HIPAA Business Associate Agreements 2

Question 1

A cloud storage vendor hosts encrypted PHI for a covered entity but claims it cannot access the data. Under HIPAA, does this vendor require a BAA?

Accepted Answer

Yes, because it still creates, receives, maintains, or transmits PHI on behalf of the covered entity

Answer

No, because it cannot decrypt the PHI

Answer

Only if the vendor is based in the United States

Answer

Only if the covered entity has more than 500 patients

Question 2

Which of the following is a required element in every Business Associate Agreement?

Accepted Answer

A prohibition on the business associate using or disclosing PHI beyond what is permitted by the agreement

Answer

A fixed pricing schedule for services rendered

Answer

A requirement to store PHI only in the covered entity's data center

Answer

An annual audit conducted by the covered entity

Question 3

A business associate discovers a breach of unsecured PHI. Within how many calendar days must it notify the covered entity?

Accepted Answer

Without unreasonable delay and no later than 60 calendar days after discovery

Answer

Within 24 hours

Answer

Within 30 calendar days of discovery

Answer

Within 90 calendar days of the fiscal quarter end

Question 4

What happens to a BAA when the underlying service contract between a covered entity and a business associate expires?

Accepted Answer

The BAA obligations typically terminate along with the service contract unless PHI return/destruction obligations remain

Answer

The BAA automatically converts to a subcontractor agreement

Answer

The BAA remains in force indefinitely until formally terminated

Answer

The business associate must retain PHI for an additional 10 years

Question 5

A payroll company processes employee health benefit deductions for a hospital. Is the payroll company a business associate of the hospital?

Accepted Answer

Yes, if it receives PHI in the course of performing payroll services

Answer

Yes, because it handles financial data related to health benefits

Answer

No, because payroll functions are excluded from the definition of business associate

Answer

No, because employees are not patients

Question 6

Under the HIPAA Omnibus Rule, which party is directly liable for HIPAA compliance failures?

Accepted Answer

Both covered entities and business associates are directly liable

Answer

Only covered entities

Answer

Only business associates acting as agents of covered entities

Answer

Subcontractors only when they sign a BAA with the covered entity

Question 7

A covered entity wants to share a de-identified dataset with a vendor. Is a BAA required?

Accepted Answer

No, because de-identified data is not PHI and BAA requirements do not apply

Answer

Yes, all vendor relationships require a BAA regardless of data type

Answer

Yes, but only if the vendor will re-identify the data

Answer

No, unless the dataset contains more than 500 records