Case Study: Business Associate

Your hospital hired a consulting firm to help review and update its HIPAA privacy program. The firm has submitted a proposal that will require limited access to records containing PHI.

The hospital must have a business associate agreement in place before the consultants begin working.

Select true or false