BAA MERCY MARICOPA.PDF

BUSINESS ASSOCIATE AGREEMENT
HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)
This Business Associate Agreement (the "Agreement") is made and entered into this 1st_ day of
_July_, 2013 (the "Effective Date"), by and between Mercy Maricopa Integrated Care ("Mercy"), a
corporation organized under the laws of Arizona and having its principal address at 4350 E. Cotton
Center Blvd Phoenix, AZ 85040 (hereinafter the "Covered Entity") and Maricopa County through its
Department of Correctional Health Services. ("Business Associate '7 Maricopa. County is a political
subdivision of the State of Arizona and having its principal address at 234 N. Central Avenue, Suite 500,
Phoenix, Arizona, 85004 (hereinafter the "Business Associate"). In conformity with the regulations at 45
C.F.R. Parts 160-164 (the "Privacy and Security Rules"), Covered Entity will provide Business Associate
with access to, or have Business Associate create, maintain, transmit and/or receive certain Protected
Health Information (as defined below), thus necessitating a written agreement that meets the applicable
requirements of the Privacy and Security Rules. Covered Entity and Business Associate agree as follows:
1. Definitions. The following terms shall have the meaning set forth below:
(a) ARRA. "ARRA." means the American Recovery and Reinvestment Act of 2009
(b) C. F. R. "C.F. R." means the Code of Federal Regulations.
(c) Designated Record Set. "Designated Record Set" has the meaning assigned to such term in 45 C. F.
R. 160.501.
(d) Discovery. "Discovery" shall mean the first day on which a Breach is known to Business Associate
(including any person, other than the individual committing the breach, that is an employee, officer, or
other agent of Business Associate), or should reasonably have been known to Business Associate, to have
occurred.
(f) Electronic Protected Health Information. "Electronic Protected Health Information" means
information that comes within paragraphs 1 (i) or 1 (ii) of the definition of "Protected Health
Information", as defined in 45 C. F. R. 160.103.
(g) Individual. "Individual" shall have the same meaning as the term "individual" in 45 C. F. R. 160.103
and shall include a person who qualifies as personal representative in accordance with 45 C. F. R.
164.502 (g).
(h) Protected Health Information. "Protected Health Information" shall have the same meaning as the
term "Protected Health Information", as defined by 45 C. F. R. 160.103, limited to the information
created or received by Business Associate from or on behalf of Covered Entity.
(1) Required by Law. "Required by Law" shall have the same meaning as the term "required by law" in
45
C. F. R. 164.103.
(j) Secretary. "Secretary" shall mean the Secretary of the Department of Health and Human Services or
his designee.
(k) Breach. "Breach" has the same meaning as the term "breach" in 45 C.F.R. 164.402.
(1) Security Incident. "Security Incident" shall have the same meaning as the term "security
incident" in 45 C.F.R. 164.304.
(m) Standard Transactions. "Standard Transactions" means the electronic health care transactions for
which 111PAA standards have been established, as set forth in 45 C. F. R„ Parts 160-162.
(n) Unsecured Protected Health Information. "Unsecured Protected Health Information" means
Protected Health Information that is not secured through the use of a technology or methodology
specified by guidance issued by the Secretary from time to time.
2. Obligations and Activities of Business Associate
Printed on 01/10/2014
Page 1 of 7

(a) Business Associate agrees to not use or further disclose Protected Health Information other than as
permitted or required by this Agreement or as Required by Law. Business Associate shall also comply
with any further limitations on uses and disclosures agreed by Covered Entity in accordance with 45
C.F.R. 164.522 provided that such agreed upon limitations have been communicated to Business
Associate in accordance with Section 4.1(c) of this Agreement.
(b) Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected
Health Information other than as provided for by this Agreement, including but not limited to the
safeguards described in Section 2(m) of this Agreement.
(c) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to
Business Associate of a use or disclosure of Protected Health Information by Business Associate in
violation of the requirements of this Agreement.
(d) Business Associate agrees to promptly report to Covered Entity any use or disclosure of the Protected
Health Information not provided for by this Agreement of which it becomes aware.
(e) Business Associate agrees to report to Covered Entity any Breach of Unsecured Protected Health
Information without unreasonable delay and in no case later than ten (10) calendar days after Discovery
of a Breach. Such notice shall include the identification of each Individual whose Unsecured Protected
Health Information has been, or is reasonably believed by Business Associate, to have been, accessed,
acquired, or disclosed In connection with such Breach. In addition, Business Associate shall provide any
additional information reasonably requested by Covered Entity for purposes of investigating the Breach.
Business Associate's notification of a Breach under this section shall comply in all respects with each
applicable provision of Section 13400 of Subtitle D (Privacy) of ARRA, 45 CPR 164.410, and related
guidance issued by the Secretary from time to time. Without limiting Covered Entity's remedies under
Section 6 or any other provision of this Agreement, in the event of a Breach involving Unsecured
Protected Health Information maintained, used or disclosed by Business .Assodiate, Business Associate
shall reimburse Covered Entity for the cost of providing any legally required notice to affected
Individuals and the cost of credit monitoring for such Individuals to extent deemed necessary by Covered
Entity in it reasonable discretion.
(f) In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate
agrees to ensure that any subcontractors that create, receive, maintain, or transmit Protected Health
Information on behalf of Business Associate agree in writing to the same restrictions and conditions that
'apply through this Agreement to Business Associate with respect to suchinformation. In no event shall
Business Associate, without Covered Entity's prior written approval, provide Protected Health
Information received from, or created or received by Business Associate on behalf of Covered Entity, to
any employee or agent, including a subcontractor, if such employee, agent or subcontractor receives,
processes or otherwise has access to the Protected Health Information outside of the United States.
(g) Business Associate agrees to provide access, at the request of Covered Entity, and in the time and
manner designated by Covered Entity, to Protected Health Information in a Designated Record Set, to
Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under
45 C.F.R. 164.524. Covered Entity's determination of what constitutes "Protected Health Information" or
a "Designated Record Set" shall be final and conclusive. If Business Associate provides copies or
summaries of Protected Health Information to an Individual it may impose a reasonable, cost-based fee in
accordance with 45 C.F.R. 164.524 (c)(4).
(h) Business Associate agrees to make any amendment(s) to Protected Health Information in a
Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 C.F.R. 164.526 at the
request of Covered Entity or an Individual, and in the time and manner designated by Covered Entity.
Business Associate shall not charge any fee for fulfilling requests for amendments. Covered Entity's
determination of what Protected Health Information is subject to amendment pursuant to 45 C.F.R.
164.526 shall be final and conclusive.
Printed on 01/10/2014
Page 2 of 7

(1) Business Associate agrees to make (i) internal practices, books, and records, including policies and
procedures, relating to the use and disclosure of Protected Health Information received from, or created or
received by Business Associate on behalf of, Covered Entity, and (ii) policies, procedures, and
documentation relating to the safeguarding of Electronic Protected Health Information available to the
Covered Entity, or at the request of the Covered Entity to the Secretary, in a time and Man . ner designated
by the Covered Entity or the Secretary, for purposes of the Secretary determining Covered Entity's or
Business Associate's compliance with the Privacy and Security Rules.
(j) Business Associate agrees to document such disclosures of Protected Health Information as would be
required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of
Protected Health Information in accordance with 45 C.F.R. 164.528.
(k) Business Associate agrees to provide to Covered Entity, in the time and manner described below, the
information colleCted in accordance with Section 2(j) of this Agreement, to permit Covered Nay to
respond to a request by an Individual for an accounting of disclosures of Protected Health Information in
accordance with 45 C.F.R. 164.528. Business Associate agrees to provide such information to Covered
--Entity -through a quarterly report. (1) Business Associate acknOdedges that it shall request from the
Covered Entity and so disclose to its affiliates, agents and subcontractors or other third parties, (i) the
information contained in a "limited data set," as such term is defined at 45 C.F.R. 164514(e)(2), or, (ii) if
needed by Business Associate, to the minimum necessary to accomplish the intended purpose of such
•-•• 1-el:rests...or disclosures. In all cases, Business Associate shall request and disclose Protected Health
Information only in a manner that is consistent with guidance ce iisued by the. Secretary from time to time
(m) With respect to Electronic Protected Health Information, Business Associate shall implement and
_ comply with (and ensure that its subcontractors implement and comply with) the administrative
- safeguards set forth at 45 C.F.R. 164.308, the physical safeguards set forth at 45 C.F.R. 310, the technical
• safeguards.set forth it 45 C.F.R. 164.312, and the policies and procedures set forth at 45 C.F.R. 164.316
. . .ta.teasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic
Protected Health4nformation that it creates, receives, maintains, or transmits on behalf of Covered Entity.
.:_Business Associate acknowledges that, (i) the foregoing safeguard, policies and procedures requirements
shalLapply to Business Associate in the same manner that such requirements apply to Covered Entity, and
(ii) Business Associate shall be liable under the civil and criminal enforcement provisions set forth at 42
U.S.C. 1320d-5 and 1320c1-6, as amended from time to time, for failure to comply with the safeguard,
policies and procedures requirements and any guidance issued by the Secretary from time to time with
respect to such requirements.
(n). With respect to Electronic Protected Health Information, Business Associate shall, ensure that any
subcontractors that create, receive, maintain, or transmit Electronic Protected Health Information on
behalf of Business Associate, agree to comply with the applicable requirements of Subpart C of 45 C.F.R.
Part 164 by entering into a contract that complies with 45 C.F.R. Section 164.314..
(o) Business Associate shall report to Covered Entity any Security Incident of which it becomes aware,
including Breaches of Unsecured Protected Health Information as required by 45 C.F.R. Section 164.410.
(p) If Business Associate conducts' any Standard Transactions on behalf of Covered Entity, Business
Associate shall comply with the applicable requirements of 45 C.F.R. Parts 160-162.
(q) During the term of this Agreement, Business Associate may be asked to complete a security survey
and/or attestation document designed to assist Covered Entity in understanding and documenting
Business Associate's security procedures and compliance with the requirements contained herein.
Business Associate's failure to complete either of these documents within the reasonable. timeframe
specified by Covered Entity shall constitute a material breach of this Agreement. -
(r) Business Associate acknowledges that, as of the Effective Date of this Agreement, it shall be liable
under the civil and criminal enforcement provisions set forth at 42 U.S.C. 1320c1-5 and 1320d-6, as
amended from time to time, for failure to comply with any of the use and disclosure requirements of this
Agreement and any guidance issued by the Secretary from time to time with respect to such use and
Printed on 01/10/2014
Page 3 of 7

disclosure requirements.
(s) To the extent Business Associate is to carry out one or more of Covered Entity's obligation(s) under
Subpart E of 45 CPR Part 164, Business Associate shall comply with the requirements of Subpart E that
apply to Covered Entity in the performance of such obligation(s).
3. Permitted Uses and Disclosures by Business Associate
3.1 General Use and Disclosure Except as otherwise limited in this Agreement, Business Associate
may use or disclose Protected Health Information to perform its obligations and Services to Covered
Entity, provided that such use or disclosure Would not iiolate the Privacy and Security Rules if done by
Covered Entity or the minimum necessary pojicies and procedures of the Covered Entity.
3.2 Specific Use and Disclosure Provisions
(a) Except as otherwise prohibited by this Agreement, Business Associate may use Protected Health
Information for the proper management and administration of the Business Associate or to carry out the
legal responsibilities of the Business Associate.
(b) Except as otherwise prohibited by this Agreement, Business Associate may disclose Protected Health
Information for the proper management and administration of the Business Associate, provided that
disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to
whom the information is disclosed that it will_remain confidential and used or further disclosed only as
Required By Law or for the purpose for whichitzas disclosed to the person, and the person notifies the
Business Associale of any instances of which it is aware in which the confidentiality of the information
has been breached in accordance with the Breach and Security Incident notifications requirements of this
Agreement.
(c) Business Associate shall not directly or indirectly receive remuneration in exchange for any Protected
Health Information of an Individual without Covered Entity's prior written approval and notice from
Covered Entity that it has obtained from the Individual, in accordance with 45 C.F.R. 164.508, a valid
authorization that includes a specification of whether the Protected Health Information can be further
exchanged for remuneration by Business Associate. The foregoing shall not apply to Covered Entity's
payments to Business Associate for services delivered by Business Associate to Covered Entity.
• (d) Except as otherwise prohibited by this Agreement, Business Associate nfay. use Protected Health
Information to provide data aggregatiOn services to Covered Entity as permitted by 42 C.F.R.
164.504(e)(2)(i)(B). Protected health information may not be de-identified for any other use, without the
prior consent of Covered Entity.
(e) Business Associate may use Protected Health Information to report violation of law to appropriate
Federal and State authorities, consistent with 164.502 (j)(1).
4. Obligations of Covered Entity.
4.1 Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions
(a) Covered Entity shall notify Business Associate of any limitation(s) in Covered Entity's notice of
privacy practices that Covered Entity produces in accordance with 45 C.F.R. 164.520 (as well as any
changes to that notice), to the extent that such limitation(s) may affect Business Associate's use or
disclosure of Protected Health Information.
(b) Covered Entity shall provide Business Associate with any changes in, or revocation of,
permission by Individual to use or disclose Protected Health Information, to the extent that such changes
affect Business Associate's use or disclosure of Protected Health Information.
Printed on 01/10/2014
Page 4 of 7

(c) Covered Entity shall notify Business Associate of any restriction to the use or disclosure of
Protected Health Information that Covered Entity has agreed to in accordance with 45 C.F.R. 164322, to
the extent that such restriction may affect Business Associate's use or disclosure of Protected Health
Information.
4.2 Permissible Requests by Covered Entity. Except as may be set forth in Section 3.2, Covered
Entity shall not request Business Associate to use or disclose Protected Health Information in any manner
that would not be permissible under the Privacy and Security Rules if done by Covered Entity.
5. Term and Termination
(a) Term. The provisions of this Agreement shall take effect on the Agreement's Effective Date and
shall terminate when all of the Protected Health Information provided by Covered Entity to Business
Associate, or created, maintained, transmitted or received by Business Associate on behalf of Covered
Entity, is destroyed or returned to Covered Entity, or, in accordance with Section 5(c)(2).
(b) Termination for Cause. Without limiting the termination rights of the Parties pursuant to the
Agreement and upon Covered Entity's knowledge of a material. breach of this Agreement by
Business Associate, Covered Entity shall either:
(i) Provide an opportunity for Business Associate to cure the breach or end the violation, or terminate
the Agreement if Business Associate does not cure the breach or end the violation within 60 days,
(ii) Immediately terminate the Agreement, if cure of such breach is not possible.
(c) Effect of Termination.
(1) Except as provided in Section 5(c), upon termination of this Agreement, for any reason,
Business Associate shall return or destroy all Protected Health Information received from Covered Entity,
or created, maintained, transmitted or received by Business Associate on behalf of Covered Entity. This
provision shall apply to Protected Health Information that is in the possession of subcontractors or agents
of Business Associate. Business Associate shall retain no copies of the Protected Health Information.
(2) In the event the Business Associate determines that returning or destroying the Protected
Health Information is infeasible, Business Associate shall provide to Covered Entity notification of the
conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return or
destruction of Protected Health Information is infeasible, per Section 5(a) above, Business Associate shall
continue to extend the protection of this Agreement to such Protected Health Information and limit further
uses and disclosures of such Protected Health Information for so long as Business Associate maintains
such Protected Health Information.
6. Indemnification. Business Associate shall indemnify and hold harmless Covered Entity and any of
Covered Entity's affiliates, directors, officers, employees and agents from and against any claim, cause of
action, liability, damage, cost or expense (including reasonable attorneys' fees) arising out of or relating
to any non-permitted use or disclosure of Protected Health Information, failure to safeguard Electronic
Protected Health Information, or other breach of this Agreement by Business Associate or any affiliate,
director, officer, employee, agent or subcontractor of Business Associate.
7. Notices. Any notices or communications to be given under this Agreement shall be made to the
address and/or fax numbers given below:
To Business Correctional Health Services To Covered Mercy Maricopa Integrated
Associate: Entity: Care
234 N. Central Avenue, Suite 4350 E. Cotton Center Blvd
Printed on 01/10/2014
Page 5 of 7

5000, Phoenix, AZ 85004
Attention: Phoenix, AZ 85040
Phone: Attn: Eddy Broadway
Fax: Phone: 602-543-6021
E-mail Address: Fax: (860) 907-3017
Each Party named above may change its address upowthirty (30) days written notice to the other Party.
8. Miscellaneous.
(a) Regulatory References. A reference in this Agreement to a section in the Privacy and Security
Rules means the section as in effect or as amended, and for which compliance ikrequired.
(b) Amendment. Upon the enactment of any law or regulation affecting the use or disclosure of
Protected Health Information or the safeguarding of Electronic Protected Health Information, the
publication of any interpretive policy or opinion of any governmental agency charged with the
enforcement of any such law or regulation, either Party may, by written notice to the other Party,
amend the Agreement in such manner as such Party determines necessary to comply with such law or
regulation,, If the other Party disagrees with such amendment, it shall so notify the first Party in
writing within thirty (30) days. of the notice, if the Parties are unable to agree on an amendment
within thirty (30) days thereafter, then either of the Parties may terminate the Agreement on thirty (30)
days written notice to the other Party."
(c) Survival. The respective rights and obligations of Business Associate under Sections 5(c)
and 6 of this Agreement shall survive the termination of this Agreement.
(d) Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that
permits Covered Entity to comply with the Privacy and Security Rules. In the event of any inconsistency
or conflict between this Agreement and any other agreement between the Parties, the terms, provisions
and conditions of this Agreement shall govern and control.
(e) No third party beneficiary. Nothing express or implied in this Agreement is intended to confer,
nor shall anything herein confer, upon any person other than the Parties and the respective successors or
assigns of the Parties, any rights, remedies, obligationS, or liabilities whatsoever.
(f) Governing Law. This Agreement shall be governed by and construed in accordance with the laws
of Arizona.
IN WITNESS WHEREOF, the Parties have hereto by their duly authorized representatives executed
this Agreement.
Merc0 opa Integrated Care Correctional Health Services
ASI*dhlaa. _
Authorized Signature Authorized Signature
_Eddy Broadway .
Print Name Print Name
Printed on 01/10/2014
Page 6 of 7

Chief Executive Officer
Title Title
1/10/201,4
Date Date
Taxpayer IN
Printed on 01/10/2014
Page 7 of 7