MCAO SMI BAA - MERCY CARE BA PORTAL FILLABLE FORM - ALL USERS FOR SIGNATURE 10-20-2026.PDF

ATTACHMENT B
BUSINESS ASSOCIATE AGREEMENT
HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA)
This Business Associate Agreement (the “Agreement”) is dated ____________________ (the “Effective Date”), by
and between Mercy Care, organized under the laws of the state of Arizona (hereinafter the “Covered Entity”) and
Maricopa County through the Maricopa County Attorney's Office organized under the laws of the
state of _____ Arizona (hereinafter the “Business Associate”). In conformity with the regulations at 45 C.F.R.
Parts 160-164 (the “Privacy and Security Rules”), Covered Entity will provide Business Associate with access to, or
have Business Associate create, maintain, transmit and/or receive certain Protected Health Information (as defined
below), thus necessitating a written agreement that meets the applicable requirements of the Privacy and Security
Rules. This BAA is limited to the purpose of the agreement it is attached to and does not replace or modify any
other existing BAA that Business Associate may have entered into with Mercy Care or an affiliate. Covered
Entity and Business Associate agree as follows:
1. Definitions. The following terms shall have the meaning set forth below:
(a) ARRA. “ARRA” means the American Recovery and Reinvestment Act of 2009
(b) Breach. “Breach” has the same meaning as the term “breach” in 45 C.F.R. 164.402.
(c) C. F. R. “C.F. R.” means the Code of Federal Regulations.
(d) Designated Record Set. “Designated Record Set” has the meaning assigned to such term in 45 C. F. R.
160.501.
(e) Discovery. “Discovery” shall mean the first day on which a Breach is known to Business Associate
(including any person, other than the individual committing the breach, that is an employee, officer, or other
agent of Business Associate), or should reasonably have been known to Business Associate, to have occurred.
(f) Electronic Protected Health Information. “Electronic Protected Health Information” means information that
comes within paragraphs 1 (i) or 1 (ii) of the definition of “Protected Health Information”, as defined in 45
C. F. R. 160.103.
(g) Individual. “Individual” shall have the same meaning as the term “individual” in 45 C. F. R. 160.103 and
shall include a person who qualifies as personal representative in accordance with 45 C. F. R. 164.502 (g).
(h) Protected Health Information. “Protected Health Information” shall have the same meaning as the term
“Protected Health Information”, as defined by 45 C. F. R. 160.103, limited to the information created or
received by Business Associate from or on behalf of Covered Entity.
(i) Required by Law. “Required by Law” shall have the same meaning as the term “required by law” in 45
C. F. R. 164.103.
(j) Secretary. “Secretary” shall mean the Secretary of the Department of Health and Human Services or his
designee.
(k) Security Incident. “Security Incident” shall have the same meaning as the term “security incident” in 45
C.F.R. 164.304.
(l) Standard Transactions. “Standard Transactions” means the electronic health care transactions for which
HIPAA standards have been established, as set forth in 45 C. F. R., Parts 160-162.
(m) Unsecured Protected Health Information. “Unsecured Protected Health Information” means Protected Health
Information that is not secured through the use of a technology or methodology specified by guidance issued
by the Secretary from time to time.
2. Obligations and Activities of Business Associate.
(a) Business Associate agrees to not use or further disclose Protected Health Information other than as permitted
or required by this Agreement or as Required by Law. Business Associate shall also comply with any further
limitations on uses and disclosures agreed by Covered Entity in accordance with 45 C.F.R. 164.522 provided
that such agreed upon limitations have been communicated to Business Associate in accordance with Section
4.1(c) of this Agreement.
(b) Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health
Information other than as provided for by this Agreement, including but not limited to the safeguards
described in Section 2(m) of this Agreement.
(c) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business
Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the
requirements of this Agreement.

(d) Business Associate agrees to promptly report to Covered Entity any use or disclosure of the Protected
Health Information not provided for by this Agreement of which it becomes aware.
(e) Business Associate agrees to report to Covered Entity any Breach of Unsecured Protected Health Information
without unreasonable delay and in no case later than five (5) calendar days after Discovery of a Breach. Such
notice shall include the identification of each Individual whose Unsecured Protected Health Information
has been, or is reasonably believed by Business Associate, to have been, accessed, acquired, or
disclosed In connection with such Breach. In addition, Business Associate shall provide any
additional information reasonably requested by Covered Entity for purposes of investigating the
Breach. Business Associate’s notification of a Breach under this section shall comply in all respects
with each applicable provision of Section 13400 of Subtitle D (Privacy) of ARRA, 45 CFR 164.410,
and related guidance issued by the Secretary from time to time. Without limiting Covered Entity’s
remedies under Section 6 or any other provision of this Agreement, in the event of a Breach involving
Unsecured Protected Health Information maintained, used or disclosed by Business Associate, Business
Associate shall reimburse Covered Entity for the cost of providing any legally required notice to affected
Individuals and the cost of credit monitoring for such Individuals to extent deemed necessary by Covered
Entity in its reasonable discretion.
(f) In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate agrees
to ensure that any subcontractors that create, receive, maintain, or transmit Protected Health Information
on behalf of Business Associate agree in writing to the same restrictions and conditions that apply through
this Agreement to Business Associate with respect to such information. In no event shall Business
Associate, without Covered Entity’s prior written approval, provide Protected Health Information
received from, or created or received by Business Associate on behalf of Covered Entity, to any employee
or agent, including a subcontractor, if such employee, agent or subcontractor receives, processes or
otherwise has access to the Protected Health Information outside of the United States.
(g) Business Associate agrees to provide access, at the request of Covered Entity, and in a reasonable time
and manner designated by Covered Entity, to Protected Health Information in a Designated Record Set, to
Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45
C.F.R. 164.524. Covered Entity’s determination of what constitutes “Protected Health Information” or a
“Designated Record Set” shall be final and conclusive. If Business Associate provides copies or
summaries of Protected Health Information to an Individual it may impose a reasonable, cost-based fee in
accordance with 45 C.F.R. 164.524 (c)(4).
(h) Business Associate agrees to make any amendment(s) to Protected Health Information in a Designated
Record Set that the Covered Entity directs or agrees to pursuant to 45 C.F.R. 164.526 at the request
of Covered Entity or an Individual, and in the time and manner designated by Covered Entity.
Business Associate shall not charge any fee for fulfilling requests for amendments. Covered Entity’s
determination of what Protected Health Information is subject to amendment pursuant to 45 C.F.R. 164.526
shall be final and conclusive.
(i) Business Associate agrees to make (i) internal practices, books, and records, including policies and
procedures, relating to the use and disclosure of Protected Health Information received from, or created
or received by Business Associate on behalf of, Covered Entity, and (ii) policies, procedures, and
documentation relating to the safeguarding of Electronic Protected Health Information available to the
Covered Entity, or at the request of the Covered Entity to the Secretary, in a reasonable time and manner
designated by the Covered Entity or the Secretary, for purposes of the Secretary determining
Covered Entity’s or Business Associate’s compliance with the Privacy and Security Rules.
(j) Business Associate agrees to document such disclosures of Protected Health Information as would
be required for Covered Entity to respond to a request by an Individual for an accounting of
disclosures of Protected Health Information in accordance with 45 C.F.R. 164.528.
(k) Business Associate agrees to provide to Covered Entity, in the time and manner described below,
the information collected in accordance with Section 2(j) of this Agreement, to permit Covered Entity to
respond to a request by an Individual for an accounting of disclosures of Protected Health Information in
accordance with 45 C.F.R. 164.528. Business Associate agrees to provide such information to Covered
Entity through a quarterly report.
(l) Business Associate acknowledges that it shall request from the Covered Entity and so disclose to its
affiliates, agents and subcontractors or other third parties, (i) the information contained in a “limited data
set,” as such term is defined at 45 C.F.R. 164.514(e)(2), or, (ii) if needed by Business Associate, to the
minimum necessary
BAA – Mercy Care BA Web Portal rev 07.2025 Page 2

to accomplish the intended purpose of such requests or disclosures. In all cases, Business Associate shall
request and disclose Protected Health Information only in a manner that is consistent with guidance issued
by the Secretary from time to time
(m) With respect to Electronic Protected Health Information, Business Associate shall implement and comply
with (and ensure that its subcontractors implement and comply with) the administrative safeguards set
forth at 45 C.F.R. 164.308, the physical safeguards set forth at 45 C.F.R. 310, the technical safeguards set
forth at 45 C.F.R. 164.312, and the policies and procedures set forth at 45 C.F.R. 164.316 to
reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic
Protected Health Information that it creates, receives, maintains, or transmits on behalf of Covered Entity.
Business Associate acknowledges that, (i) the foregoing safeguard, policies and procedures requirements
shall apply to Business Associate in the same manner that such requirements apply to Covered Entity, and
(ii) Business Associate may be liable under the civil and criminal enforcement provisions set forth at 42
U.S.C. 1320d-5 and 1320d-6, as amended from time to time, for failure to comply with the
safeguard, policies and procedures requirements and any guidance issued by the Secretary from time to
time with respect to such requirements.
(n) With respect to Electronic Protected Health Information, Business Associate shall ensure that any
subcontractors that create, receive, maintain, or transmit Electronic Protected Health Information on behalf
of Business Associate, agree to comply with the applicable requirements of Subpart C of 45 C.F.R. Part
164 by entering into a contract that complies with 45 C.F.R. Section 164.314.
(o) Business Associate shall report to Covered Entity any Security Incident of which it becomes aware,
including Breaches of Unsecured Protected Health Information as required by 45 C.F.R. Section 164.410.
(p) If Business Associate conducts any Standard Transactions on behalf of Covered Entity, Business
Associate shall comply with the applicable requirements of 45 C.F.R. Parts 160-162.
(q) During the term of this Agreement, Business Associate may be asked to complete a security survey and/
or attestation document designed to assist Covered Entity in understanding and documenting
Business Associate’s security procedures and compliance with the requirements contained herein.
Business Associate’s failure to complete either of these documents within the reasonable timeframe
specified by Covered Entity shall constitute a material breach of this Agreement.
(r) Business Associate acknowledges that, as of the Effective Date of this Agreement, it may be liable under the
civil and criminal enforcement provisions set forth at 42 U.S.C. 1320d-5 and 1320d-6, as amended from time
to time, for failure to comply with any of the use and disclosure requirements of this Agreement and any
guidance issued by the Secretary from time to time with respect to such use and disclosure requirements.
(s) To the extent Business Associate is to carry out one or more of Covered Entity’s obligation(s) under
Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of Subpart E that
apply to Covered Entity in the performance of such obligation(s).
3. Permitted Uses and Disclosures by Business Associate.
3.1 General Use and Disclosure. Except as otherwise limited in this Agreement, Business Associate may use or
disclose Protected Health Information to perform its obligations and services to Covered Entity, provided
that such use or disclosure would not violate the Privacy and Security Rules if done by Covered Entity or the
minimum necessary policies and procedures of the Covered Entity.
3.2 Specific Use and Disclosure Provisions.
(a) Except as otherwise prohibited by this Agreement, Business Associate may use Protected Health
Information for the proper management and administration of the Business Associate or to carry out the
legal responsibilities of the Business Associate.
(b) Except as otherwise prohibited by this Agreement, Business Associate may disclose Protected Health
Information for the proper management and administration of the Business Associate, provided that
disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person
to whom the information is disclosed that it will remain confidential and used or further disclosed only
as Required By Law or for the purpose for which it was disclosed to the person, and the person notifies
the Business Associate of any instances of which it is aware in which the confidentiality of the
information has been breached in accordance with the Breach and Security Incident notifications
requirements of this Agreement.
(c) Business Associate shall not directly or indirectly receive remuneration in exchange for any Protected
Health Information of an Individual without Covered Entity’s prior written approval and notice from
Covered Entity that it has obtained from the Individual, in accordance with 45 C.F.R. 164.508, a valid
authorization that includes a specification of whether the Protected Health Information can be further
BAA – Mercy Care BA Web Portal rev 07.2025 Page 3

exchanged for remuneration by Business Associate. The foregoing shall not apply to Covered Entity’s
payments to Business Associate for services delivered by Business Associate to Covered Entity.
(d) Business Associate shall not de-identify any Protected Health Information except as authorized by
Covered Entity to provide data aggregation services to Covered Entity as permitted by 42 C.F.R.
164.504(e)(2)(i)(B).
(e) Business Associate may use Protected Health Information to report violation of law to appropriate Federal
and State authorities, consistent with 164.502 (j)(1).
4. Obligations of Covered Entity.
4.1 Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions.
(a) Covered Entity shall notify Business Associate of any limitation(s) in Covered Entity’s notice of privacy
practices that Covered Entity produces in accordance with 45 C.F.R. 164.520 (as well as any changes to that
notice), to the extent that such limitation(s) may affect Business Associate’s use or disclosure of Protected
Health Information.
(b) Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by
Individual to use or disclose Protected Health Information, to the extent that such changes affect Business
Associate’s use or disclosure of Protected Health Information.
(c) Covered Entity shall notify Business Associate of any restriction to the use or disclosure of Protected Health
Information that Covered Entity has agreed to in accordance with 45 C.F.R. 164.522, to the extent that such
restriction may affect Business Associate’s use or disclosure of Protected Health Information.
4.2 Permissible Requests by Covered Entity. Except as may be set forth in Section 3.2, Covered Entity shall not
request Business Associate to use or disclose Protected Health Information in any manner that would not be
permissible under the Privacy and Security Rules if done by Covered Entity.
5. Term and Termination.
(a) Term. The provisions of this Agreement shall take effect on the Agreement’s Effective Date and shall
terminate when all of the Protected Health Information provided by Covered Entity to Business Associate,
or created, maintained, transmitted or received by Business Associate on behalf of Covered Entity, is
destroyed or returned to Covered Entity, or, in accordance with Section 5(c)(2).
(b) Termination for Cause. Without limiting the termination rights of the Parties pursuant to the Agreement
and upon Covered Entity’s knowledge of a material breach of this Agreement by Business Associate,
Covered Entity shall either:
(i) Provide an opportunity for Business Associate to cure the breach or end the violation, or terminate the
Agreement if Business Associate does not cure the breach or end the violation within the time specified by
Covered Entity,
(ii) Immediately terminate the Agreement, if cure of such breach is not possible.
(c) Effect of Termination.
(1) Except as provided in Section 5(c), upon termination of this Agreement, for any reason, Business
Associate shall return or destroy all Protected Health Information received from Covered Entity, or
created, maintained, transmitted or received by Business Associate on behalf of Covered Entity. This
provision shall apply to Protected Health Information that is in the possession of subcontractors or agents
of Business Associate. Business Associate shall retain no copies of the Protected Health Information.
(2) In the event the Business Associate determines that returning or destroying the Protected Health
Information is infeasible, Business Associate shall provide to Covered Entity notification of the
conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return
or destruction of Protected Health Information is infeasible, per Section 5(a) above, Business Associate
shall continue to extend the protection of this Agreement to such Protected Health Information and limit
further uses and disclosures of such Protected Health Information for so long as Business Associate
maintains such Protected Health Information.
6. Indemnification. Business Associate shall indemnify and hold harmless Covered Entity and any of Covered
Entity’s affiliates, directors, officers, employees and agents from and against any claim, cause of action, liability,
damage, cost or expense (including reasonable attorneys’ fees) arising out of or relating to any non-permitted use or
disclosure of Protected Health Information, failure to safeguard Electronic Protected Health Information, or other
breach of this Agreement by Business Associate or any affiliate, director, officer, employee, agent or subcontractor of
Business Associate.
BAA – Mercy Care BA Web Portal rev 07.2025 Page 4

7. Notices. Any notices or communications to be given under this Agreement shall be made to the address and/or
fax numbers given below:
To Business Associate: To Covered Entity:
Mercy Care c/o Aetna
Maricopa County through the HIPAA Member Rights Team
Maricopa County Attorney's Office 151 Farmington Avenue, AN33
Diversion Strategies-Administration Hartford, CT 06156
225 W Madison St Fax: (859) 280-1272
Phoenix AZ 85003 HIPAAFulfillment@aetna.com
Attn: Vania Laguna
Legal Support Supervisor Copy to:
Mercy Care
Attn: Legal Dept.
4750 S. 44th Pl, Suite 150
Phoenix, AZ 85040
Each Party named above may change its address upon thirty (30) days written notice to the other Party.
8. Miscellaneous.
(a) Regulatory References. A reference in this Agreement to a section in the Privacy and Security Rules means
the section as in effect or as amended, and for which compliance is required.
(b) Amendment. Upon the enactment of any law or regulation affecting the use or disclosure of Protected Health
Information or the safeguarding of Electronic Protected Health Information, or the publication of any decision
of a court of the United States or any state relating to any such law or the publication of any interpretive
policy or opinion of any governmental agency charged with the enforcement of any such law or regulation,
either Party may, by written notice to the other Party, amend the Agreement in such manner as such Party
determines necessary to comply with such law or regulation. If the other Party disagrees with such
amendment, it shall so notify the first Party in writing within thirty (30) days of the notice. If the Parties are
unable to agree on an amendment within thirty (30) days thereafter, then either of the Parties may terminate
the Agreement on thirty (30) days written notice to the other Party.
(c) Survival. The respective rights and obligations of Business Associate under Sections 5(c) and 6 of this
Agreement shall survive the termination of this Agreement.
(d) Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits Covered
Entity to comply with the Privacy and Security Rules. In the event of any inconsistency or conflict between
this Agreement and any other agreement between the Parties, the terms, provisions and conditions of this
Agreement shall govern and control.
(e) No third party beneficiary. Nothing express or implied in this Agreement is intended to confer, nor shall
anything herein confer, upon any person other than the Parties and the respective successors or assigns of the
Parties, any rights, remedies, obligations, or liabilities whatsoever.
(f) Governing Law. This Agreement shall be governed by and construed in accordance with the laws of Arizona.
(g) Scope. This BAA is limited to the purpose of the agreement it is attached to and does not replace or modify
any other existing BAA that Business Associate may have entered into with Mercy Care or an affiliate.
[This portion of the page has been left intentionally blank and is followed by the signature page.]
BAA – Mercy Care BA Web Portal rev 07.2025 Page 5

IN WITNESS WHEREOF, the Parties have hereto by their duly authorized representatives executed this Agreement.
Mercy Care Business Associate
__________________________________ __________________________________
Authorized Signature Authorized Signature
__________________________________ __________________________________
Print Name Print Name
Chair, Maricopa County Board of Supervisors
__________________________________ __________________________________
Title Title
__________________________________ __________________________________
Date Date
86-6000472
__________________________________
Taxpayer ID#
_______________________________
Authorized Signature
Rachel Mitchell
_______________________________
Print Name
Maricopa County Attorney
_______________________________
Title
_______________________________
Date
ATTEST:
_______________________________
Clerk of the Board
_______________________________
Date
Approved as to form:
_______________________________
Deputy County Attorney
_______________________________
Date
BAA – Mercy Care BA Web Portal rev 07.2025 Page 6