MOU - HU156031 - DSA - MARICOPA COUNTY - A1.PDF

Maricopa County — Formal (2024-02-28)

Extracted text (via pymupdf) 76328 characters

SHARING OF PUBLIC HEALTH DATA

Effective upon signature by both parties it is mutually agreed that the Memorandum of Understanding referenced in this
Amendment One (1) is amended as follows:
1. Pursuant to the Uniform Terms and Conditions, Provision Eleven (11), Amendment or Modifications, the Agreement is
hereby revised with the following:

1.1
Section 2.2.4., Data Transfer Methods, of this Agreement is hereby revised and replaced;

1.2
Section 20., Notices, Correspondence, and Reports, of this Agreement is hereby revised and replaced;
1.3
Exhibit A is hereby revised and replaced;

1.4
Exhibit B is hereby revised and replaced;
1.5
Exhibit C is hereby revised and replaced;

1.6
Exhibit D is hereby revised and replaced;

1.7
Exhibit E is hereby revised and replaced;

1.8
Exhibit F is hereby revised and replaced;
1.9
Exhibit G is hereby revised and replaced;
1.10
Exhibit K is hereby revised and replaced;

1.11
Exhibit L is hereby revised and replaced;

1.12
Exhibit M is hereby revised and replaced;

1.13
Exhibit N is hereby revised and replaced;

1.14
Exhibit O is added; and
1.15
Exhibit P is added.

ALL CHANGES ARE REFLECTED IN RED

ALL OTHER PROVISIONS SHALL REMAIN IN THEIR ENTIRETY
Contractor hereby acknowledges receipt and acceptance of
above amendment and that a signed copy must be filed
with the Procurement Office before the effective date
The above referenced Agreement Amendment is hereby
executed this
day of
20
at
Phoenix, Arizona

(To be filled out by Procurement Office)
Contractor Signature

Contractor Signature Date

Authorized Signatory’s Name and Title

Contractor’s Name
Procurement Officer Signature

MEMORANDUM OF UNDERSTANDING
AMENDMENT
ARIZONA DEPARTMENT OF
HEALTH SERVICES
OFFICE OF PROCUREMENT
150 N 18th Ave., Ste. #530
Phoenix, Arizona 85007
MOU NO.: HU156031
AMENDMENT NO.: ONE (1)
PROCUREMENT OFFICER
NATHANIEL THOMAS
MEMORANDUM OF UNDERSTANDING
FOR THE SHARING OF PUBLIC HEALTH DATA
BETWEEN
THE ARIZONA DEPARTMENT OF HEALTH SERVICES
AND
MARICOPA COUNTY DEPARTMENT OF PUBLIC HEALTH

WHEREAS, the Arizona Department of Health Services (ADHS) is a division of the State of Arizona
established to promote and protect public health and welfare through the operation of health related
programs within the state.

WHEREAS, the Maricopa County Department of Public Health (MCDPH) is a federally recognized
Public Health Authority, pursuant to the requirements of the Health Insurance Portability and
Accountability Act of 1996 (Pub. L. 104-191) (HIPAA) and applicable law, established to promote and
protect the public health and welfare of residents and visitors within the jurisdictional boundary of
MCDPH and patients of facilities within the jurisdictional boundary of MCDPH.

WHEREAS, ADHS and MCDPH recognize the need to set forth and define the terms under which
ADHS will provide data files to MCDPH containing public health records for the development of
community health profiles and other general public health surveillance activities and Public Health
Practice performed by MCDPH.

NOW, THEREFORE, in consideration of the mutual promises and representations set forth in this
Memorandum of Understanding (MOU), MCDPH and ADHS mutually agree as follows:

1.
DEFINITIONS. Capitalized terms used herein shall have the meanings set forth in this Section
one (1).

MEMORANDUM OF UNDERSTANDING
AMENDMENT
ARIZONA DEPARTMENT OF
HEALTH SERVICES
OFFICE OF PROCUREMENT
150 N 18th Ave., Ste. #530
Phoenix, Arizona 85007
MOU NO.: HU156031
AMENDMENT NO.: ONE (1)
PROCUREMENT OFFICER
NATHANIEL THOMAS
1.1 "Authorized Persons" means: ADHS and MCDPH employees or contractors who have a
need to know or otherwise access protected information including Personally Identifying
Information to enable ADHS and MCDPH to perform their missions in conformance with
the requirements of state statutes, rules, and this MOU; and who are bound in writing by
confidentiality obligations sufficient to protect all protected information including Personally
Identifying Information in accordance with the terms and conditions of this MOU and
applicable law.

1.2 “Confidential Information” means information that is protected from unauthorized
disclosure based on laws, regulations, and other legal agreements. For purposes of this
MOU, it includes Personally Identifying Information, Protected Health Information, and
Public Health Data.

1.3 "Personally Identifying Information" means: information provided by ADHS to MCDPH,
or by MCDPH to ADHS that: (i) identifies or can be used to identify an individual (including,
without limitation, names, signatures, addresses, telephone numbers, e-mail addresses
and other unique identifiers); or (ii) can be used to authenticate an individual (including,
without limitation, employee identification numbers, government-issued identification
numbers, passwords or PINs, financial account numbers, credit report information,
biometric or health data, answers to security questions and other personal identifiers).
ADHS’ business contact information is not by itself deemed to be Personal Information.
1.4 “Public Health Data” means: health information organized and maintained by ADHS or by
MCDPH that is received under applicable law, including, but not limited to, patient names,
mailing addresses and geocodes, dates of birth and death, gender, race, ethnicity,
discharge status, disease codes, procedures performed and other information reported to
ADHS or MCDPH under applicable law. The elements of data shared and specific
restrictions of their use under this MOU are fully described in sub- section 2.2, (Scope) and
section nineteen (19), (Data Use and Ownership).

1.5 “Public Health Practice” means interventions designed solely to enhance the well- being
of the specific subject population identified in this MOU, and which have reasonable
expectation of success.

MEMORANDUM OF UNDERSTANDING
AMENDMENT
ARIZONA DEPARTMENT OF
HEALTH SERVICES
OFFICE OF PROCUREMENT
150 N 18th Ave., Ste. #530
Phoenix, Arizona 85007
MOU NO.: HU156031
AMENDMENT NO.: ONE (1)
PROCUREMENT OFFICER
NATHANIEL THOMAS
1.6 “Quality Assurance (QA)” means: activities that are established for the purposes of
reducing morbidity and mortality and for improving the quality of health care and/or for
encouraging proper utilization of healthcare services and facilities through the review of
the qualifications, professional practices, training, experience, patient care, conduct,
processes, or data of licensed health care providers.

1.7 “Research” means: a systematic investigation, including research development, testing
and evaluation, designed to develop or contribute to generalizable knowledge. Activities
which meet this definition constitute research for purposes of this MOU, whether or not
they are conducted or supported under a program which is considered research for other
purposes. For example, some demonstration and service programs may include research
activities.

1.8 "Security Breach" means: (i) any act or omission that materially compromises either the
security, confidentiality or integrity of Personally Identifying Information or the physical,
technical, administrative or organizational safeguards put in place by ADHS and MCDPH
or any Authorized Persons that relate to the protection of the security, confidentiality or
integrity of Personal Information, or (ii) receipt of a complaint in relation to the privacy
practices of ADHS and MCDPH or any Authorized Persons or a breach or alleged breach
of this MOU relating to such privacy practices.

1.9 “Statutory Public Health Authority - SPHA” means: an agency or authority of the United
States government, a State, a territory, a political subdivision of a State or territory, or
Indian tribe that is responsible for public health matters as part of its official mandate, as
well as a person or entity acting under a grant of authority from, or under a contract with,
a public health agency, including the employees or agents of such public health agency or
its contractors or persons or entities to whom it has granted authority, that is responsibility
for public health matters as part of its official mandate. For the purposes of this agreement,
‘SPHA’ refers to both ADHS and MCDPH.
2.
PURPOSE AND SCOPE OF AGREEMENT

2.1. Purpose

Subject to availability of data and resources, ADHS and MCDPH agree to provide one
another with Public Health Data as defined in section 2.2.1 of this MOU in a mutually
agreeable format.

Subsection 2.1 notwithstanding, the Parties agree that ADHS and MCDPH do not require,
and shall not provide (except upon specific request) data files containing any of the
following information related to any individual county resident: (i) signatures, telephone
numbers, e-mail addresses; (ii) employee identification numbers, passwords or PINs,
credit report information, answers to security questions and other similar personal
identifiers; (iii) individual's government-issued identification number (including driver's
license number or state-issued identified number); and (iv) financial account number, credit
card number, debit card number, credit report information, with or without any required
security code, access code, personal identification number or password, that would permit
access to an individual’s financial account or accounts.

2.2.1.
Selection Criteria

ADHS will select records for inclusion and release to MCDPH if the record meets
any of these criterion: for residents within the jurisdictional boundary of MCDPH,
or which has been submitted by a facility within the jurisdictional boundary of
MCDPH, or human remains transported within the jurisdictional boundary of
MCDPH. Data elements that ADHS will provide in the data sets may include any
data element permitted by this MOU and that is specifically requested by
MCDPH for inclusion.

2.2.2.
Data Requests

To request data the requesting Agency shall submit a list of the Authorized
Persons who shall receive or have access to data shared under this MOU to the
Agency holding the data, along with specific data elements requested to be
provided. Under this MOU both ADHS and MCDPH may request updated data
as needed. For data to be shared, both agencies must agree to the sharing of
data requested. Following initial release of data under this MOU, ADHS or
MCDPH may request updated data as needed.

The data that will be provided by ADHS to MCDPH or by MCDPH to ADHS
under this MOU include all those listed in the Table in Exhibit A, and as further
defined and limited within any other exhibit attached to this MOU.

2.2.4
Data Transfer Methods

The method of data sharing will be in a manner agreeable to ADHS and MCDPH,
and which meets the requirements of ADHS to assure the security of the data.
The following are the methods of transfer allowed:

● Encrypted file transfer using Secure File Transfer Protocol (SFTP)
● Secure Application Programming Interface (API)
● Secure direct data access from ADHS Snowflake data lakehouse
● Secure direct access to system/application of record

2.2.4.1 ADHS and MCDPH will use Encrypted file transfer using Secure File
Transfer Protocol (SFTP). The data file will be posted to a web
accessible ADHS server by ADHS or to a server owned by MCDPH,
where it can be accessed only by MCDPH. If posted to an ADHS
server, the MCDPH staff designated to access the SFTP file transfer
site must be Authorized Persons for the data element(s) they receive,
and must use an ADHS issued user id and secure password to access
the SFTP site.

2.2.4.2 ADHS and MCDPH will use a secure Application Programming
Interface as a request and response method for data sharing. The data
file will be accessible through the API from a call within the application
of the MCDPH or as a service, where it can be accessed only by
MCDPH. The MCDPH staff designated to access the data must be
Authorized Persons for the data element(s) they receive, and must use
an ADHS issued user id and secure password to access the API.

MEMORANDUM OF UNDERSTANDING
AMENDMENT
ARIZONA DEPARTMENT OF
HEALTH SERVICES
OFFICE OF PROCUREMENT
150 N 18th Ave., Ste. #530
Phoenix, Arizona 85007
MOU NO.: HU156031
AMENDMENT NO.: ONE (1)
PROCUREMENT OFFICER
NATHANIEL THOMAS
2.2.4.3 ADHS and MCDPH will use a secure direct connection to the ADHS
Data Lakehouse to access the data elements in scope of the
agreement. The data will be accessible either as an extracted dataset
for download or views built based on the scope of data accessible,
where it can be accessed only by MCDPH. The MCDPH staff
designated to access the data must be Authorized Persons for the data
element(s) they can access, and must use a secure user ID and
secure password to access the data.

2.2.4.4 ADHS and MCDPH will use a secure direct web accessible connection
to the ADHS System/Application of record to access the data elements
in scope of the agreement. The data will be accessible through the
system/application based on the scope of data accessible, where it can
be accessed only by MCDPH. The MCDPH staff designated to access
the data must be Authorized Persons for the data element(s) they can
access, and must use an ADHS issued user ID and secure password
to access the System/Application.

2.3. Inadvertent Disclosure

In the event that ADHS or MCDPH is inadvertently provided with data files containing any
of the information listed in subsection 2.2, they will notify the agency sending the data of
the disclosure and delete or destroy such data files upon request.

3.
SUPERSESSION OF PAST AGREEMENTS

This MOU is intended to and shall supersede or replace any currently valid MOU in place
between ADHS and MCDPH regarding the sharing of Public Health Data identified under Exhibit
A of this MOU.

4.
TERM OF THE AGREEMENT

The Term of this MOU shall commence upon signature of both parties and shall continue for a
period of five (5) years thereafter, unless terminated, or canceled as otherwise provided herein.

This MOU shall not exceed a total of five (5) years from the effective date of the MOU.

6.
TERMINATION

6.1. This MOU remains in effect as provided in Sections four (4) and five (5) or until the MOU
is otherwise terminated under the following terms and conditions:

6.1.1. Termination without Cause

Both ADHS and MCDPH may terminate this MOU at any time with thirty
(30) calendar days’ notice, in writing, specifying the termination date. Such notices
shall be given by personal delivery or by certified mail, return receipt requested.

6.1.2. Termination for Default

The ADHS and MCDPH reserve the right to terminate the MOU in whole or in part
due to the failure of the other Agency to comply with any material obligation, term or
condition of this MOU. Both Agencies agree to provide written notice detailing the
area of alleged lack of compliance or non- performance and to provide thirty (30)
days to correct the alleged lack of compliance or non-performance prior to
termination for default.

6.1.3. Cancellation for Conflict of Interest

Pursuant to A.R.S. § 38-511, ADHS and MCDPH may cancel this MOU within
three (3) years after MOU execution without penalty or further obligation if any
person significantly involved in initiating, negotiating, securing, drafting or creating
this MOU becomes at any time while the MOU or an extension of the MOU are in
effect, an employee of or a consultant to the other party to this MOU with respect
to the subject matter of the MOU. The cancellation shall be effective upon receipt
of the written notice of cancellation, unless the notice specifies a later time.

7.1. ADHS and MCDPH shall monitor the use of all Public Health Data disclosed under this
MOU, including but not limited to Personal Identifying Information, and to carefully restrict
the use and disclosure of such information as provided for herein.

7.2. Survival of Duty to Protect Confidential Information

It is understood and agreed by the Parties that the obligations set forth in this Section seven
(7), shall survive the expiration or termination of this MOU, except as expressly provided
for herein.

7.3. Minimum Safeguards for PHI

ADHS and MCDPH shall carefully restrict use and access to Personally Identifying
Information shared under this MOU solely to Authorized Persons and shall ensure that the
following minimum safeguards to prevent a Security Breach in a manner consistent with
the requirements of this MOU or applicable law. These safeguards shall, at the minimum,
require that ADHS and MCDPH and their Authorized Persons:

7.3.1. Prohibit Personally Identifying Information supplied under the terms of this MOU
from being released or disclosed to anyone not working at ADHS or MCDPH as an
Authorized Person.

7.3.2. Ensure that any Authorized Persons, including any agent, or subcontractor to ADHS
or MCDPH, to whom ADHS or MCDPH provides confidential information, or
Personally Identifying Information under this MOU, agrees to the same restrictions
and conditions that apply through this MOU to ADHS and MCDPH with respect to
such information.

7.3.3. Secure all printouts containing individual identifiers or confidential data in a locked
vault, file cabinet or other method reasonably necessary to protect the confidential
information.

MEMORANDUM OF UNDERSTANDING
AMENDMENT
ARIZONA DEPARTMENT OF
HEALTH SERVICES
OFFICE OF PROCUREMENT
150 N 18th Ave., Ste. #530
Phoenix, Arizona 85007
MOU NO.: HU156031
AMENDMENT NO.: ONE (1)
PROCUREMENT OFFICER
NATHANIEL THOMAS
7.3.4. Store all data shared under this MOU only on secured servers or encrypted devices
within ADHS or MCDPH. At the termination of this MOU, all data shared under this
MOU shall be securely deleted consistent with the requirements of this MOU and
applicable law.

7.3.5. Provide one another with a description of the security measures that are in place to
maintain the confidentiality of the data being received under this MOU. ADHS and
MCDPH will consider the items described in the document titled "Security
Considerations
for
Applicants"
prepared
by
the
ADHS
HSRB
(https://www.azdhs.gov/documents/director/administrative-counsel-
rules/HSRB_SecurityChecklist.pdf).

7.3.6. ADHS and MCDPH will provide to one another upon request, a current list of
Authorized Persons, and evidence that all Authorized Persons who have access to
the Public Health Data shared under this MOU have participated in any required
training and signed any documents that are necessary to keep both ADHS and
MCDPH in compliance with HIPAA, including but not limited to, Business Associate
Agreement, user confidentiality affirmation statement, HIPAA training certification or
other HIPAA related compliance documents, if applicable.

7.3.7. Provide or continue to provide one another with a copy of procedures for notification
of any Security Breach, which shall include a requirement that any user of the Public
Health Data shared under this MOU shall immediately notify a designated individual
at the agency which owns the data of any known or reasonably suspected Security
Breach.

7.3.8. Maintain a log of all encrypted devices and identification numbers of those devices
that are authorized to transmit, receive or store the Public Health Data shared under
this MOU, until the data are destroyed. ADHS and MCDPH may request a copy of
the log at any time during the term of the MOU or until the data is destroyed.

7.3.9. Make clear to all Authorized Persons and other ADHS and MCDPH employees with
a need to know that they are prohibited from storing Public Health Data on non-
encrypted flash drives, CDs, external drives, smart phones or other non- networked
hard drives.

MEMORANDUM OF UNDERSTANDING
AMENDMENT
ARIZONA DEPARTMENT OF
HEALTH SERVICES
OFFICE OF PROCUREMENT
150 N 18th Ave., Ste. #530
Phoenix, Arizona 85007
MOU NO.: HU156031
AMENDMENT NO.: ONE (1)
PROCUREMENT OFFICER
NATHANIEL THOMAS
7.3.10. Provide to the Agency that owns the data prompt proof of the complete
destruction of the original data and any copies or subsidiary data sets containing
Personally Identifying Information that are developed from the original data upon
the conclusion of this MOU or at such time that such destruction is required by
applicable law and in accordance with the agreed retention schedule in the Exhibit
A table of this MOU.

7.3.11. Take all reasonable steps to ensure that Authorized Persons who have access to
the Public Health Data shared under this MOU shall maintain the same in strict
confidence after the termination of this MOU; provided that ADHS and MCDPH’s
obligations hereunder shall not apply to information that:

7.3.11.1.1. Was already known to the receiving party prior to the time of first
disclosure,
as
demonstrated
by
contemporaneous,
written
documentation; or

7.3.11.1.2. Is received without any obligation of confidentiality from a third party
having a legal right to disclose the same; or

7.3.11.1.3. Is independently developed by the receiving party by individuals
without
access
to
such
information,
as
demonstrated
by
contemporaneous, written documentation.
7.3.12. As mandated under ARS 36-302(B)3, which prohibits the organization, operation,
or maintenance of any alternative system of vital records, data shared under this
agreement shall not be retained longer than the term specified under the Exhibit
A table for that item, and the custodial agency holding the data agrees to provide
a Certificate of Destruction to the data owner Agency upon destruction of shared
data.

MEMORANDUM OF UNDERSTANDING
AMENDMENT
ARIZONA DEPARTMENT OF
HEALTH SERVICES
OFFICE OF PROCUREMENT
150 N 18th Ave., Ste. #530
Phoenix, Arizona 85007
MOU NO.: HU156031
AMENDMENT NO.: ONE (1)
PROCUREMENT OFFICER
NATHANIEL THOMAS
7.3.13. ADHS and MCDPH shall not release data shared under this agreement, or
disclose information contained in data records shared under this agreement, in
response to any legally enforceable order, subpoena, or other regulation
(ORDER), without giving the other Agency notice and an opportunity to discuss
and or object to the production. All legally enforceable orders, subpoenas, or
other regulations (ORDERS) received by the custodian of data shared under this
agreement will be referred immediately its legal counsel and the legal counsel of
the data owner agency for consideration. It is the intent of this provision that the
two Agencies will cooperate and discuss the merits of producing and/or objecting
to the release of any data covered by this agreement before any data is released
by either Agency.

7.4. Security Breach

In the event of a Security Breach, pursuant to A.R.S. § 44-7601, A.R.S § 18-545 and any
other applicable law, ADHS and MCDPH agree to collaborate with each other on the
investigation, mitigation, remediation and, if necessary, breach notification of citizens.
Pursuant to A.R.S. § 41-3507, ADHS and MCDPH shall notify the Arizona Strategic
Enterprise Technology (ASET) Statewide Information Security and Privacy Office
(SISPO) immediately upon becoming aware or receiving notice of a Security Breach.

8.
NON-DISCRIMINATION

The Parties shall comply with Executive Order 75-5 as modified by Executive Order 2009-09,
which mandates that all persons, regardless of race, color, religion, sex, age, national origin
or political affiliation, shall have equal access to employment opportunities, and all other
applicable State and Federal employment laws, rules, and regulations, including the
Americans with Disabilities Act. The Parties shall take affirmative action to ensure that
applicants for employment and employees are not discriminated against due to race, creed,
color, religion, sex, national origin or disability.

Under A.R.S. § 35-214 and § 35-215, ADHS and MCDPH shall retain all data and other
records (“records”) relating to the MOU for no longer than the specified data destruction
schedule for each item specified in the Exhibit A table after the completion of the MOU, and
shall provide a certificate of destruction to the data owner when the data are destroyed. All
records held by ADHS or MCDPH that were received under this MOU shall be subject to
inspection and audit by the agency that shared them at reasonable times. ADHS and MCDPH
agree to mutually provide the right of access to those servers or drives used for the storage of
Personally Identifying Information, at reasonable times, in order to monitor and evaluate
performance, compliance, and/or Quality Assurance under this MOU.

10. ARBITRATION

The parties to this MOU agree to resolve all disputes arising out of or relating to this MOU,
after exhausting applicable administrative review, through arbitration to the extent required
by A.R.S. §12-1518.

11. AMENDMENT OR MODIFICATIONS

No amendment or modifications to this MOU, including any amendment or modification of
this Section, shall be effective unless the same is in writing signed by the Parties.

12. ARIZONA LAW

The law of Arizona applies to this MOU.

13. RELATIONSHIP OF PARTIES

ADHS and MCDPH warrant that they are acting as independent Agencies under this MOU.
Neither party to this MOU shall be deemed to be the employee or agent of the other party to the
MOU.

14. SEVERABILITY

The Provisions of this MOU are severable. Any term or condition deemed illegal or invalid
shall not affect any other term or condition of the MOU.

This MOU is intended by the parties to be a final and complete expression of their agreement.
No course of prior dealings between the parties and no usage of the trade shall supplement or
explain any terms used in this document.

16. NO WAIVER

Either Party’s failure to insist on strict performance of any term or condition of the MOU shall not
be deemed a waiver of that term or condition even if the party accepting or acquiescing in the
nonconforming performance knows of the nature of the performance and fails to object to it.
17. HEADINGS

Headings are for organizational purposes only and shall not be interpreted as having legal
significance or meaning.

18. ADVERTISING AND PROMOTION OF CONTRACT

ADHS and MCDPH shall not advertise, publish, or re-release any information for commercial
benefit concerning this MOU without the prior written approval of the Procurement Officer of the
sharing Agency, and the ADHS Human Subject Review Board (HSRB).

19. DATA USE AND OWNERSHIP

19.1 Each agency will use data shared under this MOU exclusively for approved activities
mutually agreed by the parties to this MOU.

19.2 Proposed use of data shared under this MOU for Research shall first be reviewed and
approved by a mutually agreed designated institutional review body (IRB or HSRB). If it is
unclear to either party to this MOU whether the data use is Research or public health
practice or both, then a clarification shall be requested from the designated institutional
review body (IRB or HSRB).

MEMORANDUM OF UNDERSTANDING
AMENDMENT
ARIZONA DEPARTMENT OF
HEALTH SERVICES
OFFICE OF PROCUREMENT
150 N 18th Ave., Ste. #530
Phoenix, Arizona 85007
MOU NO.: HU156031
AMENDMENT NO.: ONE (1)
PROCUREMENT OFFICER
NATHANIEL THOMAS
19.3 ADHS or MCDPH activities using the data shared under this MOU that generate external
papers, or publications for dissemination outside of the custodial agency must have
specific written review and clearance from the data owner before release. Requests for
review and clearance shall align with the process agreed to between the ADHS Chief of
Strategy and Innovation and the MCDPH Administrator for the Division of Epidemiology
and Informatics.

19.4 The agency that owns the data as shown in the Exhibit A table under this MOU shall be
cited as the source of the data in tables, reports, presentations, and scientific papers, and
the publishing agency or its corresponding authors shall be cited as the source of
interpretations, calculations, or manipulations of data.

19.5 The agency that owns the data as shown in the Exhibit A table under this MOU retains
exclusive ownership of the data shared with the receiving agency except as described
under subsection 19.7 of this MOU. Any release, or modified re-release of data shared
under this MOU that is not specifically allowed under section 7.3.11 of this MOU requires
prior approval by the agency that owns the data.

19.6 Any legal order or subpoena received by an agency in custody of data owned by the other
agency, and regarding data owned by the other agency, shall immediately refer the orders
or subpoenas to the legal counsel of the agency that owns the data, and shall take no
actions, and make no decisions regarding the order or subpoena except as first directed
by legal counsel of the data owner. The agency in custody may object to producing the
data required under the legal order or subpoena.

19.7 In the case that data ownership in section 2.2.3 of this MOU is designated to MCDPH in
the Exhibit A Table, but the data are held in an ADHS system (such as MEDSIS), then the
data become the exclusive ownership of MCDPH when downloaded or extracted from the
ADHS system in which the data are held.

20. NOTICES, CORRESPONDENCE AND REPORTS
20.1. Notices, correspondence and reports from MCDPH to ADHS shall be sent to:

MEMORANDUM OF UNDERSTANDING
AMENDMENT
ARIZONA DEPARTMENT OF
HEALTH SERVICES
OFFICE OF PROCUREMENT
150 N 18th Ave., Ste. #530
Phoenix, Arizona 85007
MOU NO.: HU156031
AMENDMENT NO.: ONE (1)
PROCUREMENT OFFICER
NATHANIEL THOMAS
Arizona Department of Health Services
Attn. Enterprise Data Management Office
150 N. 18th Avenue, Suite 510
Phoenix, AZ 85007
Phone: (602) 364-1510
20.2. Notices, correspondence, and reports from ADHS to MCDPH shall be sent to:

Maricopa County Department of Public Health
Attn: Division Administrator
Division of Epidemiology and Informatics
4041 North Central,
Suite 600
Phoenix, Arizona 85012
Email: Jessica.White@maricopa.gov
Phone: (602) 329-0254

DATA SET
PII
PHI
Principal
Custodial
Program
Data
Owner
Allowed
Purpose
HSRB
Attachments
Retention
Arizona Vital
Records Birth
Data
Y
Y
Jackie Ward,
Community
Data & Health
Equity
MCDPH
ADHS
Public Health
Use
ADHS
Exhibit B*
5 year limit from
date of receipt
Arizona Vital
Records Death
Data
Y
Y
Jackie Ward,
Community
Data & Health
Equity
MCDPH
ADHS
Public Health
Use
ADHS
Exhibit C*
5 year limit from
date of receipt
Vital Records
Fetal Death Data
Set
Y
Y
Jackie Ward,
Community
Data & Health
Equity
MCDPH
ADHS
Public Health
Use
ADHS
Exhibit D*
5 year limit from
date of receipt
Arizona Hospital
Discharge Data
Y
Y
Jackie Ward,
Community
Data & Health
Equity
MCDPH
ADHS
Public Health
Use
ADHS
Exhibit E*
5 year limit from
date of receipt
BRFSS Limited
Data Set
Y
Y
Jackie Ward,
Community
Data & Health
Equity
MCDPH
ADHS
Public Health
Qualifying
Activity
ADHS
Exhibit F*
5 year limit from
date of receipt
MEDSIS
Communicable
Disease Data
Y
Y
Jenn Collins /
Office of
Communicable
Disease Data,
Surveillance, and
Outbreak
Response
(OCDDSOR)
MCDPH
MCDPH
Public Health
Qualifying
Activity
MCDPH
Exhibit G*
None

MEMORANDUM OF UNDERSTANDING
AMENDMENT
ARIZONA DEPARTMENT OF
HEALTH SERVICES
OFFICE OF PROCUREMENT
150 N 18th Ave., Ste. #530
Phoenix, Arizona 85007
MOU NO.: HU156031
AMENDMENT NO.: ONE (1)
PROCUREMENT OFFICER
NATHANIEL THOMAS
Sexually
Transmitted
Diseases Data
(PRISM)
Y
Y
Jonathan Bell /
Clinical
Services,
Community
Health &
Records
Services
(CHRS)
MCDPH
MCDPH
Public Health
Qualifying
Activity
MCDPH
Exhibit H*
None

DATA SET
PII
PHI
Principal
Custodial
Program
Data
Owner
Allowed
Purpose
HSRB
Attachments
Retention
Immunization
Data
Y
Y
Jenn Collins /
Office of
Communicable
Disease Data,
Surveillance, and
Outbreak
Response
(OCDDSOR)
or
CHN
MCDPH
ADHS
Public Health
Qualifying
Activity
ADHS
Exhibit I*
5 year limit from
date of receipt
HIV/AIDS
Surveillance
Data (EHARS)
Y
Y
MCDPH
ADHS
Public Health
Qualifying
Activity
ADHS
Exhibit J*
5 year limit from
date of receipt
Arizona State
Trauma
Registry Data
Y
Y
Jackie Ward,
Community
Data & Health
Equity
MCDPH
ADHS
Public Health
Qualifying
Activity
ADHS
Exhibit K*
5 year limit from
date of receipt
Tuberculosis
Surveillance
Case Data
Y
Y
Jonathan Bell /
Clinical
Services,
Community
Health &
Records
Services
(CHRS)
MCDPH
MCDPH
Public Health
Qualifying
Activity
including case
intervention
MCDPH
Exhibit L*
None
MEDSIS Non-
Communicable
Disease Data
Y
Y
Christina
Mrukowicz,
Substance
Use and
Mental Health
Branch
MCDPH
MCDPH
Public Health
Qualifying
Activity
MCDPH
Exhibit M*
None

MEMORANDUM OF UNDERSTANDING
AMENDMENT
ARIZONA DEPARTMENT OF
HEALTH SERVICES
OFFICE OF PROCUREMENT
150 N 18th Ave., Ste. #530
Phoenix, Arizona 85007
MOU NO.: HU156031
AMENDMENT NO.: ONE (1)
PROCUREMENT OFFICER
NATHANIEL THOMAS
MEDSIS
Environmental
Exposure Data
Y
Y
MCDPH
MCDPH
Public Health
Qualifying
Activity
MCDPH
Exhibit N*
None
Prehospital
Information and
EMS Registry
System
(AZPIERS)
Y
Y
Jenn Collins /
Office of
Communicable
Disease Data,
Surveillance,
and Outbreak
Response
(OCDDSOR)
MCPDH
ADHS
Public Health
Qualifying
Activity
ADHS
Exhibit O*
5 year limit from
date of receipt
Pregnancy Risk
Assessment
Monitoring
System
(PRAMS)
Y
Y
Jackie Ward,
Community
Data & Health
Equity
MCDPH
ADHS
Public Health
Qualifying
Activity
ADHS
Exhibit P*
None
*attachments specify details about the data to be shared, allowable purposes and uses, and may be revised from time to time through amendment
of this MOU

Limitations on Data Use:
Data may only be used as described above, no identifiable information may be published, no contact
may be attempted with agencies or individuals contained in the data unless approved as described
above.

Principal Contacts:
Arizona Department of Health Services
Bureau of Vital Records
150 N 18th Avenue, Suite 120
Phoenix, AZ, 85007
Phone: (602) 364-3048

Maricopa County Department of Public Health
Office of Health Equity and Community Data
4041 N Central Ave, Suite 600
Phoenix, AZ 85012
Email: Jackie.Ward@maricopa.gov

Frequency of Data Sharing:
Data will be shared/updated once daily. Any manual staff activity needed for maintaining or changing
data shared via the methods of data transfer below will be performed only on business days.

Method of Data Transfer:

Data may be transferred from ADHS to MCDPH by either of the following methods listed in section
2.2.4 of this MOU:

● Encrypted file transfer using Secure File Transfer Protocol (SFTP)
● Secure direct data access from ADHS Snowflake data lakehouse

Selection Criteria:
As agreed by ADHS and MCDPH that data shared will be limited to records that match the selection
criteria described in section 2.2.1 of this MOU.

Allowable Purpose:

Data are allowed to be exchanged by ADHS and MCDPH for conducting Public Health practice, Public
Health Surveillance, Quality Assurance, and approved research activity. Specific research projects must
be approved as described in this MOU.

Limitations on Data Use:

Data may only be used as described above, no identifiable information may be published, no contact
may be attempted with agencies or individuals contained in the data unless approved as described
above.

Principal Contacts:
Arizona Department of Health Services
Bureau of Vital Records
150 N 18th Avenue, Suite 120
Phoenix, AZ, 85007
Phone: (602) 364-3048

Maricopa County Department of Public Health
Office of Health Equity and Community Data
4041 N Central Ave, Suite 600
Phoenix, AZ 85012
Email: Jackie.Ward@maricopa.gov

Frequency of Data Sharing:

Data will be shared/updated once daily. Any manual staff activity needed for maintaining or changing
data shared via the methods of data transfer below will be performed only on business days.
Method of Data Transfer:

Data may be transferred from ADHS to MCDPH by either of the following methods listed in section
2.2.4 of this MOU:

● Encrypted file transfer using Secure File Transfer Protocol (SFTP)
● Secure direct data access from ADHS Snowflake data lakehouse

Selection Criteria:
As agreed by ADHS and MCDPH that data shared will be limited to records that match the selection
criteria described in section 2.2.1 of this MOU.

Frequency of Data Sharing:

Data will be shared/updated once daily. Any manual staff activity needed for maintaining or changing
data shared via the methods of data transfer below will be performed only on business days.

Method of Data Transfer:

Data may be transferred from ADHS to MCDPH by either of the following methods listed in section
2.2.4 of this MOU:

● Encrypted file transfer using Secure File Transfer Protocol (SFTP)
● Secure direct data access from ADHS Snowflake data lakehouse
Principal Contacts:

Arizona Department of Health Services
Bureau of Vital Records
150 North 18th Avenue, Suite 120
Phoenix, AZ 85007
Phone: (602) 364-3048

Maricopa County Department of Public Health
Office of Health Equity and Community Data
4041 N Central Ave, Suite 600
Phoenix, AZ 85012
Email: Jackie.Ward@maricopa.gov

Selection Criteria:

As agreed by ADHS and MCDPH that data shared will be limited to records that match the selection
criteria described in section 2.2.1 of this MOU.

Allowable Purpose:
Data are allowed to be exchanged by ADHS and MCDPH for conducting Public Health practice, Public
Health Surveillance, Quality Assurance, and approved research activity. Specific research projects must
be approved as described in this MOU.
Limitations on Data Use:
Data may only be used as described above, no identifiable information may be published, no contact
may be attempted with agencies or individuals contained in the data unless approved as described
above.
Principal Contacts:
Arizona Department of Health Services
Hospital Data & Systems, Business Intelligence Office
150 N 18th Avenue, Suite 550
Phoenix, AZ, 85007
Phone: (602) 215-6092

Maricopa County Department of Public Health
Office of Health Equity and Community Data
4041 N Central Ave, Suite 600
Phoenix, AZ 85012
Email: Jackie.Ward@maricopa.gov

Fields Shared:
All fields to be shared.

Frequency of Data Release:
Semi-annually, after the final HDD data file has been finalized, typically by mid-April, and mid-October each
year.

Method of Data Transfer:

Data may be transferred from ADHS to MCDPH by either of the following methods listed in section 2.2.4 of
this MOU:

● Encrypted file transfer using Secure File Transfer Protocol (SFTP)
● Secure direct data access from ADHS Snowflake data lakehouse
Selection Criteria:
As agreed by ADHS and MCDPH, HDD data shared under this MOU will not be limited as prescribed in
section 2.2.1, but will include all records in the standard HDD data set, and will require compliance with
the standard data release agreement terms and conditions.

Allowable Data Uses:

Public Health uses include surveillance, assessments, quality controls, interventions, and other public
health related activity.

Principal Contacts:

1. AZ BRFSS Principal Investigator: 480-273-3974
2. AZ BRFSS Manager: 602-542-1125
3. Population Survey Epidemiologist: 480-341-1201
Bureau of Assessment and Evaluation
Division of Public Health- Prevention Services
Arizona Department of Health Services
150 N. 18th Avenue, Suite 310
Phoenix, Arizona 85007

Maricopa County Department of Public Health
Office of Health Equity and Community Data
4041 N Central Ave, Suite 600
Phoenix, AZ 85012
Email: Jackie.Ward@maricopa.gov

Fields Shared and Frequency of Data Sharing:

As agreed by ADHS and MCDPH that data shared will be limited to records that match the selection criteria
described in section 2.2.1 of this MOU.

Protocol for Data Breaches:

The CDC requires immediate reporting of any security breach of BRFSS data. In the event of a breach,
MCDPH shall notify the BRFSS program immediately via email upon the discovery of a data breach.
Method of Data Transfer:

Data may be transferred from ADHS to MCDPH by the following method listed in section 2.2.4 of this MOU:
● Encrypted file transfer using Secure File Transfer Protocol (SFTP)

All uses allowable under applicable law as determined by MCDPH. For Research uses, MCDPH may use
an Institutional Review Board of choice to oversee the protection of human ethics/privacy rights in data use.

Time Frame and Scope of Data Shared:

All data in MEDSIS general communicable disease and hepatitis C modules for residents within the
jurisdiction of MCDPH, and events reported into those MEDSIS modules by medical providers located
within the jurisdiction of MCDPH.

Data Fields Shared:

All fields shared.

Frequency of Data Sharing:

Real-time continuous access to the MEDSIS production data. Sharing of reportable health event (MEDSIS)
data is facilitated by granting access to MEDSIS to authorized persons designated by MCDPH to have such
access. Data files will be shared/updated daily.

Method of Data Transfer:

Data are maintained and protected by ADHS while it is resident on the ADHS MEDSIS server. MCDPH
becomes the owner of all data downloaded by or transferred to MCDPH and becomes responsible to
maintain and protect the downloaded or transferred data.

Data may be transferred from ADHS to MCDPH by any of the following methods listed in section 2.2.4 of
this MOU:

●
Encrypted file transfer using Secure File Transfer Protocol (SFTP)
●
Secure Application Programming Interface (API)
●
Secure direct data access from ADHS Snowflake data lakehouse
●
Secure direct access to system/application of record

Time Frame and Scope of Data Shared:

All data in PRISM for residents within the jurisdiction of MCDPH, and events reported into PRISM by
medical providers located within the jurisdiction of MCDPH. Exception: cases or their contacts from
other jurisdictions may be viewed by MCDPH only during relevant case investigations.
Data Fields Shared:

All fields shared, dependent upon user permission level.
Frequency of Data Sharing:

Real-time continuous access to the PRISM production data. Sharing of reportable health event (PRISM)
data is facilitated by granting access to PRISM to authorized persons designated by MCDPH to have such
access.
Method of Data Transfer:

Data is maintained and protected by ADHS while it is resident on the ADHS PRISM server. MCDPH
becomes the owner of all data downloaded from the ADHS PRISM server by MCDPH and becomes
responsible to maintain and protect the downloaded data.

Allowable Data Uses:
Public Health uses including surveillance, assessments, quality controls, interventions, and other public
health related activity. All uses must abide by terms defined under Section 19 Data Use and Ownership
and all data security and confidentiality requirements mentioned therein. For research uses, MCDPH
may use an institutional review board of choice to oversee the protection of human ethics/privacy rights
in data use.

Data Requests: Prism reporting functions are limited. MCDPH may request data using the STD Data
Request Protocol and applications shown below:
STD Data Request Protocol

Purpose
The Purpose of this protocol is to outline procedures around the receipt of data requests from
internal and external partners while upholding best practices for data security and confidentiality.

MEMORANDUM OF UNDERSTANDING
AMENDMENT
ARIZONA DEPARTMENT OF
HEALTH SERVICES
OFFICE OF PROCUREMENT
150 N 18th Ave., Ste. #530
Phoenix, Arizona 85007
MOU NO.: HU156031
AMENDMENT NO.: ONE (1)
PROCUREMENT OFFICER
NATHANIEL THOMAS
Resources
● Data Request Form: This form can be used by internal and external partners for a one-time
data request. If the requestor is asking for data outside of their jurisdiction, then the form will
also need to be signed by the appropriate representative (e.g. county or tribal level data).
● Data Sharing Request: This form is to be used for any transmission of data that will be
repeated (i.e. weekly line lists, annual counts for a defined population, etc.). This must be
signed by the organization and by the STD Control Program Manager. If the requestor is asking
for data outside of their jurisdiction, then the form will also need to be signed by the appropriate
representative (e.g. county or tribal level data).
● Data Request Log: This log is for tracking one-time data requests
● Summary of STD MOUs and DSAs: This log is for tracking current and former Data Sharing
Requests and MOUs.

Protocol
1. A data request can be received by phone, email, etc. When one is received, first verify who is
requesting the data;
a. If contacted by the media, please redirect the requestor to the Public Information Office
b. If contacted by the general public, please redirect them to the data available on our
website (azdhs.gov/std, STD Data Tab)
c. For all other partners, proceed to step 2.
2. Determine the scope of the request. If this is a one-time request, please refer to the Data
Request Form. If this is an ongoing request, please use the Data Sharing Request form.
a. If the requestor is asking for data outside of their jurisdiction, then the form will also
need to be signed by the appropriate representative. Examples:
i. A non-county health department is requesting county level data that is not
publically available: The county area manager will need to sign the data request
and be involved in discussions around how the data can and cannot be used.
ii. A tribe is requesting county level data that is not publically available: The county
area manager(s) will need to sign off on the data request and be involved in
discussions around how the data can and cannot be used.
3. Once the appropriate form has been completed, please send to the STD Control Program
Manager for approval.
4. Once approved, the STD Control Program Manager will save the request here and update the
appropriate log.
a. The Data Request Log is used for one time requests and the Summary of STD MOUs
and DSAs is used for data sharing agreements and MOUs.
b. One time requests are stored in a folder named by the year in which the data was requested
c. Ongoing requests are grouped by the requestor (i.e. County, Tribe, nature of request) etc.

MEMORANDUM OF UNDERSTANDING
AMENDMENT
ARIZONA DEPARTMENT OF
HEALTH SERVICES
OFFICE OF PROCUREMENT
150 N 18th Ave., Ste. #530
Phoenix, Arizona 85007
MOU NO.: HU156031
AMENDMENT NO.: ONE (1)
PROCUREMENT OFFICER
NATHANIEL THOMAS
5. Maintain copies of all coding and the end product used to complete request and store
them in the appropriate subfolder here.
6. Be sure to notify the STD Control Program Manager when the request has been completed.

Instructions:
This form is designed for persons requesting Arizona STD Surveillance Data from the ADHS STD Control
Program. Please fill out all components of this form to the best of your ability. Depending on the complexity
of the request, it can take a minimum of two weeks to process requests. If your organization does not
have a Data Sharing Agreement with ADHS, please submit this form with your company letterhead.
Requestor Information:

Name
Title
Company/Organization
Email
Phone Number
Data Request:

What is the purpose for requesting this data?
Please describe what data is needed:
What disease(s)(if syphilis, indicate stages)
What timeframe (past decade/year/month)
What population (state/county/age/gender/etc.)
In what format would like you the data to be
prepared?
(i.e. graph, line list, table, etc.)
What steps will be taken to ensure data security
and confidentiality?

How will the data be delivered?
(i.e. secure email, uploaded to the Health Services
Portal, etc.)
How will the data be used, analyzed, published,
and/or distributed?
When is the data needed?
Please allow a minimum of 2 weeks to process your
data requests.

Once finished, please email this form to std@adhs.gov

Please note that all media request should be submitted directly to the ADHS Public
Information Office (http://azdhs.gov/director/public-information-office/index.php#contact-us).

ADHS STD Control Program
Description of Data Sharing Plan

Instructions:
This form is designed for persons requesting potentially identifiable data from the ADHS STD Control
Program on a regular basis. Please fill out all components of this form to the best of your ability. Depending
on the complexity of the request, it can take a minimum of two weeks to process requests. ADHS
reserves the right to deny any request that could jeopardize data security and/or confidentiality.
Requestor Information:

Name
Title
Company/
Organization
Email
Phone
Number

Data Request:

What is the purpose for requesting this data?
Please describe what data is needed:
1. What disease(s) (if syphilis, indicate stages)
2. What timeframe (past decade/year/month)
3. What population (state/county/age/gender/etc.)

In what format would like you the data to be
prepared?
(i.e., graph, line-list, table, etc.)
Is the proposed activity determined to be
consistent with all laws and regulations?
What steps will be taken to ensure data security
and confidentiality?
How will the data be delivered?
(Secure email or upload to the Health Services Portal
are recommended for potentially identifiable data)
How will the data be used, analyzed, published,
and/or distributed?
What physical and electronic security
measures are in place for transferring and
storing the data?
What are the potential risks and benefits of
data sharing?
When is the data needed?
Please allow a minimum of 2 weeks to process data
requests.

Please email completed form to std@adhs.gov

Requestor
STD Control Program Manager

EXHIBIT I - IMMUNIZATION DATA (ASIIS)

Time Frame and Scope of Data Shared:

All data in ASIIS for residents within the jurisdiction of MCDPH, and events reported into ASIIS by
medical providers located within the jurisdiction of MCDPH.
Data Fields Shared:

All fields shared.
Frequency of Data Sharing:

Real-time continuous access to the ASIIS production data. Sharing of immunization events (ASIIS) data
is facilitated by granting access to ASIIS to authorized persons designated by MCDPH to have such
access.
Method of Data Transfer:

In addition to ASIIS access, MCDPH may request HEDIS reports for specific entities by submitting
required information to the ADHS ASIIS Program Manager, and summary information will be produced
and released by secure transfer method agreed by ADHS and MCDPH.

Allowable Data Uses:
Public Health allowable activity as defined by HIPAA. Any research use must first be reviewed and
approved by the ADHS HSRB.

EXHIBIT J - HIV/AIDS SURVEILLANCE DATA (EHARS)

Time Frame and Scope of Data Shared:

All data in EHARS for residents within the jurisdiction of MCDPH, and events reported into ASIIS by
medical providers located within the jurisdiction of MCDPH. The HIV/AIDS data are of an exceptionally
sensitive and private nature, and for this reason close collaboration in sharing, using, and protecting
these data are appropriate as a condition of this sharing. Data access will be provided on a read-only
basis, and MCDPH will coordinate closely with ADHS HIV/AIDS Surveillance to assure data quality is
maintained, and that data are used in a manner that complies with all special CDC HIV/AIDS
Surveillance requirements and regulations. Otherwise federal HIV/AIDS surveillance funding to Arizona
might be jeopardized.
Data Fields Shared:

All fields shared.
Frequency of Data Sharing:

Real-time continuous access to the E-HARS production data on a read-only basis. Sharing of HIV/AIDS
surveillance (E-HARS) data is facilitated by granting limited access to E-HARS to authorized persons
designated by MCDPH to have such access.
Method of Data Transfer:

MCDPH and ADHS HIV/AIDS Surveillance will collaborate, and closely coordinate the exchange of
HIV/AIDS Surveillance data due to the extremely sensitive nature of the information it contains. ADHS
and MCDPH will use HIV/AIDS data shared under this agreement in a manner that fully complies with
usage and privacy restrictions defined by the HIV/AIDS branch of the CDC and required as a condition
of HIV/AIDS Surveillance grant funding to ADHS for the collection of these data. There will be no
unauthorized
uses of HIV/AIDS data shared with MCDPH which have not been agreed to by both
MCDPH and ADHS.

Allowable Data Uses:
Public Health allowable activity as defined by HIPAA and conforming to the CDC Security and
Confidentiality Guidance and the responding ADHS Security & Confidentiality document. Any research
use must first be reviewed and approved by the ADHS HSRB.

EXHIBIT K - ARIZONA STATE TRAUMA REGISTRY (ASTR)

Time Frame and Scope of Data Shared:

Annual data files are shared once produced by ADHS. Typically the data annual data file has been
closed, cleaned, and finalized by the first day of August.

Data Fields Shared:

All data elements found in the ASTR FULL data set.

Limitations on Data Use:

Data may only be used for public health activity. No identifiable information may be published. No contact
may be attempted with agencies or individuals contained within the shared ASTR data unless approved by
ADHS.

Principal Contacts:

Arizona Department of Health Services
Bureau Chief, Bureau of EMS and Trauma
System 150 N 18th Avenue, Suite 540
Phoenix, AZ, 85007
Phone: (602) 364-3149

Maricopa County Department of Public Health
Office of Health Equity and Community Data
4041 N Central Ave, Suite 600
Phoenix, AZ 85012
Email: Jackie.Ward@maricopa.gov

Frequency of Data Sharing:
Data can be shared annually, as MCDPH requests it.

Method of Data Transfer:

Data may be transferred from ADHS to MCDPH by the following method listed in section 2.2.4 of this MOU:
●
Encrypted file transfer using Secure File Transfer Protocol (SFTP)

Selection Criteria:

All events in the FULL Data Set which occurred within the jurisdiction of MCDPH, or which were
reported by a provider located within the jurisdiction of MCDPH.

Additional Information:

MCDPH will need to share any report/publication produced using the provided data, on an ongoing
basis.

Allowable Purpose:
Data are exchanged by MCDPH and ADHS primarily for conducting public health interventions to
maintain continuity of care for persons diagnosed with TB, especially when they move across state or
county jurisdictions. Data may also be used for other allowable public health practice, including
surveillance, and research as a part of a joint public health initiative between MCDPH and ADHS.
Specific research projects must be approved as described in this MOU.
Limitations on Data Use:
Data may only be used as described above, for allowable public health interventions, surveillance, or
as part of a mutually agreed research project. Re-release of data is allowed by ADHS to other public
health statutory authorities, their designated agents, or governments of other nations for the sole
purpose of maintaining continuity of TB medical treatment to individuals diagnosed with TB.
Principal Contacts:
At ADHS:
Quentin Mazzaferro
Arizona Department of Health Services
Office of Disease Integration and
Services 150 N 18th Avenue, Suite 540
Phoenix, AZ, 85007
Phone: (602) 364-3846
Email: tb@azdhs.gov

At MCDPH:

Maricopa County Department of Public Health
Community Health and Records Services
1645 E Roosevelt St
Phoenix, AZ 85006
Email: Jonathan.Bell@maricopa.gov

Frequency of Data Release:

Individual case data will be provided upon request.
Selection Criteria:
Based upon individual level identifiers of persons known to have been diagnosed with TB.

Time Frame and Scope of Data Shared:

All data in MEDSIS injury module for residents within the jurisdiction of MCDPH, and events reported into
MEDSIS injury module by medical providers located within the jurisdiction of MCDPH.
Data Fields Shared:

All fields shared.
Frequency of Data Sharing:

Data is maintained and protected by ADHS while it is resident on the ADHS MEDSIS server. MCDPH
becomes the owner of all data downloaded by or transferred to MCDPH, and becomes responsible to
maintain and protect the downloaded or transferred data.

Data may be transferred from ADHS to MCDPH by any of the following methods listed in section 2.2.4 of
this MOU:
● Encrypted file transfer using Secure File Transfer Protocol (SFTP)
● Secure Application Programming Interface (API)
● Secure direct data access from ADHS Snowflake data lakehouse
● Secure direct access to system/application of record

MEMORANDUM OF UNDERSTANDING
AMENDMENT
ARIZONA DEPARTMENT OF
HEALTH SERVICES
OFFICE OF PROCUREMENT
150 N 18th Ave., Ste. #530
Phoenix, Arizona 85007
MOU NO.: HU156031
AMENDMENT NO.: ONE (1)
PROCUREMENT OFFICER
NATHANIEL THOMAS
EXHIBIT N- MEDSIS Environmental Exposure Data
Allowable Data Uses:
All uses allowable under applicable law as determined by MCDPH. For Research uses, MCDPH may use
an Institutional Review Board of choice to oversee the protection of human ethics/privacy rights in data use.

Time Frame and Scope of Data Shared:

All data in MEDSIS for residents within the jurisdiction of MCDPH, and events reported into MEDSIS by
reporting entities located within the jurisdiction of MCDPH.
Data Fields Shared:

All fields shared.
Frequency of Data Sharing:

Data may be transferred from ADHS to MCDPH by any of the following methods listed in section 2.2.4 of this
MOU:
● Encrypted file transfer using Secure File Transfer Protocol (SFTP)
● Secure Application Programming Interface (API)
● Secure direct data access from ADHS Snowflake data lakehouse
● Secure direct access to system/application of record

Allowable Purpose:
Data are allowed to be exchanged by ADHS and MCDPH for conducting Public Health practice and Quality
Assurance. Data are not allowed to be used for research. Proposed sharing of data are to be reviewed on a
case-by-case basis by using the public-facing Data Request Form found on the Bureau’s webpage.
Limitations on Data Use:
Data may only be used as described above, no identifiable information may be published, no contact may be
attempted with agencies or individuals contained in the data unless approved as described above. Use of
data must be within the limitations of Arizona statutes regarding this data.
Principal Contacts:
Bureau of Emergency Medical Services & Trauma System
150 N. 18th Ave., Suite 540
Phoenix, AZ 85007
(602) 364-3150
(800) 200-8523

Maricopa County Department of Public Health
Office of Communicable Disease Data, Surveillance, and Outbreak Response
4041 N Central Ave, Suite 600
Phoenix, AZ 85012
Email: Jennifer.Collins@maricopa.gov

Selection Criteria:
Incidents which occurred within the jurisdiction of MCDPH or MCDPH residence (if available).
Data Fields Shared:
Minimum required as reviewed and approved within the allowed purposes process.
Frequency of Data Sharing:
As needed and agreed upon for each project.
Additional Information:
MCDPH will need to share any report/publication produced using the provided data, on an ongoing
basis.

Method of Data Transfer:

Data may be transferred from ADHS to MCDPH by any of the following methods listed in section 2.2.4 of this
MOU:
●
Encrypted file transfer using Secure File Transfer Protocol (SFTP)

Allowable Purpose:
For Public Health Purposes. These data will be used to identify groups of women and infants at high risk for
health problems to monitor changes in health status and to measure progress towards goals in improving
the health of mothers and infants.
Limitations on Data Use:
1. PRAMS will provide MCDPH with annual data sets of PRAMS data beginning with the 2020 dataset on
an annual basis. The data will be scrubbed of potential identifiers following the HHS Safe Harbor
Methods in order to protect privacy and confidentiality of PRAMS participants.
2. Any questions on the appropriate use of the shared data for research will be referred to the PRAMS
Coordinator and the parties referred to in Section 19 of this MOU.
3. MCDPH will not release the data set or any part of it to any person other than those listed as collaborators
in the proposal. MCDPH will assure that all approved collaborators understand that they may not share
the data set or any part of it.
4. MCDPH will follow data suppression guidelines to develop and publish any PRAMS reports (all counts
less than 6 will be suppressed and provide warnings for estimates that are based on counts less than
10).
5. Any publication of data needs to first receive approval from the PRAMS program manager.
6. MCDPH will neither attempt, nor permit others to attempt, to use the data set or link it with other data
sets to learn the identity of any participant. If the identity of a respondent should be inadvertently
discovered, MCDPH will not use and/or distribute this information, nor will MCDPH permit others to use
the information. MCDPH will inform the AZ PRAMS staff at azpramsmanager@azdhs.gov of the
discovery but will not disclose any identifiable data in the e-mail, so they can prevent future discoveries.
MCDPH pledges that no staff members will inform anyone else of this knowledge.
7. When the proposed analyses are completed, all copies of these data will be destroyed.
Protocol for Data Breaches:
The CDC requires immediate reporting of any security breach of PRAMS data. In the event of a breach:
MCDPH shall notify the PRAMS program immediately via email upon the discovery of a data breach.
MCDPH shall immediately investigate such security incident, breach, or unauthorized use or disclosure
of participant information, including:
● What data elements were involved and the extent of the data involved in the breach;
● A description of the unauthorized person(s) known or reasonably believed to have improperly used
or disclosed the protected information;
● A description of where the protected information is believed to have been improperly transmitted,
sent, or utilized;

● A description of the probable causes of the improper use or disclosure; and Whether Arizona Revised
Statutes (A.R.S) 44-7501 or any other federal or state laws requiring individual notifications of
breaches are triggered.
MCDPH shall provide a written report of the investigation to the PRAMS program within forty-eight (48)
hours of the discovery of the breach or unauthorized use or disclosure. The report shall include the
information specified above, as well as a full, detailed corrective action plan, including information on
measures that were taken to halt and/or contain the improper use or disclosure,
As described in protocol PRAMS shall report the breach to the Centers for Disease Control and
Prevention as an 'adverse event' and shall follow all other pertaining protocols set in the implementation
manuals from the CDC.
Principal Contacts:
1. AZ PRAMS Principal Investigator: 480-273-3974
2. AZ PRAMS Manager: 480-216-9790
3. Population Survey Epidemiologist: 480-341-1201
Bureau of Assessment and Evaluation
Division of Public Health - Prevention Services
Arizona Department of Health Services
150 N. 18th Avenue, Suite 310
Phoenix, Arizona 85007

Maricopa County Department of Public Health
Office of Health Equity and Community Data
4041 N Central Ave, Suite 600
Phoenix, AZ 85012
Email: Jackie.Ward@maricopa.gov

Selection Criteria:
Limited de-identified PRAMS data as agreed by ADHS and MCDPH that match the selection criteria
described in section 2.2.1 of this MOU, including zip-code.
Frequency of Data Sharing:
On an annual basis, unless otherwise agreed upon.
Method of Data Transfer:

Data may be transferred from ADHS to MCDPH by any of the following methods listed in section 2.2.4 of this
MOU:
● Encrypted file transfer using Secure File Transfer Protocol (SFTP)