On December 30, a release note landed in your practice administrator's inbox. Buried in the third bullet: an ambient documentation assistant will be enabled by default for all provider accounts on January 15, with an opt-out available in the practice settings panel. No signature required. No new contract. Nothing that looks like a decision.

That is what most ehr news looks like in practice — not a headline, but a bullet point that quietly changes who touches your protected health information. This guide is for the person who has to decide what to do with that bullet: the administrator, billing lead, or privacy officer who owns the vendor list and absorbs the fallout. It covers how to triage vendor announcements, which four categories create actual work, a 30-day intake workflow with named owners, and where your Business Associate Agreement needs to catch up.

Why EHR News Is a Compliance Input, Not a Technology Story

Your EHR vendor is a business associate. Every material change it makes to how it processes, stores, transmits, or analyzes your patient data is a change to your compliance posture — whether or not anyone asked you to sign something.

The Security Rule requires you to identify risks to electronic PHI and respond to them on an ongoing basis, not once a year when you dust off last year's risk analysis. A vendor announcement is one of the cheapest risk signals you will ever receive. It arrives free, in writing, with a date attached.

The problem is routing. In most practices, release notes go to whoever manages the EHR login — often an office manager who has no mandate to evaluate privacy impact, and no budget line for it. Six months later, an auditor or a records request surfaces a data flow nobody documented.

The Four Categories of EHR News That Create Work for Your Practice

Not everything needs a response. Sort incoming items into these four buckets and the workload becomes manageable.

1. Feature Releases and Default-On Toggles

The riskiest phrase in any release note is "enabled by default." Patient portal messaging expansions, ambient scribes, e-fax integrations, appointment reminder engines, AI-assisted coding suggestions, and analytics dashboards all change what leaves your instance and who reads it.

Ask three things: What new data does this feature touch? Where does it go? Is a new subcontractor involved? If the answer to the third question is yes and your vendor has not told you, you have a gap in your due diligence file.

2. Subprocessor, Hosting, and Ownership Changes

Vendors migrate cloud regions, swap transcription subcontractors, and get acquired. Each of those is a change in the chain of custody for your patients' records. HIPAA requires your business associate to bind its subcontractors by written agreement, but it does not require the subcontractor to be someone you would have picked.

Acquisition news deserves particular attention. When your EHR vendor is bought, the entity holding your data changes, the security program may be consolidated, and the support model usually shifts. Your BAA survives, but your assumptions about it may not.

3. Breach and Incident Disclosures

When a vendor discloses an incident, the clock is not theirs alone. If your patients' PHI was involved, you are the covered entity with the notification obligation, and your BAA governs how fast the vendor has to tell you. Check the HHS breach notification requirements against what your agreement actually says — many BAAs specify 60 days from the vendor's discovery, which can leave you almost no runway.

Get in the habit of scanning the OCR breach portal for your vendors by name once a quarter. Business associate incidents show up there, and a vendor's disclosure timeline to you is not always the same as its disclosure timeline to the world.

4. Regulatory and Certification News

Information blocking rules, certification criteria updates, payer API requirements, and proposed Security Rule changes reach you through your EHR vendor's product roadmap before they reach you through the Federal Register. When your vendor announces new API endpoints or export capabilities, that is usually a certification requirement being implemented — and it typically means new obligations on your side for how you respond to access requests.

The information blocking regulations apply to providers directly, not just to developers. Practices are actors under the rule, and "our EHR doesn't do that" is not automatically a defense. The federal information blocking resources spell out the exceptions and what documentation they require.

What Should a Practice Do When Its EHR Vendor Announces a New Feature?

Run these six steps within 30 days of the announcement:

  1. Log it. Record the announcement date, source, and effective date in a vendor change log.
  2. Classify it. Does it touch PHI? If no, close it with a one-line note. If yes, continue.
  3. Map the data flow. What fields, which patients, transmitted where, retained how long, deleted by whom.
  4. Check the BAA. Does the existing agreement cover this use, this subcontractor, and this retention period?
  5. Decide default-on or off. Assign a named owner to disable, pilot, or approve before the effective date.
  6. Update your documentation. Amend the risk analysis, the data inventory, and any policy or workforce training the change affects.

Six steps, one owner, one dated entry. That is the whole discipline.

A 30-Day Intake Workflow With Owners Attached

Assign these roles by name, not by title, and put them in your policy document.

Days 1–3 — Intake. Your practice administrator forwards every vendor communication to a single monitored address. No triage at this stage; the goal is to stop items dying in personal inboxes. Set up a rule so release notes, status page emails, and account manager messages all land in the same place.

Days 4–10 — Classification. Your privacy officer reads each item and tags it: no PHI impact, PHI impact with existing coverage, or PHI impact requiring action. Most items close here in under two minutes.

Days 11–20 — Vendor questions. For anything in the third category, send written questions to your account manager. Where is the data processed? Which subcontractors are involved? Is model training on our data in scope? What is the retention default and can we change it? Keep the replies — email is documentation.

Days 21–30 — Decision and record. Your privacy officer and practice administrator decide together, record the decision with a date and a rationale, and adjust configuration before the effective date. If the answer is "we need an amended agreement," start that now rather than after go-live.

The BAA Questions Vendor Announcements Quietly Change

Most practice BAAs were signed at onboarding and never revisited. Meanwhile the product underneath them added transcription, analytics, messaging, and third-party integrations. Pull yours and check four things against the current product.

  • Permitted uses. Does the agreement allow the vendor to use de-identified or aggregated data for product improvement? Many do, in one sentence, in the middle of a paragraph.
  • Subcontractors. Does the vendor have to notify you before adding one, or only bind them contractually?
  • Incident timelines. How many days from discovery to notice to you, and is "discovery" defined?
  • Termination and return. What happens to your records if you leave? Export format, timeline, cost, and deletion certification.

When the answers do not match what the product now does, you need a fresh agreement, not a note in a file. If you are chasing signatures across several vendors at once — the billing clearinghouse, the answering service, the new scribe subcontractor — a six-step wizard that produces a signature-ready Business Associate Agreement with PDF and DOCX export gets that off your desk in an afternoon. One-time purchase, no subscription, which matters when you need three agreements this quarter and none next quarter.

A Worked Example: The Ambient Scribe Toggle

Back to the January 15 default-on feature. Here is what a competent response looks like.

Your privacy officer confirms the assistant records encounter audio, sends it to a speech-processing subcontractor, and returns a draft note into the chart. That is PHI leaving your instance to a party you have not evaluated. Your existing BAA names the EHR vendor only.

You send written questions and learn the audio is retained for 30 days by default, configurable to zero, and that a training opt-out exists at the practice level but is off unless requested. You disable the feature on January 10, request the amended agreement, and pilot with two providers in February under a written scope.

Then the billing side. Ambient documentation changes what appears in the note — length, structure, and which elements get captured. Code selection remains the responsibility of the provider and your coding staff under your existing policy, based on documentation in the record. What changes is your audit obligation: run a documentation review on the pilot encounters, compare generated notes against your practice's documentation standards, and confirm your providers are attesting to and editing drafts rather than signing them unread. Record who reviewed, what sample size, and what you found.

How to Keep Up With EHR News Without Reading Everything

You do not need a monitoring service. You need four subscriptions and a recurring calendar block.

  • Your EHR vendor's release notes and status page, delivered to the shared intake address.
  • Your clearinghouse and patient-communication vendors' change logs, same address.
  • The HHS Security Rule guidance pages, checked quarterly. HHS proposed significant Security Rule updates in early 2025; confirm the current status before you rewrite policies on the strength of a headline.
  • A 45-minute block on the first Tuesday of each month for your privacy officer to clear the queue.

Forty-five minutes a month, one log, one owner. That is a defensible program.

What Belongs on Your January Calendar

Three items, before the end of the month. Inventory every vendor with access to PHI and confirm you hold a current signed BAA for each. Pull your last risk analysis and note every product change since it was written. Set the recurring monthly block and name the person who owns it.

If the inventory turns up vendors without agreements — and it usually does — generate the Business Associate Agreements you are missing and get them out for signature this week. If the risk analysis is the bigger gap, automated risk analysis reports and the supporting policy set will close it faster than a blank template will. Either way, the next release note is already drafted somewhere. Decide now where it lands.