From the 2013 HIPAA Omnibus:
that a business associate includes a “subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.” ... we clarify the definition of “subcontractor” in § 160.103 to provide that subcontractor means: “a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate. [emphasis added]”
Let's say that a hospital contracts with Acme Computers to handle their computers, and Acme then hires John Doe as an employee to work with the hospital's computers, computers which deal with personally identifying information. Some people I've talked with say that since HIPAA only mentions "contractors" and "subcontracts" but not "employees" that HIPAA won't apply to John Doe. From what I've read about the omnibus (like here) I think that the intent was to make HIPAA apply as far down the "chain of command" as possible, meaning that it not applying to employees of (sub)contractors would be a huge loophole. But then the line "other than in the capacity of a member of the workforce of such business associate" might exactly mean that it doesn't apply to employees of contractors.
So, which is it?