A covered entity discloses PHI to a vendor that manages its medical transcription services.Which document must govern this relationship under HIPAA?