HIPPA-BAA.pdf

This is a Business Associate Agreement (BAA) template document establishing HIPAA compliance requirements between a covered entity and a business associate. The agreement applies to the West Virginia state government and any contractors or vendors providing services related to the Transitional Living Facility HVAC Replacement project who will have access to protected health information (PHI).

The BAA outlines mandatory safeguards for the handling, storage, transmission, and protection of PHI in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules. Key provisions include requirements for the business associate to implement administrative, physical, and technical safeguards; restrict PHI use to purposes specified in the underlying service agreement; ensure workforce members sign confidentiality agreements; maintain audit controls and logs; report any unauthorized access or breaches within 60 days; and permit the covered entity to audit compliance. The business associate must also ensure any subcontractors comply with equivalent HIPAA requirements through written agreements. The document specifies that upon termination of services, all PHI must be returned or destroyed as directed, and the business associate remains liable for breaches occurring during the contract term and for up to six years thereafter. This BAA is a prerequisite document that must be executed prior to any service provider gaining access to health information related to facility residents or operations.