WV HIPAA BAA.pdf

This is a HIPAA Business Associate Addendum executed between the State of West Virginia (Agency) and Welch Community Hospital (Business Associate) to govern the handling of Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act of 1996 and related federal regulations at 45 CFR Parts 160 and 164. The addendum establishes the legal framework and operational requirements for the secure exchange, use, and disclosure of PHI between the parties in connection with an underlying service agreement. The document was approved as to form on June 21, 2011, by Patrick Morrissey, Attorney General, with Welch Community Hospital identified as the Agency partner in the agreement.

The addendum imposes comprehensive obligations on the Business Associate regarding PHI protection, including limitations on use and disclosure to stated purposes only, implementation of administrative, technical, and physical safeguards consistent with the Security Rule, maintenance of a documented privacy and security program, restriction of workforce access to necessary personnel, provision of employee training, notification of breaches within 24 hours of discovery to the Agency Procurement Officer and WV Office of Technology, mandatory reporting of security incidents with specific details within 72 hours, retention of PHI documentation for at least six years, and immediate discontinuation of PHI use or disclosure upon individual request. The addendum further requires the Business Associate to ensure all subcontractors and agents agree to identical restrictions and conditions, provide access to records for federal and state audits, submit proof of compliance with HIPAA and HITECH guidelines, undergo periodic security assessments, and bear all costs associated with breach notification and mitigation efforts. Ownership of all PHI remains with the Agency and may be returned or destroyed at the Agency's option upon termination of the underlying agreement, with the Business Associate maintaining continued confidentiality obligations and restrictions on further uses and disclosures.