HIPPA BAA (1).pdf

This is a HIPAA Business Associate Agreement (BAA) document related to Professional Accounting & Financial Management Services for the State of West Virginia. The BAA establishes the legal and operational framework for protecting Protected Health Information (PHI) that may be exchanged between the state and its service providers. The agreement outlines the responsibilities of both the state (as the Covered Entity) and the vendor (as the Business Associate) in maintaining compliance with HIPAA Privacy and Security Rules. The document specifies requirements for safeguarding PHI, including administrative, physical, and technical security measures, breach notification procedures, and permitted uses and disclosures of health information. The BAA applies to the term of the underlying professional services contract and extends to any renewal periods.

The agreement imposes mandatory compliance obligations on the vendor, including implementation of security standards, employee training, incident response protocols, and audit controls. The vendor must maintain documentation of security practices and permit the state to conduct compliance audits and investigations. The BAA requires vendors to report any unauthorized access, use, or disclosure of PHI without unreasonable delay and establishes liability provisions whereby the vendor indemnifies the state for breaches or violations. Termination provisions require proper disposition or return of PHI upon contract conclusion. This BAA is a standard requirement for vendors providing services to West Virginia that may involve access to health information and demonstrates the state's commitment to HIPAA compliance in its procurement processes.