Pull one chart from your neurology referral queue and count the outside organizations that received protected health information in the ninety days after the MS diagnosis was documented. In most practices the honest count lands somewhere between eight and fifteen. Imaging center. Reference lab. Specialty pharmacy. Infusion suite. Prior authorization portal. Clearinghouse. Release-of-information vendor. Transcription service. The reminder-text platform nobody on the compliance side signed off on.

This post is about that list — who is on it, which entries require a business associate agreement, which require a patient authorization instead, and what to do about the ones you cannot document. It is an administrative exercise, not a clinical one. Nothing here concerns how anyone is evaluated or treated.

Count the Organizations That Touch One MS Diagnosis Chart

Multiple sclerosis is a chronic condition that typically involves neurology, advanced imaging, laboratory work, and long-term specialty therapies administered outside the primary care office. That clinical reality has one administrative consequence you own: the chart moves, repeatedly, across organizational boundaries, for years.

Most privacy officers can name the four or five obvious recipients. The exposure sits in the other seven.

The disclosure trail from a single workup

  • Referred specialists and imaging facilities — treatment disclosures between covered entities.
  • Reference laboratory — usually a covered entity in its own right.
  • Health plan prior authorization — payment disclosure, often routed through a third-party utilization management portal.
  • Specialty pharmacy and infusion provider — treatment, but frequently accompanied by an intake vendor collecting far more than clinical data.
  • Billing clearinghouse and revenue cycle contractor — business associates, no exceptions.
  • Release-of-information vendor — business associate handling your right-of-access obligations.
  • Manufacturer copay or patient support program — not a business associate, and not a treatment disclosure either.
  • Disability, FMLA, and employer form processors — authorization territory.
  • Patient engagement, reminder, and portal vendors — business associates, almost always under-contracted.
  • Care coordination or remote monitoring apps — depends entirely on who deployed them and why.

Print that list. Beside each entry write a vendor name, a contract date, and the initials of the person who owns the relationship. The blanks are your project plan.

Which of Those Vendors Actually Needs a BAA

The distinction matters because the wrong instrument gives you no protection and creates a paper trail suggesting you misread the rule.

Business associates

A business associate creates, receives, maintains, or transmits PHI to perform a function on your behalf. Your clearinghouse, your ROI vendor, your transcription service, your IT managed service provider, your appointment reminder platform, your cloud hosting provider, your shredding company, your answering service, your credentialing consultant who pulls charts for a payer audit — all business associates. HHS publishes sample business associate agreement provisions that establish the floor, not the ceiling.

Not business associates

Another provider treating the same patient is not your business associate. When your office sends the neurology consult note and the MRI report to the treating neurologist, that is a treatment disclosure permitted without a BAA and without authorization. Same for the lab receiving an order.

A pharmaceutical manufacturer's copay assistance program is not your business associate either — it performs no function for you. If your staff completes enrollment paperwork that includes clinical detail, you need a valid, signed patient authorization on file, and the authorization needs to actually cover what you sent.

Your practice's own workforce, including contracted clinicians who function as workforce members under your direction, do not need BAAs. Document the distinction in writing before someone at renewal time asks why the per-diem coder has one and the traveling MA does not.

Do You Need a BAA With an Infusion Center or Specialty Pharmacy?

Usually no. When an infusion center or specialty pharmacy is providing treatment to the patient in its own right, the disclosure from your practice to that organization is a permitted treatment disclosure under the Privacy Rule. No business associate agreement is required.

You do need one when the relationship changes shape. If that same organization runs an adherence-tracking program, generates reports back to your practice, manages your prior authorization queue, or hosts an intake portal your staff logs into, it is performing a function on your behalf and a BAA is required for that scope of work. The test is not the vendor's industry. The test is whose job the vendor is doing.

When you cannot answer that question from the contract language, ask the vendor to describe every data flow in writing, then classify. Practices that skip the classification step tend to end up with two failures at once: BAAs with entities that never needed them, and no BAA with the one vendor that quietly aggregates their patient panel.

The Four BAA Clauses Auditors Read First

Signed is not the same as sufficient. When a regulator, a payer auditor, or opposing counsel reviews your agreements, they go to the same four places.

1. Breach notification timing

Your BAA should require the business associate to notify you without unreasonable delay and specify a number of days. Many practices accept the vendor's standard "promptly." Then a vendor incident is discovered on day 40, you learn on day 48, and your own 60-day clock to notify affected individuals is already most of the way gone. Name a number. Ten calendar days is defensible; five is better if the vendor will take it.

2. Subcontractor flow-down

Your ROI vendor uses an offshore indexing contractor. Your reminder platform uses a third-party SMS gateway. The agreement must require written assurances from every subcontractor that creates, receives, maintains, or transmits PHI on the business associate's behalf. Ask for the subcontractor list annually and keep the response in the vendor file.

3. Return or destruction at termination

When you switch reminder vendors or drop a billing contractor, what happens to the historical data? A chronic-condition panel means a vendor may hold years of appointment history tied to a specific service line. Get a written destruction certificate, dated, describing what was destroyed and by what method.

4. Permitted uses beyond your instruction

Read the sections on de-identification, aggregation, product improvement, and analytics. Some vendor templates grant broad rights to use "de-identified" data for the vendor's own purposes. That may be lawful, but you should decide whether you consent to it — not discover it after the fact from a marketing case study describing your patient population.

If your agreements are inherited, unsigned, or a mismatched pile of vendor-supplied templates, the fastest fix is to standardize on your own paper. You can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX — a one-time purchase, no subscription — which is generally faster than negotiating clause by clause against twelve different vendor forms.

Where MS Diagnosis Data Leaks Without Anyone Calling It a Breach

The reportable incidents get attention. The routine ones do not, and they are the ones your staff repeat weekly.

The copay assistance form

A front-desk coordinator faxes an enrollment packet including chart notes to a manufacturer program because the patient asked for help. No authorization in the file, or an authorization signed 18 months ago for a different program. This is a disclosure without a permitted basis. Build a form-specific authorization into the workflow and require it before anything leaves.

The reminder text

A confirmation message that reads "your infusion appointment Thursday at 9" discloses more than a generic reminder does. Configure templates centrally, restrict who can edit them, and confirm the platform's BAA covers message content storage — not just transmission.

The analytics module you turned on

Third-party trackers on patient-facing pages and scheduling flows have drawn sustained regulatory attention from both OCR and the FTC. If your website offers condition-specific scheduling or symptom-based intake forms, the tracking configuration on those pages is a privacy decision, not a marketing decision. Review it with whoever manages the site and document what fires where.

The unlisted vendor

Someone in the practice signed up for a free document-sharing tool to send imaging to a referring office. No contract, no BAA, no inventory entry. Run a quarterly expense review against your vendor list; anything paid by card that touches patient data and is not on the list is your next conversation.

The Records Request That Arrives Fourteen Months Later

Chronic conditions generate records requests — for disability determinations, insurance appeals, second opinions, legal matters. When a request lands, you have 30 days to provide access, with one 30-day extension available if you notify the individual in writing with a reason and a date. HHS's right of access guidance is the controlling reference, and OCR has enforced it consistently.

Two vendor problems surface here. First, if your ROI vendor is slow, you are still the one out of compliance — the clock is yours, not theirs. Put a turnaround service level in the BAA or the underlying services agreement, and monitor it monthly.

Second, define your designated record set in writing before the request arrives. Imaging performed at an outside facility and received as a report is part of your record; the raw DICOM study sitting on the imaging center's PACS generally is not. Staff who guess at this either over-disclose or under-disclose, and both create work.

A 90-Day Vendor Cleanup You Can Actually Finish

Days 1–30: inventory

One spreadsheet. Columns: vendor, service, data elements received, classification (business associate / covered entity / neither), BAA on file (Y/N), BAA date, internal owner. Build it from accounts payable, not from memory. Assign the practice manager to pull the payables list and the privacy officer to classify.

Days 31–60: close the gaps

Rank by sensitivity and volume, not alphabetically. Anything holding longitudinal data for a chronic-condition panel goes first. Send agreements out with a two-week response expectation and escalate to the vendor's account manager on day 15. For vendors that refuse to sign, you have a business decision to make and it should go to leadership in writing.

Days 61–90: tie it to the risk analysis

Vendor exposure belongs in your security risk analysis, not in a separate binder. NIST's SP 800-66r2 implementation guidance maps Security Rule requirements to practical assessment activities and is a reasonable framework for documenting third-party risk. If you would rather not assemble that documentation by hand, tools that automate risk analysis reports and the supporting policy set will get you a defensible baseline faster than a Word template will.

Assign the Names Before You Close the File

Every item above needs a person, not a department. Who owns the vendor spreadsheet. Who reviews the reminder templates. Who receives the annual subcontractor list. Who signs off before a new tool touches a chart. An MS diagnosis in your system is simply a case study in how far a single chart travels — the same failure modes apply to oncology, behavioral health, and every other referral-heavy service line you run.

If the gap you found today is a missing agreement rather than a missing process, close that one first. Build the business associate agreement, get it signed, log the date, and move to the next row on the list.