A prior authorization request for fidaxomicin for c. difficile typically leaves your office as a fax or portal upload of eight to twenty pages: the prescription, a chart note, stool test results, prior antibiotic history, and sometimes an entire discharge summary someone dragged in because it was easier than excerpting. That packet passes through a fax vendor or e-prescribing intermediary, lands at a pharmacy benefit manager, gets reviewed by a contracted utilization management vendor, and may be forwarded to a specialty pharmacy hub. That is four to six organizations touching identifiable health data for one script. This article maps that path, tells you which of those relationships require a Business Associate Agreement, and shows where the packet gets bigger than it needs to be.

No clinical guidance here. This is a records-and-vendors piece for the person who signs contracts and answers the phone when a fax goes to the wrong number.

Why This Drug Generates More Paperwork Than the Encounter Itself

Two administrative facts drive everything downstream. First, the medication is oral, so it runs through the pharmacy benefit rather than the medical benefit. Your practice never bills for the drug itself — there is no J-code, no buy-and-bill, no infusion suite chargemaster line. The claim is an NCPDP transaction submitted by a pharmacy, using an NDC, to a PBM you have no contract with.

Second, it is expensive relative to alternatives, which means payers put utilization management in front of it. Your practice's work product is not a claim; it is a justification packet. And justification packets are where minimum necessary discipline collapses.

That combination creates an odd compliance shape. You carry the PHI disclosure risk without carrying the revenue. Your billing staff spends hours on something that produces no line item on your remittance advice, which is precisely why these workflows go unsupervised for years.

Coding on Your Side of the Line

What your practice does bill is the encounter. C. difficile infection is captured in ICD-10-CM under A04.7, with subcategories distinguishing recurrent from not-specified-as-recurrent presentations. Your coders should already know that recurrence status is documented by the clinician, not inferred by the coder from a medication history — and that guessing at it to strengthen a prior authorization is a documentation integrity problem, not a shortcut.

The administrative point for you: the diagnosis code you submit on the office visit claim and the diagnosis code the pharmacy transmits on the drug claim are visible to different entities and reconciled by neither. If your chart note and the PA form disagree, the disagreement surfaces months later in an audit, and someone will pull the whole record to resolve it.

Who Sees PHI When You Request Fidaxomicin for C. Difficile

Short answer for the person searching this at 4:40 p.m. on a Friday: a single prior authorization for fidaxomicin for c. difficile commonly discloses PHI to the health plan, the plan's pharmacy benefit manager, a delegated utilization management reviewer, the dispensing or specialty pharmacy, the e-prescribing or fax transmission vendor, and — if the patient enrolls in a manufacturer copay or patient support program — the program administrator. The first four are covered entities or their business associates operating under treatment and payment permissions. The transmission vendor is your business associate and needs a BAA with your practice. The manufacturer program is generally neither, and disclosure to it usually requires the patient's written authorization.

That last distinction is the one practices get wrong most often, and it is worth its own section.

Manufacturer Support Programs Are Not Part of Treatment, Payment, or Operations

When a nurse faxes an enrollment form with the patient's name, diagnosis, and insurance details to a drug manufacturer's copay assistance or nurse-support program, that is not a payment disclosure and it is not treatment coordination between providers. The manufacturer is not your business associate — it is not performing a function on your behalf. It is a third party receiving PHI for its own purposes.

Handle it the way you would handle any non-TPO disclosure: a HIPAA-compliant written authorization signed by the patient, specific to the program, retained in the chart, with an expiration. Build the authorization into the enrollment packet so staff cannot send one without the other. Audit it quarterly by pulling five enrollments and looking for the signed form.

The Prior Auth Packet: Where Minimum Necessary Actually Bites

The HIPAA Privacy Rule's minimum necessary standard applies to disclosures for payment purposes, and a prior authorization is a payment disclosure. HHS is explicit that covered entities must limit disclosures to what is reasonably necessary and may rely on a requesting plan's representation of what it needs — but only to the extent that reliance is reasonable. See the HHS guidance on the minimum necessary requirement.

In practice, here is what goes wrong:

  • Staff attach the full inpatient discharge summary because the relevant paragraph is buried in it. That summary may contain behavioral health notes, HIV status, or family history irrelevant to the request.
  • The EHR's "print visit summary" function includes a problem list covering unrelated conditions.
  • A denial appeal triggers a second, larger submission — appeals are where packets balloon from twelve pages to sixty.
  • Multi-page faxes get sent to a number transcribed by hand from a payer letter.

Fix it with a standing rule, not with training slides. Designate one person per site who assembles PA packets against a written checklist: the PA form, the encounter note supporting the diagnosis, the laboratory confirmation, and the prior therapy record. Anything beyond those four items requires a note in the chart explaining why the plan asked for it. Store the payer's criteria document so you can point to what they said they needed.

Fax Confirmation Sheets Are Evidence — Keep Them

Misdirected fax is still one of the most common small-practice privacy incidents, and it is the one your staff will not self-report unless you make reporting cheap. Retain transmission confirmations with the PA record. When a patient later asks for an accounting of disclosures, or when you are reconstructing an incident timeline, those confirmations are the only proof of where the packet went and when.

The Vendor List You Probably Have Not Updated

Pull your business associate inventory and check it against this workflow. For a practice routinely handling prior authorizations for high-cost oral antibiotics, the following typically require a signed BAA:

  1. Cloud fax or secure-messaging vendor. They transmit and, critically, store images of PHI. Storage kills any conduit argument.
  2. E-prescribing and prior authorization network intermediaries, where you contract with them directly rather than receiving the service embedded in your EHR license.
  3. Clearinghouse handling your office visit claims.
  4. Outsourced billing or coding contractor reviewing charts to support appeals.
  5. Transcription or scribe service producing the note you attach.
  6. Document scanning or offsite storage vendor holding paper PA files.
  7. IT managed services provider with access to the drive where PA PDFs are saved.

Notice what is not on the list: the health plan and its PBM. They are covered entities or business associates of the plan, receiving PHI under their own payment permissions. You do not sign a BAA with a payer for claims and authorization traffic.

If you find gaps — and most practices find two or three, usually the fax vendor and the IT provider — close them before the next audit cycle. You can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export, one-time purchase, which is faster than routing a redline to counsel for a vendor you onboarded eighteen months ago and forgot about.

Public Health Reporting Is a Separate Permission — Do Not Route It Through Authorization

Many states include certain healthcare-associated infections on reportable condition lists, and hospitals report through their own surveillance channels. If your practice receives a request from a state or local health department related to a C. difficile case, that disclosure is permitted under the Privacy Rule's public health provision at 45 CFR 164.512(b). You do not need patient authorization, and you should not delay while chasing one.

What you do need: a written procedure identifying who verifies the requester's identity and authority, what gets sent, and where the disclosure is logged for accounting purposes. Public health disclosures are accountable disclosures. If a patient exercises their right to an accounting, an undocumented report to the health department is a hole in your response.

The 2026 Prior Authorization Rules Change Your Vendor Math

CMS finalized the Interoperability and Prior Authorization rule (CMS-0057-F) in early 2024, with impacted payers required to implement prior authorization APIs and shortened decision timeframes on a phased schedule running into 2027. The CMS final rule page is the authoritative reference.

For your practice, the operational consequence is that PA traffic is shifting from fax and portal keying to API exchange mediated by your EHR or a connectivity vendor. That is a net privacy improvement — structured requests carry less incidental PHI than a scanned discharge summary. It is also a new business associate relationship, or an expanded one, and the scope language in your existing agreement may not cover it.

Ask your EHR vendor, in writing, three questions: which payers you can reach through the API today, whether any subcontractor sits in the path, and whether the current BAA covers that subcontractor. Keep the answer. It is the cheapest audit evidence you will ever collect.

A Worked Example: Discharge on Friday, Denial on Tuesday

A patient is discharged from a hospital on Friday with a prescription for fidaxomicin for c. difficile and a follow-up appointment at your practice. Here is a defensible sequence.

Friday: The specialty pharmacy contacts your office to confirm coverage. Your front desk verifies the caller against the pharmacy on file before discussing anything. Verification is logged.

Monday: The plan requires prior authorization. Your designated PA coordinator assembles the four-item packet, transmits it through the fax vendor covered by your BAA, and files the confirmation sheet.

Tuesday: Denial arrives citing insufficient documentation of prior therapy. Before anyone attaches the hospital record wholesale, the coordinator requests the specific criterion from the payer in writing and pulls only the pages that address it. The rest of the discharge summary stays in the chart.

Wednesday: Patient asks about copay assistance. Staff provide the enrollment form together with a HIPAA authorization. Nothing is faxed to the manufacturer until the signed authorization is scanned.

Ongoing: Every disclosure outside treatment, payment, and operations gets logged. Every transmission confirmation gets retained. HIPAA requires six years of documentation retention for required policies and records; your state medical record retention period may be longer, and the longer clock governs the chart.

Two Audits Worth Running This Quarter

Audit one — packet size. Pull the last ten prior authorization submissions of any kind. Count pages. Identify every page that was not required by the payer's stated criteria. If your average packet is more than 60 percent necessary content, you have a minimum necessary problem, not a training problem.

Audit two — vendor coverage. List every system or service that touched those ten packets. Match each to a signed, current BAA. Anything unmatched is a finding. Reviewing the OCR breach portal for incidents at practices your size is a useful reminder that business associate incidents account for a meaningful share of reported breaches, and that the covered entity's name appears on the list either way.

If those audits turn up missing agreements, close them now rather than at renewal. Start with the BAA generator for the one-off vendors, and if your broader documentation set — risk analysis, policies, workforce training records — is equally stale, automated compliance document generation will get you to a defensible baseline faster than rebuilding binders from scratch. Neither is a certification, because no such government credential exists. Both are evidence that you did the work.