ARFQ WEH2600000004 WV HIPAA BAA.pdf

This is a HIPAA Business Associate Agreement (BAA) document involving Welch Community Hospital and the West Virginia Department of Health and Human Resources (WVDHHR) Office of Health Facilities (OHF). The document establishes the terms and conditions under which Welch Community Hospital, as a business associate, will handle protected health information (PHI) on behalf of WVDHHR. The agreement outlines the hospital's obligations to safeguard patient data, implement required security measures, and comply with HIPAA Privacy, Security, and Breach Notification Rules. The BAA specifies the permitted uses and disclosures of PHI limited to the purposes outlined in the underlying service agreement between the parties.

The agreement details the business associate's responsibilities regarding administrative, physical, and technical safeguards for PHI, including access controls, audit logs, encryption requirements, and incident response protocols. Welch Community Hospital is required to maintain business associate status only for the duration of the contract and any applicable retention periods specified in the underlying service agreement. The hospital must notify WVDHHR of any unauthorized access, use, or disclosure of PHI and cooperate fully with breach investigations. The agreement establishes that WVDHHR retains the right to audit and monitor the hospital's compliance with HIPAA requirements and that all PHI must be returned or destroyed upon contract termination according to WVDHHR's instructions.