WV HIPAA BAA.pdf

This is a HIPAA Business Associate Agreement (BAA) between Welch Community Hospital and the West Virginia Department of Health and Human Resources (WVDHHR) Office of Health Facilities (OHF). The document establishes the legal framework governing the handling of protected health information (PHI) by Welch Community Hospital as a business associate to the covered entity. The agreement outlines the hospital's obligations to safeguard patient health information in compliance with HIPAA Privacy, Security, and Breach Notification Rules, including requirements for administrative, physical, and technical safeguards, workforce training, and incident response protocols.

The BAA specifies that Welch Community Hospital must implement and maintain security measures to protect the confidentiality, integrity, and availability of PHI, with provisions for authorized use limited to treatment, payment, and healthcare operations. The agreement includes terms requiring the hospital to report any suspected or confirmed breaches of unsecured PHI to WVDHHR without unreasonable delay, maintain compliance documentation, and permit regulatory audits and investigations. The contract establishes ongoing obligations for the duration of the business relationship and extends post-termination requirements for secure destruction or return of all PHI. No specific pricing, project timeline, or award dates are detailed in this compliance-focused agreement, as it serves as an enabling document for lawful PHI exchange rather than a traditional procurement contract.