BUSINESS ASSOCIATE AGREEMENT RE HIPAA WITH HEALTH CHOICE ARIZONA.PDF

BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement (the "Agreement") is made and entered into as of
September 23, 2013 (the "Effective Date"), by and between Maricopa County Department of
Public Health ("Associate") and Health Choice Arizona, Inc. ("Entity") (collectively the
"Parties") to comply with the requirements of the Health Insurance Portability and
Accountability Act of 1996 (42 USC §1320d et seq.) ("HIPAA"), the Health Information
Technology for Economic and Clinical Health Act ("HITECH"), their implementing privacy and
security regulations set forth at 45 CFR Parts 160 and 164 (the "HIPAA Rules") and any
applicable state confidentiality laws.
NOW THEREFORE, in consideration of the mutual promises and covenants herein,
and for other good and valuable consideration, the receipt and sufficiency of which is hereby
acknowledged, the Parties agree as follows:
A. Definitions. Terms used herein, but not otherwise defined, shall have meaning ascribed
by the H1PAA Rules. "PHI" means Protected Health Information maintained, created, received
or transmitted by Associate from Entity Of on Entity's behalf.
B. Permitted Uses and Disclosures. To the extent Associate is acting as a Business Associate
of Entity, the provisions of this Agreement shall apply to Associate and Associate shall be
subject to the penalty provisions of HIPAA as specified in 45 CFR Part 160. To the extent
Associate is to carry out an obligation of Entity under the HIPAA Rules, Associate shall comply
with the requirements of the HIPAA Rules that apply to Entity in the performance of such
obligation. Associate will neither use nor disclose PHI except as permitted or required by this
Agreement or as Required By Law. Without limiting the foregoing, Associate will not sell PHI
or use or disclose PHI for purposes of marketing or fundraising, as defined and proscribed in the
HIPAA Rules. Associate is permitted to use and disclose PHI as follows:
1. to perform any and all obligations of Associate as described in the service
agreement between the Parties (the "Service Agreement"), provided that such use or
disclosure is consistent with the terms of Entity's notice of privacy practices and would
not violate the HIPAA Rules, if done by Entity directly;
2. to perfor.m Data Aggregation services relating to the health care operations of
Entity;
3. to report violations of the law to federal or state authorities consistent with 45
CFR § 164.502(j)(1);
4, as necessary for Associate's proper management and administration and to carry
out Associate's legal responsibilities (collectively "Associate's Operations") provided
that any disclosure made for purposes of Associate's Operations is Required By Law or is
made after Associate obtains reasonable assurances, evidenced by a written contract,
from the recipient that the recipient will:
(a) hold such PHI in confidence and use or further disclose it only for the purpose for

which Associate disclosed it to the recipient or as Required By Law; and
(b) notify Associate of any instance of which the recipient becomes aware in which the
confidentiality of such PHI was breached; and
5. to de-identify PHI in accordance with 45 CFR § 164.514(b) for purposes of
performing its obligations under the Service Agreement or for Associate's Operations to
the extent permitted by applicable law. Associate shall not use or disclose PHI to create
de-identified information to be used or disclosed for any other purpose without the prior
written consent of Entity.
Notwithstanding the foregoing, in the event Entity notifies Associate of a restriction
request that would restrict a use or disclosure otherwise permitted by this Agreement, Associate
shall comply with the terms of the restriction request.
C. Obligations of Entity. Entity shall notify Associate of (i) any limitations in its notice of
privacy practices, (ii) any changes in, or revocation of, permission by an individual to use or
disclose PHI, and (iii) any confidential communication request or restriction on the use or
disclosure of PHI affecting Associate that Entity has agreed to Or with which Entity is required to
comply, to the extent any of the foregoing affect Associate's use or disclosure of PHI.
D. Safeguards. Associate will use appropriate administrative, technical and physical
safeguards to prevent the use or disclosure of PHI other than as permitted by this Agreement and
shall maintain policies and procedures to detect, prevent, and mitigate identity theft based on PHI
or information derived from PHI. Associate will also comply with the provisions of 45 CFR Part
164, Subpart C of the HIPAA Rules with respect to electronic PHI to prevent any use or
disclosure of such information other than as provided by this Agreement, which obligation shall
include maintaining safeguards that reasonably and appropriately protect the confidentiality,
integrity and availability of electronic PHI.
E. Minimum Necessary. Associate represents that the PHI requested, used or disclosed by
Associate shall be the minimum amount necessary to provide the Services. Associate will limit
its uses and disclosures of, and requests for, PHI (i) when practical, to the information making up
a Limited Data Set; and (ii) in all other cases subject to the requirements of 45 CFR §
164.502(b), to the minimum amount of PHI necessary to accomplish the intended purpose of the
use, disclosure or request.
F. Subcontractors. In accordance with 45 CFR §§ 164.308(b)(2) and 164.502(e)(1)(ii),
Associate will ensure that all of its subcontractors that create, receive, maintain or transmit PHI
on behalf of Associate agree by written contract to comply with the same restrictions and
conditions that apply to Associate with respect to such PHI. Associate shall be liable to Entity for
any acts, failures or omissions of the subcontractor in providing the services as if they were
Associate's own acts, failures or omissions, to the extent permitted by law.
G. Policies and Training. Associate has policies in place regarding the confidential and
secure treatment of PHI. Associate shall require its Workforce to adhere to such policies and
shall train its Workforce regarding the requirements of this Agreement and applicable
confidentiality and security laws and regulations.
H. Access and Amendment. To the extent required for Covered Entities by 45 CFR
§ 164.524, Associate will promptly permit Entity or, at Entity's request, an Individual (or the

Individual's designee) to inspect and obtain copies of any PHI about the Individual that is in
Associate's custody or control and that is maintained in a Designated Record Set. If the
requested PHI is maintained electronically, A.ssociate must provide a copy of the PHI in the
electronic form and format requested by the Individual, if it is readily producible, or, if not, in a
readable electronic form and format as agreed to by Entity and the Individual. Associate will
notify Entity of any request (including but not limited to subpoenas) that Associate receives for
access to PHI that is in Associate's custody or control within five (5) business days of receipt of
such request. Entity shall be responsible for making determinations about access. Associate will,
upon receipt of notice from Entity, promptly amend or permit Entity access to amend any portion
of the PHI that is in Associate's custody or control so that Entity may meet its amendment
obligations under 45 CFR § 164.526.
I. Accounting of Disclosures. Except for disclosures excluded from the accounting
obligation by the HIPAA Rules and regulations issued pursuant to HITECH, Associate will
record for each disclosure that Associate makes of PHI the information necessary for Entity to
make an accounting of disclosures pursuant to the HIPAA Rules. Associate will make this
information available to Entity promptly upon Entity's request for the period requested, but for
no longer than the six (6) years preceding Entity's request for the information (except Associate
need not have any information for disclosures occurring before the effective date of any previous
HIPAA business associate agreements between the parties or, if none, the Effective Date).
J. Books and Records. Associate will make its internal practices, books, and records,
relating to its use and disclosure of the PHI available upon request to Entity or the Secretary of
U.S. Department of Health and Haman Services ("HHS") to determine Entity's compliance with
the HIPAA Rules. Notwithstanding the above, no attorney-client, accountant-client, or other
legal privilege shall be deemed waived by Entity or Associate by virtue of this provision.
K. Withdrawal of Authorization. If the use or disclosure of PHI in this Agreement is based
upon an Individual's specific authorization for the use or disclosure of his or her PHI, and the
Individual revokes such authorization, the effective date of such authorization has expired, or
such authorization is found to be defective in any manner that renders it invalid, Associate shall,
if it has notice of such revocation, expiration, or invalidity, cease the use and disclosure of the
Individual's PHI except to the extent it has relied on such use or disclosure, or if an exception
under the HIPAA Rules expressly applies. Nothing in this Section K shall be interpreted to
permit Associate to make any use or disclosure not expressly permitted by Section B of this
Agreement.
L. Reporting. Associate shall promptly report to Entity, to the extent Associate becomes
aware of or discovers any of the following: any use or disclosure of PHI not permitted by this
Agreement, any Security Incidents involving electronic PHI, and any Breach of Unsecured
Protected Health Information ("Breach"). Associate shall mitigate, to the extent practicable, any
harmful effect known to it of a Security Incident, Breach or use Of disclosure of PHI by
Associate not permitted by this Agreement. Notwithstanding the foregoing, the parties
acknowledge and agree that this section constitutes notice by Associate to Entity of the ongoing
existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below)
for which no additional notice to Entity shall be required. "Unsuccessful Security Incidents"
shall include, but not be limited to, pings and other broadcast attacks on Associate's firewall,
port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so
long as no such incident results in unauthorized access, use or disclosure of electronic PHI. All
reports of Breaches shall be made within ten (10) business days of Associate discovering the

Breach and shall comply with 45 CFR § 164.410. Associate shall promptly reimburse Entity all
reasonable costs incurred by Entity with respect to providing notification of and mitigating a
Breach involving Associate, including but not limited to printing, postage costs and toll-free
hotline costs.
Term and Termination.
1. Term. This Agreement shall be effective as of the Effective Date and shall remain
in effect until terminated pursuant to Section M.2 below or the Service Agreement
terminates, whichever is earlier.
2. Termination for Breach. If Associate breaches any provision in this Agreement,
Entity may, at its option, access and audit the records of Associate related to its use and
disclosure of PHI, require Associate to submit to monitoring and reporting, and such
other conditions as Entity may determine is necessary to ensure compliance with this
Agreement, or Entity may terminate this Agreement on a date specified by Entity. In
addition, either of the Parties may terminate this Agreement effective immediately if it
determines that the other Party has breached a material provision of this Agreement and
failed to cure such breach within thirty (30) days of being notified by the other Party of
the breach. If the non-breaching Party determines that cure is not possible, such Party
may terminate this Agreement effective immediately upon written notice to other Party.
3. Effect of Termination. Upon termination of this Agreement for any reason,
Associate agrees, at no cost to Entity, to return or destroy, in a secure manner, all PHI,
maintained by Associate (or its subcontractors or agents) in any form. If Associate
determines that the return or destruction of PHI is infeasible, Associate shall inform
Entity in writing of the reason thereof, and shall agree to extend the protections of this
Agreement to such PHI and limit further uses and disclosures of the PHI to those
purposes that make the return or destruction of the PHI infeasible for so long as Associate
retains the PHI. The respective rights and obligations of Associate under this Agreement
shall survive termination and
remain in effect
(a) until Associate has completed the return or destruction of PHI as required by this
Section and
(b) to the extent Associate retains any PHI pursuant to this Section.
N. Miscellaneous.
1. Amendments. This Agreement may not be changed or modified in any manner
except by an instrument in writing signed by a duly authorized officer of each of the
Parties hereto. The Parties, however, agree to amend this Agreement from time to time as
necessary, in order to allow Entity's to comply with the requirements of the HIPAA
Rules.
2. No Waiver. Failure or delay on the part of either Party to exercise any right,
power, privilege or remedy hereunder shall not constitute a waiver thereof. No provision
of this Agreement may be waived by either Party except by a writing signed by an
authorized representative of the Party making the waiver.

3. Equitable Relief. Any disclosure of misappropriation of PHI by Associate in
violation of this Agreement will cause Entity irreparable harm, the amount of which may
be difficult to ascertain. Associate therefore agrees that Entity shall have the right to
apply to a court of competent jurisdiction for specific performance and/or an order
restraining and enjoining Associate from any such further disclosure or breach, and for
such other relief as Entity shall deem appropriate. Such rights are in addition to any other
remedies available to Entity at law or in equity. Associate expressly waives the defense
that a remedy in damages will be adequate, and further waives any requirement in an
action for specific performance or injunction for the posting of a bond by Entity.
4. Interpretation. Any ambiguity in this Agreement shall be resolved to permit Entity
to comply with the HIPAA Rules. Nothing in this Agreement shall be construed to create
any rights or remedies in any third parties or any agency relationship between the Parties.
A reference in this Agreement to a section in the HIPAA Rules means the section as in
effect or as amended. This Agreement shall be incorporated into the Service Agreement
and subject to any notice, choice of law, waiver or similar provisions of the Service
Agreement. The provisions of this Agreement shall prevail over any conflicting
provisions of the Service Agreement and any other agreement that exists between the
Parties that may conflict with, or appear inconsistent with, any provision of this
Agreement or the HIPAA Rules. Associate shall agree to conduct business in accordance
with the standards of conduct set forth by Entity ("Our Common Bond").
In Witness Whereof, the parties have executed this Agreement on the dates indicated below.
Entity
By:
Name:
Title:
Date:
Business Associate
By:
Name:
Title:
Date:

IN WITNESS WHEREOF, the parties agree to enter into this Agreement:
FOR AND ON BEHALF OF
MARICOPA COUNTY
By
Chairman, Board of Supervisors
Date
ATTEST:
Clerk of the Board
Date
APPROVED AS TO FORM:
Deputy Attorney for Maricopa County
Date