Under HIPAA which one of the following statements is true regarding the release of phi by covered entities to business associates