As of 2010, what is different with regard to business associates and HIPAA protections?

Question

Options

• ABusiness associates now must notify clients directly of privacy breaches, as if they were a covered
• BThere are no significant changes in business associate practices
• CCovered entities have increase responsibilities to ensure the practice of business associates
• DBusiness associates are no longer required to notify clients directly of privacy breaches

• A
  93% (26)
• B
  4% (1)
• D
  4% (1)

Explanation

Option A is correct because the HITECH Act (signed 2009, effective 2010) dramatically expanded HIPAA by making business associates directly liable under the law - not just through their contracts with covered entities. This means business associates must comply with breach notification requirements on their own, just as covered entities do, including notifying affected individuals.

Why the distractors are wrong:

• B is wrong because HITECH created sweeping, significant changes to business associate obligations - it was one of the most substantial expansions of HIPAA since the original law.
• C is wrong because HITECH actually reduced the covered entity's burden to police business associates by making business associates directly accountable; covered entities didn't gain increased oversight responsibilities.
• D is the exact opposite of the truth - HITECH added direct notification obligations to business associates rather than removing them.

Memory tip: Think "HITECH = Higher accountability." Before 2010, business associates hid behind their contracts; after HITECH, they stepped into the spotlight with the same breach notification duties as covered entities - no more middleman excuses.

No community discussion yet for this question.