Business Associates are directly liable to the OCR, and BAAs have moved front and center as a critical component of HIPAA compliance due to OCR’s extended jurisdiction & steady increases in security incidents & breaches.