Under the Health Insurance Portability and Accountability Act (HIPAA), combining protected health information by a business associate together with the protected health information received by the business associate in its capacity as a business associate of another covered entity.