What must people who work at a medical office but are not employees sign if they come in contact with patient information?

What will be an ideal response?

These people must sign a HIPAA Business Associate Agreement if they have contact with a patient's private health information.