No, it's a Business Associate Agreement, part of HIPAA. (See a sample here: http://www.hhs.gov/hipaa/for-professionals/covered-entities/...)

Basically an agreement between organizations that there is an understanding that PHI (protected health information) is at stake and that both parties are aware of their obligations to protect it.