I just wanted to provide one example to keep it simple. Nothing about HIPAA is ever simple, other than not being a covered entity ;)