Report to the covered entity any security incident of which it becomes aware

Ensure the complete safety of all electronic protected health information

Compensate the covered entity for penalties incurred because of the business associate's security incidents.

Register as a business associate with HHS

Submit to periodic audits by HHS of critical systems containing electronic protected health information