As a result of HITECH, Covered Entities were required to conduct due diligence on any third party with whom they shared PHI and sign a Business Associate Agreement with the third party stipulating the terms and conditions of their business arrangement in relation to what PHI would be disclosed to the third party and what measures the third party had to implement to keep it secure.