Jane is an independent cybersecurity consultant contracted to test information security safeguards for a health insurance company. Her job is to try to break into the patient billing system to identify potential vulnerabilities. What sort of contract should the health insurance company have in place with Jane?

A Binding corporate rules $($BCRs$)$

B

Patient records contract $($PRC$)$

c

Business associates agreement $($BAA$)$

HIPAA scope agreement $($HSA$)$