HIPAA — Business Associates

First published: September 2, 2026Last verified: September 2, 2026Reviewed by the CertQuestUSA team

TL;DR

HIPAA — Business Associates: a 44-question practice bank for the real HIPAA / Healthcare Compliance standard, 1 full paper of 25 questions each with no repeats, every question citing the real regulation it comes from.

Where these questions come from

Every question in this bank cites a real source -- primarily 45 CFR (100%) of this exam's citations.

Not sure where you stand? Take the free diagnostic — 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.

Start diagnostic

1

full paper

25

questions per paper

44

questions in the bank

What this exam covers

Breach Notification and Subcontractor Flow-Down26%
Required Business Associate Agreement Terms26%
Business Associate Definition and Scope28%
Security Rule Assurances and Contracts21%

5 real sample questions

Under what circumstance is a plan sponsor excluded from the business associate definition?

A. Under the specified conditions set out in 160.103 for plan sponsors

B. A plan sponsor can never be excluded under any circumstance

C. Only if the plan sponsor is a nonprofit organization

D. Only if the plan sponsor has fewer than 50 employees

Source: 45 CFR 160.103

Are subcontractors of a business associate themselves included in the 160.103 definition?

A. Yes, subcontractors that create, receive, maintain, or transmit PHI on behalf of the business associate are included

B. No, HIPAA only regulates the covered entity’s direct contractors

C. Only if the subcontractor is itself a hospital or clinic

D. Only if the covered entity directly signs a contract with the subcontractor

Source: 45 CFR 160.103

Under 45 CFR 160.103, what generally makes a person or entity a "business associate"?

A. They create, receive, maintain, or transmit protected health information on behalf of a covered entity for a regulated function, or they provide certain PHI-involving services to a covered entity

B. They are any company that has ever done business with a hospital

C. They are any individual who has been a patient at a covered entity

D. They are automatically any vendor that sells medical equipment

Source: 45 CFR 160.103

Which of the following services, when performed for a covered entity and involving PHI disclosure, falls within the business associate definition under 160.103?

A. Legal, accounting, consulting, data aggregation, management, or financial services

B. Painting the covered entity’s office walls

C. Mowing the lawn at a covered entity’s facility

D. Delivering office supplies with no PHI access

Source: 45 CFR 160.103

Which entities are specifically named as included within the business associate definition under 160.103?

A. Health Information Organizations, e-prescribing gateways, and personal health record vendors acting on a covered entity’s behalf

B. Any entity that has ever received a fax from a covered entity

C. Patients who request copies of their own records

D. Local newspapers that report on public health statistics

Source: 45 CFR 160.103

Frequently asked questions

How many questions are on the CertQuestUSA HIPAA — Business Associates practice test?

44 questions total, split into 1 full paper of 25 each with no repeats across papers.

What topics does the HIPAA — Business Associates test cover?

4 domains, with the heaviest weight on Business Associate Definition and Scope (28%), Breach Notification and Subcontractor Flow-Down (26%), and Required Business Associate Agreement Terms (26%).

Where do CertQuestUSA's HIPAA — Business Associates questions come from?

Primarily 45 CFR (100%) of this bank's citations -- computed directly from this exam's own question sources, not a generic description.

Is there a free diagnostic for HIPAA — Business Associates?

Yes -- 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.