CTR065009_BAA.pdf

This document is a Business Associate Agreement (BAA) between the Arizona Department of Economic Security (DES) and the AARP Foundation, specifically addressing compliance with the Health Insurance Portability & Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH). The agreement establishes the terms and conditions for the AARP Foundation's handling of Protected Health Information (PHI) on behalf of the DES Covered Component, ensuring regulatory compliance and data protection standards.

The agreement outlines the Business Associate's obligations in managing PHI, including strict guidelines for use, disclosure, safeguarding, and handling of sensitive health information. Key requirements include implementing appropriate administrative, physical, and technical safeguards, reporting any potential security incidents within one business day, maintaining confidentiality, providing data aggregation services if requested, and ensuring that any subcontractors or agents adhere to the same stringent privacy and security protocols. The contract is effective from the date of signing and will terminate when all PHI is returned or destroyed, with provisions for extending protections if complete return or destruction is not feasible.