successful unauthorized
access, use, disclosure, modification, or destruction of information, or interference
with the system operations in an information system. Business Associate shall
provide in such notice the remedial or other actions taken to correct the
unauthorized use or disclosure.
2.6 Agents. Business Associate will ensure that any of its employees, agents,
subcontractors, or other third parties with which Business Associate does business
are aware of and are bound to abide by Business Associate's obligations under
this Agreement,
2.7 Duty to Document Disclosures.
a. Business Associate will document each disclosure it makes of PHI to any
other person, including Provider, that is not permitted or required by this
Agreement or by applicable law. The documentation shall include:
i. The date of the disclosure;
ii. The name of the person receiving the PHI, and, if known, the address
of such person; and
iii. A brief statement of the purpose of the disclosure or, instead of such
statement, a copy of the request for disclosure.
b. Notwithstanding Section. 2.7(a), Business Associate is not required to
document the following disclosures:
i. Unless otherwise required by Section 2.10, disclosures made for the
purpose of, or incidental to, carrying out treatment, payment, or health
care operations;
ii. Disclosures made prior to April 14, 2003;
iii. Disclosures made to provide the Patient with access to its PHI under
Section 2.7;
iv. Disclosures made pursuant to a Patient's written authorization;
Page 5 of 10
Partners in Recovery Business Associate Agreement

v. Disclosures required by law for national security or intelligence purposes;
vi. Disclosures to correctional institutions or law enforcement officials having
lawful custody of a Patient;
vii. Disclosures made as part of a limited data set;
viii. Disclosures made to persons involved in the individual's care; arid
ix. Disclosures made for notification purposes such as in an emergency,
2:8 Accounting ofDisclosures. Business Associate understands that a Patient has the
right to an accounting of disclosures of PHI upon request, pursuant to 45 C.F.R.
§ 164.528. To provide Patients with such an accounting, if required by 45 C.F.R.
§ 164.528, Business Associate will make available to Provider the documentation
Business Associate has collected in accordance with Section 2.7 upon written
request of Provider. Business Associate shall provide the accounting within 20
days of receipt of Provider's request. If disclosures were made by Business
Associate through the use of an electronic health record, the Patient has the right
to receive an accounting of disclosures of personal health records made by
Business Associate for treatment, payment, and health care operations during the
previous 3 years.
2.9 Minimum Necessary. Business Associate represents and warrants that it will use
and disclose PHI in accordance with the Privacy Rule's "minimum necessary"
Standard.
2,10 Other Uses and Disclosures. Business Associate will not use or disclose PHI in
any manner that would not be permissible under the Privacy Rule or the Security
Rule if used or disclosed by Provider.
2.11 Books and Records and Internal Practices, Business Associate agrees to make all
internal practices, books, and records relating to the use and disclosure of PHI
available to Provider or to the Secretary of the U.S. Department of Health and
Human Services (the "Secretary"), in a time and manner reasonably designated by
Provider or the Secretary for the purposes of the Secretary determining Provider's
compliance with the Privacy Rule and the Security Rule.
2,12 Business Associate's Obligations Regarding Unsecured Protected Health
Information. Business Associate shall comply with the following obligations that
are related to Unsecured PHI.
a. Notification of Provider. Business Associate will notify Provider of any
Patient whose unsecured PHI has been, or is reasonably believed by
Business Associate to have been, inappropriately accessed, disclosed, or
used. Such notification shall include the names and contact information of
the Patients involved and shall be made without unreasonable delay, but in
no case later than 20 days following discovery of such breach, unless
Page 6 of 10
Partners in Recovery Business Associate Agreement

delayed for law enforcement purposes. Business Associate will conduct a
risk assessment, in accordance with the final "Omnibus" Rule when
determining whether a breach has occurred.
b. Notification of Patient. Business Associate will notify the Patient by first
class mail or by email (if the Patient has indicated a preference to receive
information by email) of any breaches of unsecured PHI as soon as possible,
but in any event, no later than 60 days following the discovery of the breach.
Business Associate will obtain Provider's approval of the form and content
of the written notification before its issuance.
c. Posting Notice of Breach. In the event the breach involves 10 or more
Patients whose contact information is out of date, Business Associate will
post a notice of the breach on the home page of its website or in a major
print or broadcast media. Business Associate will obtain Provider's approval
of the form and content of the written notice before its posting,
d. Contacting Media Outlets. If a breach involves more than 500 Patients in a
single state or jurisdiction, Business Associate will send a notice to
prominent media outlets. Business Associate will obtain Provider's
approval of the form and content of the written notice before its issuance to
the media outlets.
e. Notice to the Secretary. On behalf of Provider, Business Associate shall
provide written notice of a Breach to the Secretary to the extent required
under 45 C.F.R, § 164.408.
f. Contents ofNotice. The notices required under this Section shall include the
following:
i. A brief description of the breach, including the date of the breach and the
date of its discovery, if known;
ii. A description of the types of unsecured PHI involved in the breach;
iii. Steps the Patient should take to protect himself/herself from potential
harm resulting from the breach;
iv. A brief description of actions Business Associate is taking to investigate
the breach, mitigate losses, and protect against further breaches; and
v. Contact information, including a toll-free telephone number, email
address, website or postal address to permit Patient to ask questions or
obtain additional information.
3. Obligations of Provider.
Page 7 of 10
Partners in Recovery Business Associate Agreement

3.1 Notice of Privacy Practices. To the extent that such limitation or restriction may
affect Business Associate's use or disclosure of PHI, Provider shall provide
Business Associate with a copy of its Notice of Privacy Practices, and notify
Business Associate of:
a. Any limitation(s) in its Notice of Privacy Practices;
b. Any changes in, or revocation of, permission by a Patient to use or disclose
PHI; and
c. Any restriction to the use or disclosure of PHI to which Provider has agreed,
to the extent that such restriction may affect Business Associate's use or
disclosure of PHI.
3.2 Permissible Requests. Provider shall not request Business Associate to use or
disclose PHI in any manner that would not be permissible under the Privacy Rule
if used or disclosed by Provider.
4. Term and Termination.
4.1 Term. The Term of this Agreement shall be effective as of the effective date of
the Services Agreement and shall continue in effect until all obligations of the
parties have been met, unless terminated by mutual agreement of the parties or as
provided in Section 4.
4.2 Termination for Cause. Provider may immediately terminate this Agreement and
the Services Agreement if, after providing Business Associate written notice of
the existence of a material breach of this Agreement, Business Associate fails to,
or is unable to, cure the breach upon mutually agreeable terms within 10 days.
4.3 Effect of Termination. Upon expiration or termination of the Service Agreement
for any reason, Business Associate shall immediately cease using the Covered
Entity Electronic Medical Record system and return or destroy all PHI and EPHI,
if any, that is in the possession of subcontractors or agents of Business Associate.
If Business Associate determines that returning or destroying the PHI or EPHI is
infeasible, Business Associate shall extend the protections of this Agreement to
such PHI and EPHI and limit further uses and disclosures of such PHI and EPHI
to those purposes that make the return or destruction infeasible, for so long as
Business Associate maintains such PHI and EPHI.
5. Miscellaneous Provisions.
5.1 Indemnification. The parties agree to indemnify, defend and hold harmless each
other and each other's respective employees, directors, officers, subcontractors,
agents, or other members of its workforce, each of the foregoing referred to as an
"indemnified party," against all actual and direct losses suffered by the
indemnified party and all liability to third parties arising from or in connection
with negligence or wrongful acts or omissions, including failure to perform its
Page 8 of 10
Partners in Recovery Business Associate Agreement

obligations under the Privacy Regulation, by the indemnifying party OT its
employees, directors, officers, subcontractors, agents, or other members of its
workforce. Accordingly, on demand, the indemnifying party shall reimburse any
indemnified party for any and all actual and direct losses, liabilities, lost profits,
fines, penalties, costs, or expenses (including reasonable attorneys' fees) which
may for any reason be imposed upon any indemnified party by reason of any suit,
claim, action, proceeding or demand by any third party which results from the
indemnifying party's breach of this agreement. The parties' obligation to
indemnify any indemnified party shall survive the expiration or termination of
this agreement. The scope of the indemnification obligation set forth in this
paragraph does not extend to the sole negligence of either party.
5.2 Notice. Notices, requests, and other communications that are required to be in
writing must be personally delivered, mailed by prepaid certified mail, return
receipt requested, or sent by overnight carrier, and must be addressed as follows.
Such notice shall be effective upon being mailed or personally delivered.
If to Provider:
PARTNERS IN RECOVERY, LLC
924 North Country Club Drive
Mesa, AZ 85201
If to Business Associate:
Maricopa County Department of Correctional Health Services
Attn: CFO Correctional Health Services Administration
234 N. Central Ave., Suite 5000
Phoenix, AZ 85004
5.3 Mutual Representation and Warranty. Business Associate and Provider each
represents and warrants to the other that all of its employees, agents,
representatives and members of its workforce, whose services may be used to
fulfill obligations under this Agreement and/or the Services Agreement, are OT
shall be appropriately informed of the terms of this Agreement and are under legal
obligation to fully comply with all provisions of this Agreement.
5_4 No Third Party Beneficiaries. Nothing express or implied in this Agreement is
intended to confer, or shall confer, any rights, remedies, or liabilities upon any
person other than Business Associate, its Subcontractors and Provider.
5.5 Effect of Assignment. This Agreement shall be binding upon and shall inure to the
benefit of Business Associate and Provider and their respective transferees,
successors and assigns, except that Business Associate shall not have the right to
assign or transfer this Agreement, or Business Associate's rights and obligations
hereunder, without Provider's prior written consent. -Upon assignment or transfer
of this Agreement, Business Associate shall return or destroy all PHI or EPHI in
accordance with the terms set forth in Section 4.
Page 9 of 10
Partners in Recovery Business Associate Agreement

5.6 Regulatory References. A reference in this Agreement to a section in the Privacy
Rule or the Security Rule or a term defined in a Privacy Rule or the Security Rule
means the section or definition as in effect or as amended under HIPAA.
5. 7 Amendment. Business Associate and Provider agree to take such action to amend
this Agreement as is necessary for Provider to comply with the requirements of
the Privacy Rule and the Security Rule.
5.8 Survival. The respective rights and obligations of Business Associate under this
Agreement shall survive the termination of this Agreement and the Services
Agreement.
5.9 Interpretation. Any ambiguity in this Agreement shall be resolved to permit
Provider to comply with the Privacy Rule and the Security Rule.
5.10 Captions and Headings. The captions and headings in this Agreement are
included for convenience and reference only, and shall in no way be held or
deemed to define, limit, describe, explain, modify, amplify or add to the
interpretation, construction or meaning of, or the scope or intent of, this
Agreement.
IN WITNESS WHEREOF, Provider and Business Associate have executed or caused the
execution of this Agreement as of the dates set forth below:
Provider: Business Associate:
PAU-NgRS IN RECOVERY, LLC MA RICOPA COUNTY
iii
By: By: 561V
' .
Its: Prea(A Oa) -1)4 Ve riot
Date: L 16 )o 1 -1 Date:
Page 10 of 10
Partners in Recovery Business Associate Agreement