HIPAA - Health Insurance Portability and Accountability Act Business Associate Agreements Questions and Answers

Question 1

A covered entity hires a third-party data analytics firm to process patient data for a quality improvement study.
The analytics firm then hires a cloud storage provider to host the data.
According to HIPAA, what is the minimum requirement for Business Associate Agreements (BAAs) in this scenario?

Accepted Answer

The covered entity must have a BAA with the analytics firm, and the analytics firm must have a separate BAA with the cloud provider.

Answer

The covered entity must have a single, three-party BAA with both the analytics firm and the cloud provider.

Answer

The covered entity only needs a BAA with the analytics firm, as this agreement automatically extends to any of their subcontractors.

Answer

No BAAs are required as long as the data is de-identified before being transferred to the cloud provider.

Question 2

Which of the following is a direct liability for a Business Associate under the HIPAA Omnibus Rule?

Accepted Answer

Failure to comply with the HIPAA Security Rule.

Answer

Failing to provide a Notice of Privacy Practices to patients.

Answer

Charging an unreasonable, cost-based fee for providing an individual with access to their PHI.

Answer

Designating a new Privacy Official without notifying the covered entity.

Question 3

A Business Associate Agreement (BAA) must include a provision that addresses the termination of the agreement. Which of the following is a required element of this termination provision?

Accepted Answer

A mandate for the business associate to return or destroy all PHI at the end of the contract.

Answer

A clause stating that the BAA is perpetual and can only be terminated by mutual consent.

Answer

A requirement that the business associate pay a financial penalty to the covered entity upon any termination.

Answer

A provision that all PHI becomes the property of the business associate upon termination.

Question 4

In which of the following situations is a Business Associate Agreement (BAA) NOT required?

Accepted Answer

A physician's office uses a courier service, like the US Postal Service, to mail patient records to another provider for treatment purposes.

Answer

A hospital hires a shredding company to dispose of paper records containing PHI.

Answer

A health plan uses a third-party administrator to process claims.

Answer

A medical practice hires an IT consultant who has persistent access to their electronic health record (EHR) system.

Question 5

A covered entity learns that its business associate has a pattern of non-compliance that constitutes a material breach of the Business Associate Agreement (BAA). If the business associate fails to cure the breach, what is the covered entity's primary obligation under HIPAA?

Accepted Answer

Terminate the BAA with the business associate, if feasible.

Answer

Report the business associate to the local law enforcement agency.

Answer

Immediately pay any fines on behalf of the business associate.

Answer

Publish a notice of the business associate's non-compliance in a major newspaper.

Question 6

A law firm provides legal services to a hospital and, in the course of its work, has access to PHI. Under HIPAA, what is the relationship between the law firm and the hospital?

Accepted Answer

The law firm is a 'Business Associate' and must have a signed BAA with the hospital.

Answer

The law firm is considered part of the hospital's workforce and does not need a BAA.

Answer

The law firm is a 'Covered Entity' in this context, operating under its own HIPAA policies.

Answer

The law firm is exempt from HIPAA because legal services are not a core healthcare function.