Pick one closed ankle sprain chart from last quarter. Trace every organization that touched a byte of it. In most urgent care and primary care practices, the honest count lands between eight and fourteen outside entities — scheduling, intake, imaging, transcription, referral transport, durable medical equipment, clearinghouse, statement printing, payment processing, appointment reminders, and a patient satisfaction survey that went out the following Tuesday.

This article is a vendor-mapping exercise for practice administrators and privacy officers, built around a low-acuity musculoskeletal encounter. It is not clinical guidance. When a patient asks how long does a sprained ankle take to heal, that is a conversation for their clinician. Your version of the question is different: how long does that record stay in motion, and which of the companies moving it owes you a signed business associate agreement?

Why "How Long Does a Sprained Ankle Take to Heal" Is a Records Question Inside Your Building

The clinical fact that matters administratively is narrow and uncontroversial: recovery from a soft-tissue ankle injury typically unfolds over weeks rather than a single visit, and the pathway commonly includes follow-up contact, sometimes imaging, sometimes a referral to orthopedics or physical therapy, and often a brace or boot. Multiple touchpoints across multiple organizations.

That is the whole reason this anchor is useful for vendor mapping. A single acute complaint that resolves in one visit teaches you nothing about your data flows. A pathway that stretches across four to eight weeks and crosses organizational boundaries lights up almost every third-party relationship you have.

Repeat contact manufactures vendors

Every follow-up touch is a chance for a vendor to enter the chain. The reminder text about the two-week recheck runs through a messaging platform. The work-status note gets faxed through a cloud fax service. The therapy referral goes out through a health information exchange or a referral management portal. The boot comes from a supplier who needs the order, the diagnosis code, and the patient's insurance information.

None of that is exotic. All of it is protected health information leaving your walls.

One Encounter, Nine Handoffs: Mapping the Actual Flow

Before the patient is roomed

  • Scheduling and digital intake vendor — collects name, DOB, chief complaint, insurance card images. Business associate.
  • Eligibility and clearinghouse — transmits the 270/271 transaction. Business associate.
  • After-hours answering service — takes the call that starts the encounter, often records it. Business associate.
  • Interpretation service — hears the entire clinical exchange. Business associate, and frequently the one nobody has papered.

During the visit

  • EHR host or cloud infrastructure provider — business associate, including the infrastructure layer underneath your EHR if you contract with it directly.
  • Imaging equipment vendor with remote support access — if their engineers can reach the modality or the PACS, they can reach images. Business associate.
  • Teleradiology group — if you send studies out for over-read under a services contract rather than a treatment relationship, that arrangement usually looks like a business associate relationship. Read the contract, not the marketing page.
  • Ambient documentation or transcription vendor — processes the full narrative. Business associate.

After the visit

  • Cloud fax or secure messaging transport — business associate. The fax machine on the wall is not; the SaaS that stores your sent faxes for ninety days absolutely is.
  • Referral management platform — business associate.
  • DME supplier — usually a separate covered entity billing its own claim. Disclosure for treatment and payment, no BAA required. But if they are performing a service for you, such as managing your in-office consignment inventory and billing on your behalf, the analysis flips.
  • Physical therapy practice or orthopedic group — covered entity to covered entity, treatment disclosure. No BAA.

The money trail

  • Revenue cycle management firm — business associate.
  • Statement printing and mailing vendor — business associate.
  • Collections agency — business associate.
  • Payment processor — depends. A processor that only handles the card transaction may qualify as a financial institution conduit. One that stores patient names against balances and service dates does not.

The long tail nobody maps

  • Appointment reminder and recall texting platform — business associate.
  • Patient satisfaction survey or reputation vendor — business associate, and a common gap.
  • Population health or care-gap analytics tool — business associate.
  • Website analytics and ad pixels on your scheduling pages — HHS has issued guidance on tracking technologies and the exposure created when identifiers reach an advertising platform. Treat this as a live issue, not a settled one.

Which Vendors in This Pathway Need a Signed BAA?

Short answer: any organization that creates, receives, maintains, or transmits protected health information on your behalf, or that provides services to you involving disclosure of PHI. In an ankle sprain pathway that typically means your EHR host, intake and scheduling vendor, clearinghouse, transcription or ambient scribe, cloud fax service, referral platform, interpretation service, RCM firm, statement and collections vendors, reminder and survey platforms, analytics tools, and any IT provider with access to systems holding PHI.

It does not include: the orthopedic group or physical therapist you refer to (covered entity, treatment disclosure), the pharmacy, the health plan, the patient's employer receiving a work note under a valid authorization, or a true conduit such as the postal service or a telecom carrier. HHS describes the business associate definition and the narrow conduit exception in its business associate guidance.

Three Places Practices Get the Analysis Wrong

Stretching the conduit exception

The conduit exception covers entities that transport information without accessing it other than randomly or incidentally, like a courier. It does not cover a vendor that stores your data, even if the vendor swears it never looks. A cloud fax provider retaining sent-item archives is storing PHI. Storage is the tell.

Confusing a treatment partner with a subcontractor

Sending the referral packet to an orthopedic practice is a permitted treatment disclosure and needs no agreement. Paying a company to manage that referral traffic on your behalf is a business associate relationship. The question is not who ends up with the data — it is who is performing a function for you.

Accepting "we're HIPAA compliant" as a substitute for paper

There is no government HIPAA certification. HHS does not certify, endorse, or approve any product, vendor, or training program. A badge on a vendor's website is a marketing claim. The only artifact that matters in an OCR investigation is an executed agreement with the required provisions, and the only way to know a vendor's security posture is to ask specific questions and read the answers.

The 90-Minute Vendor Map Exercise

Block ninety minutes. Bring the privacy officer, the practice manager, and whoever actually owns your IT relationships. Do not invite the whole leadership team; this is production work.

  1. Minutes 0–15. Pull one representative musculoskeletal encounter and walk it chronologically from first phone call to final statement. Whiteboard every system that touched it.
  2. Minutes 15–35. Cross-reference against accounts payable. Every recurring vendor payment gets asked: does this company see, store, or move PHI? AP catches the vendors that memory misses — the survey tool a departed marketing coordinator signed up for, the transcription service used only by one clinician.
  3. Minutes 35–55. Classify each entry: business associate, covered entity, conduit, or no PHI contact. Write the reasoning in one sentence. Future-you will want it.
  4. Minutes 55–75. For each business associate, locate the signed agreement. Record the execution date, the signatory, and where the PDF lives. "Somewhere in the shared drive" is a finding, not a location.
  5. Minutes 75–90. Assign owners and due dates for every gap. One named person per gap.

The gaps you find in step four are the point of the exercise. When a vendor has no agreement — or has one signed in 2017 that predates the subcontractor language you now need — you need executable paper quickly, not a two-week legal cycle for a $180-a-month reminder platform. A six-step business associate agreement generator that exports signature-ready PDF and DOCX closes routine gaps the same afternoon for a one-time cost, which keeps your attorney's hours pointed at the contracts that actually carry risk. HHS publishes sample business associate agreement provisions if you want to compare required elements line by line.

Clauses Worth Reading Before You Sign

  • Subcontractor flow-down. Your transcription vendor's offshore QA contractor is a subcontractor. The agreement must obligate the BA to bind them equivalently.
  • Breach notification timing. "Without unreasonable delay" gives you nothing. Negotiate a number — five or ten calendar days from discovery — because your own 60-day clock under the Breach Notification Rule starts running whether or not the vendor has told you anything.
  • Return or destruction at termination. Specify format and deadline. If return is infeasible, the protections must survive termination.
  • Secondary use. Many platforms reserve the right to de-identify and commercialize aggregate data. Decide deliberately whether you allow it.
  • Access request support. When a patient requests records that live in the vendor's system, the vendor must produce them in time for you to meet the 30-day requirement.
  • Audit cooperation. The vendor makes practices, books, and records available to HHS.

HHS proposed substantial Security Rule amendments in January 2025 that would tighten expectations around business associate verification and documentation. That rulemaking was not final as of this writing, but the direction is clear enough that building verification into your renewal cycle now is cheaper than retrofitting later. NIST SP 800-66 Revision 2 remains the most useful free mapping between Security Rule requirements and concrete controls.

Worked Example: The Brace Order Nobody Papered

A three-site urgent care group stocked walking boots in-office and used an outside billing partner to submit the DME claims. The partner received patient demographics, diagnosis codes, and insurance data for every ankle and knee injury the group saw. Nobody had a BAA, because everyone assumed the supplier relationship covered it — the supplier and the billing partner were two different companies with confusingly similar names.

The gap surfaced during a payer audit, not a breach. It cost the group nothing directly. But if that billing partner had suffered a ransomware incident, the group would have been explaining to OCR why PHI flowed monthly to an entity with no agreement, no security assurances, and no notification obligation. Browse the OCR breach portal for a sense of how often business associate incidents drive large reportable events.

Retention and Cadence

Keep executed agreements for six years from the later of creation date or last effective date. Store them in one place with a consistent naming convention that includes vendor name and execution year.

Re-run the vendor map annually and any time you add a service line, switch EHRs, or bring on a new billing partner. Tie it to your risk analysis so the two documents reference each other; if you are rebuilding that documentation set from scratch, automated risk analysis and policy generation will get you a defensible baseline faster than a blank template.

Your Next Step This Week

Print your accounts payable vendor list. Circle every name that could plausibly see patient data. Pull the agreement for each one. However you answer a patient's question about how long does a sprained ankle take to heal, the administrative answer to "how long does the record stay in motion" is: longer than you think, and through more hands than your vendor binder currently reflects.

Close the easy gaps first. Generate a signature-ready business associate agreement, send it, file it, and move to the contracts that need a lawyer.