The Health Insurance Portability and Accountability Act (HIPAA) requires an agreement between Cloud Service Providers (CCSP) and the covered entity. Based on HIPAA. which document must be completed…

Question

Options

• ABusiness Associate Agreement (BAA)
• BMemorandum of Understanding (MOU)
• CService Level Agreement (SLA)
• DInterconnection Security Agreement (ISA)

• A
  71% (25)
• B
  9% (3)
• C
  17% (6)
• D
  3% (1)

Explanation

A (BAA) is correct because HIPAA explicitly mandates that covered entities (hospitals, insurers, etc.) execute a Business Associate Agreement with any third party - including Cloud Service Providers - that creates, receives, maintains, or transmits Protected Health Information (PHI) on their behalf. The BAA legally binds the CCSP to HIPAA's privacy and security requirements and defines each party's obligations regarding PHI.

Why the distractors are wrong:

• B (MOU) is an informal, non-binding document used to outline general intent between parties - it carries no legal enforcement power under HIPAA.
• C (SLA) addresses service performance metrics (uptime, response times) but does not cover HIPAA privacy/security obligations - it's a commercial, not a compliance, document.
• D (ISA) is used between federal agencies or organizations to govern the security of interconnected IT systems (common in NIST/FISMA contexts), not a HIPAA-specific requirement.

Memory tip: Think BAA = HIPAA's handshake. Any "Business Associate" (anyone outside the covered entity who touches PHI) requires a BAA - no exceptions. If the question mentions HIPAA + a third party + PHI, the answer is always the BAA.

No community discussion yet for this question.