Business Associate Agreements and Third-Party Compliance Flashcards

A hospital discloses PHI to an outside specialist physician for a patient's treatment. Is a BAA required?

Answer: No, disclosures to a health care provider for treatment do not require a BAA

The Privacy Rule specifically excludes treatment disclosures to providers from the business associate requirements.

A covered entity learns that its business associate is materially violating the BAA. What must the covered entity do first?

Answer: Take reasonable steps to cure the breach or end the violation, and terminate the contract if that is unsuccessful and feasible

45 CFR 164.504(e)(1)(ii) requires the covered entity to take reasonable steps to cure the breach, and to terminate if those steps fail and termination is feasible.

Which party is generally NOT a business associate of a covered entity?

Answer: A member of the covered entity's own workforce

Workforce members are part of the covered entity and are excluded from the business associate definition.

A business associate acts as an agent of the covered entity under federal common law and discovers a breach. When is the breach treated as discovered by the covered entity?

Answer: At the same time the business associate discovers it

When the BA is an agent, the BA's knowledge is imputed to the covered entity, so the CE's notification clock starts at the BA's discovery.

Under the BAA, a business associate may use PHI for which of the following?

Answer: Its own proper management and administration, if the BAA permits it

A BAA may allow the BA to use PHI for its proper management and administration and to meet its legal responsibilities.

A bank processes a health plan's premium payments by check and credit card. Under HIPAA, the bank is generally:

Answer: Not a business associate, because Section 1179 of HIPAA exempts these payment-processing activities

HIPAA Section 1179 exempts financial institutions that only process payments from the business associate requirements.

A janitorial service may occasionally see PHI while cleaning a clinic after hours. Does the clinic need a BAA with the service?

Answer: No, because any exposure is incidental and the service does not perform functions involving PHI

HHS says a BAA is not needed when a service's access to PHI is incidental and its work does not involve using or disclosing PHI.