Exam 712-50 topic 1 question 449 discussion

In the context of a hybrid cloud model where both on-premises infrastructure and cloud services are used, the Cloud Service Provider (CSP) is still considered a Business Associate under HIPAA if it handles protected health information (PHI) on behalf of the covered entity. Regardless of whether the PHI is stored or processed on-premises or in the cloud, the HIPAA regulations apply to any entity that has access to PHI. Therefore, based on HIPAA, once the agreement between the covered entity (the hospital) and the CSP is signed, the CSP is: B. Directly liable for compliance with the applicable requirements of the HIPAA Rules

why not B ?