If Optometrist A - who does not qualify as a Covered Entity - performs a service for or on behalf of Optometrist B - who does qualify as a Covered Entity – and the service involves the creation, use, storage, disclosure, or transmission of Protected Health Information, Optometrist A becomes a Business Associate of Optometrist B. As a Business Associate of Optometrist B, Optometrist A must comply with the Security Rule, the Breach Notification Rule, and certain elements of the Privacy Rule depending on the nature of the disclosure and for what it will be used. Optometrist A will also have to sign a Business Associate Agreement with Optometrist B to provide assurances that PHI will remain secure.