Although the Privacy Rule only applies to Covered Entities, Business Associates are advised to develop Privacy Rule policies for situations in which Privacy Rule standards apply. For example, there are circumstances in which a patient could approach a Business Associate directly with a request to access their PHI. Therefore, Business Associates should include such circumstances in their Security Rule risk assessments to ensure Privacy Rule policies exist when these circumstances occur.