CHP Business Associates & Vendor Management Flashcards

To what extent is a covered entity responsible for the HIPAA-related actions of its business associates?

Answer: To the extent defined by the BAA terms and its own oversight obligations

Covered entities are responsible to the extent defined by BAA terms and must take corrective action when violations become known.

Which of the following best describes a 'downstream' business associate under HIPAA?

Answer: A subcontractor of a business associate that also handles PHI

A downstream business associate is a subcontractor of a business associate that creates, receives, maintains, or transmits PHI in the course of its work.

What is the primary purpose of a covered entity conducting periodic audits of its business associates?

Answer: To verify that business associates are meeting their HIPAA obligations under the BAA

Periodic audits help covered entities verify that business associates are handling PHI in accordance with the BAA and applicable HIPAA standards.

Following HITECH, a business associate that knowingly violates HIPAA can be subject to:

Answer: Both civil monetary penalties and criminal prosecution

Since the HITECH Act, business associates are directly subject to both HIPAA civil monetary penalties and criminal prosecution.

Which of the following is the clearest example of a HIPAA business associate?

Answer: A billing company that processes insurance claims containing PHI for a covered entity

A billing company that processes PHI-containing claims on behalf of a covered entity is a textbook example of a HIPAA business associate.

What must a covered entity do if it cannot cure a material breach of a BAA by its business associate?

Answer: Terminate the BAA if feasible to do so

If a material BAA breach cannot be cured, the covered entity must terminate the Business Associate Agreement if termination is feasible.