For HIPAA implementation specifications that are addressable, which of the following statements is true? Choose matching definition Outsourced transcription company; they would be business associates of a covered entity Performance improvement relies on the collection and analysis of data to increase knowledge. The covered entity must conduct a risk assessment to determine whether the specification is appropriate to its environment. A patient must be given the opportunity to determine if they want to be placed in the directory or not, but it does not need to be in writing