The HIPAA Rules apply to all members of a Covered Entity´s or Business Associate´s workforce regardless of their employment status. This is because HIPAA defines a workforce as “employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity or business associate, is under the direct control of such covered entity or business associate, whether or not they are paid by the covered entity or business associate”.