Attachment_6_Business_Associate_Agreement.pdf

This document is a Business Associate Agreement (BAA) between the Arizona Department of Economic Security (DES) and Phoenix Rescue Mission, a business associate. The agreement is designed to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009. It establishes guidelines for handling Protected Health Information (PHI) in accordance with federal and state privacy and security regulations.

The agreement outlines the responsibilities of Phoenix Rescue Mission in managing, protecting, and handling sensitive health information. Key provisions include strict limitations on PHI use and disclosure, requirements for safeguarding electronic and physical health records, mandatory reporting of any security incidents, and provisions for data retention and destruction. The business associate must implement appropriate administrative, physical, and technical safeguards to prevent unauthorized use of PHI, train its workforce on privacy requirements, and maintain comprehensive documentation of all PHI-related activities. The contract includes detailed protocols for managing potential breaches, amendments to health information, and auditing processes, with provisions for termination if compliance standards are not met.