WV HIPAA BAA.pdf

This is a HIPAA Business Associate Addendum between the State of West Virginia ("Agency") and an unnamed Business Associate for Welch Community Hospital. The document establishes the responsibilities and requirements for handling Protected Health Information (PHI) in accordance with HIPAA regulations, the HITECH Act of 2009, and associated federal regulations under 45 CFR parts 160 and 164. The addendum outlines comprehensive requirements for data security, breach notification, PHI handling protocols, and compliance measures.

The agreement specifies detailed operational requirements including retention of PHI for six years after contract termination, mandatory breach reporting within 24 hours, and incident investigation protocols. The Business Associate must implement appropriate safeguards for electronic PHI, limit workforce access to PHI, provide staff training, and maintain comprehensive privacy and security programs. All costs associated with breach notifications or mitigation efforts must be borne by the Business Associate. The agreement is specific to protected health information including patient demographics, medical records, test results, and treatment information for Welch Community Hospital patients.