; and (ii) the risk of harm reasonably expected to occur as a result of the covered entity disclosing personal data to a service provider without complying with such clause. (b) Contractual requirements (1) In general A contract between a covered entity and a service provider governing the disclosure of personal data by the covered entity to the service provider shall— (A) require the service provider to only collect or process the personal data as directed by the covered entity; (B) establish the purposes for, and means of, the collecting or processing of the personal data by the service provider, including instructions, policies, and practices, as applicable, with which the service provider is required to comply