A practice is a covered entity, and any vendor that creates, receives, maintains or transmits protected health information on its behalf is a business associate, which requires a written agreement in place before any disclosure. That agreement has to describe permitted uses, require safeguards, bind subcontractors on the same terms, and require return or destruction at termination. This is why putting a model provider in the path is a decision rather than a formality: a business associate has no independent authority to use protected information for its own product development or model training, and if a vendor will not sign, the information cannot go to it. The minimum necessary principle separately limits how much data a workflow should move even under an agreement. Coding and anything submitted to a payer under a provider identifier carries liability for that provider, so a person attests even where a system assembles.