On a Tuesday morning, a primary care physician in your practice administers a bipolar test — a standard mood screening questionnaire — during a 20-minute visit. By Friday afternoon, that result has been touched by your EHR host, your e-fax gateway, your transcription vendor, your referral coordination platform, your clearinghouse, and possibly a patient engagement app you didn't know the front desk enabled. Six organizations. You have signed agreements with four of them.

This article is for the person who owns that gap: the practice administrator, privacy officer, or compliance lead who has to name every vendor that touches behavioral health data and prove the paperwork exists. It is not clinical guidance. It is a map of where the data goes and what has to be in writing before it gets there.

Where a Bipolar Test Result Actually Travels After the Visit

Screening for mood disorders often happens in primary care, and a positive screen frequently triggers a referral to psychiatry or behavioral health. That single administrative fact — referral out — is why this data crosses organizational boundaries more often than a routine lab value does.

Sit down with your IT lead and trace one encounter end to end. In most small and mid-sized practices, the path looks something like this:

  • Intake: A tablet or portal-based questionnaire, often hosted by a patient intake vendor separate from your EHR.
  • Documentation: The score and clinician note land in the EHR, hosted by a cloud provider that is itself a business associate.
  • Dictation: If the clinician dictates, a transcription or ambient documentation vendor holds the audio and the draft note.
  • Referral: A summary goes to a psychiatric practice by e-fax, direct messaging, or a referral platform. Each of those is a distinct vendor relationship.
  • Billing: A CPT code for the screening flows to your billing service and clearinghouse, then to the payer.
  • Records requests: Weeks later, a release-of-information vendor or a disability insurer's request pulls the same note out again.
  • Backup and archive: Whoever holds your offsite backups holds this too.

Every organization on that list that creates, receives, maintains, or transmits protected health information on your behalf is a business associate. The screening instrument doesn't change the rule. What changes is the sensitivity of what leaks if the rule is ignored — mental health data carries a stigma cost that a routine cholesterol panel does not, and patients notice.

The Vendor Inventory Most Practices Get Wrong

Ask your privacy officer for the vendor list. Then ask your office manager for the credit card statement. The two documents rarely match, and the gap is where your exposure lives.

Shadow vendors nobody logged

The appointment reminder service the front desk signed up for during a staffing crunch. The scanning app on a clinician's phone. The scheduling add-on with a free tier. The answering service that takes after-hours calls and writes down why the patient called. Each one may be handling PHI, and none of them appear on a formal vendor list because nobody ran a purchase order.

Run the reconciliation quarterly. Pull twelve months of card and ACH activity, filter for anything software-shaped, and match against your signed BAA folder. Assign a named owner to every unmatched line item within ten business days.

Subcontractors you never see

Your EHR vendor uses a cloud host. Your billing company uses an offshore coding partner. Your e-fax provider uses a telecom carrier. Under the HIPAA Rules, a business associate must obtain satisfactory assurances from its own subcontractors, and those flow-down obligations belong in your agreement. You will not audit a subcontractor directly, but you should be able to answer, in writing, whether your vendor's contract requires them to.

HHS has published specific guidance on cloud service providers and HIPAA, including the position that a cloud provider storing only encrypted PHI without the key is still a business associate. "They can't read it" is not an exemption.

Vendors who fall outside HIPAA entirely

If a patient uses a consumer mood-tracking app on their own and shares the output with your clinician, that app is not your business associate. But if your practice recommends or configures the app as part of care delivery, the analysis changes. Consumer health apps that fall outside HIPAA may still be covered by the FTC's Health Breach Notification Rule, which the Commission strengthened in 2024 to cover a broader set of health apps. Know which regime applies before you let a tool into a workflow.

Do You Need a BAA for a Vendor That Handles Bipolar Test Data?

Yes, if the vendor creates, receives, maintains, or transmits protected health information on your practice's behalf. That includes screening-questionnaire platforms, EHR hosts, transcription services, e-fax gateways, billing companies, cloud backup providers, and release-of-information vendors. You do not need a BAA for conduits that only transport data without persistent access (a phone carrier, the postal service), for other treating providers receiving a referral for treatment purposes, or for vendors with no realistic access to PHI, such as a cleaning service under an appropriate access policy. When you are unsure, the deciding question is whether the vendor can see, store, or route identifiable patient information — not whether they intend to look at it.

What Your BAA Must Cover Before Bipolar Test Results Leave the Building

A one-page "we are HIPAA compliant" attestation from a vendor is not a business associate agreement. The required contract provisions are specified in the Privacy and Security Rules, and HHS publishes sample business associate agreement provisions that track them.

At minimum, verify your template addresses:

  1. Permitted uses and disclosures — narrowly scoped, not "any purpose related to the services."
  2. Safeguards — administrative, physical, and technical, consistent with the Security Rule.
  3. Subcontractor flow-down — the vendor must bind its own subcontractors to equivalent terms.
  4. Breach and security incident reporting — with a contractual clock shorter than the regulatory outer limit.
  5. Individual rights support — access, amendment, and accounting of disclosures, with a response window that lets you meet your own 30-day obligation.
  6. Return or destruction on termination — including backups, with a certification requirement.
  7. Cooperation with HHS — making internal practices and records available for compliance review.

If you are chasing signatures across a dozen vendors and your template is a decade-old Word file with someone else's practice name still in the header, fix the template first. You can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — one-time purchase, no subscription — which is faster than legal review for standard vendor relationships and gives you a consistent baseline to negotiate from.

Behavioral Health Records Carry Extra Handling Rules

Psychotherapy notes sit in their own bucket

Under the Privacy Rule, psychotherapy notes — a therapist's separately maintained process notes — generally require a specific patient authorization for disclosure, even for many purposes where other PHI can move freely. The administrative consequence is concrete: they must actually be maintained separately from the rest of the record.

If your EHR mingles process notes with the encounter note, your release-of-information workflow will disclose them by default. Ask your EHR administrator to demonstrate the segregation, then ask your ROI vendor to demonstrate that their extraction respects it. Document both answers with dates.

State law and Part 2 overlays

Many states impose consent requirements for mental health records that exceed HIPAA's floor. A bipolar test result released under a general HIPAA-compliant authorization may still violate state law if the authorization lacks a state-required element. Separately, if a screening happens inside a federally assisted substance use disorder treatment program, 42 CFR Part 2 applies to that program's records with its own consent and redisclosure rules.

Have counsel produce a one-page matrix for the states where you operate. Give it to whoever processes records requests. Re-review it annually.

The 60-Day Clock When a Vendor Loses the Data

A business associate that discovers a breach of unsecured PHI must notify the covered entity without unreasonable delay and no later than 60 calendar days from discovery. That is the regulatory ceiling. It is a terrible operational target.

If your billing vendor is breached on day 1, notifies you on day 58, and you then have to notify affected individuals within 60 days of discovery, your practice absorbs the timeline pressure, the notification cost, and the patient anger. Negotiate a contractual notification window of 5 to 10 business days, plus immediate notice of any suspected security incident affecting your data.

Then look at what actually happens in the field. The OCR breach portal lists reported breaches affecting 500 or more individuals, and the entries involving business associates are a standing reminder that vendor incidents drive a large share of the volume. Spend twenty minutes reading recent entries in your specialty before your next vendor renewal. It sharpens the questions you ask.

A Vendor Review Cycle You Can Actually Run

Small practices don't fail at vendor management because they lack sophistication. They fail because nobody owns it on a schedule. Here is a cycle that fits inside a practice with three clinicians and one administrator.

Month 1 — Inventory

The office manager reconciles twelve months of payments against the BAA folder. Output: a single spreadsheet with vendor name, service, PHI touched (yes/no/unknown), BAA on file (yes/no), date signed, and renewal date. Two half-days of work.

Month 2 — Close the gaps

The privacy officer sends agreements to every vendor in the "no BAA" column and every vendor whose agreement predates the current template. Set a 30-day response deadline. Escalate non-responders to a decision: sign, or we migrate off you.

Month 3 — Test one workflow

Pick the highest-sensitivity path — a behavioral health referral, for instance — and walk it. Who transmitted it? Over what channel? Was minimum necessary applied, or did the whole chart go out because it was one click? Document the finding and one corrective action.

Ongoing — Tie it to the risk analysis

Vendor exposure belongs in your Security Rule risk analysis, not in a separate binder. NIST's SP 800-66r2 maps Security Rule requirements to practical safeguard activities and is a reasonable structure for practices without a dedicated security staff. If you want the risk analysis, policies, and supporting documentation generated as a coherent set rather than assembled piecemeal, automated HIPAA documentation tooling can produce the baseline you then tailor to your environment.

One caution: no vendor, product, or consultant can grant you HIPAA "certification." HHS does not certify or endorse compliance products. What you can produce is evidence — dated documents, signed agreements, completed reviews — and that is what an investigator asks for.

Start With the Agreements You Can't Find

The fastest measurable win is the BAA gap. Pull your vendor list this week, mark the missing agreements, and send them out. If your template is stale or you don't have one, build a signature-ready BAA in six steps and export it for e-signature — a one-time purchase, no recurring cost, and one fewer item on the list of things you cannot document when someone asks.