nerdexam
(ISC)2

HCISPP · Question #313

Business Associates

The correct answer is A. are entities that perform services that require the use of Protected Health Information on behalf of. HIPAA defines a Business Associate as an entity that performs services requiring the use of Protected Health Information (PHI) on behalf of a covered entity.

Third-Party Risk Management

Question

Business Associates

Options

  • Aare entities that perform services that require the use of Protected Health Information on behalf of
  • Bare entities that do not perform services that require the use of Protected Health Information on
  • Care entities that perform services that require the use of Encrypted Insurance Information on behalf
  • Dare entities that perform services that require the use of Protected Health Information on behalf of

How the community answered

(45 responses)
  • A
    93% (42)
  • B
    2% (1)
  • C
    4% (2)

Why each option

HIPAA defines a Business Associate as an entity that performs services requiring the use of Protected Health Information (PHI) on behalf of a covered entity.

Aare entities that perform services that require the use of Protected Health Information on behalf ofCorrect

Under HIPAA (45 CFR 160.103), a Business Associate is specifically defined as a person or entity that performs functions or activities on behalf of a covered entity that involve the use or disclosure of PHI. The key elements are the service relationship, the covered entity context, and the involvement of PHI - all captured in choice A.

Bare entities that do not perform services that require the use of Protected Health Information on

This inverts the HIPAA definition - Business Associates are defined precisely by their requirement to use PHI, not by the absence of such use.

Care entities that perform services that require the use of Encrypted Insurance Information on behalf

'Encrypted Insurance Information' is not a recognized HIPAA term; the regulation uses 'Protected Health Information' (PHI), making this choice factually incorrect.

Dare entities that perform services that require the use of Protected Health Information on behalf of

Choice D appears nearly identical to A in the visible text but differs in the truncated portion - since A is designated correct, D must contain an inaccurate qualifier or entity type in the omitted text.

Concept tested: HIPAA Business Associate definition under 45 CFR 160.103

Source: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html

Topics

#Business Associate#HIPAA#Protected Health Information#Third-Party Relationships

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full HCISPP Practice