Select the correct statement regarding the responsibilities of providers and payers under HIPAA's privacy rule.

Optionally, they might develop a mechanism of accounting for all disclosures of PHI for purposes other than TPO.

They must redesign their offices, workspaces, and storage systems to afford maximum protection to PHI from intentional and unintentional use and disclosure.

They must develop methods for disclosing only the minimum amount of protected information necessary to accomplish any intended purpose

They must obtain a "top secret" security clearance for all member of their workforce

They must identify business associates that need to use PHI to accomplish their function and develop authorization forms to allow PHI to be shared with these business associates