Offering a BAA is necessary, but not sufficient, to be a HIPAA-compliant service.