ADCS_Business_Associate_HITECH-signed.pdf

This is a HIPAA Business Associate Agreement ("BAA") between the Arizona Department of Child Safety ("ADCS") and Care Youth Corporation, a business managing director signed by Rusty Alexander. The agreement was executed on November 27, 2025, and supplements an underlying contract between ADCS and Care Youth Corporation that involves the disclosure and handling of Protected Health Information ("PHI") and Electronic Protected Health Information ("ePHI") under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act of 2009 ("HITECH"). The agreement establishes the legal framework ensuring that Care Youth Corporation, as a Business Associate to ADCS, complies with federal and state privacy and security standards.

Care Youth Corporation is authorized to use and disclose PHI only for purposes necessary to perform functions, activities, or services on behalf of ADCS as specified in the underlying contract, or as required by law. The company must implement appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI in accordance with HIPAA regulations (45 C.F.R. Parts 160, 162, and 164, and 42 U.S.C. §17938). Key obligations include reporting any breaches or security incidents to ADCS within one business day of discovery; maintaining data aggregation services; de-identifying PHI according to regulatory standards; providing access to protected information within ten business days; retaining all PHI records for six years from creation or last use; and permitting ADCS to conduct inspections and audits to ensure compliance. The agreement terminates when all PHI is destroyed or returned to ADCS, and either party may terminate for material breach or upon discovery of violations of HIPAA, HITECH, or other security and privacy laws.