ARFQ WEH2500000006 WV HIPAA BAA.pdf

This document is a HIPAA Business Associate Agreement (BAA) related to a request for quote (ARFQ WEH2500000006) involving the West Virginia Department of Health and Human Resources (WVDHHR), Office of Health Facilities (OHF), and Welch Community Hospital. The BAA establishes the terms and conditions for protecting protected health information (PHI) that may be shared between the parties. The agreement specifies the obligations of the Business Associate in handling, safeguarding, and managing PHI in compliance with HIPAA regulations. The document outlines permitted uses and disclosures of PHI, security requirements, breach notification procedures, and the rights of the covered entity to audit and monitor compliance. The BAA also addresses subcontracting arrangements, data ownership, and requirements for termination of the agreement.

The agreement includes provisions regarding the Business Associate's responsibility to implement administrative, physical, and technical safeguards to protect PHI from unauthorized access or disclosure. The BAA specifies that the Business Associate must maintain compliance with all applicable HIPAA Security Rule requirements and notify the covered entity immediately upon discovery of any unauthorized access, use, or disclosure of PHI. The document establishes the framework for ongoing oversight, with provisions allowing the covered entity to conduct audits and inspections. The agreement remains in effect for the duration of the business relationship and continues to apply to any PHI retained after termination of the underlying contract, with specific procedures required for the return or destruction of such information.