Are medical malpractice insurers that receive PHI from their insureds (doctors) considered to be business associates under HIPAA's privacy rules? If so, what health care functions or services would such BAs provide to the covered entity? Thanks.