Under the HIPAA Privacy Rule, when destruction services are outsourced to a business associate, the contract must provide that the business associate will establish the permitted and required uses and disclosures and include which of the following elements?
A. method of destruction or disposal
B. time that will elapse between acquisition and destruction or disposal
C. safeguards against breaches
D. all of the above
Answer: D