HIPAA Business Associate Agreements 4

Question 1

Which of the following workforce members of a business associate is directly subject to HIPAA's workforce conduct requirements?

Accepted Answer

All workforce members of the business associate who handle PHI

Answer

All workforce members of a business associate who handle PHI must comply with HIPAA safeguards, not just designated officers.

Question 2

A marketing firm offers to analyze patient data and share aggregated results with third parties for profit. A covered entity wants to hire this firm. What HIPAA concern arises?

Accepted Answer

The BAA would need to explicitly prohibit the firm from using PHI for its own commercial purposes

Answer

A BAA must prohibit business associates from using PHI for their own purposes, including commercial gain, beyond what the agreement permits.

Question 3

A hospital system acquires a smaller clinic. The clinic has an existing BAA with a billing vendor. What should the hospital do regarding this BAA?

Accepted Answer

Review and update the BAA to reflect the new covered entity relationship and ensure it meets current HIPAA standards

Answer

After an acquisition, the new covered entity should review existing BAAs to confirm they are adequate and properly reflect the new organizational structure.

Question 4

What does HIPAA require a BAA to say about the business associate's obligation to report security incidents?

Accepted Answer

The business associate must report security incidents, including unsuccessful attempts, to the covered entity

Answer

BAAs must require business associates to report security incidents, including unsuccessful attempts to breach security, to the covered entity.

Question 5

A business associate goes out of business and cannot return or destroy PHI it holds. What is the recommended course of action?

Accepted Answer

The BAA should address this scenario and typically requires the business associate to notify the covered entity and attempt to transfer PHI securely

Answer

BAAs should include provisions for PHI disposition when the business associate ceases operations, ensuring the covered entity is notified and PHI is protected.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Business Associate Agreements 4