A. Compensate the covered entity for penalties incurred because of the business associate's security incidents.

B. Report to the covered entity any security incident of which it becomes aware.

C. Ensure the complete safety of all electronic protected health information.

D. Submit to periodic audits by HHS of critical systems containing electronic protected health information.

E. Register as a business associate with HHS.