The CP is acting as the covered entities agent in receiving PHI and arranging for services with a provider.  There is no need for any CP or CBO to be a BAA, but then the covered entity may be unwilling to use them to act on behalf of one of their patients since they take on the HIPAA responsibilities for all PHI release. Add some clarification to the current language regarding consented and non-consented release of information.