Your quote misses the most important part:

>>"Covered entities may disclose protected health information to an entity in its role as a business associate only to help the covered entity carry out its health care functions – not for the business associate’s independent use or purposes, except as needed for the proper management and administration of the business associate."

BAA's keep the chain of HIPAA in place but just because a BAA is in place does not allow for violation of privacy.