How did they decide that this data doesn't need to be protected? If it's PHI (at the covered entity) and accessed through their BAA, it's still PHI and deserves protections. Were they willfully ignoring their obligations?