For liability to attach to a covered entity for the actions of its business associate, in addition to determining that the business associate is an agent of the covered entity, the business associate must have also been acting within the scope of the agency/principal relationship.