HIPAA Business Associate Agreements 5

Question 1

A telehealth platform vendor processes video visits for a covered entity. The vendor argues it is merely a 'conduit' like the postal service and does not need a BAA. Is this correct?

Accepted Answer

No, the conduit exception applies only to entities that transmit PHI without storing it; a telehealth platform that processes and stores PHI is a business associate

Answer

The conduit exception covers mere transmission with no PHI storage; a telehealth platform that stores or processes visit data is a business associate requiring a BAA.

Question 2

When a BAA is required but never executed, which party bears the greatest regulatory risk if PHI is misused?

Accepted Answer

The covered entity, because it is responsible for ensuring BAAs are in place before sharing PHI

Answer

Covered entities are responsible for obtaining signed BAAs before sharing PHI; failing to do so exposes the covered entity to HIPAA penalties.

Question 3

A business associate agrees to provide data analytics but later expands its services to include direct patient communications without amending the BAA. What HIPAA issue does this create?

Accepted Answer

The business associate's new activities may exceed the permitted uses of PHI under the existing BAA, creating a violation

Answer

Using PHI for purposes beyond those specified in the BAA violates HIPAA; the BAA must be amended to authorize new activities involving PHI.

Question 4

A research institution receives de-identified data from a hospital for a study, then re-identifies the data using a secondary dataset it possesses. What HIPAA obligation may the hospital have failed to meet?

Accepted Answer

The hospital should have executed a BAA and data use agreement to restrict re-identification by the institution

Answer

If there is a reasonable basis to believe re-identification could occur, the hospital should use a limited data set with a data use agreement or a full BAA to prohibit re-identification.

Question 5

Under HIPAA, what must a BAA require regarding the business associate's minimum necessary standard when using PHI?

Accepted Answer

The business associate must use, disclose, or request only the minimum PHI necessary to accomplish the intended purpose

Answer

Business associates are bound by the minimum necessary standard and must limit their use and disclosure of PHI to what is needed for the specified purpose.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Business Associate Agreements 5