Business Associate Agreements and Third-Party Compliance Flashcards

Which of the following best describes the 'minimum necessary' standard as it applies to business associates?

Answer: Business associates must limit PHI use and disclosure to what is necessary for the contracted purpose

Business associates are required to apply the minimum necessary standard, using and disclosing only the PHI needed to fulfill their contracted function.

A privacy officer learns that a business associate experienced a ransomware attack that encrypted PHI. Under HIPAA, this event is presumed to be:

Answer: A breach unless the BA can demonstrate a low probability that PHI was compromised

HHS guidance indicates ransomware attacks on PHI are presumed breaches because access by an unauthorized actor is implied unless the BA can rebut the presumption.

Which document formally authorizes a business associate to use PHI for a purpose not specified in the original BAA?

Answer: A BAA amendment or addendum signed by both parties

Any new permitted use or disclosure of PHI outside the original BAA scope requires a written amendment or addendum executed by both the covered entity and the business associate.

Under HIPAA, which of the following is an example of a business associate acting outside the scope of its BAA?

Answer: Using patient data to market the BA's own services without authorization

Using PHI for the BA's own marketing purposes goes beyond the contracted service and violates both the BAA and HIPAA's permitted use restrictions.

A hospital's privacy officer is reviewing contracts with a new telehealth platform vendor. The vendor claims it is a 'conduit' and does not need a BAA. The privacy officer should:

Answer: Evaluate whether the vendor stores or accesses PHI content beyond mere transmission before accepting the conduit claim

The conduit exception is narrow and applies only to entities that transport PHI without accessing its content; a telehealth platform that processes or stores PHI does not qualify.

What is the primary purpose of including indemnification clauses in a Business Associate Agreement from the covered entity's perspective?

Answer: To shift financial liability to the business associate for PHI breaches caused by the BA's actions

Indemnification clauses protect the covered entity by requiring the business associate to bear costs and liabilities arising from PHI breaches attributable to the BA's conduct.