When a covered entity boards a vendor and if access to PHI is shared with the vendor, then the vendor will have to sign a business associate agreement with the covered entity. For example, a hospital onboards a cyber security vendor and the vendor will have access to PHI. In that case, a business associate agreement is signed between the hospital and the security vendor.