A US dental office uses an outside billing company that accesses protected health information. Under HIPAA, what document must be in place?