CHPC Business Associate Agreements and Third-Party Compliance 2

Question 1

A business associate discovers a breach of unsecured PHI. How soon must it notify the covered entity?

Accepted Answer

Without unreasonable delay and no later than 60 days after discovery

Answer

Business associates must notify the covered entity without unreasonable delay and within 60 days of discovering a breach of unsecured PHI.

Question 2

Which of the following is a permitted use of PHI by a business associate WITHOUT requiring additional patient authorization?

Accepted Answer

Using PHI for the specific services described in the BAA with the covered entity

Answer

A business associate may only use or disclose PHI as permitted by its BAA with the covered entity or as required by law.

Question 3

What happens to a BAA if the underlying covered entity–business associate relationship ends?

Accepted Answer

The BA must return or destroy all PHI and confirm compliance to the covered entity

Answer

Upon termination of the relationship, the business associate must return or destroy all PHI and certify that no copies have been retained, unless retention is legally required.

Question 4

A HIPAA privacy officer is conducting a third-party vendor risk assessment. Which element should be PRIORITIZED in evaluating a new cloud vendor?

Accepted Answer

Whether the vendor will sign a HIPAA-compliant BAA and has documented security controls

Answer

The most critical factors are the vendor's willingness to sign a compliant BAA and evidence of security controls that protect PHI.

Question 5

Which scenario does NOT require a Business Associate Agreement?

Accepted Answer

A U.S. Postal Service carrier that incidentally delivers paper PHI on behalf of a covered entity

Answer

HIPAA explicitly exempts transmission-only entities like the USPS from the business associate definition when they are not accessing PHI content.

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC Business Associate Agreements and Third-Party Compliance 2