Question

Which of the following statements was true about a business associate (BA) before the enactment of the American Recovery and Reinvestment Act (ARRA)? That is, pre-2009, which of the following statements was true?

a) BAs were not subject to HIPAA regulations
b) BAs were not required to sign business associate agreements
c) BAs were not allowed to handle protected health information
d) BAs were directly covered entities

Answer 1

Pre-2009, business associates were not directly subject to HIPAA regulations but were required to sign business associate agreements that outlined their responsibilities for protecting PHI. Post-ARRA, BAs became directly accountable for complying with certain HIPAA rules.

Step-by-step explanation:

Before the enactment of the American Recovery and Reinvestment Act (ARRA) in 2009, business associates (BAs) were subject to different stipulations under the Health Insurance Portability and Accountability Act (HIPAA). Specifically, before ARRA, it was true that BAs were not directly subject to HIPAA regulations. Instead, they were required to enter into business associate agreements with covered entities that outlined the responsibilities of the BA regarding the protection of Protected Health Information (PHI).

These agreements were legally binding contracts, but the BAs themselves were not directly regulated by HIPAA; the accountability for ensuring the protection of PHI under HIPAA rested with the covered entities (such as healthcare providers and insurance companies). After the enactment of ARRA, specific provisions of HIPAA were extended to BAs, holding them directly accountable for compliance with certain HIPAA privacy and security rules.