Business associate agreement
Billing companies, virtual assistants, transcription services and other vendors that can access protected health information are business associates. Without a signed BAA, the provider should not share that information with them.
A BAA is one part of compliance. Vendors should also use access controls, encrypted devices and staff training that match what the agreement promises.