HIPAA's Privacy Rule lets a covered entity allow a business associate to create, receive, maintain or transmit protected health information on its behalf only if the entity obtains satisfactory assurance that it will be safeguarded.

In the source's own words

“A covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information”

45 CFR 164.502: Uses and disclosures of protected health information, Legal Information Institute, Cornell Law School, 2026, 45 CFR 164.502(e)(1)(i).