Excerpt: HIPAA's privacy rules generally do not require 'business associate' contracts between a covered entity and its service technicians, janitors and couriers because they do not need protected health information (PHI) to perform their duties, according to [an Oct. 8, 2002] HHS guidance document. Another clarification of interest to plan sponsors is that covered entities may contact individuals other than the patient if necessary to obtain payment.