National BAA Signed Jan23.pdf

This document is a Business Associate Agreement (BAA) between the Department of Veterans Affairs Veterans Health Administration (VHA) and Varian Medical Systems, Inc. The agreement establishes requirements for Varian Medical Systems to provide radiation therapy and medical imaging equipment, training, and FullScale Infinity Managed Services (virtual infrastructure services) for or on behalf of the VHA.

The BAA outlines detailed obligations for handling Protected Health Information (PHI), including strict protocols for use, disclosure, security, and breach notification in compliance with HIPAA Rules. Key provisions include Varian's responsibilities to implement administrative, physical, and technical safeguards to protect PHI, notify VHA of any potential incidents within three business days, and ensure that any subcontractors maintain the same level of data protection. The agreement was revised in February 2021 and became effective on January 16, 2023, with signatures from Stephanie H. Griffin, J.D., Director of Information Access & Privacy for VHA, and Patrick King, Director of AMS Contracts at Varian Medical Systems.