Business Associate Agreements and Third-Party Compliance Flashcards
6 cards from real CHPC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Business Associate Agreements and Third-Party Compliance flashcards as text
A business associate discovers a breach of unsecured PHI. How soon must it notify the covered entity?
Answer: Without unreasonable delay and no later than 60 days after discovery
Business associates must notify the covered entity without unreasonable delay and within 60 days of discovering a breach of unsecured PHI.
Which of the following is a permitted use of PHI by a business associate WITHOUT requiring additional patient authorization?
Answer: Using PHI for the specific services described in the BAA with the covered entity
A business associate may only use or disclose PHI as permitted by its BAA with the covered entity or as required by law.
What happens to a BAA if the underlying covered entity–business associate relationship ends?
Answer: The BA must return or destroy all PHI and confirm compliance to the covered entity
Upon termination of the relationship, the business associate must return or destroy all PHI and certify that no copies have been retained, unless retention is legally required.
A HIPAA privacy officer is conducting a third-party vendor risk assessment. Which element should be PRIORITIZED in evaluating a new cloud vendor?
Answer: Whether the vendor will sign a HIPAA-compliant BAA and has documented security controls
The most critical factors are the vendor's willingness to sign a compliant BAA and evidence of security controls that protect PHI.
Which scenario does NOT require a Business Associate Agreement?
Answer: A U.S. Postal Service carrier that incidentally delivers paper PHI on behalf of a covered entity
HIPAA explicitly exempts transmission-only entities like the USPS from the business associate definition when they are not accessing PHI content.
A business associate receives a subpoena for PHI. What should it do first?
Answer: Notify the covered entity and review whether disclosure is permitted under the BAA or law
Business associates should consult their BAA and notify the covered entity before disclosing, since the BA's permitted disclosures are governed by the agreement and applicable law.