The two organizational standards in 45 CFR 164.314: what business associate contracts and other arrangements must contain, and the plan document requirements for group health plans and their sponsors.
What the business associate contract (or other arrangement) must say for Security Rule purposes: comply with Subpart C, flow requirements down to subcontractors, and report security incidents and breaches. All required.
The required plan document amendments that make a group health plan's sponsor safeguard ePHI it receives: safeguards, separation, agents and incident reporting. Applies only to group health plans.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.