CHP CHP Business Associates & Vendor Management

Question 1

Under HIPAA, a Business Associate Agreement (BAA) is required when a vendor does which of the following?

Accepted Answer

Creates, receives, maintains, or transmits PHI on behalf of a covered entity

Answer

Sells medical supplies directly to patients

Answer

Provides building maintenance services to a hospital

Answer

Delivers food and catering services to a healthcare facility

Question 2

Which of the following is NOT a required element of a HIPAA Business Associate Agreement?

Accepted Answer

The business associate's annual revenue and profit margins

Answer

Description of permitted uses and disclosures of PHI

Answer

Obligation to report security incidents to the covered entity

Answer

Agreement to use PHI only as permitted by the BAA

Question 3

When a business associate discovers a breach of unsecured PHI, it must notify the covered entity:

Accepted Answer

Without unreasonable delay and no later than 60 days after discovery

Answer

Within 24 hours of discovery

Answer

Within 72 hours of discovery

Answer

Within 30 calendar days of discovery

Question 4

Under HIPAA, subcontractors of business associates who handle PHI are treated as:

Accepted Answer

Business associates with direct HIPAA obligations

Answer

Covered entities subject to the Privacy Rule only

Answer

Exempt third parties not covered by HIPAA

Answer

Workforce members of the original covered entity

Question 5

Which federal legislation made business associates directly subject to HIPAA compliance obligations?

Accepted Answer

The Health Information Technology for Economic and Clinical Health (HITECH) Act

Answer

The Affordable Care Act (ACA)

Answer

The Medicare Modernization Act of 2003

Answer

The Sarbanes-Oxley Act

Question 6

A covered entity discovers that its business associate has violated the terms of their BAA. What is the covered entity's first required step?

Accepted Answer

Take reasonable steps to cure the breach or end the violation

Answer

Immediately terminate the BAA without investigation

Answer

Report the violation directly to HHS OCR

Answer

File a lawsuit against the business associate