Free HIPAA Business Associate Practice Test Online

Official exam: HIPAA — Business Associates

Take a free HIPAA Business Associate practice test online: 10 questions, no sign-up, scored by topic. The full 44-question bank and the timed simulator are $14.99 for 30 days.

First published: September 2, 2026Bank updated: September 2, 2026Published by CertQuestUSA · review process

TL;DR

HIPAA — Business Associates: a 44-question practice bank for the real HIPAA / Healthcare Compliance standard, 1 full paper of 25 questions each with no repeats, every question written to the regulation it comes from.

Where these questions come from

Every question in this bank cites a source -- primarily 45 CFR (100%) of this exam's citations.

Not sure where you stand? Take the free diagnostic, 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.

Start diagnostic

Want the whole bank for HIPAA — Business Associates? One payment of $14.99 gives you 30 days of full access to this exam. It does not renew. No account needed to buy, and there is a 7-day money-back guarantee.

Not ready yet? Take the free practice test first.

Ways to pay for the full bank

30-day pass

$14.99

about $15 a month

This exam only. Pays once, does not renew.

Monthly

$19.99

$19.99 a month

Every exam. Cancel any time.

Yearly

$143.93

about $11.99 a month

Every exam. Billed once a year.

Lifetime

$39.99

pay once

This exam only, no time limit.

See all plans and bundles

1

full paper

25

questions per paper

44

questions in the bank

What this exam covers

Breach Notification and Subcontractor Flow-Down26%
Required Business Associate Agreement Terms26%
Business Associate Definition and Scope28%
Security Rule Assurances and Contracts21%

5 real sample questions

Under what circumstance is a plan sponsor excluded from the business associate definition?

A. Under the specified conditions set out in 160.103 for plan sponsors

B. A plan sponsor can never be excluded under any circumstance

C. Only if the plan sponsor is a nonprofit organization

D. Only if the plan sponsor has fewer than 50 employees

Show answer and reasoning

Correct answer: A. Under the specified conditions set out in 160.103 for plan sponsors

B: The exclusion is conditional, not absolute.
C: Nonprofit status is not the stated basis for this exclusion.
D: Employee headcount is not the stated basis for this exclusion.

Source: 45 CFR 160.103

Are subcontractors of a business associate themselves included in the 160.103 definition?

A. Yes, subcontractors that create, receive, maintain, or transmit PHI on behalf of the business associate are included

B. No, HIPAA only regulates the covered entity’s direct contractors

C. Only if the subcontractor is itself a hospital or clinic

D. Only if the covered entity directly signs a contract with the subcontractor

Show answer and reasoning

Correct answer: A. Yes, subcontractors that create, receive, maintain, or transmit PHI on behalf of the business associate are included

B: HIPAA’s obligations expressly extend down the subcontracting chain, not just to the covered entity’s direct contractor.
C: Subcontractor status does not depend on the subcontractor being a health care provider itself.
D: The subcontractor relationship, not a direct contract with the covered entity, is what triggers this inclusion.

Source: 45 CFR 160.103

Under 45 CFR 160.103, what generally makes a person or entity a "business associate"?

A. They create, receive, maintain, or transmit protected health information on behalf of a covered entity for a regulated function, or they provide certain PHI-involving services to a covered entity

B. They are any company that has ever done business with a hospital

C. They are any individual who has been a patient at a covered entity

D. They are automatically any vendor that sells medical equipment

Show answer and reasoning

Correct answer: A. They create, receive, maintain, or transmit protected health information on behalf of a covered entity for a regulated function, or they provide certain PHI-involving services to a covered entity

B: General business dealings alone, without PHI involvement, do not create business associate status.
C: Patient status is unrelated to business associate status.
D: Selling equipment alone does not create business associate status unless PHI is created, received, maintained, or transmitted on the covered entity’s behalf.

Source: 45 CFR 160.103

Which of the following services, when performed for a covered entity and involving PHI disclosure, falls within the business associate definition under 160.103?

A. Legal, accounting, consulting, data aggregation, management, or financial services

B. Painting the covered entity’s office walls

C. Mowing the lawn at a covered entity’s facility

D. Delivering office supplies with no PHI access

Show answer and reasoning

Correct answer: A. Legal, accounting, consulting, data aggregation, management, or financial services

B: A painting service with no PHI access is not a business associate.
C: Lawn care with no PHI access is not a business associate.
D: A supply delivery vendor with no PHI access is not a business associate.

Source: 45 CFR 160.103

Which entities are specifically named as included within the business associate definition under 160.103?

A. Health Information Organizations, e-prescribing gateways, and personal health record vendors acting on a covered entity’s behalf

B. Any entity that has ever received a fax from a covered entity

C. Patients who request copies of their own records

D. Local newspapers that report on public health statistics

Show answer and reasoning

Correct answer: A. Health Information Organizations, e-prescribing gateways, and personal health record vendors acting on a covered entity’s behalf

B: A single incidental fax receipt does not create business associate status.
C: A patient requesting their own records is exercising a personal right, not acting as a business associate.
D: General news reporting on public statistics is not a business associate function.

Source: 45 CFR 160.103

Frequently asked questions

Where can I take a free HIPAA Business Associate practice test online?

Right here. CertQuestUSA's free HIPAA Business Associate practice test online is a 10-question diagnostic across the exam's domains, with no sign-up and no credit card, and shows your score by topic at the end. The full 44-question bank, with every answer explained and cited to the regulation it comes from, is $14.99 for a 30-day pass that never renews.

How many questions are on the CertQuestUSA HIPAA — Business Associates practice test?

44 questions total, split into 1 full paper of 25 each with no repeats across papers.

What topics does the HIPAA — Business Associates test cover?

4 domains, with the heaviest weight on Business Associate Definition and Scope (28%), Breach Notification and Subcontractor Flow-Down (26%), and Required Business Associate Agreement Terms (26%).

Where do CertQuestUSA's HIPAA — Business Associates questions come from?

Primarily 45 CFR (100%) of this bank's citations -- computed directly from this exam's own question sources, not a generic description.

Is there a free diagnostic for HIPAA — Business Associates?

Yes -- 10 real questions across the exam's domains, no sign-up required, with a domain-by-domain breakdown at the end.