Business Associate Agreements are required by the regulation whenever a business associate relationship exists. This is true even when the business associates are both covered entities.

Question

Options

• AThere are no specific elements which must be included in a Business Associate Agreement.
• BThere are specific elements which must be included in a Business Associate Agreement. These
• CThere are no specific elements which must be included in a Business Associate Agreement.
• DThere are specific elements which must be included in a Business Associate Agreement. These

• B
  4% (2)
• C
  2% (1)
• D
  94% (47)

Explanation

HIPAA's Privacy Rule (45 CFR §164.504(e)) mandates Business Associate Agreements (BAAs) whenever a covered entity shares PHI with a business associate. Critically, this requirement applies even when both parties are themselves covered entities. The regulation does not leave the content of BAAs to the parties' discretion - it prescribes specific required elements, including: what the business associate may and may not do with PHI, requirements to safeguard PHI, obligations to report breaches, requirements to flow down obligations to subcontractors, and provisions for termination upon breach. Answer D is correct because it affirms both that specific required elements exist and that they are defined in the regulation.

No community discussion yet for this question.