According to the General Administrative Requirements of HIPAA (45 CFR § 160.103), a “workforce” is defined as “employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a Covered Entity or Business Associate, is under the direct control of such Covered Entity or Business Associate, whether or not they are paid by the Covered Entity or Business Associate”.