Healthcare Compliance

I keep getting an in correct response when answering a question on the Healthcare Compliance Lab.  The HIPAA Framework.

Question is

Your hospital hires an IT consultant to audit your network security. Before giving them access to patient data, what must you do?

My response is 

Have them sign a business associate agreement

but its wrong any ideas what the correct response is to this question?