Another good description of the HIPAA/HITECH update –  rule extended to “downstream” business associates:

http://lawyersusaonline.com/blog/2013/02/12/new-hipaa-rule-means-big-changes-for-doctors-hospitals-others/