HIPAA business associates sit outside the provider's workforce | Yap