At 8:40 on a Tuesday morning, a patient joins a fifteen-minute virtual follow-up for a farxiga diabetes prescription. Before the clinician's camera turns on, that encounter has already crossed a scheduling platform, an intake form vendor, a video service, an e-prescribing gateway, a lab interface, and — if your practice enrolled the patient in a manufacturer savings program — a third party that is not your business associate at all. You are reading this because you sign the contracts for all of that, answer the records request that follows, and own the breach notification if one of those links fails.

This is an administrative walkthrough, not clinical guidance. Nothing here tells you or your clinicians what to prescribe, monitor, or document clinically. It maps who touches the data, what paperwork has to exist before they do, and where the gaps usually sit.

The Six-Vendor Map Behind One Farxiga Diabetes Telehealth Visit

Oral medications for type 2 diabetes are typically managed with periodic follow-up and lab work, and patients are frequently co-managed with endocrinology or nephrology. That clinical reality has one administrative consequence you care about: records move between organizations, repeatedly, for years. A single virtual visit is not a closed loop.

Sit down with your practice manager and list every system the encounter touches. In most small and mid-sized practices the list looks like this:

  • Scheduling and reminder platform — holds name, phone, appointment reason. Appointment reason is PHI.
  • Digital intake form vendor — often the richest data set in the whole chain: medication list, allergies, insurance card images, sometimes a photo of a glucose meter screen.
  • Video visit platform — connection metadata at minimum, session recordings if the feature is on.
  • EHR and e-prescribing route — the prescription transmission to a retail or mail-order pharmacy.
  • Lab interface — order and result routing.
  • Payer portal or clearinghouse — eligibility, prior authorization, claims.

Every entity on that list except the payer, the pharmacy, and the lab is a business associate. Payers, pharmacies, and labs are covered entities in their own right and receive data as permitted disclosures for treatment or payment — no BAA required, and no patient authorization required either. Confusing those two categories is the most common intake-workflow error I see during vendor reviews.

Where the map usually breaks

The intake form vendor. Practices adopt a form tool because the front desk wanted to stop retyping medication lists, and the contract gets signed at the office-manager level without a business associate agreement. Six months later that vendor holds insurance card images for four thousand patients. If your vendor inventory does not have a countersigned agreement on file for every platform in the chain, generate a signature-ready business associate agreement and close the gap before your next audit rather than after it.

Do You Need a BAA With Your Telehealth Platform?

Yes, in nearly every case. If a vendor creates, receives, maintains, or transmits protected health information on your behalf, HIPAA requires a business associate agreement before you use it. A video platform routing a patient encounter transmits PHI. The narrow exception is the conduit exception, which HHS reads very tightly — it covers entities like the postal service or a telecom carrier that move data without accessing or storing it. Most cloud video products do not qualify because they store connection data, chat logs, or recordings.

Two practical tests before you sign:

  1. Does the vendor offer a BAA at your subscription tier? Several consumer-grade platforms offer one only on enterprise plans. A free tier with no BAA is not usable for patient encounters.
  2. Does the BAA name subcontractors, or at least obligate the vendor to flow down equivalent terms? Your video vendor's transcription subcontractor is your exposure.

The COVID-era enforcement discretion for telehealth communication technologies ended in 2023. There is no remaining grace period. HHS maintains current guidance on HIPAA and telehealth that your privacy officer should re-read before approving any new platform.

Most practices hand a telehealth patient one bundled "consent" and assume it covers everything. It does not. Separate the documents in your intake stack and label them so staff can tell them apart.

1. Notice of Privacy Practices acknowledgment

Required by the Privacy Rule for direct treatment relationships. For a virtual visit, you must make a good-faith effort to obtain written acknowledgment — an electronic checkbox with a timestamp works, and the timestamp is what saves you when someone asks for proof three years later. Confirm your intake vendor exports that timestamp into the chart and does not leave it stranded in the vendor's own dashboard.

This is a state requirement, not a HIPAA requirement, and it varies substantially. Some states require documented consent to the telehealth modality itself; some require specific disclosure of alternatives to a virtual visit; some require the clinician to verbally confirm the patient's physical location at the start of the encounter. If your practice treats patients across state lines, your consent template has to branch by the patient's location, and your intake form should capture that location before the visit — not after.

3. Authorization for disclosures that are neither treatment, payment, nor operations

This is the one practices skip. Sending a patient's information to a drug manufacturer's copay assistance program, a patient support hub, or an adherence program run by someone other than your business associate is a disclosure that generally requires a signed HIPAA authorization under 45 CFR 164.508. Bundling it into the general treatment consent does not satisfy the requirement — authorizations have mandatory elements, including a description of the information disclosed, the named recipient, an expiration, and a statement of the right to revoke.

Copay Cards and Support Programs: The Authorization You Probably Don't Have

Manufacturer savings and support programs are common with branded diabetes medications, and front-desk staff enroll patients in them because it lowers the out-of-pocket cost and reduces abandoned prescriptions. That is a genuine service to the patient. It is also a disclosure of PHI to an entity outside your covered-entity relationships.

Draw a bright line for your staff:

  • If the patient enrolls themselves and enters their own information, your practice has disclosed nothing.
  • If your staff submits the patient's name, diagnosis, or prescription details to the program, that is a disclosure requiring an authorization on file.
  • If your practice receives any remuneration from a manufacturer in connection with communications encouraging use of that product, you are in marketing territory under 45 CFR 164.508(a)(3), and the authorization must disclose the payment.

Write this into your intake script for farxiga diabetes visits and every other branded-medication follow-up. One paragraph in the front-desk SOP prevents an entire category of complaints.

The 30-Day Clock That Starts When the Patient Asks for the Visit Record

Telehealth encounters generate designated record set material in places your release-of-information clerk does not normally look: the intake form vendor's stored responses, uploaded photos of meters or medication bottles, secure-message threads, and any session recording. HHS is explicit that the right of access covers the designated record set wherever it lives, including with business associates. Review the OCR individuals' right of access guidance with whoever fulfills your requests.

The obligation is 30 days from receipt, with one 30-day extension available if you notify the patient in writing of the reason and the new date. Right-of-access enforcement has been one of OCR's steadiest streams of resolution agreements for years, and the fact patterns are dull: a request that sat in a shared inbox, a clerk who told the patient to "ask the doctor," a fee that exceeded the cost-based standard.

A workable fulfillment checklist

  1. Log the request with a date stamp on the day it arrives, in any channel — portal, phone, email, or a note handed to the front desk.
  2. Pull the EHR chart and the intake vendor's stored submissions for the same date range.
  3. Confirm whether a recording exists. If your platform records by default, you have inherited a record you must produce.
  4. Deliver in the form and format requested if readily producible, including unencrypted email if the patient asks after being warned of the risk.
  5. Charge only a reasonable, cost-based fee. Per-page state schedules do not override the federal standard for electronic copies.

Prior Authorization Traffic Is About to Get Faster and More Auditable

Branded diabetes medications draw utilization management. Under the CMS Interoperability and Prior Authorization final rule, impacted payers face shortened decision timeframes — expedited and standard requests — that took effect at the start of 2026, with payer-to-provider API requirements arriving in 2027. CMS publishes the rule details on its interoperability and prior authorization page.

The administrative point for you: prior authorization submissions are payment disclosures, permitted without authorization, but they are subject to minimum necessary. Your staff should send the clinical documentation the payer's criteria require — not the full chart export because it was faster to click. Audit ten recent submissions and see which one your team actually did.

Ambient Scribes, Recordings, and the Default Setting Nobody Checked

If a clinician uses an AI scribe during a farxiga diabetes follow-up, three questions need answers in writing before the first session: Is there a BAA? Does the vendor use encounter audio or transcripts to train models, and can you opt out contractually? How long is audio retained, and can you set retention to zero after the note is generated?

Also decide whether the patient is told. HIPAA does not require patient consent for a business associate to assist with documentation, but several states have all-party recording consent statutes that apply to the audio itself. A single sentence in the telehealth consent — that documentation support may be used and audio is not retained beyond note generation — costs nothing and forecloses the argument.

Where Non-Covered Apps Enter the Picture

Patients arrive with glucose tracking apps, diet apps, and wearables. When a patient directs you to send data to an app of their choosing, you may do so, and the app's downstream handling is not your liability. When you recommend or supply the app and it feeds data back to your practice, examine the relationship carefully. Health apps outside HIPAA's reach fall under the FTC's Health Breach Notification Rule, and the FTC has enforced against health data sharing with advertising platforms. Your practice's own website and patient portal deserve the same scrutiny — third-party tracking pixels on a scheduling page for a diabetes visit are a recurring source of trouble.

A 45-Day Cleanup You Can Assign This Week

Days 1–10 (Privacy Officer): Build the vendor inventory for telehealth encounters. Every platform, every subcontractor you know of, with the BAA execution date and renewal date beside it.

Days 11–20 (Practice Manager): Unbundle the consent packet into NPP acknowledgment, state telehealth consent, and third-party authorization. Confirm each artifact writes back into the chart with a timestamp.

Days 21–30 (Front Desk Lead): Rewrite the copay-program script. Train it. Document the training date and attendees.

Days 31–45 (Privacy Officer): Refresh the security risk analysis to include the telehealth stack — recordings, intake storage, scribe audio, and remote access by clinicians working from home. If your last risk analysis predates your current telehealth vendors, it is stale. NIST's SP 800-66 Revision 2 remains the most usable free framework for mapping Security Rule requirements to concrete controls, and if you would rather not build the document set by hand, automated risk analysis and policy generation will get you a defensible baseline faster than a consultant's calendar allows.

None of this changes what happens clinically in the visit. It changes what you can prove afterward — which vendor held what, who consented to what, and when the request came in. That is the whole job.

Next step: pull your telehealth vendor list, mark the ones with no countersigned agreement on file, and build the missing business associate agreements through a six-step wizard with PDF and DOCX export — one-time purchase, no subscription. Then put the renewal dates on your compliance calendar so this stays a five-minute review next year instead of a forty-five-day project.