DME companies are indeed a provider and covered entity under HIPAA. You are not required to have a BAA with another treatment provider (covered entity) when both entities are providing services to a patient and the DME company submits invoices directly to the payer.