Which statement about BA scope and data transport is true?

• A. There is a broad list of BAs beyond the four listed categories with no exceptions.
• B. The Omnibus Rule removed all transport-related exemptions.
• C. Only hospitals are BAs.
• D. There is a narrow exception for entities that simply transport data, such as USPS or ISPs, whose temporary storage is for transporting.

Answer: (D)

When thinking about BA scope and data transport, the key idea is that a business associate is someone who performs functions on behalf of a covered entity that involve PHI. There is a narrow exception for entities that simply move PHI from one place to another and only store it temporarily as part of transport. Examples like USPS or an ISP illustrate this role: they handle PHI in transit but do not access or use it beyond what is necessary to transport, so they are not treated as business associates under a BA Agreement. If such an entity were to access PHI beyond transporting or to store it for longer than incidental transit, they would become a business associate and would need a BA Agreement. The other statements are not correct because BAs can include organizations beyond hospitals, the Omnibus Rule did not remove all transport-related distinctions, and the transport-only exemption is indeed narrow.