Count the vendors that touch a single telehealth lipid visit at your practice. A patient books through your scheduling widget, fills out an intake form hosted somewhere, joins a video session on a platform, and the clinician places an order for a lipoprotein a test that routes through an interface engine to a reference lab. The result comes back, lands in the chart, and publishes to a portal. That is five to seven distinct organizations handling protected health information before anyone submits a claim.

This post is for the administrator who has to document that chain. Not the clinical picture — the paperwork, the agreements, the release timing, and the audit trail. If your intake and consent workflow was built for in-person visits and bolted onto telehealth in 2020, this is the review you have been postponing.

Why a Lipoprotein A Test Visit Generates More Records Movement Than a Routine Follow-Up

You do not need clinical detail to run this workflow, but one uncontroversial fact shapes the administrative load: Lp(a) levels are largely inherited, so these encounters often involve family history intake, and an abnormal result frequently prompts a referral to a lipid or cardiology specialist. That means two things for your records team.

First, your intake form is collecting family health history, which is genetic information under the Genetic Information Nondiscrimination Act and is treated as PHI under the HIPAA Privacy Rule. Second, the encounter regularly ends with records moving to another organization — a referral packet, a consult note back, sometimes a request from a relative's physician.

Neither is exotic. Both are places where practices get sloppy, because the workflow was designed around a chart that stayed in one building.

Family History Fields Deserve a Second Look

Genetic information, including family medical history, is PHI when your practice holds it. The Privacy Rule's specific prohibition is on health plans using or disclosing genetic information for underwriting purposes. Your practice is not a plan, but you are frequently the source that feeds a plan.

Practical rule for your staff: family history collected on a telehealth intake form does not travel with a claim, does not go into a prior authorization packet unless the payer specifically requires it for medical necessity, and does not get pasted into a referral cover note out of convenience. Assign one person — usually your privacy officer or a senior biller — to review what your claim scrubber actually transmits from the encounter note.

The Intake Form Is Where Most Telehealth Leakage Happens

Your video platform is probably fine. It has a BAA, it encrypts sessions, and your IT vendor has documented it. The unglamorous risk is the form the patient fills out at 9 p.m. the night before.

Ask three questions about that form:

  • Who hosts it? If it lives on your marketing website's form builder rather than inside your clinical system, you have a business associate relationship you may not have papered.
  • What analytics or advertising scripts run on that page? OCR's guidance on tracking technologies has been through litigation — a federal court vacated part of it in 2024 — but the underlying Privacy Rule obligation did not change. If a third party receives identifiable information about a patient's visit to a page where they are describing a cardiac risk workup, you need an agreement or you need the script gone.
  • Where does the completed form go? Email inbox, shared drive, or directly into the record? An intake PDF sitting in a general reception inbox for six weeks is a designated record set problem and a breach-scope problem at the same time.

Run this as a fifteen-minute exercise: open your own intake link in a private browser window, use your browser's developer tools network tab, and list every outbound domain the page contacts. Hand that list to whoever maintains your vendor inventory.

Do You Need a BAA With the Lab That Runs a Lipoprotein A Test?

Usually no. A clinical laboratory that receives an order and performs the test is a covered entity in its own right, and the disclosure from your practice to the lab is a disclosure for treatment purposes. Treatment disclosures between covered entities do not require a business associate agreement.

The vendors around the lab are a different story. You almost certainly do need signed BAAs with:

  • The interface or order-routing middleware that formats and transmits the lab order
  • Any results-delivery or care-coordination app that surfaces the result outside your EHR
  • Your telehealth intake and scheduling host, if separate from your clinical system
  • Mobile phlebotomy or specimen courier services that handle requisitions containing patient identifiers
  • Transcription, scribe, or ambient documentation tools running during the visit
  • Your patient communication vendor sending appointment and results-ready notifications

The test that trips practices up is the courier. A driver picking up specimens with printed requisitions is handling PHI on your behalf. That is a business associate, and "they've been doing our pickups for eleven years" is not a defense during an OCR data request.

If you are looking at that list and realizing three of those relationships run on a handshake, you can generate a signature-ready Business Associate Agreement through a six-step wizard with PDF and DOCX export — a one-time purchase, no subscription, which is the right shape for a practice closing a handful of documentation gaps rather than buying a platform.

The Three Consents a Telehealth Lipid Visit Actually Needs

Practices routinely collapse these into one checkbox. Separate them, because they carry different legal weight and different revocation rules.

1. Notice of Privacy Practices Acknowledgment

You must make a good faith effort to obtain written acknowledgment of your NPP for direct treatment relationships. In a telehealth-first workflow, that means the NPP is presented before the visit, the acknowledgment is timestamped, and the record of that timestamp is retrievable six years later. If your platform captures the click but not the version of the NPP the patient saw, fix the versioning.

This is state law, not HIPAA. Many states require documented consent to receive care via telehealth, and some specify content — limitations of remote evaluation, what happens if the connection fails, how to reach the practice afterward. Your compliance calendar should include an annual check of the telehealth consent requirements in every state where your patients are physically located during visits, not just where your clinicians are licensed.

3. Communication Preferences and Method of Contact

Patients have the right to request confidential communications by alternative means or at alternative locations, and you must accommodate reasonable requests. For a visit that may produce a result the patient wants kept away from household members, capture this at intake — preferred phone, whether voicemail is acceptable, whether text notifications are permitted, and whether a proxy has portal access.

Text messaging consent is separate from HIPAA and lives under telecommunications rules. Keep it as its own field with its own revocation path.

Results Release Timing: The Portal Question You Will Get Asked

Under the information blocking regulations implementing the 21st Century Cures Act, electronic health information must be released to the patient without delay, unless an exception applies. There is no general "let the doctor review it first" exception. A patient can and often will see the result of a lipoprotein a test in the portal before anyone from your office calls.

What you can control is the administrative preparation:

  1. Set an expectation during the visit that results post immediately to the portal. Document that this was said.
  2. Give the patient a written path for questions — secure message, callback line, or a scheduled follow-up slot — before they leave the video call.
  3. Define internally who monitors incoming portal messages on results, and what the turnaround commitment is. Two business days is a reasonable, defensible internal standard; whatever you choose, write it down and staff to it.
  4. Document any exception you invoke, on the specific record, with the reason and the person who made the call. An undocumented delay looks identical to information blocking from the outside.

The details and the eight exceptions are laid out by ASTP/ONC's information blocking resources. Read the preventing harm and privacy exceptions closely with your medical director before you rely on either.

The 30-Day Clock When the Specialist's Office Calls

A lipid clinic requests the intake form, the visit note, and the lab result. Your front desk treats it as a records request and quotes three weeks. That is the wrong reflex twice over.

If the request is for treatment, it is a permitted disclosure and should move the same day. If the request comes from the patient, you have 30 days to act, with one 30-day extension available and written notice required. HHS's individual right of access guidance covers fee limits and format obligations — including that if a patient asks for an electronic copy of information you maintain electronically, you provide it electronically.

Train your front desk on the distinction with a one-page decision tree posted at the desk. The single most common failure is routing a treatment disclosure into the release-of-information queue and letting it age.

Designated Record Set: Include the Intake Form

The telehealth intake form is part of the designated record set if it is used to make decisions about the patient. That includes the family history section. If your ROI staff pulls only the encounter note and the lab result, your fulfillment is incomplete.

Breach Timelines You Should Have Memorized

If a vendor in this chain — the intake host, the courier, the results app — reports an incident, your clock is short. Notice to affected individuals goes out without unreasonable delay and no later than 60 days from discovery. Breaches affecting 500 or more individuals get reported to HHS within that same 60 days; smaller ones are logged and submitted within 60 days after the end of the calendar year.

Two related points. Discovery includes what your business associate knew, so your BAA needs a notification window short enough that you can still meet your own deadline — 10 calendar days is a common and reasonable term. And if a vendor in your chain is not HIPAA-covered, the FTC's Health Breach Notification Rule may reach them instead. Know which regime each vendor sits under before an incident, not during one.

HHS also maintains telehealth-specific HIPAA guidance worth circulating to clinical leadership. The COVID-era enforcement discretion for remote communication technologies ended in 2023; the standard rules apply to every video visit you run today.

A Workable Ninety-Minute Audit

Block one afternoon and assign these five tasks:

  • Privacy officer: List every vendor that touches a telehealth lipid encounter end to end. Mark each as covered entity, business associate with executed BAA, business associate without BAA, or unclear.
  • Practice manager: Pull the three consent artifacts for five recent telehealth visits and confirm each is timestamped, versioned, and retrievable.
  • IT or MSP: Inventory the outbound scripts on your intake and scheduling pages.
  • Front desk lead: Walk through the records-request decision tree with two real examples from last month.
  • Billing lead: Confirm what family history data, if any, leaves the practice on claims or prior auth packets.

Anything in the "no BAA" or "unclear" column becomes a two-week action item. That is also the point where the rest of the documentation set — risk analysis, policies, workforce training records — usually needs attention, and automating the risk analysis and policy set beats rebuilding it in a word processor for the fourth time.

The workflow around a lipoprotein a test is not special. It is just dense enough with vendors and referrals to expose whatever gaps already exist in your telehealth program. Start with the vendor list, close the missing agreements, and the rest of the review gets considerably shorter.