Count the outside organizations that touch one specialty prescription. A relistor order written on a Tuesday afternoon can reach a payer's prior authorization portal, a pharmacy benefit manager, a specialty pharmacy, a manufacturer-sponsored patient support hub, your e-fax provider, and whoever hosts your practice management system — all before Friday. Six external parties. If you are the privacy officer, your job is to know which of those six are business associates, which are covered entities in their own right, and which need a signed patient authorization before a single page moves.

This is a vendor and records workflow post, not a clinical one. Nothing here tells you anything about the drug itself beyond the administrative fact that it is dispensed through specialty channels, which is exactly why the paperwork sprawls.

What Actually Moves When a Relistor Prescription Leaves the Building

Specialty products almost never follow the simple retail path of an e-prescription landing at the corner pharmacy and ending there. They generate a benefits investigation, a prior authorization packet, an enrollment form, and a stack of status faxes that arrive for weeks afterward.

Here is the typical disclosure chain for one patient, in order:

  1. Prescriber to payer or PBM. Prior authorization request with diagnosis codes, medication history, and often free-text clinical notes pasted into a portal field.
  2. Prescriber to specialty pharmacy. The prescription plus demographics, insurance, and frequently a clinical summary the pharmacy requests to complete its own intake.
  3. Front desk to manufacturer hub. An enrollment or copay assistance form, usually faxed, usually containing name, date of birth, diagnosis, insurance details, and prescriber signature.
  4. Everyone back to you. Status faxes, denial letters, appeal requests, refill coordination calls, and adherence outreach summaries that land in your document queue and become part of the designated record set.

Each arrow in that chain has a different legal basis. Treating them all the same is the mistake that shows up in audits.

The paperwork you forget you created

Every inbound status fax about a relistor authorization is now PHI sitting in your document management system. If that system is hosted by a vendor, that vendor is a business associate. If your staff scans faxes to a shared network folder, that folder is inside your risk analysis scope. If someone forwards a denial letter to a personal email to work on it at home, you have an incident to evaluate.

Short answer for the person searching this at 4:45 on a Thursday:

You need a business associate agreement with any vendor that creates, receives, maintains, or transmits PHI on your behalf — e-fax and secure messaging providers, EHR and practice management hosts, document scanning and storage vendors, prior authorization automation platforms, billing and revenue cycle companies, transcription services, IT managed service providers, and any offshore support desk your software vendor uses as a subcontractor. You do not need a BAA with payers, PBMs, or dispensing pharmacies — those are covered entities or plans, and disclosures to them for treatment and payment stand on their own. You need a patient authorization, not a BAA, for disclosures to a drug manufacturer's patient support or copay program, because that entity is not performing a function on your behalf and is not part of your treatment or payment chain.

That third category is where most practices get sloppy. HHS publishes sample business associate agreement provisions that define the relationship precisely: the vendor must be performing a service for or on behalf of the covered entity. A manufacturer running its own commercial assistance program is doing something for itself and for the patient, not for you.

The test that settles most arguments

Ask two questions. Does this entity get PHI because we hired it to do work we would otherwise do ourselves? Do we direct what it does with the data? Two yeses means BAA. If the answer is that the patient enrolled in an outside program and we are simply completing a form the patient asked us to complete, that is an authorized disclosure, and the authorization needs to exist in writing.

The Hub Enrollment Form Your Front Desk Hands Out

Walk to your front desk and look at the enrollment packet for any specialty product. Two pages in, there is usually a patient consent block written by the manufacturer's counsel. That block authorizes the manufacturer to receive and use the patient's information for the program.

Three things go wrong with it.

The patient signs but your copy vanishes. The signed form gets faxed to the hub and no scanned copy lands in the chart. Six months later a patient complains, and you cannot demonstrate the authorization existed. Rule: scan before you send, index it to the chart, every time.

Staff complete the form before the patient signs. A well-meaning coordinator fills in diagnosis and insurance details and faxes it to keep the process moving, with the plan to get the signature at the next visit. That is a disclosure without authorization. Make the signature a hard gate in your workflow, not a follow-up task.

Nobody tracks the expiration. Authorizations have an expiration date or event. If a relistor support program keeps sending your office adherence reports two years later and the underlying authorization lapsed, you are receiving PHI outside a documented basis and continuing to respond to it.

Assign it to a role, not a person

Name the position responsible: the prior authorization coordinator owns the authorization scan, the privacy officer owns the annual sample audit of ten enrollment files. Write both into the job description. Personnel turn over; roles persist.

Opioid-Adjacent Records Pull 42 CFR Part 2 Into the Room

Records that travel with a relistor prescription frequently reference chronic opioid therapy. That fact alone does not make your records Part 2 records — Part 2 applies to information from federally assisted substance use disorder treatment programs, not to every mention of an opioid in a general practice chart.

But if your patient was referred from, or co-managed with, a Part 2 program, and that program's records made it into your chart, the redisclosure restrictions travel with them. The 2024 final rule aligning Part 2 more closely with HIPAA carried a compliance date of February 16, 2026. As of this year, your consent forms, notices, and breach procedures need to reflect it. HHS maintains guidance for professionals on the HIPAA and Part 2 relationship.

The practical control is upstream: teach your scanning staff to flag inbound records that carry a Part 2 redisclosure notice, and route them to a chart section your release-of-information process treats differently. Nobody catches this at the moment of a records request if it was not tagged at intake.

A 45-Day Cleanup for a Vendor List You Have Not Touched Since 2023

Days 1–10: build the actual list. Pull every vendor from accounts payable, not from memory. Cross-check against your fax logs, your EHR's integration settings, and the browser bookmarks on the prior authorization workstation. Shadow IT lives in bookmarks.

Days 11–20: classify each one. Three buckets — business associate, covered entity, neither. Write one sentence per vendor explaining the classification. That sentence is your audit defense.

Days 21–35: chase the missing agreements. Expect to find three categories of gap: no BAA at all, a BAA signed by a company that has since been acquired, and a BAA that predates the current Security Rule expectations and says nothing useful about subcontractors, encryption, or breach timelines. All three need new paper. If you are drafting from scratch rather than negotiating a vendor's template, a six-step wizard that produces a signature-ready business associate agreement in PDF and DOCX gets you a defensible document the same afternoon, for a one-time fee rather than another subscription line item.

Days 36–45: fix the intake gate. No new vendor gets network access, a fax number, or a portal login until the classification and agreement are on file. Put the privacy officer's signature on the vendor onboarding form.

Renewal discipline

Set a calendar reminder tied to your annual risk analysis. Any vendor whose service scope changed during the year gets its BAA re-reviewed. A billing vendor that added an AI coding module is handling PHI differently than it was when you signed.

When the Vendor Is the One Who Breaches

A specialty pharmacy coordination platform gets compromised. Your patients' names, medications, and diagnoses are in the exposed set. Now what?

Your BAA should require the vendor to notify you without unreasonable delay, and you should have negotiated a specific number of days rather than accepting the regulatory outer limit. The covered entity's own notification obligation to affected individuals runs no later than 60 calendar days from discovery, with the annual or immediate reporting to HHS depending on the number of individuals affected. Review the breach notification rule requirements before you need them, not during.

Two operational details that cost practices money. First, you need the affected-individual list from the vendor in a usable format, and BAAs rarely say so — add a clause requiring the vendor to produce it within a stated number of days. Second, decide in advance who pays for notification, credit monitoring, and call center support. Silence in the contract means you pay.

Read through the HHS breach portal and you will see how many reported incidents involve a business associate rather than the provider itself. Your vendor list is your risk surface.

Three Documents to Have Ready Before Anyone Asks

  • The vendor register. Name, service, classification, BAA execution date, subcontractor disclosure, renewal date.
  • The disclosure map for specialty prescriptions. One page showing where relistor and similar specialty-channel data goes and the legal basis for each hop. Use it in new-hire training.
  • Your current risk analysis. Dated within the last twelve months and reflecting the vendors you actually use. If you need the underlying risk analysis and policy set generated and kept current, automate the production so the document work stops competing with patient work.

Start with the vendor register. Pick ten vendors this week, classify them honestly, and find out how many are missing an agreement — then generate the BAAs you are short on and close the gap before someone else finds it for you.