ARFQ WEH2500000012 WV HIPAA BAA (1).pdf

This is a HIPAA Business Associate Agreement (BAA) document involving Welch Community Hospital and the West Virginia Department of Health and Human Resources (WVDHHR), Office of Health Facilities (OHF). The document establishes the terms and conditions under which Welch Community Hospital will serve as a business associate in handling protected health information (PHI) on behalf of WVDHHR/OHF. The BAA outlines the hospital's obligations to maintain compliance with Health Insurance Portability and Accountability Act (HIPAA) privacy and security standards when processing, storing, or transmitting any protected health information received from or created on behalf of the covered entity. The agreement specifies permitted uses and disclosures of PHI, establishes safeguards for information security, and delineates the responsibilities of both parties regarding breach notification, access rights, and amendment procedures.

The BAA includes standard HIPAA-required provisions addressing data security measures, employee training requirements, incident response protocols, and audit controls necessary for protecting sensitive health information. Welch Community Hospital is required to implement administrative, physical, and technical safeguards consistent with HIPAA regulations and to ensure all subcontractors handling PHI are bound by equivalent business associate obligations. The agreement establishes the hospital's liability for unauthorized access or disclosure of PHI and requires immediate notification to WVDHHR/OHF in the event of any suspected breaches. The BAA remains in effect for the duration of the underlying service relationship and continues for a specified period following contract termination to ensure proper disposal or return of all PHI in accordance with regulatory requirements.