Personal health information?

Give an example of a person or organization who might be considered a “business ociate” of a physician’s office. See page 4 for a list of some different types of "business ociates". List what type of PHI (personal health information) they might reasonably need to have disclosed. It is only appropriate to reveal to each business ociate with the minimum amount of information that is required to do thier job. Therefore, the appropriate information to reveal would be different for each business ociate. What type of verification should you obtain to ensure that this business ociate should be given access to the patient's health information?