2-Attachment I HIPAA Business Associate Agreement.pdf

This document is a HIPAA Business Associate Agreement (BAA) attachment related to the Arizona Department of Health Services' Registry Staffing Services procurement for the Arizona State Hospital. The agreement establishes the legal framework governing the relationship between ADHS (as the Covered Entity) and contracted staffing providers (as Business Associates) in handling Protected Health Information (PHI). The BAA outlines the permitted uses and disclosures of PHI, establishing that Business Associates may only use or disclose PHI as necessary to perform staffing services or as otherwise permitted by HIPAA regulations. The agreement specifies that Business Associates must implement administrative, physical, and technical safeguards to protect PHI, maintain compliance with HIPAA Security and Privacy Rules, and establish audit controls and access logs. Business Associates are required to report any suspected or confirmed breaches of unsecured PHI to ADHS without unreasonable delay and must cooperate with ADHS in breach notification obligations to affected individuals.

The BAA further delineates Business Associate responsibilities including restrictions on PHI subcontracting without prior written authorization, requirements for employee confidentiality agreements, documentation of workforce training and sanctions policies, and procedures for secure destruction or return of PHI upon contract termination. The agreement authorizes ADHS to audit and inspect Business Associate facilities, systems, and records to verify compliance with HIPAA requirements. Termination provisions require the return or destruction of all PHI within specified timeframes, and the agreement remains in effect for the duration of the staffing contract plus six years following termination. This BAA is a mandatory compliance document essential for any contractor providing Registry Staffing Services at the Arizona State Hospital, as healthcare workers will necessarily access patient health information during their employment at the facility.