Under the HIPAA Privacy Rule, when destruction services are outsourced to a business associate, the contract must provide that the business associate will establish the permitted and required uses and disclosures and include all but which of the following elements?

Under the HIPAA Privacy Rule, when destruction services are outsourced to a business associate, the contract must provide that the business associate will establish the permitted and required uses and disclosures and include all but which of the following elements?

• A. The hospital's liability insurance in specified amounts
• B. The business associate must establish the permitted and required uses and disclosures
• C. Safeguarding PHI procedures
• D. Breach notification procedures

Answer: (A)

Under HIPAA, a business associate agreement sets the rules for how PHI can be used or disclosed and requires the business associate to protect that information. When destruction services are outsourced, the contract must require the business associate to specify what uses and disclosures are permitted and to implement safeguards to protect PHI throughout the process. It should also establish procedures for safeguarding PHI and for notifying relevant parties if a breach occurs, so any unauthorized access or disclosure can be addressed promptly. The hospital’s liability insurance in specified amounts is not a HIPAA-mandated element of a business associate agreement. HIPAA focuses on how PHI is used, protected, and reported in the event of a breach, not on setting insurance coverage levels for the covered entity. That’s why this element is the exception among the options.

Under HIPAA, a business associate agreement sets the rules for how PHI can be used or disclosed and requires the business associate to protect that information. When destruction services are outsourced, the contract must require the business associate to specify what uses and disclosures are permitted and to implement safeguards to protect PHI throughout the process. It should also establish procedures for safeguarding PHI and for notifying relevant parties if a breach occurs, so any unauthorized access or disclosure can be addressed promptly.

The hospital’s liability insurance in specified amounts is not a HIPAA-mandated element of a business associate agreement. HIPAA focuses on how PHI is used, protected, and reported in the event of a breach, not on setting insurance coverage levels for the covered entity. That’s why this element is the exception among the options.