CISSP Security and Risk Management Practice Question
A hospital is subject to HIPAA. Which of the following is required when sharing protected health information (PHI) with a third-party billing company?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Business Associate Agreement
Under HIPAA, covered entities must have a Business Associate Agreement (BAA) with business associates that handle PHI.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Annual audit report
Why it's wrong here
While HIPAA-covered entities are required to conduct risk analyses and implement security measures, an "annual audit report" is not a specific document mandated by HIPAA that must be shared with a Business Associate (like a billing company) as a prerequisite for data sharing. The primary requirement for establishing a compliant data-sharing relationship with a Business Associate is the execution of a Business Associate Agreement, which outlines responsibilities rather than requiring the sharing of internal audit findings.
- ✓
Business Associate Agreement
Why this is correct
A Business Associate Agreement (BAA) is a legally required contract under HIPAA that must be in place before a Covered Entity (like a hospital) shares Protected Health Information (PHI) with a Business Associate (like a billing company). This agreement outlines the permissible uses and disclosures of PHI by the Business Associate and mandates their compliance with HIPAA's Security and Privacy Rules, ensuring appropriate safeguards are maintained. It establishes the responsibilities and liabilities of both parties regarding PHI protection.
- ✗
Patient consent
Why it's wrong here
HIPAA generally permits the use and disclosure of Protected Health Information (PHI) for treatment, payment, and healthcare operations (TPO) without requiring explicit patient consent or authorization. Sharing PHI with a billing company falls squarely under "payment" operations, which is a permissible disclosure under HIPAA. While patients have the right to receive a Notice of Privacy Practices, this informs them of how their PHI may be used, but does not necessitate their specific consent for TPO activities.
- ✗
Data Protection Impact Assessment
Why it's wrong here
A Data Protection Impact Assessment (DPIA) is a specific requirement under the European Union's General Data Protection Regulation (GDPR) for processing activities likely to result in a high risk to individuals' rights and freedoms. While a hospital subject to HIPAA must conduct a risk analysis as part of its Security Rule compliance, a DPIA is a distinct regulatory instrument not mandated by HIPAA for sharing PHI with a billing company in the United States.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.