In the context of this and ignoring the insurance loophole mentioned (which probably applies here as another poster pointed out) I don’t see how this company wouldn’t be covered as a business associate where HIPAA would extend to them even though, as you point out, they aren’t a coveted entity.
