The privacy rule requires covered entities to enter into a written agreement with each business associate-known as a business associate agreement.
The business associate may not use or disclose the protected health information other than as permitted or required by the business associate agreement or as required by law.