Exhibit 5_BAA.pdf

This document is a HIPAA Business Associate Addendum between the State of West Virginia Government and an unnamed Business Associate, designed to establish responsibilities for protecting Protected Health Information (PHI) in compliance with the Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act. The addendum outlines the Associate's obligations in handling PHI, including strict limitations on use and disclosure, requirements for safeguarding electronic and physical health information, mandatory reporting of security incidents, and specific protocols for managing potential breaches of confidential medical data.

The addendum provides comprehensive guidelines for the Associate's handling of PHI, including provisions for access to records, amendment of information, accounting of disclosures, and individual rights protection. Key stipulations include the Associate's responsibility to investigate and report any security incidents within 72 hours, ensure confidentiality of all PHI, implement appropriate administrative and technical safeguards, and assist the Agency in litigation or administrative proceedings related to HIPAA compliance. The document emphasizes that ownership of PHI remains with the Agency, and the Associate is prohibited from selling or improperly using the information, with potential termination of the underlying agreement for non-compliance.