If are not a healthcare provider but you do business with one, you may be a Business Associate.
Research
In the course of conducting research, researchers may obtain, create, use, and/or disclose individually identifiable health information. Under the Privacy Rule, covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the Privacy Rule.
Research Use/Disclosure Without Authorization. To use or disclose protected health information without authorization by the research participant, a covered entity must obtain one of the following:
Documented Institutional Review Board (IRB) or Privacy Board Approval
Preparatory to Research
Research on Protected Health Information of Decedents
Limited Data Sets with a Data Use Agreement
Research Use/Disclosure With Individual Authorization