Count the outside companies that touch a single newborn follow-up visit at your practice. A two-week well-baby check where a clinician documents an umbilical granuloma, orders a follow-up, and possibly sends a referral will typically route protected health information through nine to fourteen third parties before the encounter closes. Most administrators can name four of them from memory. This post is a vendor-mapping exercise for that pathway: which third parties receive PHI, which of them require a signed business associate agreement, which do not, and how to build the map without a six-month project.

Nothing here is clinical guidance. The only clinical fact that matters administratively is that this kind of newborn finding is usually handled in primary care and occasionally referred, which means records move between organizations and between systems.

The Vendor Chain Behind One Umbilical Granuloma Encounter

Walk the encounter in order, not by department. Data flow maps built by department miss the handoffs, and handoffs are where BAAs go missing.

Before the visit

The parent books through an online scheduling tool or your portal. They complete digital intake forms — sometimes a separate vendor from the EHR. If the family needs an interpreter, a language services company joins the chain. An appointment reminder text or email goes out through a messaging platform, and that message often contains the patient name, appointment time, and practice name.

Every one of those is a vendor creating, receiving, maintaining, or transmitting PHI on your behalf. Every one needs a BAA. The reminder vendor is the one practices most often overlook, because someone in the front office signed up for it with a credit card three years ago.

During the visit

The EHR vendor and its hosting provider sit at the center. Around them: an ambient documentation or transcription service if your clinicians use one, a clinical decision support module embedded in the chart, an in-office device that syncs measurements, and possibly a photo-documentation tool if the practice images the umbilical site for the chart. That last one deserves scrutiny — image capture apps frequently store data in a consumer cloud account by default.

After the visit

Now the chain widens. A coder or billing company reviews the encounter. A clearinghouse formats and transmits the claim. If a referral goes out, it travels through an e-fax service, a health information exchange, a direct secure messaging vendor, or a referral management platform. The parent gets an after-visit summary through the portal. A records request may arrive weeks later and route through a release-of-information vendor.

Behind all of it: your managed IT provider, your backup and disaster recovery vendor, your document shredding company, your answering service, and — if your website runs analytics or advertising pixels on pages tied to appointment booking — a marketing stack that has been the subject of sustained OCR and FTC attention.

Which Vendors in an Umbilical Granuloma Pathway Need a Signed BAA?

Short answer: any vendor that creates, receives, maintains, or transmits PHI to perform a function or service on your practice's behalf needs a BAA. In a typical umbilical granuloma encounter, that means:

  • BAA required: EHR and practice management vendor, cloud hosting and backup, transcription or ambient scribe service, billing and coding company, clearinghouse performing services on your behalf, e-fax provider, appointment reminder and patient messaging platform, patient intake form vendor, health information exchange, referral management platform, release-of-information vendor, managed IT provider with system access, document shredding company, outside legal counsel reviewing charts, interpreter services company, marketing agency with any access to patient data.
  • No BAA required: the pediatric surgery practice you refer to (disclosure for treatment between covered entities), the pharmacy, the health plan receiving a claim as a covered entity, the postal service or courier acting purely as a conduit, your internet service provider, janitorial staff with incidental exposure, and any vendor that genuinely never touches PHI.

HHS maintains the authoritative explanation of who qualifies as a business associate in its business associate guidance. Read the conduit discussion closely — it is narrower than vendors like to argue.

The conduit exception is not a hiding place

Vendors will tell you they are "just a pipe." The conduit exception covers entities that transmit PHI transiently and do not access it other than randomly or as necessary for transport. A courier qualifies. A cloud storage provider does not, even if it claims it never looks at the data — persistent storage defeats the argument. An e-fax provider that retains fax images on its servers does not qualify either.

If a vendor refuses to sign a BAA on conduit grounds, ask two questions in writing: does the service store PHI at rest, and for how long. The answers usually end the debate.

Building the Map: A Four-Week Project With Named Owners

Assign this to one person with authority to read contracts. Splitting it across three people produces three partial lists.

Week 1 — Pull the financial trail

Export twenty-four months of accounts payable and every corporate card statement. Every recurring software charge is a candidate. This catches the tools departments bought without telling you, which in most practices is between three and eight vendors.

Week 2 — Interview the workflow, not the org chart

Sit with the front desk for an hour, then a medical assistant, then whoever handles referrals, then billing. Ask each one: "Walk me through everything you clicked yesterday for a newborn visit." You will hear about a referral portal, a scanning app, and a shared drive that never appeared on any list.

Week 3 — Classify and match to contracts

For each vendor, record: what PHI it touches, whether it stores or only transmits, whether a BAA exists, the BAA execution date, and whether the agreement addresses subcontractors. Flag anything where the BAA predates the vendor's move to a new cloud platform or its acquisition by another company.

Week 4 — Close the gaps

Send agreements to the vendors missing them. This is where practices stall, because drafting a defensible agreement from scratch is a legal exercise most offices are not staffed for. If you have five or six gaps to close this month, a guided business associate agreement builder that exports a signature-ready PDF or DOCX gets them out the door in an afternoon rather than sitting in a queue waiting for outside counsel. It is a one-time purchase, which matters when the alternative is billing hours per agreement.

Contract Terms Worth Arguing About

A BAA that only restates the regulatory minimum leaves you exposed operationally. Four provisions carry real weight.

Breach notification timing

The regulation gives a business associate up to 60 days from discovery to notify you. Your own clock to notify individuals is also 60 days from discovery. If your BA burns 55 days, you have five. Negotiate for notification within a defined short window — many vendors will accept a shorter commitment when asked directly during renewal.

Subcontractor flow-down

Your transcription vendor uses an offshore review team. Your billing company uses a cloud analytics tool. Under the Rule, business associates must obtain satisfactory assurances from their own subcontractors. Your BAA should require written flow-down and give you the right to request the subcontractor list annually.

Return or destruction at termination

Specify a deadline in days, a required format for returned data, and a written certificate of destruction. "Infeasible to return" clauses should be narrowed, not accepted as boilerplate.

Cooperation with access and amendment requests

If a parent requests the complete record of a newborn's care and part of the designated record set lives in a vendor system, you need a contractual obligation to produce it within a timeframe that lets you meet your own 30-day deadline. Vendors that only commit to "reasonable cooperation" will hand you a problem on day 28.

HHS publishes sample business associate agreement provisions that serve as a baseline. Treat them as a floor.

Five Places Vendor Maps Break in Pediatric Practices

  1. The referral hop. Sending an umbilical granuloma referral to a surgical practice is a treatment disclosure and needs no BAA — but the platform carrying it almost certainly does. Practices conflate the two and skip both.
  2. Photo capture. Clinical images taken on a personal phone and texted to a colleague create PHI on two devices and one carrier's servers, none of which are covered by anything you signed.
  3. The website. Analytics and advertising code on pages where patients schedule or describe symptoms has drawn enforcement interest from both OCR and the FTC. Note that a federal court vacated part of the online tracking guidance in 2024, which narrowed one theory of liability but did not eliminate the exposure. Inventory your tags regardless.
  4. Acquired vendors. When your reminder platform is bought, the BAA may transfer but the infrastructure changes. Re-verify after any acquisition announcement.
  5. Departed staff accounts. A former biller's login at the clearinghouse is a vendor-side access problem your BAA should let you audit.

What Regulators Actually Look At

Reported breaches involving 500 or more individuals appear on the OCR breach portal, and the pattern there is consistent: business associates account for a large share of affected individuals, usually through vendors serving many practices at once. Your exposure is not proportional to your patient volume — it is proportional to your vendors' aggregate footprint.

The proposed Security Rule update published in January 2025 would, if finalized as drafted, require covered entities to obtain written verification of business associate technical safeguards on an annual cadence. Whether or not that language survives, building the verification habit now costs less than retrofitting it under a compliance deadline. The same applies to documenting your vendor inventory inside your risk analysis rather than in a spreadsheet nobody references — if that documentation set is thin, automated risk analysis and policy generation is a faster path than starting from a blank template.

A 30-Minute Quarterly Review

Put it on the calendar with a named owner. Four items:

  • Pull new recurring charges from the last quarter's AP and card statements. Any new vendor touching PHI without a BAA gets one before the next payment clears.
  • Confirm no vendor on the list was acquired, changed hosting, or added an AI feature that processes chart data.
  • Verify termination steps completed for any vendor you dropped — data returned or destroyed, accounts disabled, certificate on file.
  • Spot-check one vendor's subcontractor list against what they disclosed at signing.

Thirty minutes, four times a year, keeps a map current that took four weeks to build.

Start With the Gap You Already Know About

Most administrators reading this can name at least one vendor operating without a signed agreement right now. Close that one first. If you need agreements drafted and executed this week rather than next quarter, generate a signature-ready BAA through a six-step wizard and export it as a PDF or DOCX for countersignature — one purchase, no subscription, and the gap is closed before your next vendor invoice arrives.