a business associate agreement must be signed when doing business with an external entity (ex: vendor, contractor, temporary staffing services).