HIPAA BAA.pdf

This is a HIPAA Business Associate Agreement (BAA) involving Welch Community Hospital and the West Virginia Department of Health and Human Resources (WVDHHR), Office of Health Facilities (OHF). The document establishes the terms and conditions under which Welch Community Hospital, as a business associate, will handle protected health information (PHI) on behalf of WVDHHR/OHF as the covered entity. The agreement outlines the hospital's obligations to maintain compliance with HIPAA Privacy and Security Rules while processing, storing, and managing sensitive health information. The BAA specifies the permitted uses and disclosures of PHI, security safeguards required, breach notification procedures, and the hospital's responsibilities regarding data protection and confidentiality. The term of the agreement typically extends for the duration of the underlying business relationship and continues for specified periods after termination.

The BAA contains standard provisions requiring Welch Community Hospital to implement administrative, physical, and technical safeguards to protect PHI from unauthorized access, use, or disclosure. The agreement obligates the hospital to ensure subcontractors and workforce members comply with HIPAA requirements and to maintain audit controls and security measures. Additionally, the hospital must notify WVDHHR/OHF of any confirmed or suspected breaches of unsecured PHI without unreasonable delay. The agreement does not establish pricing terms or financial compensation but rather defines the compliance framework and liability allocations between the parties. This BAA serves as a foundational compliance document required for any entity handling PHI on behalf of a covered entity under HIPAA regulations.