We've been audited by a professional and an unbiased 3rd-bash CPA firm to validity of our operational controls and compliance expert services. If you employ any outdoors entity to handle ePHI, such as a server infrastructure corporation, you need to have a company Associate Arrangement (BAA)