Which of the following must be a covered entity or business associate do before sharing PHI with a third-party organization?
a) Obtain patient consent
b) Perform a risk analysis
c) Notify the media
d) Delete the PHI