HIPAA requirements extend to outsourced work