HIPAA compliance with a signed Business Associate Agreement (BAA) is just one step in good governance.