Summary of Attachment J - BAA

This is a Business Associate Agreement (BAA) document for the West Virginia Immunization Information System (IIS) contract, establishing terms between the state health agency and contracted service providers regarding the handling of protected health information (PHI). The agreement outlines the responsibilities of business associates in managing, processing, and safeguarding patient immunization data and related health information in compliance with the Health Insurance Portability and Accountability Act (HIPAA). The BAA specifies permitted uses and disclosures of PHI, required administrative and technical safeguards, breach notification procedures, and audit and compliance obligations. The contractor must implement comprehensive security measures to protect confidential health records, limit access to authorized personnel, maintain detailed documentation of PHI handling activities, and immediately report any unauthorized access or data breaches to the state entity.

The agreement establishes ongoing compliance requirements throughout the contract term, including mandatory staff training on HIPAA regulations and PHI protection protocols. The contractor is required to cooperate fully with state audits, investigations, and compliance reviews, and must provide evidence of implemented security controls upon request. The BAA permits the state to terminate the agreement or take corrective action if the contractor fails to maintain required protections or breaches confidentiality obligations. The contractor assumes liability for violations and unauthorized use or disclosure of PHI, with obligations extending beyond contract termination to ensure proper destruction or return of all sensitive health information maintained during the engagement.