Business Associate Agreements and Third-Party Compliance Flashcards
6 cards from real CHPC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Business Associate Agreements and Third-Party Compliance flashcards as text
Under HIPAA, which entity is required to sign a Business Associate Agreement (BAA) with a covered entity?
Answer: A vendor that creates, receives, maintains, or transmits PHI on behalf of the covered entity
A BAA is required with any business associate that creates, receives, maintains, or transmits PHI while performing services on behalf of the covered entity.
Which of the following is NOT required to be included in a Business Associate Agreement?
Answer: The business associate's liability insurance coverage amount
HIPAA mandates specific BAA provisions about permitted uses, safeguards, breach reporting, and PHI disposition, but does not require disclosure of the BA's insurance coverage.
A business associate hires a subcontractor who will have access to PHI. What must the business associate do?
Answer: Execute a BAA with the subcontractor that provides equivalent PHI protections
Business associates must obtain satisfactory assurances (via a BAA) from subcontractors that they will appropriately safeguard the PHI they handle.
When a covered entity discovers that a business associate has materially breached the BAA and the violation has not been cured, what must the covered entity do?
Answer: Terminate the contract with the business associate if feasible
HIPAA requires the covered entity to terminate the contract if a business associate materially breaches the BAA and does not cure the breach when feasible.
Which of the following entities is considered a business associate under HIPAA?
Answer: A cloud service provider that stores PHI for a covered entity
Cloud service providers that store or process PHI on behalf of covered entities are business associates and require a BAA.
Under HITECH, business associates are directly liable for which of the following?
Answer: Compliance with the HIPAA Security Rule's required and addressable safeguards
HITECH made business associates directly subject to the HIPAA Security Rule and certain Privacy Rule provisions, meaning HHS OCR can penalize them directly.