The HIPAA Privacy Rule regulates the use and disclosure of Protected Health Information (PHI) held by "covered entities" (generally, health care clearinghouses, employer sponsored health plans, health insurers, and medical service providers that engage in certain transactions.)[15] By regulation, the Department of Health and Human Services extended the HIPAA privacy rule to independent contractors of covered entities who fit within the definition of "business associates".
References:
https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act#Privacy
_Rule

Explanation

Explanation
There are five main ways to manage risk: acceptance, avoidance, transference, mitigation or exploitation.
References:
http://www.dbpmanagement.com/15/5-ways-to-manage-risk

Risk assessment include:
References: https://en.wikipedia.org/wiki/IT_risk_management#Risk_assessment