CHPC Business Associate Agreements and Third-Party Compliance 5

Question 1

A hospital discloses PHI to an outside specialist physician for a patient's treatment. Is a BAA required?

Accepted Answer

No, disclosures to a health care provider for treatment do not require a BAA

Answer

The Privacy Rule specifically excludes treatment disclosures to providers from the business associate requirements.

Question 2

A covered entity learns that its business associate is materially violating the BAA. What must the covered entity do first?

Accepted Answer

Take reasonable steps to cure the breach or end the violation, and terminate the contract if that is unsuccessful and feasible

Answer

45 CFR 164.504(e)(1)(ii) requires the covered entity to take reasonable steps to cure the breach, and to terminate if those steps fail and termination is feasible.

Question 3

Which party is generally NOT a business associate of a covered entity?

Accepted Answer

A member of the covered entity's own workforce

Answer

Workforce members are part of the covered entity and are excluded from the business associate definition.

Question 4

A business associate acts as an agent of the covered entity under federal common law and discovers a breach. When is the breach treated as discovered by the covered entity?

Accepted Answer

At the same time the business associate discovers it

Answer

When the BA is an agent, the BA's knowledge is imputed to the covered entity, so the CE's notification clock starts at the BA's discovery.

Question 5

Under the BAA, a business associate may use PHI for which of the following?

Accepted Answer

Its own proper management and administration, if the BAA permits it

Answer

A BAA may allow the BA to use PHI for its proper management and administration and to meet its legal responsibilities.

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC Business Associate Agreements and Third-Party Compliance 5