HIPAA requires that every healthcare professional maintain the privacy and confidentiality of all protected health information (PHI). Business associates are a person or entity that provides services to a covered entity involving the disclosure of PHI. Reinforce a participant’s understanding of HIPAA privacy, security, and breach notification rules with this starter Qstream microlearning course.
Navigate through the Qstream questions below to preview. Each challenge is designed following Qstream’s best practices for maximum knowledge reinforcement and engagement. This Qstream is free for clients to use as a starting point.
Click on each title to preview the question in the mobile/desktop widget.
Follow the interactions on each screen to answer Qstream questions as a Participant.
Answer explanation:
A HIPAA business associate (BA) is any entity that is provided with access to Protected Health Information (PHI) to perform services or functions for a HIPAA-covered entity. A BA can be either an individual, a corporation or a company.
Examples of Business Associates include a/an:
• Third-party administrator that assists a health plan with claims processing
• Consultant that performs utilization reviews for a hospital
• Healthcare clearinghouse that translates a claim from a non-standard format into a standard transaction on behalf of a healthcare provider, and forwards the processed transaction to a payer
• Independent medical transcriptionist that provides transcription services to a physician
BAs of covered entities must also comply with HIPAA Rules and can be fined directly by regulators for non-compliance.
Answer explanation:
Heather’s function is billing which is defined as a business associate function. Her service is administrative in that she oversees some employee billing as well as providing training in-office. Because of this, Heather will be considered a business associate of Dr. Kittrell for all activities covered by their independent contractor relationship whether they are performed at home or in the office.
Examples of Business Associates (BAs) functions and activities include claims processing or administration, benefits management, utilization review, quality assurance, and billing.
Examples of services provided by BAs include legal, accounting, data aggregation, and financial.
Answer explanation:
Dr. Frankel may decide to submit a modified agreement to Visa and Mastercard that is more aligned with his state’s HIPAA regulations than federal ones.
Because Visa and Mastercard provide standard banking and financial transactions (i.e., processing of credit card and electronic funds payments), they are exempt from HIPAA Rules for Business Associates.
According to the U.S. Department of Health and Human Services (HHS), this applies when a financial institution;
• Processes consumer-conducted financial transactions by debit, credit, or other payment cards
• Clears checks
• Initiates or processes electronic funds transfers
• Conducts any other activity that directly facilitates or affects the transfer of funds for payment for healthcare or health plan premiums
Answer explanation:
A software provider, whose solutions interact with systems containing electronically protected health information (ePHI), is considered a business associate. The same applies to cloud service providers, cloud platforms, document storage companies (physical and electronic storage), collection agencies, medical billing companies, asset, and document recycling companies, answering services, attorneys, actuaries, consultants, medical device manufacturers, transcription companies, CPA firms, third party administrators, medical couriers, and marketing firms.
Answer explanation:
If a covered entity engages a business associate to help carry out its health care activities and functions, the covered entity must have a written business associate contract with the business associate that:
• Establishes specifically what the business associate has been engaged to do
• Requires the business associate to comply with HIPAA
Access to protected health information (PHI) is permitted to accomplish the performance of certain tasks for a covered entity. Vendors must agree to use the PHI exclusively for the tasks they have been contracted to perform before PHI can be shared. They must also agree not to disclose the PHI to other entities and must implement safeguards to ensure the confidentiality, integrity, and availability of PHI.
Answer explanation:
The U.S. Department of Health and Human Services (HHS) stated that business associates and their subcontractors may now face HIPAA enforcement actions and are directly liable for violating the HIPAA Security Rule and enumerated provisions of the Privacy and Breach Notification Rules.
The subcontractor must sign a BAA with the vendor. The subcontractor may - but is not required to -sign a BAA with the covered entity. In the BAA the subcontractors must promise to safeguard the electronically protected health information (ePHI) it creates, receives, maintains, or transmits on behalf of the business associate.
Answer explanation:
An impermissible use or disclosure of PHI is presumed to be a breach unless the covered entity demonstrates that there is a “low probability” that the PHI has been compromised.
The severity of improper use or disclosure of PHI must be made by assessing whether the use or disclosure meets HIPAA’s “low probability of compromise” threshold. A 4-factor test should be used which evaluates:
• The nature and extent of the PHI involved, including the types of identifiers
• The unauthorized person who accessed or used the PHI, or to whom the disclosure was made
• Whether the PHI was acquired or viewed
• The extent to which the risk to the PHI has been mitigated
If, after an evaluation is made of whether the PHI has been compromised, and a covered entity or business associate reasonably determines that the probability of such compromise is low, breach notification is not required.
Physical security measures should immediately be put in place to prevent non-staff members from accessing the area with PHI, and computer/monitor shutoff should be activated before staff moves away from the workstation.
Answer explanation:
Always look at your business associate agreement first to decide the next steps because the notice requirements there might be shorter than HIPAA law and may require notice even if it’s proven that it wasn’t ransomware.
Ransomware is presumed to be a breach under HIPAA unless you can prove it isn’t. HIPAA requires that you let the covered entity know about a breach promptly, but no later than 60 days after discovery.
To evaluate the extent of the breach and determine the “low probability” of PHI compromise, four factors have to be assessed according to HIPAA:
• The nature and extent of the PHI involved, including the types of identifiers
• The unauthorized person who accessed or used the PHI, or to whom the disclosure was made
• Whether the PHI was acquired or viewed
• The extent to which the risk to the PHI has been mitigated
The process of determining low probability has to be thorough. Covered entities and their business associates must also sufficiently document their analysis to meet the burden of proof regarding the breach assessment.
Answer explanation:
HIPAA only requires breach notification for unsecured PHI (e.g., unencrypted PHI). As such, physicians are encouraged to use appropriate encryption and destruction techniques for PHI, which render PHI unusable, unreadable or indecipherable to unauthorized individuals. Best practices and often BAA’s would require that the originating medical office be notified
A covered entity may hire an outside vendor to pick up PHI in paper records or electronic media from its premises, to shred, burn, pulp, or pulverize the PHI, or purge or destroy the electronic media, and deposit the deconstructed material in a landfill or other appropriate area.
Answer explanation:
The Privacy Rule regulates covered entities, not business associates.
However, the Privacy Rule requires that a covered entity obtain satisfactory assurances from its business associate that the business associate will appropriately safeguard the protected health information (PHI) it receives or creates on behalf of the covered entity. These satisfactory assurances must be in writing, in the form of a contract or other agreement between the covered entity and the business associate.
Answer explanation:
The HIPAA Rules do not expressly require that a business associate provide documentation of its security practice, or otherwise allow a customer to audit its security practices.
However, covered entities may require through the BAA, service level agreement, or other documentation additional assurances of protections for the PHI. This may include documentation of safeguards or audits based on their risk analysis and risk management or other compliance activities.
There is a direct liability for business associates who fail to safeguard ePHI under the Security Rule and for impermissible uses or disclosures of the PHI.
Answer explanation:
Some best practices for business associates include the following:
• Adopt and operationalize HIPAA policies and procedures that comply with the HIPAA Rules
• Distribute the HIPAA Policies and Procedures to members of your workforce.
• Conduct a risk analysis
• Make sure to enter into business associate agreements with any covered entities that will send you PHI.
• When any PHI you have is impermissibly used or disclosed, consult your business associate agreement to see what your obligations are at that point.
Answer explanation:
A HIPAA business associate (BA) is any entity that is provided with access to Protected Health Information (PHI) to perform services or functions for a HIPAA-covered entity. A BA can be either an individual, a corporation or a company.
Examples of Business Associates include a/an:
• Third-party administrator that assists a health plan with claims processing
• Consultant that performs utilization reviews for a hospital
• Healthcare clearinghouse that translates a claim from a non-standard format into a standard transaction on behalf of a healthcare provider, and forwards the processed transaction to a payer
• Independent medical transcriptionist that provides transcription services to a physician
BAs of covered entities must also comply with HIPAA Rules and can be fined directly by regulators for non-compliance.
Answer explanation:
Heather’s function is billing which is defined as a business associate function. Her service is administrative in that she oversees some employee billing as well as providing training in-office. Because of this, Heather will be considered a business associate of Dr. Kittrell for all activities covered by their independent contractor relationship whether they are performed at home or in the office.
Examples of Business Associates (BAs) functions and activities include claims processing or administration, benefits management, utilization review, quality assurance, and billing.
Examples of services provided by BAs include legal, accounting, data aggregation, and financial.
Answer explanation:
Dr. Frankel may decide to submit a modified agreement to Visa and Mastercard that is more aligned with his state’s HIPAA regulations than federal ones.
Because Visa and Mastercard provide standard banking and financial transactions (i.e., processing of credit card and electronic funds payments), they are exempt from HIPAA Rules for Business Associates.
According to the U.S. Department of Health and Human Services (HHS), this applies when a financial institution;
• Processes consumer-conducted financial transactions by debit, credit, or other payment cards
• Clears checks
• Initiates or processes electronic funds transfers
• Conducts any other activity that directly facilitates or affects the transfer of funds for payment for healthcare or health plan premiums
Answer explanation:
A software provider, whose solutions interact with systems containing electronically protected health information (ePHI), is considered a business associate. The same applies to cloud service providers, cloud platforms, document storage companies (physical and electronic storage), collection agencies, medical billing companies, asset, and document recycling companies, answering services, attorneys, actuaries, consultants, medical device manufacturers, transcription companies, CPA firms, third party administrators, medical couriers, and marketing firms.
Answer explanation:
If a covered entity engages a business associate to help carry out its health care activities and functions, the covered entity must have a written business associate contract with the business associate that:
• Establishes specifically what the business associate has been engaged to do
• Requires the business associate to comply with HIPAA
Access to protected health information (PHI) is permitted to accomplish the performance of certain tasks for a covered entity. Vendors must agree to use the PHI exclusively for the tasks they have been contracted to perform before PHI can be shared. They must also agree not to disclose the PHI to other entities and must implement safeguards to ensure the confidentiality, integrity, and availability of PHI.
Answer explanation:
The U.S. Department of Health and Human Services (HHS) stated that business associates and their subcontractors may now face HIPAA enforcement actions and are directly liable for violating the HIPAA Security Rule and enumerated provisions of the Privacy and Breach Notification Rules.
The subcontractor must sign a BAA with the vendor. The subcontractor may - but is not required to -sign a BAA with the covered entity. In the BAA the subcontractors must promise to safeguard the electronically protected health information (ePHI) it creates, receives, maintains, or transmits on behalf of the business associate.
Answer explanation:
An impermissible use or disclosure of PHI is presumed to be a breach unless the covered entity demonstrates that there is a “low probability” that the PHI has been compromised.
The severity of improper use or disclosure of PHI must be made by assessing whether the use or disclosure meets HIPAA’s “low probability of compromise” threshold. A 4-factor test should be used which evaluates:
• The nature and extent of the PHI involved, including the types of identifiers
• The unauthorized person who accessed or used the PHI, or to whom the disclosure was made
• Whether the PHI was acquired or viewed
• The extent to which the risk to the PHI has been mitigated
If, after an evaluation is made of whether the PHI has been compromised, and a covered entity or business associate reasonably determines that the probability of such compromise is low, breach notification is not required.
Physical security measures should immediately be put in place to prevent non-staff members from accessing the area with PHI, and computer/monitor shutoff should be activated before staff moves away from the workstation.
Answer explanation:
Always look at your business associate agreement first to decide the next steps because the notice requirements there might be shorter than HIPAA law and may require notice even if it’s proven that it wasn’t ransomware.
Ransomware is presumed to be a breach under HIPAA unless you can prove it isn’t. HIPAA requires that you let the covered entity know about a breach promptly, but no later than 60 days after discovery.
To evaluate the extent of the breach and determine the “low probability” of PHI compromise, four factors have to be assessed according to HIPAA:
• The nature and extent of the PHI involved, including the types of identifiers
• The unauthorized person who accessed or used the PHI, or to whom the disclosure was made
• Whether the PHI was acquired or viewed
• The extent to which the risk to the PHI has been mitigated
The process of determining low probability has to be thorough. Covered entities and their business associates must also sufficiently document their analysis to meet the burden of proof regarding the breach assessment.
Answer explanation:
HIPAA only requires breach notification for unsecured PHI (e.g., unencrypted PHI). As such, physicians are encouraged to use appropriate encryption and destruction techniques for PHI, which render PHI unusable, unreadable or indecipherable to unauthorized individuals. Best practices and often BAA’s would require that the originating medical office be notified
A covered entity may hire an outside vendor to pick up PHI in paper records or electronic media from its premises, to shred, burn, pulp, or pulverize the PHI, or purge or destroy the electronic media, and deposit the deconstructed material in a landfill or other appropriate area.
Answer explanation:
The Privacy Rule regulates covered entities, not business associates.
However, the Privacy Rule requires that a covered entity obtain satisfactory assurances from its business associate that the business associate will appropriately safeguard the protected health information (PHI) it receives or creates on behalf of the covered entity. These satisfactory assurances must be in writing, in the form of a contract or other agreement between the covered entity and the business associate.
Answer explanation:
The HIPAA Rules do not expressly require that a business associate provide documentation of its security practice, or otherwise allow a customer to audit its security practices.
However, covered entities may require through the BAA, service level agreement, or other documentation additional assurances of protections for the PHI. This may include documentation of safeguards or audits based on their risk analysis and risk management or other compliance activities.
There is a direct liability for business associates who fail to safeguard ePHI under the Security Rule and for impermissible uses or disclosures of the PHI.
Answer explanation:
Some best practices for business associates include the following:
• Adopt and operationalize HIPAA policies and procedures that comply with the HIPAA Rules
• Distribute the HIPAA Policies and Procedures to members of your workforce.
• Conduct a risk analysis
• Make sure to enter into business associate agreements with any covered entities that will send you PHI.
• When any PHI you have is impermissibly used or disclosed, consult your business associate agreement to see what your obligations are at that point.
© Qstream, Inc. 2025. All Rights reserved. Privacy Policy | Terms of Use | Qstream AI Terms & Conditions | Accessibility