From the link below the bullet points:

"In addition, business associates of covered entities must follow parts of the HIPAA regulations."

All vendors must comply with HIPAA laws (ie EMR systems)