The Final Rule expands the reach of the HIPAA rules by stating that any business associate of a HIPAA covered entity who ____________________ protected health information on behalf of that covered entity, is subject to many of the same HIPAA rules as the covered entity.