HIPAA contract that pushes covered-entity obligations down to vendors handling PHI. The chain breaks if the BAA inventory isn't a control.