Which statement defines a Business Associate in HIPAA terms?

• A. A hospital administrator
• B. An employee who handles billing
• C. A patient advocate
• D. An individual or entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity

Answer: (D)

Under HIPAA, a Business Associate is an individual or organization that creates, receives, maintains, or transmits protected health information (PHI) on behalf of a covered entity. PHI is identifiable health information, and covered entities include health care providers, health plans, and health-care clearinghouses that handle PHI in certain ways. The key point is that the entity is handling PHI for a covered entity, typically as an external partner, not just someone inside the organization.

This makes the description in that option the best fit, because it captures the external role that performs PHI-related functions on behalf of a covered entity, which is the essence of a business associate. The other roles described are usually internal workforce members or do not clearly indicate functioning on behalf of a covered entity with PHI outside normal internal processes.