SIG BLOCK MOU - HU156031 - DSA - MARICOPA COUNTY FINAL FOR SIGNATURE.PDF
Extracted text (via pymupdf)
53517 characters
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 1 of 31
MEMORANDUM OF UNDERSTANDING
FOR THE SHARING OF PUBLIC HEALTH DATA
BETWEEN
THE ARIZONA DEPARTMENT OF HEALTH SERVICES
AND
MARICOPA COUNTY DEPARTMENT OF PUBLIC HEALTH
WHEREAS, the Arizona Department of Health Services (ADHS) is a division of the State of
Arizona established to promote and protect public health and welfare through the operation of
health related programs within the state.
WHEREAS, the Maricopa County Department of Public Health (MCDPH) is a federally
recognized Public Health Authority, pursuant to the requirements of the Health Insurance
Portability and Accountability Act of 1996 (Pub. L. 104-191) (HIPAA) and applicable law,
established to promote and protect the public health and welfare of Native American Tribal
entities and people through the operation of health-related programs within the United States.
WHEREAS, ADHS and MCDPH recognize the need to set forth and define the terms under
which ADHS will provide data files to MCDPH containing public health records for the
development of community health profiles and other general public health surveillance activities
and Public Health Practice performed by MCDPH.
NOW, THEREFORE, in consideration of the mutual promises and representations set forth in
this Memorandum of Understanding (MOU), MCDPH and ADHS mutually agree as follows:
1.
DEFINITIONS. Capitalized terms used herein shall have the meanings set forth in
this Section one (1).
1.1 "Authorized Persons" means: ADHS and MCDPH employees or contractors who
have a need to know or otherwise access protected information including Personally
Identifying Information to enable ADHS and MCDPH to perform their missions in
conformance with the requirements of state statutes, rules, and this MOU; and who are
bound in writing by confidentiality obligations sufficient to protect all protected
information including Personally Identifying Information in accordance with the terms
and conditions of this MOU and applicable law.
1.2 “Confidential Information” means information that is protected from unauthorized
disclosure based on laws, regulations, and other legal agreements. For purposes of
this MOU, it includes Personally Identifying Information, Protected Health Information,
and Public Health Data.
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 2 of 31
1.3. "Personally Identifying Information" means: information provided by ADHS to
MCDPH, or by MCDPH to ADHS that: (i) identifies or can be used to identify an
individual (including, without limitation, names, signatures, addresses, telephone
numbers, e-mail addresses and other unique identifiers); or (ii) can be used to
authenticate an individual (including, without limitation, employee identification
numbers, government-issued identification numbers, passwords or PINs, financial
account numbers, credit report information, biometric or health data, answers to
security questions and other personal identifiers). ADHS’ business contact information
is not by itself deemed to be Personal Information.
1.4. “Public Health Data” means: health information organized and maintained by ADHS
or by MCDPH that is received under applicable law, including, but not limited to,
patient names, mailing addresses and geocodes, dates of birth and death, gender,
race, ethnicity, discharge status, disease codes, procedures performed and other
information reported to ADHS or MCDPH under applicable law. The elements of data
shared and specific restrictions of their use under this MOU are fully described in sub-
section 2.2, (Scope) and section nineteen (19), (Data Use and Ownership).
1.5. “Public Health Practice” means interventions designed solely to enhance the well-
being of the specific subject population identified in this MOU, and which have
reasonable expectation of success.
1.6. “Quality Assurance (QA)” means: activities that are established for the purposes of
reducing morbidity and mortality and for improving the quality of health care and/or for
encouraging proper utilization of healthcare services and facilities through the review
of the qualifications, professional practices, training, experience, patient care,
conduct, processes, or data of licensed health care providers.
1.7. “Research” means: a systematic investigation, including research development,
testing and evaluation, designed to develop or contribute to generalizable knowledge.
Activities which meet this definition constitute research for purposes of this MOU,
whether or not they are conducted or supported under a program which is considered
research for other purposes. For example, some demonstration and service programs
may include research activities.
1.8. "Security Breach" means: (i) any act or omission that materially compromises
either the security, confidentiality or integrity of Personally Identifying Information or
the physical, technical, administrative or organizational safeguards put in place by
ADHS and MCDPH or any Authorized Persons that relate to the protection of the
security, confidentiality or integrity of Personal Information, or (ii) receipt of a
complaint in relation to the privacy practices of ADHS and MCDPH or any Authorized
Persons or a breach or alleged breach of this MOU relating to such privacy
practices.
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 3 of 31
1.9. “Statutory Public Health Authority - SPHA” means: an agency or authority of the
United States government, a State, a territory, a political subdivision of a State or
territory, or Indian tribe that is responsible for public health matters as part of its
official mandate, as well as a person or entity acting under a grant of authority from,
or under a contract with, a public health agency, including the employees or agents of
such public health agency or its contractors or persons or entities to whom it has
granted authority, that is responsibility for public health matters as part of its official
mandate. For the purposes of this agreement, ‘SPHA’ refers to both ADHS and
MCDPH.
2.
PURPOSE AND SCOPE OF AGREEMENT
2.1. Purpose
Subject to availability of data and resources, ADHS and MCDPH agree to provide one
another with Public Health Data as defined in section 2.2.1 of this MOU in a mutually
agreeable format.
2.2. Scope
Subsection 2.1 notwithstanding, the Parties agree that ADHS and MCDPH do not
require, and shall not provide (except upon specific request) data files containing any
of the following information related to any individual county resident: (i) signatures,
telephone numbers, e-mail addresses; (ii) employee identification numbers,
passwords or PINs, credit report information, answers to security questions and other
similar personal identifiers; (iii) individual's government-issued identification number
(including driver's license number or state-issued identified number); and (iv)
financial account number, credit card number, debit card number, credit report
information, with or without any required security code, access code, personal
identification number or password, that would permit access to an individual’s
financial account or accounts.
2.2.1.
Selection Criteria
ADHS will select records for inclusion and release to MCDPH if the record
meets any of these criterion: for residents within the jurisdictional boundary
of MCDPH, or which has been submitted by a facility within the
jurisdictional boundary of MCDPH, or human remains transported within the
jurisdictional boundary of MCDPH. Data elements that ADHS will provide in
the data sets may include any data element permitted by this MOU and that
is specifically requested by MCDPH for inclusion.
2.2.2.
Data Requests
To request data the requesting Agency shall submit a list of the Authorized
Persons who shall receive or have access to data shared under this MOU
to the Agency holding the data, along with specific data elements requested
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 4 of 31
to be provided. Under this MOU both ADHS and MCDPH may request
updated data as needed. For data to be shared, both agencies must agree
to the sharing of data requested. Following initial release of data under this
MOU, ADHS or MCDPH may request updated data as needed.
2.2.3
Data Elements
The data that will be provided by ADHS to MCDPH or by MCDPH to ADHS
under this MOU include all those listed in the Table in Exhibit A, and as
further defined and limited within any other exhibit attached to this MOU.
2.2.4 Data Transfer Methods
The method of data sharing will be in a manner agreeable to ADHS and
MCDPH, and which meets the requirements of ADHS and MCDPH to
assure the security of the data as follows:
2.2.4.1 Encrypted file transfer using Secure File Transfer Protocol
(SFTP). The data file will be posted to a web accessible ADHS
server by ADHS, where it can be accessed only by MCDPH.
The MCDPH staff designated to access the SFTP file transfer
site must be Authorized Persons for the data element(s) they
receive, and must use an ADHS issued user id and secure
password to access the SFTP site.
2.2.4.2
Direct Access to ADHS application software (front end) or
database tables (back end) by MCDPH staff designated as
Authorized Persons for the data element(s) they are accessing.
To utilize this method of access, MCDPH must demonstrate that
the Information Technology network from which Authorized
Users will have Direct Access meets and maintains all applicable
data security requirements of ADHS and MCDPH.
2.3. Inadvertent Disclosure
In the event that ADHS or MCDPH is inadvertently provided with data files containing
any of the information listed in subsection 2.2, they will notify the agency sending the
data of the disclosure and delete or destroy such data files upon request.
3.
NO SUPERSESSION OF PAST AGREEMENTS
This MOU is intended to and shall supersede or replace any currently valid MOU in place
between ADHS and MCDPH regarding the sharing of Public Health Data identified under
Exhibit A of this MOU.
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 5 of 31
4.
TERM OF THE AGREEMENT
The Term of this MOU shall commence upon signature of both parties and shall
continue for a period of five (5) years thereafter, unless terminated, or canceled as
otherwise provided herein.
5.
CONTRACT EXTENSION
This MOU shall not exceed a total of five (5) years from the effective date of the MOU.
6.
TERMINATION
6.1. This MOU remains in effect as provided in Sections four (4) and five (5) or until the
MOU is otherwise terminated under the following terms and conditions:
6.1.1. Termination without Cause
Both ADHS and MCDPH may terminate this MOU at any time with thirty
(30) calendar days’ notice, in writing, specifying the termination date. Such
notices shall be given by personal delivery or by certified mail, return receipt
requested.
6.1.2. Termination for Default
The ADHS and MCDPH reserve the right to terminate the MOU in whole or in
part due to the failure of the other Agency to comply with any material
obligation, term or condition of this MOU. Both Agencies agree to provide
written notice detailing the area of alleged lack of compliance or non-
performance and to provide thirty (30) days to correct the alleged lack of
compliance or non-performance prior to termination for default.
6.1.3. Cancellation for Conflict of Interest
Pursuant to A.R.S. § 38-511, ADHS and MCDPH may cancel this MOU
within three (3) years after MOU execution without penalty or further
obligation if any person significantly involved in initiating, negotiating,
securing, drafting or creating this MOU becomes at any time while the
MOU or an extension of the MOU are in effect, an employee of or a
consultant to the other party to this MOU with respect to the subject matter of
the MOU. The cancellation shall be effective upon receipt of the written
notice of cancellation, unless the notice specifies a later time.
7.
SECURITY OF CONFIDENTIAL INFORMATION
7.1. ADHS and MCDPH shall monitor the use of all Public Health Data disclosed under
this MOU, including but not limited to Personal Identifying Information, and to carefully
restrict the use and disclosure of such information as provided for herein.
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 6 of 31
7.2. Survival of Duty to Protect Confidential Information
It is understood and agreed by the Parties that the obligations set forth in this
Section seven (7), shall survive the expiration or termination of this MOU, except as
expressly provided for herein.
7.3. Minimum Safeguards for PHI
ADHS and MCDPH shall carefully restrict use and access to Personally Identifying
Information shared under this MOU solely to Authorized Persons and shall ensure
that the following minimum safeguards to prevent a Security Breach in a manner
consistent with the requirements of this MOU or applicable law. These safeguards
shall, at the minimum, require that ADHS and MCDPH and their Authorized Persons:
7.3.1. Prohibit Personally Identifying Information supplied under the terms of this
MOU from being released or disclosed to anyone not working at ADHS or
MCDPH as an Authorized Person.
7.3.2. Ensure that any Authorized Persons, including any agent, or subcontractor to
ADHS or MCDPH, to whom ADHS or MCDPH provides confidential
information, or Personally Identifying Information under this MOU, agrees to
the same restrictions and conditions that apply through this MOU to ADHS and
MCDPH with respect to such information.
7.3.3. Secure all printouts containing individual identifiers or confidential data in a
locked vault, file cabinet or other method reasonably necessary to protect
the confidential information.
7.3.4. Store all data shared under this MOU only on secured servers or encrypted
devices within ADHS or MCDPH. At the termination of this MOU, all data
shared under this MOU shall be securely deleted consistent with the
requirements of this MOU and applicable law.
7.3.5. Provide one another with a description of the security measures that are in place to
maintain the confidentiality of the data being received under this MOU. ADHS
and MCDPH will consider the items described in the document titled "Security
Considerations
for
Applicants"
prepared
by
the
ADHS
HSRB
(https://www.azdhs.gov/documents/director/administrative-counsel-rules/HSRB_SecurityChecklist.pdf).
7.3.6. ADHS and MCDPH will provide to one another upon request, a current list of
Authorized Persons, and evidence that all Authorized Persons who have
access to the Public Health Data shared under this MOU have participated in
any required training and signed any documents that are necessary to keep
both ADHS and MCDPH in compliance with HIPAA, including but not limited
to, Business Associate Agreement, user confidentiality affirmation statement,
HIPAA training certification or other HIPAA related compliance documents, if
applicable.
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 7 of 31
7.3.7. Provide or continue to provide one another with a copy of procedures for
notification of any Security Breach, which shall include a requirement that any
user of the Public Health Data shared under this MOU shall immediately notify
a designated individual at the agency which owns the data of any known or
reasonably suspected Security Breach.
7.3.8. Maintain a log of all encrypted devices and identification numbers of those
devices that are authorized to transmit, receive or store the Public Health Data
shared under this MOU, until the data is destroyed. ADHS and MCDPH may
request a copy of the log at any time during the term of the MOU or until the
data is destroyed.
7.3.9. Make clear to all Authorized Persons and other ADHS and MCDPH
employees with a need to know that they are prohibited from storing Public
Health Data on non-encrypted flash drives, CDs, external drives, smart
phones or other non- networked hard drives.
7.3.10.Provide to the Agency that owns the data prompt proof of the complete
destruction of the original data and any copies or subsidiary data sets
containing Personally Identifying Information that are developed from the
original data upon the conclusion of this MOU or at such time that such
destruction is required by applicable law and in accordance with the agreed
retention schedule in the Exhibit A table of this MOU.
7.3.11.Take all reasonable steps to ensure that Authorized Persons who have access
to the Public Health Data shared under this MOU shall maintain the same in
strict confidence after the termination of this MOU; provided that ADHS and
MCDPH’s obligations hereunder shall not apply to information that:
7.3.11.1.1. Was already known to the receiving party prior to the time of
first disclosure, as demonstrated by contemporaneous, written
documentation; or
7.3.11.1.2. Is received without any obligation of confidentiality from a third
party having a legal right to disclose the same; or
7.3.11.1.3. Is independently developed by the receiving party by individuals
without access to such information, as demonstrated by
contemporaneous, written documentation.
7.3.12 As mandated under ARS 36-302(B)3, which prohibits the organization,
operation, or maintenance of any alternative system of vital records, data
shared under this agreement shall not be retained longer than the term
specified under the Exhibit A table for that item, and the custodial agency
holding the data agrees to provide a Certificate of Destruction to the data
owner Agency upon destruction of shared data.
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 8 of 31
7.3.13 ADHS and MCDPH shall not release data shared under this agreement, or
disclose information contained in data records shared under this agreement, in
response to any legally enforceable order, subpoena, or other regulation
(ORDER), without giving the other Agency notice and an opportunity to discuss
and or object to the production. All legally enforceable orders, subpoenas, or
other regulations (ORDERS) received by the custodian of data shared under
this agreement will be referred immediately its legal counsel and the legal
counsel of the data owner agency for consideration. It is the intent of this
provision that the two Agencies will cooperate and discuss the merits of
producing and/or objecting to the release of any data covered by this
agreement before any data is released by either Agency.
7.4. Security Breach
In the event of a Security Breach, pursuant to A.R.S. § 44-7601, A.R.S § 18-545
and any other applicable law, ADHS and MCDPH agree to collaborate with each
other on the investigation, mitigation, remediation and, if necessary, breach
notification of citizens. Pursuant to A.R.S. § 41-3507, ADHS and MCDPH shall
notify the Arizona Strategic Enterprise Technology (ASET) Statewide Information
Security and Privacy Office (SISPO) immediately upon becoming aware or receiving
notice of a Security Breach.
8.
NON-DISCRIMINATION
The Parties shall comply with Executive Order 75-5 as modified by Executive Order
2009-09, which mandates that all persons, regardless of race, color, religion, sex, age,
national origin or political affiliation, shall have equal access to employment
opportunities, and all other applicable State and Federal employment laws, rules, and
regulations, including the Americans with Disabilities Act. The Parties shall take
affirmative action to ensure that applicants for employment and employees are not
discriminated against due to race, creed, color, religion, sex, national origin or disability.
9.
RECORDS AND RIGHT OF INSPECTION
Under A.R.S. § 35-214 and § 35-215, ADHS and MCDPH shall retain all data and
other records (“records”) relating to the MOU for no longer than the specified data
destruction schedule for each item specified in the Exhibit A table after the completion of
the MOU, and shall provide a certificate of destruction to the data owner when the data
are destroyed. All records held by ADHS or MCDPH that were received under
this MOU shall be subject to inspection and audit by the agency that shared them at
reasonable times. ADHS and MCDPH agree to mutually provide the right of access to
those servers or drives used for the storage of Personally Identifying Information, at
reasonable times, in order to monitor and evaluate performance, compliance, and/or
Quality Assurance under this MOU.
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 9 of 31
10. ARBITRATION
The parties to this MOU agree to resolve all disputes arising out of or relating to this
MOU, after exhausting applicable administrative review, through arbitration to the extent
required by A.R.S. §12-1518.
11. AMENDMENT OR MODIFICATIONS
No amendment or modifications to this MOU, including any amendment or modification
of this Section, shall be effective unless the same is in writing signed by the Parties.
12. ARIZONA LAW
The law of Arizona applies to this MOU.
13. RELATIONSHIP OF PARTIES
ADHS and MCDPH warrant that they are acting as independent Agencies under this
MOU. Neither party to this MOU shall be deemed to be the employee or agent of the
other party to the MOU.
14. SEVERABILITY
The Provisions of this MOU are severable. Any term or condition deemed illegal or
invalid shall not affect any other term or condition of the MOU.
15. NO PAROLE EVIDENCE
This MOU is intended by the parties to be a final and complete expression of their
agreement. No course of prior dealings between the parties and no usage of the
trade shall supplement or explain any terms used in this document.
16. NO WAIVER
Either Party’s failure to insist on strict performance of any term or condition of the MOU
shall not be deemed a waiver of that term or condition even if the party accepting or
acquiescing in the nonconforming performance knows of the nature of the performance
and fails to object to it.
17. HEADINGS
Headings are for organizational purposes only and shall not be interpreted as having legal
significance or meaning.
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 10 of 31
18. ADVERTISING AND PROMOTION OF CONTRACT
ADHS and MCDPH shall not advertise, publish, or re-release any information for
commercial benefit concerning this MOU without the prior written approval of the
Procurement Officer of the sharing Agency, and the ADHS Human Subject Review Board
(HSRB).
19. DATA USE AND OWNERSHIP
19.1 Each agency will use data shared under this MOU exclusively for approved activities
mutually agreed by the parties to this MOU.
19.2 Proposed use of data shared under this MOU for Research shall first be reviewed
and approved by a mutually agreed designated institutional review body (IRB or
HSRB). If it is unclear to either party to this MOU whether the data use is Research or
public health practice or both, then a clarification shall be requested from the
designated institutional review body (IRB or HSRB).
19.3 ADHS or MCDPH activities using the data shared under this MOU that generate
external papers, or publications for dissemination outside of the custodial agency
must have specific written review and clearance from the data owner before release.
Requests for review and clearance shall be responded to within a reasonable time,
and no later than thirty (30) calendar days.
19.4 The agency that owns the data as shown in the Exhibit A table under this MOU shall
be cited as the source of the data in tables, reports, presentations, and scientific
papers, and the publishing agency or its corresponding authors shall be cited as the
source of interpretations, calculations, or manipulations of data.
19.5 The agency that owns the data as shown in the Exhibit A table under this MOU retains
exclusive ownership of the data shared with the receiving agency except as described
under subsection 19.7 of this MOU. Any release, or modified re-release of data
shared under this MOU that is not specifically allowed under section 7.3.11 of this
MOU requires prior approval by the agency that owns the data.
19.6 Any legal order or subpoena received by an agency in custody of data owned by the
other agency, and regarding data owned by the other agency, shall immediately refer
the orders or subpoenas to the legal counsel of the agency that owns the data, and
shall take no actions, and make no decisions regarding the order or subpoena except
as first directed by legal counsel of the data owner. The agency in custody may
object to producing the data required under the legal order or subpoena.
19.7 In the case that data ownership in section 2.2.3 of this MOU is designated to MCDPH
in the Exhibit A Table, but the data are held in an ADHS system (such as MEDSIS),
then the data become the exclusive ownership of MCDPH when downloaded or
extracted from the ADHS system in which the data are held.
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 11 of 31
20.
NOTICES, CORRESPONDENCE AND REPORTS
20.1. Notices, correspondence and reports from MCDPH to ADHS shall be sent to:
Arizona Department of Health Services
Attn. Public Health Data Sharing, Bureau of Public Health Statistics
150 N. 18th Avenue, Suite 550
Phoenix, AZ 85007
Phone: (602) 542-8064
20.2. Notices, correspondence, and reports from ADHS to MCDPH shall be sent to:
Maricopa County Department of Public Health
Attn: Marcy M. Flanagan, DBA, Director
4041 North Central
Suite 1400
Phoenix, Arizona 85012
Phone: (602) 506-6601
Signatures/Approvals:
For Maricopa County:
For Arizona Department of Health Services:
__________________________________
Bill Gates, Chairman
Board of Supervisor
Chief Procurement Officer or Designee
Date:
Date:
ATTEST:
_____________________________
Clerk of the Board Date
APPROVE AS TO FORM:
_______________________________
Attorney for County Date
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 12 of 31
EXHIBIT A – TABLE 1 – PUBLIC HEALTH DATA SHARED UNDER THE MOU
DATA SET
PII
PHI
Principle
Custodial
Program
Data
Owner
Allowed
Purpose
HSRB
Attachments
Retention
Vital Records
Confidential
Birth Data
Y
Y
MCDPH
ADHS
Public
Health Use
ADHS
Exhibit B*
5 year limit from
date of receipt
Vital Records
Confidential
Death Data
Y
Y
MCDPH
ADHS
Public
Health Use
ADHS
Exhibit C*
5 year limit from
date of receipt
Vital Records Fetal
Death
Y
Y
MCDPH
ADHS
Public Health
Use
ADHS
Exhibit D*
5 year limit from
date of receipt
Hospital
Discharge
Limited Data
Sets (ED and
IP)
Y
Y
MCDPH
ADHS
Public
Health Use
ADHS
Exhibit E*
5 year limit from
date of receipt
BRFSS
Y
N
MCDPH
ADHS
Public Health
Qualifying
Activity
ADHS
Exhibit F*
5 year limit from
date of receipt
MEDSIS Infectious
Disease Data
Y
Y
MCDPH
MCDPH
Public Health
Qualifying
Activity
MCDPH
Exhibit G*
None
Sexually
Transmitted
Diseases Data
(PRISM)
Y
Y
MCDPH
MCDPH
Public Health
Qualifying
Activity
MCDPH
Exhibit H*
None
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 13 of 31
DATA SET
PII
PHI
Principle
Custodial
Program
Data
Owner
Allowed
Purpose
HSRB
Attachments
Retention
Immunization Data
Y
Y
MCDPH
ADHS
Public Health
Qualifying
Activity
ADHS
Exhibit I*
5 year limit from
date of receipt
HIV Data (EHARS)
Y
Y
MCDPH
ADHS
Public Health
Qualifying
Activity
ADHS
Exhibit J*
5 year limit from
date of receipt
Arizona State
Trauma Registry
Data
Y
Y
MCDPH
ADHS
Public Health
Qualifying
Activity
ADHS
Exhibit K*
5 year limit from
date of receipt
Tuberculosis
Surveillance Case
Data
Y
Y
MCDPH
MCDPH
Public Health
Qualifying
Activity
including case
intervention
MCDPH
Exhibit P*
None
MEDSIS Non-
Infectious Disease
Data
Y
Y
MCDPH
MCDPH
Public Health
Qualifying
Activity
MCDPH
Exhibit Q*
None
MEDSIS
Environmental
Exposure Data
Y
Y
MCDPH
MCDPH
Public Health
Qualifying
Activity
MCDPH
Exhibit R*
None
*attachments specify which elements of each data set are shared, and may be revised from time to time through amendment of this MOU
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 14 of 31
EXHIBIT B
ARIZONA VITAL RECORDS BIRTH DATA
Allowable Purpose:
Data are allowed to be exchanged by ADHS and MCDPH for conducting Public Health practice, Public
Health Surveillance, Quality Assurance, and approved research activity. Specific research projects must
be approved as described in this MOU.
Limitations on Data Use:
Data may only be used as described above, no identifiable information may be published, no contact
may be attempted with agencies or individuals contained in the data unless approved as described
above.
Principle Contacts:
Arizona Department of Health Services
Bureau of Vital Records – Bureau of Public Health Statistics
150 N 18th Avenue, Suite 581
Phoenix, AZ, 85007
Phone: (602) 364-3048
Frequency of Data Release:
PII Year-To-Date data file provided via encrypted Secure File Transfer Protocol (SFTP) or PII data
provided through direct database link on a scheduled frequency as requested by MCDPH. A designated
contact at MCDPH will be granted credentials for SFTP access to the ADHS SFTP server to facilitate
data transfer, or a direct access link and query defined to pull data appropriate for the county.
Yearly, after the final vital records Birth non-PII data file has been closed, cleaned, and finalized, typically
by the first day of August.
Selection Criteria:
As agreed by ADHS and MCDPH that data shared will be limited to records that match the selection
criteria described in section 2.2.1 of this MOU.
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 15 of 31
EXHIBIT C
ARIZONA VITAL RECORDS DEATH DATA
Allowable Purpose:
Data are allowed to be exchanged by ADHS and MCDPH for conducting Public Health practice, Public
Health Surveillance, Quality Assurance, and approved research activity. Specific research projects must
be approved as described in this MOU.
Limitations on Data Use:
Data may only be used as described above, no identifiable information may be published, no contact
may be attempted with agencies or individuals contained in the data unless approved as described
above.
Principle Contacts:
Arizona Department of Health Services
Bureau of Vital Records – Bureau of Public Health Statistics
150 N 18th Avenue, Suite 581
Phoenix, AZ, 85007
Phone: (602) 364-3048
Frequency of Data Release:
PII Year-To-Date data file provided via encrypted Secure File Transfer Protocol (SFTP) or PII data
provided through direct database link on a scheduled frequency as requested by MCDPH. A designated
contact at MCDPH will be granted credentials for SFTP access to the ADHS SFTP server to facilitate
data transfer, or a direct access link and query defined to pull data appropriate for the county.
Yearly, after the final vital records Death non-PII data file has been closed, cleaned, and finalized,
typically by the first day of August.
Selection Criteria:
As agreed by ADHS and MCDPH that data shared will be limited to records that match the selection
criteria described in section 2.2.1 of this MOU.
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 16 of 31
EXHIBIT D – VITAL RECORDS FETAL DEATH DATA SET
Allowable Purpose:
Data are allowed to be exchanged by ADHS and MCDPH for conducting Public Health practice, Public
Health Surveillance, Quality Assurance, and approved research activity. Specific research projects must
be approved as described in this MOU.
Frequency of Data Sharing:
PII Year-To-Date data file provided via encrypted Secure File Transfer Protocol (SFTP) or PII data
provided through direct database link on a scheduled frequency as requested by MCDPHA designated
contact at MCDPH will be granted credentials for SFTP access to the ADHS SFTP server to facilitate
data transfer, or a direct access link and query defined to pull data appropriate for the county.
Yearly, after the final vital records Death non-PII data file has been closed, cleaned, and finalized,
typically by the first day of August.
Principle Contacts:
Arizona Department of Health Services
Bureau of Vital Records – Bureau of Public Health Statistics
150 N 18th Avenue, Suite 581
Phoenix, AZ, 85007
Phone: (602) 364-3048
Selection Criteria:
As agreed by ADHS and MCDPH that data shared will be limited to records that match the selection
criteria described in section 2.2.1 of this MOU.
MEMORANDUM OF UNDERSTANDING (MOU)
No.: HU156031
Page 17 of 31
EXHIBIT E - ARIZONA HOSPITAL DISCHARGE DATA – Standard Limited Data Set
Allowable Purpose:
Data are allowed to be exchanged by ADHS and MCDPH for conducting Public Health practice, Public
Health Surveillance, Quality Assurance, and approved research activity. Specific research projects must
be approved as described in this MOU.
Limitations on Data Use:
Data may only be used as described above, no identifiable information may be published, no contact
may be attempted with agencies or individuals contained in the data unless approved as described
above.
Principle Contacts:
Arizona Department of Health Services
Bureau of Public Health Statistics Hospital and Cost Reporting Program
150 N 18th Avenue, Suite 581
Phoenix, AZ, 85007
Phone: (602) 364-3048
All Fields to be shared.
Frequency of Data Release:
Semi-Annually, after the final HDD limited data file has been finalized, typically by the mid-April, and mid-
October each year.
Selection Criteria:
As agreed by ADHS and MCDPH , HDD data shared under this MOU will not be limited as prescribed in
section 2.2.1, but will include all records in the standard HDD limited data set, and will require
compliance with the standard data release agreement terms and conditions.
Page 18 of 31
MEMORANDUM OF UNDERSTANDING
MOU# HU156031
EXHIBIT F – BRFSS LIMITED DATA SET
Fields Shared:
All contained within the limited data set, including 5 digit zip code, and PCA assignment, but excluding
nearest intersection responses or geocoding.
•
All core and state-only survey question responses will be included in the data set shared with
MCDPH.
•
ADHS and MCDPH will collaborate to review and redact responses as needed to protect
respondent confidentiality when producing any analyses below the county level.
•
ADHS will assist MCDPH as needed to develop and assign each survey response to all
geographic regions below the county level as requested by MCDPH.
•
Neither the residence zip code value, nor PCA assignment of nearest intersection response are
to be released by MCDPH to third parties.
•
The county may release all fields contained in the public data set to third parties.
•
Publications of sub-county level estimates will present aggregated data only.
•
ADHS and MCDPH shall agree on a cell suppression policy for small number cell counts to be
applied in small area estimate reporting.
Frequency of Data Sharing:
Annual Data file provided via encrypted Secure File Transfer Protocol (SFTP). Data files are generally
available for the prior year survey between August and October.
Allowable Data Uses:
Public Health uses including surveillance, assessments, quality controls, interventions, and other public
health related activity.
Page 19 of 31
MEMORANDUM OF UNDERSTANDING
MOU# HU156031
EXHIBIT G – MEDSIS Communicable Disease Data
Time Frame and Scope of Data Shared:
All data in MEDSIS for residents within the jurisdiction of MCDPH, and events reported into MEDSIS by
medical providers located within the jurisdiction of MCDPH.
Data Fields Shared:
All fields shared.
Frequency of Data Sharing:
Real-time continuous access to the MEDSIS production data. Sharing of reportable health event
(MEDSIS) data is facilitated by granting access to MEDSIS to authorized persons designated by MCDPH
to have such access.
Method of Data Transfer:
Data is maintained and protected by ADHS while it is resident on the ADHS MEDSIS server. MCDPH
becomes the owner of all data downloaded from the ADHS MEDSIS server by MCDPH, and becomes
responsible to maintain and protect the downloaded data.
Allowable Data Uses:
All uses allowable under applicable law as determined by MCDPH. For Research uses, MCDPH may
use an Institutional Review Board of choice to oversee the protection of human ethics/privacy rights in
data use.
Page 20 of 31
MEMORANDUM OF UNDERSTANDING
MOU# HU156031
EXHIBIT H – SEXUALLY TRANSMITTED DISEASE DATA (PRISM)
Time Frame and Scope of Data Shared:
All data in PRISM for residents within the jurisdiction of MCDPH, and events reported into PRISM by
medical providers located within the jurisdiction of MCDPH. Exception: cases or their contacts from
other jurisdictions may be viewed by MCDPH only during relevant case investigations.
Data Fields Shared:
All fields shared, dependent upon user permission level.
Frequency of Data Sharing:
Real-time continuous access to the PRISM production data. Sharing of reportable health event (PRISM)
data is facilitated by granting access to PRISM to authorized persons designated by MCDPH to have
such access.
Method of Data Transfer:
Data is maintained and protected by ADHS while it is resident on the ADHS PRISM server. MCDPH
becomes the owner of all data downloaded from the ADHS PRISM server by MCDPH, and becomes
responsible to maintain and protect the downloaded data.
Allowable Data Uses:
Public Health uses including surveillance, assessments, quality controls, interventions, and other public
health related activity. All uses must abide by terms defined under Section 19 Data Use and Ownership
and all data security and confidentiality requirements mentioned therein. For research uses, MCDPH
may use an institutional review board of choice to oversee the protection of human ethics/privacy rights
in data use.
Data Requests: Prism reporting functions are limited. MCDPH may request data using the STD Data
Request Protocol and applications shown below:
STD Data Request Protocol
Purpose
The Purpose of this protocol is to outline procedures around the receipt of data requests from internal
and external partners while upholding best practices for data security and confidentiality.
Page 21 of 31
MEMORANDUM OF UNDERSTANDING
MOU# HU156031
Resources
•
Data Request Form: This form can be used by internal and external partners for a one-time data
request. If the requestor is asking for data outside of their jurisdiction, then the form will also
need to be signed by the appropriate representative (e.g. county or tribal level data).
•
Data Sharing Request: This form is to be used for any transmission of data that will be
repeated (i.e. weekly line lists, annual counts for a defined population, etc.). This must be signed
by the organization and by the STD Control Program Manager. If the requestor is asking for data
outside of their jurisdiction, then the form will also need to be signed by the appropriate
representative (e.g. county or tribal level data).
•
Data Request Log: This log is for tracking one-time data requests
•
Summary of STD MOUs and DSAs: This log is for tracking current and former Data Sharing
Requests and MOUs.
Protocol
1. A data request can be received by phone, email, etc. When one is received, first verify who is
requesting the data;
a. If contacted by the media, please redirect the requestor to the Public Information Office
b. If contacted by the general public, please redirect them to the data available on our
website (azdhs.gov/std, STD Data Tab)
c. For all other partners, proceed to step 2.
2. Determine the scope of the request. If this is a one-time request, please refer to the Data Request
Form. If this is an ongoing request, please use the Data Sharing Request form.
a. If the requestor is asking for data outside of their jurisdiction, then the form will also need
to be signed by the appropriate representative. Examples:
i. A non-county health department is requesting county level data that is not
publically available: The county area manager will need to sign the data request
and be involved in discussions around how the data can and cannot be used.
ii. A tribe is requesting county level data that is not publically available: The county
area manager(s) will need to sign off on the data request and be involved in
discussions around how the data can and cannot be used.
3. Once the appropriate form has been completed, please send to the STD Control Program
Manager for approval.
4. Once approved, the STD Control Program Manager will save the request here and update the
appropriate log.
a. The Data Request Log is used for one time requests and the Summary of STD MOUs and
DSAs is used for data sharing agreements and MOUs.
b. One time requests are stored in a folder named by the year in which the data was
requested
c. Ongoing requests are grouped by the requestor (i.e. County, Tribe, nature of request) etc.
5. Maintain copies of all coding and the end product used to complete request and store them in the
appropriate subfolder here.
6. Be sure to notify the STD Control Program Manager when the request has been completed.
Page 22 of 31
MEMORANDUM OF UNDERSTANDING
MOU# HU156031
Data Request Form
Instructions:
This form is designed for persons requesting Arizona STD Surveillance Data from the ADHS STD Control
Program. Please fill out all components of this form to the best of your ability. Depending on the
complexity of the request, it can take a minimum of two weeks to process requests. If your organization
does not have a Data Sharing Agreement with ADHS, please submit this form with your company
letterhead.
Requestor Information:
Name
Title
Company/Organization
Email
Phone Number
Data Request:
What is the purpose for requesting this data?
Please describe what data is needed:
What disease(s)(if syphilis, indicate stages)
What timeframe (past decade/year/month)
What population (state/county/age/gender/etc.)
In what format would like you the data to be
prepared?
(i.e. graph, line list, table, etc.)
What steps will be taken to ensure data security
and confidentiality?
Page 23 of 31
MEMORANDUM OF UNDERSTANDING
MOU# HU156031
How will the data be delivered?
(i.e. secure email, uploaded to the Health Services
Portal, etc.)
How will the data be used, analyzed, published,
and/or distributed?
When is the data needed?
Please allow a minimum of 2 weeks to process your
data requests.
Once finished, please email this form to std@adhs.gov
Please note that all media request should be submitted directly to the ADHS Public Information Office
(http://azdhs.gov/director/public-information-office/index.php#contact-us).
Page 24 of 31
MEMORANDUM OF UNDERSTANDING
MOU# HU156031
ADHS STD Control Program
Description of Data Sharing Plan
Instructions:
This form is designed for persons requesting potentially identifiable data from the ADHS STD Control
Program on a regular basis. Please fill out all components of this form to the best of your ability.
Depending on the complexity of the request, it can take a minimum of two weeks to process requests.
ADHS reserves the right to deny any request that could jeopardize data security and/or confidentiality.
Requestor Information:
Name
Title
Company/
Organization
Email
Phone
Number
Data Request:
What is the purpose for requesting this data?
Please describe what data is needed:
1. What disease(s) (if syphilis, indicate stages)
2. What timeframe (past decade/year/month)
3. What population (state/county/age/gender/etc.)
In what format would like you the data to be
prepared?
(i.e., graph, line-list, table, etc.)
Page 25 of 31
MEMORANDUM OF UNDERSTANDING
MOU# HU156031
Is the proposed activity determined to be
consistent with all laws and regulations?
What steps will be taken to ensure data security
and confidentiality?
How will the data be delivered?
(Secure email or upload to the Health Services Portal are
recommended for potentially identifiable data)
How will the data be used, analyzed, published,
and/or distributed?
What physical and electronic security measures
are in place for transferring and storing the
data?
What are the potential risks and benefits of data
sharing?
When is the data needed?
Please allow a minimum of 2 weeks to process data
requests.
Please email completed form to std@adhs.gov
Requestor
STD Control Program Manager
Page 26 of 31
MEMORANDUM OF UNDERSTANDING
MOU# HU156031
EXHIBIT I – IMMUNIZATION DATA (ASIIS)
Time Frame and Scope of Data Shared:
All data in ASIIS for residents within the jurisdiction of MCDPH, and events reported into ASIIS by
medical providers located within the jurisdiction of MCDPH.
Data Fields Shared:
All fields shared.
Frequency of Data Sharing:
Real-time continuous access to the ASIIS production data. Sharing of immunization events (ASIIS) data
is facilitated by granting access to ASIIS to authorized persons designated by MCDPH to have such
access.
Method of Data Transfer:
In addition to ASIIS access, MCDPH may request HEDIS reports for specific entities by submitting
required information to the ADHS ASIIS Program Manager, and summary information will be produced
and released by secure transfer method agreed by ADHS and MCDPH.
Allowable Data Uses:
Public Health allowable activity as defined by HIPAA. Any research use must first be reviewed and
approved by the ADHS HSRB.
Page 27 of 31
MEMORANDUM OF UNDERSTANDING
MOU# HU156031
EXHIBIT J – HIV/AIDS SURVEILLANCE DATA (EHARS)
Time Frame and Scope of Data Shared:
All data in EHARS for residents within the jurisdiction of MCDPH, and events reported into ASIIS by
medical providers located within the jurisdiction of MCDPH. The HIV/AIDS data are of an exceptionally
sensitive and private nature, and for this reason close collaboration in sharing, using, and protecting
these data are appropriate as a condition of this sharing. Data access will be provided on a read-only
basis, and MCDPH will coordinate closely with ADHS HIV/AIDS Surveillance to assure data quality is
maintained, and that data are used in a manner that complies with all special CDC HIV/AIDS
Surveillance requirements and regulations. Otherwise federal HIV/AIDS surveillance funding to Arizona
might be jeopardized.
Data Fields Shared:
All fields shared.
Frequency of Data Sharing:
Real-time continuous access to the E-HARS production data on a read-only basis. Sharing of HIV/AIDS
surveillance (E-HARS) data is facilitated by granting limited access to E-HARS to authorized persons
designated by MCDPH to have such access.
Method of Data Transfer:
MCDPH and ADHS HIV/AIDS Surveillance will collaborate, and closely coordinate the exchange of
HIV/AIDS Surveillance data due to the extremely sensitive nature of the information it contains. ADHS
and MCDPH will use HIV/AIDS data shared under this agreement in a manner that fully complies with
usage and privacy restrictions defined by the HIV/AIDS branch of the CDC and required as a condition of
HIV/AIDS Surveillance grant funding to ADHS for the collection of these data. There will be no un-
authorized uses of HIV/AIDS data shared with MCDPH which have not been agreed to by both MCDPH
and ADHS.
Allowable Data Uses:
Public Health allowable activity as defined by HIPAA and conforming to the CDC Security and
Confidentiality Guidance and the responding ADHS Security & Confidentiality document. Any research
use must first be reviewed and approved by the ADHS HSRB.
Page 28 of 31
MEMORANDUM OF UNDERSTANDING
MOU# HU156031
EXHIBIT K – ARIZONA STATE TRAUMA REGISTRY (ASTR)
Time Frame and Scope of Data Shared:
Annual data files are shared once produced by ADHS. Typically the data annual data file has been
closed, cleaned, and finalized by the first day of August.
Data Fields Shared:
All data elements found in the ASTR FULL data set.
Limitations on Data Use:
Data may only be used for public health activity. No identifiable information may be published. No
contact may be attempted with agencies or individuals contained within the shared ASTR data unless
approved by ADHS.
Principle Contacts:
Arizona Department of Health Services
Bureau Chief, Bureau of EMS and Trauma System
150 N 18th Avenue, Suite 540
Phoenix, AZ, 85007
Phone: (602) 364-3149
Selection Criteria:
All events in the FULL Data Set which occurred within the jurisdiction of MCDPH, or which were reported by a
provider located within the jurisdiction of MCDPH.
Page 29 of 31
MEMORANDUM OF UNDERSTANDING
MOU# HU156031
EXHIBIT L – TUBERCULOSIS SURVEILLANCE CASE DATA
Allowable Purpose:
Data are exchanged by MCDPH and ADHS primarily for conducting public health interventions to
maintain continuity of care for persons diagnosed with TB, especially when they move across state or
county jurisdictions. Data may also be used for other allowable public health practice, including
surveillance, and research as a part of a joint public health initiative between MCDPH and ADHS.
Specific research projects must be approved as described in this MOU.
Limitations on Data Use:
Data may only be used as described above, for allowable public health interventions, surveillance, or as
part of a mutually agreed research project. Re-release of data is allowed by ADHS to other public health
statutory authorities, their designated agents, or governments of other nations for the sole purpose of
maintaining continuity of TB medical treatment to individuals diagnosed with TB.
Principle Contacts:
At ADHS:
Dr. Eugene Livar
Arizona Department of Health Services
Office of Disease Integration and Services
150 N 18th Avenue, Suite 540
Phoenix, AZ, 85007
Phone: (602) 364-3846
At MCDPH:
Principle Contact Block
Attn: Marcy Flanagan, DBA, Director
4041 North Central, Suite 1400
Phoenix, AZ 85012
Phone: (602)506-6601
Frequency of Data Release:
Individual case data will be provided upon request.
Selection Criteria:
Based upon individual level identifiers of persons known to have been diagnosed with TB.
Page 30 of 31
MEMORANDUM OF UNDERSTANDING
MOU# HU156031
EXHIBIT M – MEDSIS Non-Communicable Disease Data
Time Frame and Scope of Data Shared:
All data in MEDSIS for residents within the jurisdiction of MCDPH, and events reported into MEDSIS by
medical providers located within the jurisdiction of MCDPH.
Data Fields Shared:
All fields shared.
Frequency of Data Sharing:
Real-time continuous access to the MEDSIS production data. Sharing of reportable health event
(MEDSIS) data is facilitated by granting access to MEDSIS to authorized persons designated by MCDPH
to have such access.
Method of Data Transfer:
Data is maintained and protected by ADHS while it is resident on the ADHS MEDSIS server. MCDPH
becomes the owner of all data downloaded from the ADHS MEDSIS server by MCDPH, and becomes
responsible to maintain and protect the downloaded data.
Allowable Data Uses:
All uses allowable under applicable law as determined by MCDPH. For Research uses, MCDPH may
use an Institutional Review Board of choice to oversee the protection of human ethics/privacy rights in
data use.
Page 31 of 31
MEMORANDUM OF UNDERSTANDING
MOU# HU156031
EXHIBIT N – MEDSIS Environmental Exposure Data
Time Frame and Scope of Data Shared:
All data in MEDSIS for residents within the jurisdiction of MCDPH, and events reported into MEDSIS by
reporting entities located within the jurisdiction of MCDPH.
Data Fields Shared:
All fields shared.
Frequency of Data Sharing:
Real-time continuous access to the MEDSIS production data. Sharing of reportable health event
(MEDSIS) data is facilitated by granting access to MEDSIS to authorized persons designated by MCDPH
to have such access.
Method of Data Transfer:
Data is maintained and protected by ADHS while it is resident on the ADHS MEDSIS server. MCDPH
becomes the owner of all data downloaded from the ADHS MEDSIS server by MCDPH, and becomes
responsible to maintain and protect the downloaded data.
Allowable Data Uses:
All uses allowable under applicable law as determined by MCDPH. For Research uses, MCDPH may
use an Institutional Review Board of choice to oversee the protection of human ethics/privacy rights in
data use.