HIPPA FORM (2).pdf

This document is a HIPAA Business Associate Addendum between the State of West Virginia government and an unnamed Business Associate, designed to establish responsibilities for handling Protected Health Information (PHI) in compliance with the Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act. The addendum outlines the terms under which the Business Associate will perform services requiring the exchange of confidential health information, with a focus on maintaining the privacy, security, and proper use of PHI created, received, maintained, or transmitted on behalf of the Agency.

The addendum details specific obligations for the Business Associate, including implementing appropriate safeguards to prevent unauthorized use or disclosure of PHI, limiting access to PHI to only those workforce members who require it to complete assigned tasks, and maintaining comprehensive written privacy and security programs. The document also establishes protocols for breach notification, with the Associate required to immediately investigate and report any security incidents to the Agency within specified timeframes. Key provisions include restrictions on selling or improperly using PHI, requirements for subcontractor compliance, and the Associate's responsibilities for mitigating any harmful effects of PHI breaches. The addendum will terminate simultaneously with the underlying agreement and requires the Associate to return or destroy all PHI upon contract termination.