It is 7:41 p.m. on a Tuesday. A patient sends a portal message asking how often can you take Zofran — she took a dose after her infusion, is still nauseated, and wants to know if she can take another. That message is now protected health information sitting in your portal vendor's database. By Friday it will have generated a triage note, a phone log entry, possibly a claim line with a units field, and — if the plan pushes back — a prior authorization packet sent to a payer.

This article is about that trail. Not the clinical answer, which belongs to your prescribers and pharmacists. The administrative one: which systems hold the record, which vendors need a Business Associate Agreement, and where your practice gets exposed on audit.

Quick answer: which systems touch a Zofran frequency question?

When a patient asks how often can you take Zofran, the question typically lands in four to six systems inside a single week:

  • Patient portal or secure messaging platform — holds the original inbound message and your clinical staff's reply. Business associate.
  • EHR / practice management system — holds the triage note, medication list, and the encounter that supports the claim. Business associate.
  • E-prescribing network and pharmacy — receives the prescription and quantity. The pharmacy is a covered entity in its own right; the routing network is generally a business associate.
  • Clearinghouse and billing company — receive the claim, including diagnosis codes, drug codes, and units. Business associates.
  • Health plan or PBM — receives claim and prior authorization data as a covered entity for payment purposes, not as your business associate.
  • Answering service or after-hours triage vendor, if the message came in overnight. Business associate, and frequently the one missing from the vendor inventory.

Every entry on that list marked "business associate" requires a signed agreement before PHI moves. Every one marked otherwise still requires you to apply the minimum necessary standard.

The claim line: where frequency becomes units of service

Here is the part that surprises new billers. A clinical frequency question converts, on the administrative side, into a units of service field. Injectable ondansetron is reported under HCPCS J2405, defined per 1 mg. An office or infusion suite administering a dose is not billing "one injection" — it is billing a multiple of 1 mg units. Oral antiemetic substitution around chemotherapy administration carries its own Q-code with a defined dosage-regimen window baked into the code descriptor.

That means the answer to "how often" and "how much" is literally encoded on the claim. Get the units math wrong and you have either underbilled or created an overpayment that a payer will eventually claw back with interest.

Medically Unlikely Edits are the frequency guardrail

CMS publishes Medically Unlikely Edit files quarterly through the National Correct Coding Initiative. An MUE is the maximum units of a given HCPCS or CPT code that a provider would report for a single patient on a single date of service under most circumstances. Drug J-codes carry MUE values, and they are updated. Your billing lead should be checking the current quarterly files, not a value someone wrote on a sticky note in 2023. Start at the CMS NCCI edits page.

When a claim exceeds an MUE, one of two things happens: an automatic denial, or a request for records. That second outcome is the privacy event. A denial costs money. A records request means you are now packaging chart notes, administration records, and possibly the portal thread and sending them to a payer or its contracted reviewer.

NDC reporting adds a second data element

Most state Medicaid programs, and a growing number of commercial plans, require the 11-digit National Drug Code alongside the J-code on physician-administered drug claims, with NDC units and a unit-of-measure qualifier. That is a second place your units math has to be internally consistent. If your J-code units and NDC units tell different stories about how much drug was given, you have handed an auditor a starting point.

Assign this to a named person. Not "billing." A person, with a quarterly calendar reminder tied to the NCCI file release.

Who sees the PHI before the payment posts

Inside your walls

The front desk sees the appointment and the reason for visit. The medical assistant sees the medication list. The nurse or prescriber sees and answers the message. The coder sees the note, the drug, and the units. The billing lead sees the claim and any denial correspondence. That is five roles, and under the minimum necessary standard your access controls should reflect the difference between them.

The common failure: a front-desk user account with full clinical chart access because it was easier to configure that way during go-live. HHS guidance on the minimum necessary requirement is explicit that role-based access is how covered entities are expected to operationalize it for internal uses.

The second common failure: front-desk staff answering the clinical question. A patient calls, asks how often can you take Zofran, and a well-meaning scheduler reads something off the label or the internet. That is a scope problem before it is a privacy problem, but it also produces an undocumented clinical interaction — which becomes a documentation gap the day someone requests the full record. Write the script. Post it at the phone. The script is a warm handoff, not an answer.

Outside your walls

Now count the external organizations. Portal vendor. EHR host. Clearinghouse. Billing company or RCM partner. After-hours answering service. Transcription, if you still use it. Coding auditor. Release-of-information vendor. IT managed service provider with remote access to workstations. Cloud backup.

Every one of those creates, receives, maintains, or transmits PHI on your behalf, and every one needs an executed Business Associate Agreement on file — dated, signed by someone with authority, and findable in under five minutes. If you cannot produce the answering service's BAA right now, that is your first task this week. You can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export, one-time purchase, and close the gap the same afternoon.

Note the asymmetry: the health plan and the PBM are not your business associates. When you send claim or prior authorization data to a payer, that is a permitted disclosure for payment under the Privacy Rule. No BAA required — but the minimum necessary standard still applies to what you send.

Prior authorization and quantity limits create a second disclosure

Antiemetic prescriptions frequently hit PBM quantity limits. The pharmacy rejects at point of sale, the patient calls your office, and your staff assembles a prior authorization or quantity-limit exception request. That packet often includes diagnosis, treatment history, prior therapy failures, and clinical notes.

Three administrative controls matter here:

  1. Send the narrowest set that supports the request. A payer asking for justification of a quantity limit does not need the full chart. Attaching the entire encounter history because it was one click is a minimum necessary problem you created for convenience.
  2. Log the disclosure. Payment disclosures are exempt from the accounting of disclosures requirement, but your own outbound log is what saves you when a patient asks who received their information. Build it anyway.
  3. Verify the fax number or portal destination before sending. Misdirected PA packets are a recurring, entirely preventable breach category. If your staff still fax, require a second-person verification on any new destination number.

The portal message is part of the designated record set

This is the item most practices get wrong. A patient's inbound message asking how often can you take Zofran, and the clinical reply, are used to make decisions about that patient. That places the thread inside the designated record set. When the patient submits a records request, the portal thread is responsive.

You have 30 days from receipt to act on that request, with one 30-day extension available if you notify the patient in writing of the delay and the reason. HHS's individual right of access guidance lays out the timeline, the fee limits, and the form-and-format obligation. OCR has pursued right-of-access enforcement steadily since launching that initiative, and the pattern in published resolutions is consistent: small practices, ordinary requests, no response until OCR got involved.

Test whether you can actually export it

Run a live drill. Pick a chart in your test environment with an active portal thread. Ask your release-of-information staff to produce a complete record — including messages — in a format the patient can use. Time it. If your portal exports messages only as individual screenshots, or if messages sit in a module your ROI process never touches, you have a 30-day clock you will not beat.

Rehearse these three scenarios before they happen

Scenario one: a payer audits your drug units. A commercial plan requests records for twelve dates of service where J-code units exceeded a threshold. Who pulls the records? Who verifies that only responsive dates are included? Who signs the cover letter? Assign these now, in writing.

Scenario two: the answering service documents an after-hours call incorrectly. A patient calls overnight asking how often can you take Zofran. The service logs it under the wrong patient. That is a wrong-patient disclosure inside a vendor system. Your incident response process needs to cover vendor-side errors, and your BAA needs to specify the vendor's notification timeline to you — not just their obligation to notify "promptly."

Scenario three: a coder emails a chart excerpt to an outside consultant. Unencrypted, to a personal address, because the consultant's work email bounced. This is the mundane path to a reportable breach. Your risk analysis should already flag email as a channel, and your policy should say what staff do when a normal channel fails.

If your risk analysis is more than a year old, or if it was a checklist rather than a documented assessment of where PHI actually lives in your environment, rebuild it. NIST SP 800-66 Revision 2 is the practical reference for mapping Security Rule requirements to real controls. Tools that automate risk analysis reports and the supporting policy set shorten the work considerably, but the inventory of systems and vendors has to come from you — nobody outside your practice knows which answering service you switched to last spring.

Your 30-day cleanup list

  • Pull the vendor inventory. Add anything that touches messages, claims, or after-hours calls. Confirm a signed BAA for each.
  • Verify current quarter MUE values for the drug codes you bill most, and document who checks them each quarter.
  • Confirm J-code units and NDC units reconcile on a sample of ten recent claims.
  • Review role-based access in the EHR. Reduce front-desk accounts to what the role requires.
  • Write and post the phone script for clinical dosing questions.
  • Run a records-request drill that includes portal messages, and time it.
  • Confirm your BAAs specify a breach notification timeline in days, not adverbs.

The clinical question of how often can you take Zofran gets answered in about ninety seconds by someone licensed to answer it. The administrative consequences run for months across six systems and four organizations. Start with the agreements — build the missing BAAs now and get them signed before the next vendor onboards, because retroactive paperwork is the hardest kind to explain.