PE MCDPH-NOAH BAA FORM_8-30-22.PDF
Extracted text (via pymupdf)
28395 characters
Neighborhood Outreach Access to Health
BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement (“BAA”) sets out the responsibilities and
obligations of Maricopa County Department of Public Health (MCDPH) ("Associate") as a
Business Associate (as defined at 45 C.F.R.§ 160.103) of Neighborhood Outreach
Access to Health (“NOAH”) pursuant to the agreement between Associate and NOAH
dated July 1, 2020, as well as all future agreements entered into by the Parties
(collectively, the “Agreement”). Associate and NOAH (individually a "Party" and
collectively the "Parties") agree to the terms and conditions of this BAA in order to comply
with the use and disclosure of Protected Health Information (“PHI”) (as defined at 45
C.F.R.§ 160.103) provisions of the Standards for Privacy of Individually Identifiable Health
Information, at 45 C.F.R. Parts 160 and 164, Subparts A and E, as amended from time
to time (the “Privacy Rule”); the Security Standards for the Protection of Electronic PHI,
45 C.F.R. Parts 160 and 164, Subparts A and C (the "Security Rule"); and the standards
for Notification in the Case of Breach of Unsecured PHI, 45 C.F.R. Part 164, Subpart D
(the "Breach Notification Rule") (collectively, the “HIPAA Rules”). Unless otherwise
provided herein, all capitalized terms in this BAA will have the same meaning as provided
under the HIPAA Rules and HITECH (as defined below). Associate and NOAH will
comply with the terms of this BAA for the duration of the Agreement and for such other
continuing periods as provided in this BAA. This BAA shall supersede any and all prior
business associate agreements entered into between the Parties.
1. USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION.
a. Term of this Agreement. The parties agree that this BAA shall have a retroactive
effective date beginning July 1, 2020, and will continue in perpetuity, until
terminated by either party.
b. Performance of Services. Associate will use and disclose PHI only for those
purposes necessary to perform its duties, obligations and functions under the
Agreement, or as otherwise expressly permitted or required by this BAA or as
Required by Law. Associate will not use or further disclose any PHI in violation of
this BAA or in a manner that, if done by NOAH, would violate the Privacy Rule.
c. Limited Data Sets. Associate will limit any uses, disclosures, or requests of PHI
to a Limited Data Set, as defined in 45 C.F.R. § 164.514(e)(2), or if needed by
Associate to the minimum necessary PHI required to accomplish the intended
purpose of the use, disclosure, or request, as defined by the Privacy Rule,
pursuant to the Health Information Technology for Economic and Clinical Health
Act (“HITECH”), and any regulations or guidance promulgated thereunder by the
Secretary. For any disclosures of PHI pursuant to this BAA, the Party disclosing
the PHI shall determine what constitutes the minimum necessary to accomplish
the intended purpose of the disclosure.
d. Data Aggregation. Associate may use PHI to perform data aggregation services
as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).
e. Associate’s Management and Administration. Associate may use or disclose
PHI for the necessary management and administration of Associate, or to carry
out the legal responsibilities of Associate, provided that if Associate makes a
disclosure of PHI:
i. The disclosure is Required By Law; or
ii. Associate first secures written assurances from the receiving party
that the receiving party will: (i) hold the PHI confidentially; (ii) use or
disclose the PHI only as required by law or for the purposes for which
it was disclosed to the recipient; and (iii) notify the Associate of any
breaches in the confidentiality of the PHI.
Notwithstanding the foregoing, the Parties explicitly agree that unless the
de-identification requirements in Section 1(e) of this BAA are met, Associate’s use
of PHI in demonstrating its services or product to an outside third party is strictly
prohibited by this BAA.
f. De-Identification. Associate may de-identify the PHI, provided that such
de-identification is in accordance with 45 C.F.R. § 164.514(b)92) and such
resulting de-identified information is only used or disclosed for Associate’s internal
business purposes. Associate may not commercialize or sell the de-identified
information to a third party.
g. Prohibition on Off-Shoring PHI. Associate agrees that no PHI may be created,
received, maintained, accessed, or transmitted outside of the United States of
America, which shall be construed as one of the fifty United States or one of the
United States territories (i.e., American Samoa, Guam, Northern Mariana Islands,
Puerto Rico, and Virgin Islands).
2.
SAFEGUARDS FOR PROTECTED HEALTH INFORMATION. Associate will
implement appropriate safeguards to prevent any use or disclosure of PHI not
otherwise permitted in this BAA. Associate also will implement administrative,
physical and technical safeguards to protect the confidentiality, integrity, and
availability of the electronic PHI, if any, that Associate creates, receives, maintains,
or transmits on behalf of NOAH. Associate will also comply with the applicable
requirements of Subpart C of Part 164 of the Security Rule in the same manner
such provisions apply to NOAH.
3.
REPORTS OF IMPERMISSIBLE USE OR DISCLOSURE.
a. Notification of an Impermissible Use or Disclosure of PHI. Associate will
report to NOAH any use or disclosure of PHI not permitted by this BAA, including
any Breach of Unsecured PHI, as soon as reasonably practicable but in all events,
within five (5) business days of its discovery.
b. Notification of Security Incidents. Associate also will report to NOAH any
Security Incident of which it becomes aware within five (5) business days of its
discovery. Notwithstanding the foregoing, Associate and NOAH acknowledge the
ongoing existence and occurrence of attempted but unsuccessful Security
Incidents that are trivial in nature, such as pings and port scans, and NOAH
acknowledges and agrees no additional notification to NOAH of such unsuccessful
Security Incidents is required. However, to the extent that Associate becomes
aware of an unusually high number or pattern of unsuccessful Security Incidents
due to the repeated acts of a single party, Associate shall notify NOAH of these
attempts and provide the name, if available, of said party. At the request of NOAH,
Associate shall use its best efforts to identify the date of the Security Incident,
Associate’s response to the Security Incident and the identification of the party
responsible for causing the Security Incident, if known.
c. Content of Notifications. Associate's notices provided under this Section 3 will
include, to the extent possible, the identification of each Individual whose PHI has
been, or is reasonably believed by Associate to have been, accessed, acquired,
used, or disclosed during or as a result of the impermissible use or disclosure of
PHI, or a Security Incident (“Security Event”). Associate shall also provide NOAH
with at least the following information: a description of the Security Event, including
the date of the Security Event and date of discovery, if known; a description of the
types of PHI involved in the Security Event; any steps Individuals should take to
protect themselves from potential harm as a result of the Security Event; and any
other information requested by NOAH related to the Security Event. Associate
shall supplement such notice with further information as it becomes available, even
if such information becomes available after Individuals have been notified of the
Security Event.
d. Cooperation by Associate. Associate agrees to cooperate with NOAH in the
investigation of a Security Event and understands and agrees that NOAH in its
sole discretion will determine whether or not a Security Event is a Breach and/or
triggers notification obligations.
e. Obligation to Provide Notifications. In the event that Associate or its Workforce
members or Subcontractors cause a Security Event or a Security Event occurs
while PHI is in Associate’s possession or is being transmitted by Associate,
Associate agrees that NOAH may, in its sole discretion, require Associate to
provide all notifications that NOAH is required to make pursuant to the Breach
Notification Rule and any other applicable laws. NOAH shall have the right to
review, direct, and approve or reject the contents or manner of such notifications.
f. Cost Reimbursement and Indemnification. Associate also agrees to indemnify
and reimburse NOAH for any costs incurred in investigating, mitigating, and
otherwise responding to a Security Event caused by Associate or its Workforce or
Subcontractors, or a Security Event occurs while PHI is in Associate’s possession
or is being transmitted by Associate, including costs related to providing legally
required notifications, as well as credit monitoring services for at least one (1) year
to the extent the Security Event involved social security numbers or financial
account information.
4.
SUBCONTRACTORS. In accordance with 45 C.F.R. §§ 164.308(b)(2) and
164.502(e)(1)(ii), if Associate provides PHI to a Subcontractor, Associate shall
ensure that the Subcontractor agrees in writing to substantially the same, but at
least as stringent and protective as to NOAH and the PHI, as the restrictions and
conditions that apply in this BAA to Associate with respect to such information,
including the safeguards required by Section 2. Associate shall maintain a list of
its Subcontractors and will provide NOAH with a copy of such list upon reasonable
request.
5.
OBLIGATIONS REGARDING ASSOCIATE PERSONNEL. Associate will
appropriately inform and train all of its Workforce members (“Associate
Personnel”), whose services may be used to satisfy Associate’s obligations under
the Agreement and this BAA of such Associate Personnel’s HIPAA Rule and
HITECH obligations so as to enable Associate to comply with the terms of this
BAA. Associate represents and warrants that the Associate Personnel are under
legal obligation to Associate, by contract or otherwise, sufficient to enable
Associate to fully comply with the provisions of this BAA.
6.
ACCESS TO PHI.
a. NOAH Access. Within five (5) business days of a request by NOAH for access to
PHI held by Associate in a Designated Record Set, Associate will make the
requested PHI available to NOAH, in the time, manner, and format requested by
NOAH, including electronically if Associate maintains the PHI electronically and
the requested form and format is readily producible, or, if not, in a readable
electronic form and format as agreed to by NOAH and the Individual. Any fee that
Associate may charge for providing the access required hereunder must be
reasonable, cost-based, and determined in accordance with 45 C.F.R. §
164.524(c)(4).
b. Individual Access. If an Individual requests access to PHI directly from
Associate, Associate will notify the Individual that it will forward the request to
NOAH. Within five (5) business days of the request, Associate will forward such
request in writing to NOAH. NOAH will be responsible for making all
determinations regarding the grant or denial of an Individual’s request for PHI and
Associate will make no such determinations. Only NOAH will release PHI to the
Individual pursuant to such a request.
C. Additional Data Collection. This BAA encompasses primary data collected by
NOAH and or Associate throughout course of the Community Health Needs
Assessment. This additional data may include but is not limited to survey data,
focus group data, and key informant interview data.
7.
AMENDMENT OF PHI. Within five (5) business days of receiving a request from
NOAH to amend an Individual’s PHI held by Associate in a Designated Record Set,
Associate will provide such information to NOAH for amendment. If NOAH’s
request includes specific information to be included in the PHI as an amendment,
Associate will incorporate such amendment within five (5) business days of receipt
of NOAH’s request. Associate will forward to NOAH within five (5) business days
any requests by Individuals to Associate to amend PHI within its or NOAH's
possession. NOAH will be responsible for making all determinations regarding
amendments to PHI, and Associate will make no such determinations.
8.
ACCOUNTING OF DISCLOSURES; REQUESTS FOR DISCLOSURE.
a. Disclosure Records. Associate will keep a record of any disclosure of PHI received
from NOAH that Associate makes to its employees, subcontractors, and agents,
or other third parties other than those excluded under 45 CFR §164.528(a)(1),
including the following:
(1) Disclosures to health care providers to assist in the treatment of patients;
(2) Disclosures to others to assist NOAH in paying claims;
(3) Disclosures to others to assist NOAH in conducting its health care
operations, as defined in 45 C.F.R. § 164.501;
(4) Disclosures to individuals of protected health information about them as
provided in 45 C.F.R. § 164.502; or
(5) Disclosures made pursuant to an individual’s Authorization.
MCDPH will maintain this disclosure record for six (6) years from the termination
of this Agreement.
Associate also agrees to maintain necessary and sufficient documentation of
Disclosures of Protected Health Information as would be required for Associate to
respond to a request by an individual for an accounting of Disclosures, in
accordance with 45 CFR 164.528.
b. Data Regarding Disclosures. For each disclosure for which Associate must
maintain documentation under Section 8(a), Associate will record and maintain the
following information:
The date of disclosure;
The name of the entity or person who received the PHI, and, the
address of such entity or person, if known;
A description of the PHI disclosed; and
A brief statement of the purpose of the disclosure.
c. Individual Request for Disclosure Records. Within five (5) business days of
receipt of a notice from NOAH to Associate of an Individual’s request for an
accounting of disclosures, Associate will provide NOAH with the record of
disclosures requested in the notice.
d. Individual Request to Associate. If an Individual requests an accounting of
disclosures directly from Associate, Associate will notify the Individual that he or
she will receive such accounting from NOAH. Associate will forward the request
to NOAH within five (5) business days of Associate’s receipt of the request, and
will make its records of disclosures available to NOAH as otherwise provided in
this Section. NOAH will be responsible for preparation and delivery of the records
of disclosure to the Individual. Associate will not provide an accounting of its
disclosures directly to the Individual.
e. Survival of Obligations. Associate’s obligations related to maintaining a
disclosure record and providing the disclosure record to NOAH as required by this
Section 8 shall survive for six (6) years from the effective date of the relevant
Agreement, Associate shall provide NOAH with its disclosure record which reflects
disclosures made by Associate over the six (6) years immediately preceding the
date of termination.
9.
REQUESTS FOR RESTRICTIONS. If NOAH advises Associate of any changes
in, or restrictions to the permitted use or disclosure of PHI provided to Associate,
Associate will restrict use or disclosure of PHI consistent with NOAH’s instructions.
If Associate receives a request to restrict the disclosure of PHI directly from an
Individual, Associate shall promptly notify NOAH of such request, and NOAH shall
be responsible for making the determination as to whether Associate shall comply
with the Individual's request.
10.
DELEGATION OF OBLIGATIONS. To the extent Associate is clearly required by
the terms of the Agreement to carry out NOAH’s obligations under the Privacy
Rule, Associate shall comply with the requirements of the Privacy Rule that apply
to NOAH in the performance of such delegated obligations.
11.
MITIGATION PROCEDURES. Associate will mitigate, to the maximum extent
practicable, any harmful effect that is known to Associate arising from its, its
Workforce’s, or its Subcontractors’ Use or Disclosure of PHI in a manner that
violates this BAA.
12.
INDEMNIFICATION. The following indemnification provisions shall apply to this
BAA and shall survive the termination of the Agreement or this BAA:
a. To the fullest extent permitted by law, Associate, its successors, assigns and
guarantors, shall pay, defend, indemnify and hold harmless NOAH, its agents,
representatives, officers, directors, officials and employees from and against all
allegations, demands, proceedings, investigations or audits by state or federal
government agencies, suits, actions, claims, damages, liability, penalties, losses,
expenses, including but not limited to, attorney fees, defense costs, court costs,
the cost of appellate proceedings, and the costs of responding to and defending
against an investigation or audit, and all claim adjusting and handling expenses,
related to, arising from or out of or resulting from any actions, acts, errors, mistakes
or omissions caused in whole or part by Associate relating to work or services in
the performance of this BAA, including but not limited to, any Subcontractor, or
Associate’s or Subcontractor’s Workforce, regardless of whether or not caused in
part by the active or passive negligence of a party indemnified hereunder including
NOAH, its agents, representatives, officers, directors, officials and employees.
b. If any claim, action or proceeding is brought against NOAH by reason of any event
that is the subject of this BAA and or described herein, upon demand made by
NOAH, Associate, at its sole cost and expense, shall pay, resist or defend such
claim or action on behalf of NOAH by an attorney hired by Associate, or if covered
by insurance, Associate’s insurer, all of which must be approved by NOAH, which
approval shall not be unreasonably withheld or delayed. NOAH shall cooperate
with all reasonable efforts in the handling and defense of such claim. Included in
the foregoing, NOAH may engage its own attorney to defend or assist in its
defense. Any settlement of claims shall fully release and discharge the indemnified
parties from any further liability for those claims. The release and discharge shall
be in writing and shall be subject to approval by NOAH, which approval shall not
be unreasonably withheld or delayed. If Associate neglects or refuses to defend
NOAH as provided by this BAA, any recovery or judgment against NOAH for a
claim covered under this BAA shall conclusively establish Associate’s liability to
NOAH in connection with such recovery, fine, penalty, or judgment. Further, if
NOAH desires to settle such dispute, NOAH shall be entitled to settle such dispute
in good faith and Associate shall be liable for the amount of such settlements.
Regardless of settlement, fine, penalty, or judgment, Associate shall be liable for
all expenses connected to the defense, including reasonable attorney fees, and
other investigative and claims adjusting expenses.
c. Any limitations of liability contained in the Agreement shall not apply to the
indemnification requirements of this Section.
d. In addition to the indemnification obligations set forth herein, Associate shall make
itself and any Subcontractors or Workforce members assisting Associate in the
performance of its obligations under the Agreement or this BAA available to NOAH,
at no cost to NOAH, to testify as witnesses, or otherwise, in the event of litigation
or administrative proceedings being commenced against NOAH, its directors,
officers or employees based upon a claim of violation of HIPAA, the HITECH Act,
the HIPAA Rules, or other laws related to security and privacy by Associate or its
Subcontractors or Workforce members.
e. This Section shall survive termination of this BAA.
13.
RESPONSIBILITIES UPON TERMINATION.
a. Return of PHI; Destruction. Within fifteen (15) days of termination of this BAA,
Associate will return to NOAH all PHI received from NOAH or created or received
by Associate on behalf of NOAH which Associate maintains in any form or format
(including copies thereof), and Associate will not maintain or keep in any form or
format any portion of the PHI. Alternatively, Associate may, upon NOAH’s written
consent, destroy all such PHI and provide written documentation of such
destruction to Associate. The requirement to return or destroy such PHI will apply
to all Subcontractors of Associate. Associate will be responsible for recovering
any PHI from such Subcontractors. If Associate cannot obtain the PHI from any
Subcontractor, Associate will so notify NOAH and will require that such
Subcontractor directly return PHI to NOAH or otherwise destroy such PHI, subject
to the terms of this Section.
b. Return or Destruction of PHI Infeasible. If Associate believes that returning or
destroying PHI in its or its Subcontractors' possession at the termination of this
BAA is infeasible, it will provide written notice to NOAH within five (5) business
days of the effective date of termination of this BAA. Such notice will set forth the
circumstances that Associate believes makes the return or destruction of PHI
infeasible and the alternative measures that Associate recommends for assuring
the continued confidentiality and security of the PHI. NOAH promptly will notify
Associate of whether it agrees that the return or destruction of PHI is infeasible. If
NOAH agrees that return or destruction of PHI is infeasible, Associate agrees to
extend all protections, limitations and restrictions of this BAA to the PHI retained
after termination of this BAA and to limit further uses or disclosures to those
purposes that make the return or destruction of the PHI infeasible. Any such
extended protections, limitations and restrictions will apply to any Subcontractors
of Associate for whom return or destruction of PHI is determined by NOAH to be
infeasible. If NOAH does not agree that the return or destruction of PHI from
Associate or its Subcontractors is infeasible, NOAH will provide Associate with
written notice of its decision, and Associate and its Subcontractors will proceed
with the return or destruction of the PHI pursuant to the terms of this Section within
fifteen (15) days of the date of NOAH’s notice.
14.
TERMINATION. NOAH and Associate may immediately terminate this BAA upon
written notice to the other Party if NOAH or Associate determines in its discretion
that the other Party has breached a material term of this BAA. Alternatively, the
non-breaching Party may elect to provide the breaching Party with thirty (30) days’
advance written notice of the breaching Party's breach of any term or condition of
this BAA, and afford the breaching Party the opportunity to cure the breach to the
satisfaction of the non-breaching Party within twenty (20) days of such notice. If
the breaching Party fails to timely cure the breach, as determined by the non-
Breaching Party, the BAA will terminate this BAA as provided in the non-breaching
Party's notice. This BAA will automatically terminate upon expiration or termination
of the last effective Agreement between the Parties, unless the Parties explicitly
agree in writing to extend the term of this BAA beyond the expiration or termination
of the last effective Agreement.
15.
ASSOCIATE BOOKS AND RECORDS.
a. NOAH Access. Following a Security Event, or for purposes of NOAH responding
to a government inquiry or judicial or administrative process, Associate will, within
five (5) business days of NOAH’s written request, make available during normal
business hours at Associate’s offices, all records, books, agreements, policies and
procedures relating to the use or disclosure of PHI for the purpose of allowing
NOAH to determine Associate’s compliance with the Agreement and this BAA.
b. Government Access. Associate will make its internal practices, books and
records on the use and disclosure of PHI available to the Secretary to the extent
required for determining compliance with the Privacy Rule. Notwithstanding this
provision, no attorney-client, accountant-client or other legal privilege will be
deemed waived by Associate or NOAH as a result of this Section. Associate shall
also make its policies and procedures, and documentation required by the Security
Rule relating to the safeguards in Section 2, available to the Secretary for purposes
of determining NOAH's and Associate’s compliance with the Security Rule.
16.
NOTICES.
a. Any notices required under this BAA will be sent to the Parties at the following
address by first class mail, fax or hand delivery:
NOAH:
Associate:
Contracts Department
Maricopa County Department of Public Health
7500 N Dream Draw Dr. Suite 145
4041 N. Central Ave. Suite 1400
Phoenix, AZ 85020
Phoenix, AZ 85012
Fax: 602-314-5771
Fax: 602-506-6885
Attn: Contracts Specialist
Attn: Grants/Contracts Administrator
b. Any notice, report or other communication required under this BAA shall be in
writing and shall be delivered personally, telegraphed, emailed, sent by facsimile
transmission, or sent by U.S. mail.
17.
MISCELLANEOUS.
a. Relationship of Parties. In the performance of the work, duties and obligations
described in this BAA or the Agreement, the Parties acknowledge and agree that
each Party is at all times acting and performing as an independent contractor and
at no time shall the relationship between the Parties be construed as a partnership,
joint venture, employment, principal / agent relationship, or master / servant
relationship.
b. Regulatory References. A reference in this BAA to a section in the HIPAA Rules
means the section as in effect or as amended and for which compliance is required.
c. Amendment. No change, amendment, or modification of this BAA shall be valid
unless set forth in writing and agreed to by both Parties. Notwithstanding the
foregoing, the Parties acknowledge that state and federal laws relating to
electronic data security and privacy are rapidly evolving and that amendment of
this BAA may be required to ensure compliance with such developments. The
Parties specifically agree to take such action as may be necessary from time to
time for the Parties to comply with the requirements of the HIPAA Rules and
HITECH. NOAH shall provide written notice to Associate to the extent that any
final regulation or amendment to the HIPAA Rules promulgated by the Secretary
requires an amendment to this BAA. The Parties agree to negotiate an
amendment to this BAA in good faith; however, either Party may terminate this
BAA upon ninety (90) days written notice to the other Party if the Parties are unable
to reach an agreement.
d. Interpretation. Any ambiguity in this BAA shall be resolved to permit NOAH and
Associate to comply with the HIPAA Rules and HITECH. The provisions of this
BAA shall prevail over any provisions in the Agreement that may conflict or appear
inconsistent with any provision in this BAA, provided that any provision in the
Agreement that is more stringent or protective of PHI than the terms of this BAA
shall govern.
IN WITNESS WHEREOF, each Party has cause this BAA to be executed by its
duly authorized representative.
NOAH:
ASSOCIATE:
By:
By:
Print Name: Wendy Armendariz
Print Name:
Title: Chief Executive Officer
Title:
Date:
Date:
Wendy Armendariz (Sep 2, 2022 14:48 PDT)
Wendy Armendariz
09/02/22
ATTEST:
Office of the Clerk of the Board
Date
APPROVE AS TO FORM:
Attorney for Maricopa County
Date