What do you anticipate that Mark's Privacy team at Biotech Company X will advise him? What type data do you think they will ask for? Will they need a BAA, DUA, or no agreement with Covered Entity A and/or the university hospital?

You are a Privacy officer at Covered Entity A. Your colleague Diane is in the dermatology department would like to receive data from a university hospital so that she can develop algorithm that will detect certain skin cancers from patient-submitted images. Diane would like to know whether the dermatology department needs a particular agreement with the university hospital to receive this data. Additionally, Diane would like to partner with Mark from Biotech Company X, who is a product innovation lead, so that Mark's team can help co-develop the algorithm.