can you sign a business associate agreement for HIPAA complaince