They sign business associate agreements. It's good enough for HIPAA compliance.