Rather than looking into the laws yourself, you should have consulted a lawyer. You would have learned how the rules actually apply to service providers of health institutions instead of developing a serious misunderstanding of how HIPPA works.
For years, under advice of my lawyer, I operated under a signed contract with all my healthcare customers that included a disclaimer that HIPPA was not my responsibility and I had no HIPPA responsibilities. Recent decisions by the DCR have ruled such disclaimers invalid and defined Business Associates as providers to healthcare providers that have access to PHI and thus to which the HIPPA regulations apply directly. My lawyer said he can no longer limit my liability or responsibility for HIPPA with a disclaimer and advised me to implement full HIPPA compliant policies, procedures and documentation or drop my healthcare customers.
Please feel free to ignore reality if you want to get blind-sided by this.