the HIPAA Rules define "Business associate" to expressly include a "Health Information [Exchange] Organization . . . or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information.".