ARFQ WEH2500000007 WV HIPAA BAA.pdf

This is a HIPAA Business Associate Agreement (BAA) document involving the West Virginia Department of Health and Human Resources (WVDHHR), Office of Health Facilities (OHF), and Welch Community Hospital. The document establishes the terms and conditions under which Welch Community Hospital will serve as a business associate in handling protected health information (PHI) on behalf of WVDHHR/OHF. The agreement outlines the hospital's obligations to maintain compliance with HIPAA privacy, security, and breach notification rules when processing, storing, or transmitting PHI related to state health programs and services.

The BAA specifies the permitted uses and disclosures of PHI limited to the purposes outlined in the underlying service agreement between the parties. Welch Community Hospital must implement appropriate administrative, physical, and technical safeguards to protect health information, maintain comprehensive audit controls and logs, and immediately notify WVDHHR/OHF of any suspected or confirmed breaches of unsecured PHI. The agreement requires the hospital to ensure its subcontractors and workforce members execute similar business associate agreements or comply with equivalent HIPAA requirements, and the hospital remains liable for breaches caused by its agents or contractors.