At 7:40 on a Tuesday morning, a lab interface drops a comprehensive metabolic panel into your EHR with two values flagged out of range. By 9:15 the patient has read the result in the portal, self-scheduled a telehealth follow-up for that afternoon, and typed a paragraph into your intake form about her drinking, a supplement she buys online, and a medication her cousin recommended. Nobody clinical has looked at any of it yet.

You are the administrator, not the clinician. Your problem is not what the high liver enzymes mean. Your problem is that in the next fourteen days this encounter will generate portal messages, a video session, an AI-generated note, a referral packet, a repeat lab order, an imaging authorization, and probably a records request — and every one of those steps involves a different vendor, a different consent question, and a different retention clock. This post maps that administrative trail so you can assign it to named people with named deadlines.

Why a High Liver Enzymes Visit Touches More Systems Than a Sore Throat

Abnormal liver enzyme results are a workup trigger, not an endpoint. Administratively, that means the encounter almost always generates outbound records: repeat labs, imaging, and in a meaningful share of cases a referral to gastroenterology or hepatology. Compare that to a self-limited complaint that opens and closes inside your four walls.

Trace the PHI footprint of the single encounter above:

  • Reference lab — result delivered via interface or portal, plus any add-on orders
  • EHR / practice management system — chart, orders, billing codes
  • Telehealth platform — video session metadata, waiting-room queue, possibly chat
  • Intake or digital forms vendor — the free-text paragraph about alcohol and supplements
  • Ambient documentation or transcription vendor — raw audio and draft note
  • Fax, direct messaging, or HIE service — referral packet to the specialist
  • Clearinghouse and payer — claim with diagnosis codes attached

That is six or seven business associates for one afternoon visit. If you cannot produce an executed agreement for each, you have a gap that shows up the moment anything goes wrong. HHS maintains plain guidance on who counts as a business associate, and the definition is broader than most front-office staff assume.

The Intake Form Is Where Practices Over-Collect

Intake questionnaires for liver-related visits tend to grow. Someone adds alcohol frequency. Someone adds a supplement free-text box. Someone adds travel history, tattoo history, household contacts. Each addition is clinically defensible and each one raises your exposure if the forms vendor is breached.

The minimum necessary standard does not restrict what a treating clinician collects for treatment purposes. It does restrict what you disclose and request. But there is a separate operational argument for restraint: every free-text field you collect is a field you must later review before releasing records, and free text is where the surprises live.

Three intake design decisions worth making before your next form revision

  1. Structure the sensitive fields. A coded alcohol-use screening instrument in a discrete field is easier to segment, easier to redact, and easier to explain than a paragraph someone typed at 9:15 a.m.
  2. Decide who reads intake before the visit. If your medical assistant triages intake responses, that access is treatment-related and fine. If your scheduler reads them to decide visit length, document why, and confirm your role-based access settings actually match that practice.
  3. Set a retention rule for the forms vendor. Ask, in writing, how long submitted forms sit in the vendor's environment after they land in your chart. Many default to indefinite. That is a second copy of the sensitive paragraph, outside your EHR, outside your backup policy, and inside someone else's breach.

Substance use records: know which rules actually apply to you

Intake for a high liver enzymes visit routinely asks about alcohol. Staff sometimes assume that makes the record a 42 CFR Part 2 record. Usually it does not. Part 2 attaches to federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment, or referral — not to a general practice that screens for alcohol use as part of a broader workup.

Where it bites is inbound. If a Part 2 program sends you records, those records carry restrictions that travel with them into your chart. The 2024 final rule aligning Part 2 more closely with HIPAA carried a compliance date of February 16, 2026, so as of now your notice content, consent handling, and breach obligations for any Part 2 material you hold should already reflect it. If your practice receives records from an affiliated behavioral health program, confirm with your privacy officer that this was closed out and documented, not deferred.

Most telehealth platforms present a single check-box before the patient enters the virtual waiting room. Administrators frequently believe that box does four jobs. It usually does one.

What the box typically covers

Consent to treat by telehealth, as required by your state's telemedicine statute and by many payer policies. That is a state-law and reimbursement document, not a HIPAA document.

What it usually does not cover

  • Notice of Privacy Practices acknowledgment. Direct treatment providers must make a good faith effort to obtain written acknowledgment of receipt. Electronic acknowledgment is acceptable; a check-box on a vendor's page that never syncs into your chart is not evidence you can retrieve during an investigation.
  • Authorization for disclosures outside treatment, payment, and operations. Sending a de-identifiable-in-theory case summary to a research registry, or letting a specialty pharmacy program market to the patient, needs a compliant authorization with all required elements.
  • Recording consent. Separate question, covered below.

Assign one person to pull the actual consent artifacts for three recent telehealth encounters and confirm each one lands in the legal medical record with a timestamp and a version number. If your platform stores them only in its own admin console, you have a records production problem waiting for you. HHS publishes practical provider-facing telehealth guidance that is worth handing to your clinical leads alongside your own policy.

Do You Need a BAA With Your Telehealth Platform?

Yes, in nearly every real configuration. A telehealth vendor that creates, receives, maintains, or transmits protected health information on your behalf is a business associate, and you need an executed business associate agreement before the first patient joins a session. The narrow "conduit" exception covers transmission-only services that do not access PHI beyond what is random and infrequent — think the phone company, not a platform that holds session recordings, chat logs, waiting-room rosters, or scheduling data.

The same test applies to your intake forms vendor, your ambient scribe, your e-fax service, your appointment reminder texting tool, and your cloud backup provider. If it holds the data, it needs an agreement, regardless of whether the vendor's marketing page says "HIPAA compliant."

If you find a vendor operating without one — and a telehealth expansion is the most common way this happens — you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX the same afternoon. One-time purchase, no subscription, which matters when you need three agreements this week and none next month.

Recording, Transcription, and the AI Scribe Question

An abnormal liver panel visit is a history-heavy encounter: medications, supplements, alcohol, prior labs, family history. That is exactly the kind of visit clinicians want an ambient scribe for, and exactly the kind of transcript you would least like to see in a breach notification.

Three things to nail down before you approve a scribe for telehealth use:

  1. Consent to record. HIPAA is not your only constraint. Several states require all-party consent to record a conversation. Your telehealth consent language and your scribe workflow have to match your state's rule, and the clinician has to actually say it out loud.
  2. Audio retention. Ask the vendor how long raw audio persists after the note is finalized, whether it is used for model training, and whether you can turn that off contractually. Get the answer in the agreement, not in an email from a sales engineer.
  3. Note provenance. If the draft note is machine-generated, your amendment workflow needs to handle a patient who requests correction of something the scribe misheard. Decide now who processes those requests and within what window.

The Referral Handoff: Where Records Actually Leak

When a high liver enzymes workup moves to a specialist, someone assembles a packet. That assembly step is the highest-risk manual task in the entire encounter, because it involves a human selecting documents and a fax number or direct address typed by hand.

Build the handoff as an assigned, logged task:

  • Who assembles — one named role, not "whoever is free."
  • What goes — a defined document set for referrals, so the packet does not default to "entire chart." Sending 400 pages when the specialist needs 12 is a minimum necessary problem and a misdirection risk multiplied by page count.
  • Destination verification — a maintained directory of specialist fax numbers and direct addresses, reviewed quarterly. Misdirected faxes remain one of the most mundane and most reported small-practice incidents; you can browse the pattern yourself in the OCR breach portal.
  • Closed-loop tracking — a log entry with date sent, date acknowledged, and date the consult note returned. Referrals that vanish generate patient complaints, and patient complaints generate records requests.

The 30-Day Clock After the Visit

Patients in the middle of a workup ask for their records. Expect it. Under the HIPAA right of access, you generally have 30 calendar days to act on a request, with one 30-day extension available if you notify the individual in writing of the reason and the new date. Fees must be reasonable and cost-based, and you must provide the records in the form and format requested if you can readily produce it.

Two operational specifics that trip up telehealth-heavy practices. First, "the record" now includes material sitting in your telehealth platform and your forms vendor — if the patient asks for everything, you need a documented procedure for pulling from those systems, not just the EHR. Second, a request to transmit records directly to a third party the patient designates must be honored in writing-signed form; front-desk staff should not be improvising that determination. The OCR individual right of access guidance is the document to train from.

A Fourteen-Day Assignment Sheet for One Encounter

Take the Tuesday scenario and put names on it:

  1. Day 0, front desk: confirm telehealth consent and NPP acknowledgment landed in the chart with version and timestamp. Two minutes.
  2. Day 0, clinical support: review intake responses under a role-based account; do not forward the free-text field by email.
  3. Day 0, clinician: state recording consent aloud if a scribe is active; confirm the patient's identity and location on the record.
  4. Day 1, billing: verify diagnosis codes on the claim match the documented encounter; flag anything that would disclose more than the payer needs.
  5. Day 2–3, referral coordinator: assemble the defined document set, verify destination against the quarterly directory, log the send.
  6. Day 7, referral coordinator: check acknowledgment; escalate unacknowledged sends.
  7. Day 10, privacy officer: spot-check the encounter's vendor trail against the BAA inventory. Any new tool used in this workflow that lacks an agreement is a finding.
  8. Day 14, privacy officer: confirm no access request or amendment request is sitting unlogged in a shared inbox.

None of these steps takes long. All of them fail silently when unassigned.

Tie It Back to Your Risk Analysis

Adding telehealth intake for workup-heavy visits changes your risk picture: new vendors, new data flows, new copies of sensitive free text. That is a change your security risk analysis is supposed to reflect, and NIST's SP 800-66r2 gives you a workable structure for documenting it without inventing your own framework. If your last analysis predates your telehealth platform, the analysis is stale and an investigator will notice the date before anything else.

A practical sequence: inventory the vendors touching your high liver enzymes workflow, close the BAA gaps, then update the risk analysis and the policies that reference those systems. If you would rather not rebuild the document set from scratch, tools that automate HIPAA risk analysis reports and the supporting policy set will get you to a reviewable draft faster than a blank template will. And when you find the vendor with no agreement on file — you will — draft the BAA and get it out for signature before the next patient books a video visit.