Answer
If the provider is a business associate because it handles PHI for the covered entity or business associate, the relationship should address the applicable business associate requirements and contractual arrangement. A BAA does not make the workload compliant by itself.
References
- Cloud computing guidance HHS Office for Civil Rights