ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Under the HIPAA Privacy and Security Rules, any third party that creates, receives, maintains, or transmits PHI on behalf of a covered entity is a business associate. HIPAA (45 CFR §164.308(b) and §164.502(e)) requires the covered entity to execute a Business Associate Agreement (BAA) with each business associate-including cloud service providers-before PHI is disclosed. A PCI Report on Compliance and a SOC 2 Type II report are useful for other assurance purposes but are not mandated by HIPAA. A GDPR-focused Data Processing Addendum addresses EU personal data and does not satisfy HIPAA's specific contractual obligation. Therefore, the BAA is the mandatory document.