WvBaaAgEffectiveJun2013.pdf

This is a Business Associate Agreement (BAA) document effective June 2013 issued by West Virginia, establishing the terms and conditions for entities providing services that involve handling protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA). The agreement applies to business associates working with West Virginia state agencies and healthcare entities that function as HIPAA covered entities. The BAA outlines the operational framework and compliance requirements that service providers must maintain when processing, storing, or transmitting PHI on behalf of the state. The document establishes the foundational legal relationship between West Virginia and any vendor selected to provide services involving health information management, including the DocuSign digital transaction and eSignature management services referenced in the related contract opportunity.

The agreement specifies that business associates must implement administrative, physical, and technical safeguards to protect PHI, maintain audit controls, ensure proper authorization and access controls, and provide breach notification procedures in accordance with HIPAA regulations. The BAA requires vendors to comply with all HIPAA Security and Privacy Rule requirements, restrict PHI use to purposes specified in the underlying service agreement, and permit West Virginia to conduct compliance audits and inspections. Vendors must also ensure subcontractors maintain equivalent BAA protections, return or destroy PHI upon contract termination, and indemnify the state for violations. This standard BAA template establishes the baseline compliance expectations for any digital transaction platform or eSignature solution provider contracting with West Virginia, ensuring that vendors managing sensitive health information meet federal regulatory standards and state requirements for information security and privacy protection.