Which of the following must a covered entity or business associate do before sharing PHI with a third party?
a) Obtain written permission from the Secretary of Health and Human Services
b) Conduct a risk analysis and implement appropriate safeguards
c) Notify the media about the disclosure
d) Share the information freely without any precautions
