Under HIPAA, Business Associates (BAs) must implement administrative, physical, and technical safeguards for any PHI they create, receive, maintain, or transmit.