"If you are a health plan sponsor ... [p]ay particular attention to vendors who may have access to PHI ... e.g.: [1] Document disposal services if some of the documents contain PHI; [2] Providers of cloud and other off-site data storage facilities; [3] Technicians that may have access to PHI while troubleshooting or fixing computer software.... [An] employer with a fully insured health plan may still have business associates acting on behalf of a plan if: [1] It uses a broker that obtains PHI in order to quote coverage. [2] It has a Health FSA. [3] It has an HRA. [4] It has certain types of wellness or employee assistance programs."  MORE >>