Any healthcare provider or business associate must be HIPAA-compliant which means that he must be able to show due diligence in their attempt to comply with the HIPAA Security and/or Privacy Rule.