HIPAA Business Associate Agreements 3

Question 1

A business associate engages a subcontractor to perform data analytics involving PHI. What must the business associate do?

Accepted Answer

Enter into a BAA with the subcontractor that imposes equivalent PHI protections

Answer

Business associates must obtain satisfactory assurances from subcontractors through a BAA that imposes the same PHI safeguards required of the business associate.

Question 2

Which of the following scenarios would NOT require a Business Associate Agreement?

Accepted Answer

A janitorial company whose staff may incidentally view PHI on a whiteboard

Answer

Incidental exposure by a janitorial company does not make it a business associate; BAAs apply to those who handle PHI as a function of their service.

Question 3

A BAA must require the business associate to make its internal practices available to which government agency upon request?

Accepted Answer

The Department of Health and Human Services (HHS)

Answer

BAAs must require the business associate to make its books, records, and practices available to HHS for purposes of determining the covered entity's compliance.

Question 4

If a covered entity cannot obtain a BAA from a business associate despite good-faith efforts, what should the covered entity do?

Accepted Answer

Cease sharing PHI with that vendor and seek an alternative that will sign a BAA

Answer

If a business associate refuses to enter a BAA, the covered entity must stop sharing PHI with that vendor to remain compliant.

Question 5

What is the primary purpose of the 'termination for cause' provision typically included in a BAA?

Accepted Answer

To permit the covered entity to terminate the BAA if the business associate materially breaches its PHI obligations

Answer

The termination for cause provision allows the covered entity to end the relationship if the business associate violates the BAA's PHI protection requirements.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Business Associate Agreements 3