Which of the following statements is true of Hipaa rules regarding the release of PHI by covered entities to business associates?