Cert Master

KT-CG HIPAA

A vendor offers free analytics on ePHI if they sign a BAA. What must you verify?

Multiple choice — select one answer

Answer choices

  1. a. BAA terms, minimum necessary data shared, subprocessors, and breach notification duties
  2. b. Free services are exempt from business associate requirements automatically, without security or identity team coordination per policy.
  3. c. Encryption at rest removes the need for any vendor contract review, without security or identity team coordination per policy.
  4. d. HIPAA does not apply if the vendor stores data in the United States only

Architectural breakdown & explanation

Business associates need BAAs with explicit permitted uses and safeguards.

Correct answer(s): a. BAA terms, minimum necessary data shared, subprocessors, and breach notification duties

Exam domain: HIPAA (20% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Compliance & Governance bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications