Eleven days. That is how long it took, in a mid-sized internal medicine practice I reviewed last spring, for a single patient's protected health information to touch six outside organizations after a CBC came back showing normocytic anemia. Nobody did anything wrong clinically. The problem was administrative: three of those six organizations had no current business associate agreement on file, and one of them had quietly moved its storage to a subcontractor the practice had never heard of.

This post is not about the condition. It is about the vendor and records exposure that a workup like this creates, and what you — the administrator, privacy officer, or compliance lead — do about it before someone else asks you to explain it.

The Eleven-Day Paper Trail Behind One Normocytic Anemia Workup

Normocytic anemia is a lab finding, not a diagnosis, which is exactly why it generates administrative volume. It typically prompts additional testing and, often enough, a specialist referral. Records move. Every movement is a disclosure, and every disclosure has an owner in your organization whether you have named one or not.

Here is the realistic path for one patient in a practice with a standard outpatient stack:

  • Day 0. Draw at your in-house station, specimen routed to a reference lab under a lab services agreement.
  • Day 1. Results return through a lab interface vendor that normalizes HL7 messages into your chart system.
  • Day 2. Physician orders follow-up panels. Order goes back out through the same interface.
  • Day 4. Practice sends a referral packet to hematology through a third-party referral portal or a cloud fax service.
  • Day 5. Chart notes and results sync to your patient engagement vendor for the portal message and appointment reminder.
  • Day 8. Coding and claim submission run through your billing company and its clearinghouse.
  • Day 11. Your transcription or ambient documentation vendor has retained the encounter audio or draft note in its own environment.

Six to eight organizations. Count the subcontractors behind them and the real number is higher. If you cannot name every one of those entities from memory, you do not have a vendor inventory — you have a vendor assumption.

Which of Those Vendors Actually Need a BAA

Short answer: you need a business associate agreement with any person or entity that creates, receives, maintains, or transmits PHI on your behalf to perform a function or service for you. You do not need one with another covered entity that receives PHI for its own treatment, payment, or health care operations purposes.

Applied to the list above:

  • Reference lab performing the test: generally no BAA required. The lab is a covered entity receiving PHI for treatment. You still need a lab services agreement and, in practice, a documented understanding of results delivery.
  • Hematology practice receiving the referral: no BAA. Provider-to-provider disclosure for treatment.
  • Lab interface / integration vendor: BAA required. It handles PHI on your behalf.
  • Referral portal or cloud fax service: BAA required in nearly every configuration, because the vendor stores transmitted documents.
  • Patient engagement and reminder vendor: BAA required.
  • Billing company and clearinghouse: BAA required.
  • Transcription or documentation vendor: BAA required, plus a written answer on retention and model training.

HHS publishes sample business associate agreement provisions that are worth reading against whatever your vendors send you. They are a floor, not a contract.

The treatment exception people misapply

The most common error I see is stretching the treatment exception to cover anything lab-adjacent. A reference lab running the panel is a covered entity. A vendor that routes results between you and that lab is not doing treatment — it is performing a service for you. Same data, different legal posture. If your file has a lab services agreement where a BAA belongs, that gap will surface during a records dispute or an incident review.

Conduits versus vendors that hold data

The conduit exception is narrow. It covers entities that transmit and do not access PHI other than randomly or incidentally — the classic examples are the postal service and telecommunications carriers. A cloud fax vendor that keeps sent documents in a web archive for ninety days is not a conduit. Ask every transmission vendor a single question in writing: do you retain any copy of what passes through you, and for how long? The answer determines the paperwork.

Where the Normocytic Anemia Referral Chain Breaks Down

Subcontractor drift

Your BAA with the referral portal was signed in 2022. Since then the vendor migrated storage, added an offshore support desk, and bolted on an analytics module. Each of those is a subcontractor that must be bound by terms at least as restrictive as yours. Your BAA should require notice of material subcontractor changes, and your annual review should actually ask for the current list.

The fax number nobody owns

Anemia referral packets are still faxed constantly. In most practices, the fax destination list lives in a front-desk cheat sheet, not a governed system. Misdirected faxes remain one of the most mundane and most frequent sources of impermissible disclosure. Assign one person to verify the specialist directory quarterly and to document the verification. It takes twenty minutes and it is the cheapest control you will ever implement.

Portal accounts that outlive employees

Every external portal — reference lab result viewer, referral platform, clearinghouse, payer site — is a separate identity store outside your directory. When your MA leaves, IT disables the network account and nobody touches the lab portal login. Build a termination checklist that enumerates every external system by name, and have the departing employee's supervisor sign it. NIST's SP 800-66 Revision 2 resource guide maps this kind of access management back to Security Rule requirements in plain language.

The vendor you inherited

Practices that have merged, changed billing companies, or switched chart systems almost always carry a legacy vendor with residual PHI. Old data is still your data. Termination provisions in your BAA should require return or destruction, with written certification. Chase the certification.

Build the Vendor Inventory in One Afternoon

You do not need a platform to start. You need a spreadsheet and four hours. Run it in this order:

  1. Pull the accounts payable vendor list for the last 24 months. Money is the most honest map of who touches your operation.
  2. Pull the list of every system your staff logs into. Ask three clinical staff and two front-desk staff to write down every username they have. You will find two or three vendors AP never showed you.
  3. Mark each row: PHI, no PHI, unclear. "Unclear" is an action item, not a category you get to keep.
  4. For every PHI row, locate the signed BAA. Record the signature date, the counterparty entity name, and where the PDF lives.
  5. Flag anything older than three years, unsigned, or signed by an entity whose name has since changed. Those are your remediation queue.

Expect to find gaps in the referral and transmission layer specifically. That is where anemia workups, imaging orders, and specialist packets all funnel, and it is where practices most often assume someone else papered the relationship. When you find a gap, close it that week — you can generate a signature-ready business associate agreement through a six-step wizard and export it as PDF or DOCX the same afternoon, without waiting on outside counsel for a routine vendor. One-time purchase, no subscription, which matters when you are closing eleven gaps at once rather than one.

If the inventory exercise reveals that your broader documentation set is stale too — risk analysis, policies, workforce training records — automating the full compliance document set is a faster path than rebuilding it from templates you found in a shared drive.

The Records Request That Arrives Six Weeks Later

Now the administrative back half. The patient with the normocytic anemia workup applies for disability coverage, or switches to a new primary care physician, and requests the complete file.

Under the HIPAA right of access, you have 30 calendar days from receipt to act, with one 30-day extension available if you notify the individual in writing of the reason and the expected date. Fees must be reasonable and cost-based. HHS's individual right of access guidance is the operative reference, and OCR has enforced against small practices on access timeliness repeatedly.

Two practical traps in this specific fact pattern:

  • Lab results you received are part of your designated record set. You cannot redirect the patient to the reference lab for results already sitting in your chart.
  • Records held by your business associates count. If your transcription vendor holds the only complete version of a note, or your old billing company holds explanation-of-benefits detail, your 30-day clock still runs. Your BAA needs a turnaround commitment shorter than 30 days — 10 business days is a reasonable ask — or you will miss deadlines through no fault of your own.

Delay and obstruction also carry information blocking exposure separate from HIPAA. Familiarize yourself with the information blocking rules and exceptions before you decide a request is too burdensome to fill.

If the Vendor Loses the File: Your 60-Day Clock

Business associates must notify you of a breach without unreasonable delay and no later than 60 calendar days after discovery. Your own notification clock to affected individuals also runs 60 days from discovery. Those two clocks can consume each other. Negotiate a shorter vendor notice window — many practices require 5 business days — and put it in the BAA rather than relying on goodwill.

When an incident lands, the four-factor risk assessment governs whether notification is required: the nature and extent of the PHI including identifiers and re-identification likelihood, who used or received it, whether it was actually acquired or viewed, and the extent to which risk has been mitigated. Document the assessment even when you conclude no breach occurred. The undocumented conclusion is worth nothing eighteen months later.

Spend twenty minutes in the OCR breach portal filtering for business associate involvement. The pattern is consistent and unglamorous: vendors, not clinicians, account for a large share of the largest reported incidents.

Assign the Work by Name

Controls without owners decay. Write these into your privacy program with actual names:

  • Vendor inventory owner: updates the spreadsheet within 5 business days of any new vendor engagement. Usually the practice manager.
  • BAA custodian: holds executed agreements, tracks expiration and amendment dates, requests subcontractor lists annually. Usually the privacy officer.
  • Referral directory verifier: confirms fax numbers and portal destinations quarterly. Front-desk supervisor.
  • External access reviewer: reconciles portal logins against the active roster twice a year. IT lead or office manager.
  • Records request lead: logs receipt date, tracks the 30-day clock, escalates vendor-held records at day 10. Medical records staff.
  • Incident intake: single named contact and backup, published to every business associate in the BAA notice provision.

One anemia workup, six vendors, eleven days. Multiply by your annual encounter volume and you have the actual shape of your privacy risk — not in the exam room, but in the contracts folder.

Start with the inventory this week. When you find the vendors operating without paper, build and export the agreements you need rather than adding them to a list you will look at next quarter.