What you are referring to is a Business Associate Agreement, and is indeed already required by law.