What is required under HIPAA privacy and security requirements regarding business associates in an ASC?

• A. Business associate agreements are optional
• B. PHI can be shared with vendors without restrictions
• C. Business associate agreements must be in place with vendors who handle PHI
• D. PHI can be shared with vendors only if they are medical doctors

Answer: (C)

Under HIPAA, any external party that handles or has access to PHI for a covered entity must operate under a written contract called a business associate agreement. For an ASC, this means that with vendors such as billing companies, IT services, cloud storage, or transcription services, there must be a BAA in place. The BAA defines how PHI may be used and disclosed, requires appropriate safeguards to protect PHI (administrative, physical, and technical), mandates breach notification, and obligates the vendor and any subcontractors to comply with HIPAA.

This is why the best answer is that business associate agreements must be in place with vendors who handle PHI. The other options don’t fit because BAAs aren’t optional, PHI cannot be shared with vendors without the required protections, and PHI sharing isn’t limited to medical doctors—any vendor that handles PHI qualifies as a business associate when a BAA is in place.