Conduit clause — which statement is true?

• A. Conduits may have access to metadata and could store data about who connected with whom
• B. Conduits always require a BAA
• C. Conduits never retain metadata
• D. Conduits are illegal

Answer: (A)

In HIPAA terms, a conduit is an intermediary that simply transmits PHI and doesn’t use or interpret its content beyond what is needed to move the data. The key idea tested is that while the conduit should not access the actual PHI, it can handle metadata necessary for routing and security. This means conduits may have access to metadata such as who connected with whom, when, and how the data was transmitted, and they can keep logs or records essential for operations and auditing. This metadata handling is allowed because it doesn’t involve viewing or storing the PHI itself.

That’s why the statement about conduits having access to metadata and potentially storing data about connections is the best fit. The other statements aren’t accurate: a BAA isn’t always required for a conduit that only transmits and handles metadata, metadata retention is common, and conduits are not illegal.