HIPAA Security Rule – 45 C.F.R. 164.308

(b)(1) Standard: Business associate contracts and other arrangements. “A covered entity, in accordance with §164.306, may permit a business associate to  create, receive, maintain, or transmit electronic protected health information on the covered entity’s behalf only if the covered entity obtains satisfactory
assurances, in accordance with §164.314(a) that the business associate will appropriately safeguard the information.”

Read the rule