HIPAA only covers business associates, covered entities and subcontractors. I’m guessing this company is neither of those three. Therefore the “PHI” you provide to them, is not “PHI” under HIPAA since you are providing the data, and not a covered entity.