A patient comes in for her six-week postpartum recovery visit. Before she reaches the parking lot, her data has touched your EHR, your clearinghouse, a reference lab, an appointment-reminder service, and — if she enrolled in your remote blood pressure program — a device vendor and that vendor's cloud host. Six organizations from one twenty-minute encounter, and at least four of them are business associates. This post is a vendor-exposure map for practice administrators: how to inventory who actually receives postpartum recovery data, which relationships require a signed BAA, and what to fix before a breach or an audit forces the question for you.

The Nine Systems One Postpartum Recovery Visit Touches

Run this exercise with your office manager and your billing lead. Take a single recent encounter and trace every place the record went. Most practices stop at three or four and are surprised by the rest.

  • Your EHR and its hosting provider. One vendor, sometimes two if hosting is subcontracted.
  • The clearinghouse and downstream payer routing. Claims carry diagnosis codes that describe the encounter.
  • The reference lab. Orders and results move both directions.
  • Appointment reminders and patient messaging. Often a separate SaaS product with its own database.
  • Remote monitoring or home-based follow-up. Postpartum recovery programs frequently include blood pressure cuffs or scales that transmit readings to a vendor platform before your clinician sees them.
  • Behavioral health referral partners. Screening at postpartum visits routinely generates a referral, which means a record leaves your organization.
  • Interpreter or translation services. Live or remote, they hear everything.
  • Transcription or ambient documentation tooling. Audio is PHI.
  • Print-and-mail or statement vendors. Envelopes with a patient's name, address, and service description.

That is nine, and it excludes your shredding company, your IT managed service provider, your backup vendor, and your answering service. Every one of those entities creates, receives, maintains, or transmits PHI on your behalf. Every one of them is a business associate under 45 CFR 160.103.

Is a Postpartum Remote Monitoring Vendor a Business Associate?

Yes, in almost every configuration. If your practice enrolls the patient, receives the readings, bills for the service, or uses the vendor's platform to manage care, the vendor is performing a function on your behalf and handling PHI. You need an executed business associate agreement before the first reading transmits.

The narrow exception is a device or app the patient buys and controls entirely on her own, with no data flowing to you and no contractual relationship between you and the vendor. The moment your practice recommends enrollment, receives a data feed, or gets a dashboard login tied to your patient panel, you have crossed into a business associate relationship. HHS publishes sample business associate agreement provisions that define the required contractual elements.

The app the patient downloaded herself

Consumer wellness apps that track postpartum recovery are generally not covered by HIPAA when there is no relationship with a covered entity. They are not unregulated, though. The FTC's Health Breach Notification Rule reaches vendors of personal health records and related entities, and the Commission has brought enforcement actions against health apps over data sharing with advertising platforms.

Why does that matter to you? Because patients ask your front desk whether an app is "HIPAA approved." Train staff to say your practice does not vet consumer apps and does not send records into them without a written request. Put that in your patient communication policy so the answer is consistent across every person who answers the phone.

Conduits versus business associates

The conduit exception is narrower than most administrators assume. It covers entities that merely transport data without accessing it other than randomly or incidentally — the postal service, a telecom carrier. It does not cover a cloud storage provider, a fax-to-email service that retains images, or a texting platform that stores message history. If the vendor holds the data, even encrypted, treat it as a business associate.

What Your BAA Must Actually Say — and What Most Are Missing

Pull three BAAs from your file and check them against this list. In my experience reviewing practice contract binders, at least one will fail on two or more points.

  1. Permitted uses and disclosures, stated specifically. Not "as necessary to perform services." Name the function.
  2. Subcontractor flow-down. The BA must obtain written assurances from its own subcontractors that are at least as protective. Your monitoring vendor's cloud host is your exposure too.
  3. Breach and security incident notification, with a contractual deadline shorter than the regulatory one. More on this below.
  4. Cooperation on individual access requests. If the vendor holds part of a designated record set, your 30-day access clock depends on their responsiveness.
  5. Return or destruction of PHI at termination, with a certificate and a defined timeframe.
  6. Audit and documentation rights, including the right to request a current risk analysis summary or third-party assessment.
  7. No secondary use. Explicitly prohibit de-identification for the vendor's own product development or resale unless you have affirmatively agreed to it. This clause is missing from a startling number of monitoring and digital health contracts.

Point seven deserves emphasis in this context. Postpartum recovery data — screening scores, home vital sign trends, lactation encounters — is commercially attractive training and analytics material. If the contract is silent, assume the vendor is doing something with it.

If you found gaps and need clean paper fast, you can generate a signature-ready business associate agreement through a six-step wizard with PDF and DOCX export. It is a one-time purchase with no subscription, which makes it practical for the one-off vendor you onboarded last Tuesday and never papered.

The Breach Notification Clock Your Vendor Contract Controls

Under 45 CFR 164.410, a business associate must notify you of a breach without unreasonable delay and no later than 60 calendar days after discovery. Under 164.404, you must notify affected individuals within 60 days of your discovery. If your vendor burns 58 days, you have two.

Fix this in the contract. Require notice within five business days of discovery, with a preliminary notification within 24 hours of the vendor identifying a suspected incident. Require that the notification include the identification of affected individuals, the categories of PHI involved, and the vendor's containment steps. Specify who at your practice receives it — a named role and a monitored address, not a general inbox.

Also account for agency. If the business associate qualifies as your agent under federal common law, its discovery of a breach is imputed to you on the date the vendor discovered it, not the date it told you. That is how a practice ends up late on a notification it learned about on day 55. HHS maintains current guidance on the breach notification rule, including the risk assessment factors that determine whether an impermissible use is reportable.

Reporting mechanics worth writing down

Breaches affecting 500 or more individuals go to HHS and to prominent media within 60 days of discovery. Breaches affecting fewer than 500 are logged and submitted within 60 days after the end of the calendar year. Keep the log in a form your privacy officer can produce on demand — a spreadsheet with discovery date, description, individuals affected, risk assessment outcome, and mitigation is sufficient and defensible.

Postpartum Recovery Encounters Create a Two-Patient Records Problem

Postpartum visits often document information about both the parent and the newborn in overlapping notes. That creates records-release complications your ROI staff need scripted answers for.

When a records request arrives for the newborn, the responsive chart may contain the birth parent's clinical information. When a request arrives for the parent, the note may reference the infant. Your release-of-information workflow needs a rule: identify the record subject, review for information about a third party, and release only what belongs to the requester unless authorization covers both.

Personal representative determinations add another layer. A parent is generally the personal representative of a minor, but state law and specific circumstances vary. Document the determination in the request file — who asked, what proof of relationship you accepted, and who approved the release. Review the OCR right of access guidance with your ROI staff annually; access complaints remain one of the most common categories OCR resolves.

The unsettled reproductive health layer

The 2024 amendments adding special protections and an attestation requirement for reproductive health care information were substantially vacated in federal litigation in 2025. Do not assume the attestation workflow you built in late 2024 still applies exactly as drafted, and do not assume it is entirely gone either. Confirm your current posture with counsel, and separately confirm your state's law, which may impose obligations independent of HIPAA.

A 90-Day Vendor Cleanup You Can Actually Finish

Days 1–15 — Build the inventory. Assign your office manager to list every external system that touches patient data. Pull the accounts payable ledger and the list of SaaS subscriptions on the practice credit card. Shadow IT lives on that card.

Days 16–30 — Match contracts to vendors. For each vendor, record: BAA on file yes/no, execution date, subcontractor flow-down present yes/no, breach notice deadline, termination data-return clause. Every "no" is a task.

Days 31–60 — Paper the gaps. Send agreements to the vendors missing one. If a vendor refuses to sign or insists on its own one-sided form, escalate to the physician owners with a written risk statement. Some vendors will not sign; you then decide whether to keep them.

Days 61–90 — Tie it to the risk analysis. Vendor exposure is a finding in your security risk analysis, not a separate exercise. Update the analysis to reflect the new inventory, and record the remediation decisions. Practices that need structure here can automate the risk analysis and policy document set rather than rebuilding a spreadsheet every year. For the underlying framework, NIST's guidance on implementing the Security Rule remains the reference most auditors recognize.

Three Things to Check Before Friday

One. Ask your remote monitoring or home-follow-up vendor for the name of every subcontractor that stores or processes your patients' readings. If they cannot answer in one email, that is your finding.

Two. Open your last three vendor BAAs and find the breach notification deadline. If it says 60 days, it is a compliance document, not a protective one.

Three. Ask your front desk what they tell a patient who asks whether a postpartum recovery tracking app is safe to use. If you get three different answers, write the script this week.

Vendor exposure is the part of privacy work that compounds quietly. Each new tool arrives with a demo, a champion inside the practice, and no paperwork. When you find one without an agreement, produce an executable BAA in a few minutes and close the gap the same day — it is a one-time purchase, and it beats explaining the omission to an investigator eighteen months from now.