A Raleigh orthopaedic clinic settled with OCR after handing patient records to a prospective partner without an agreement, and here is what that means for your vendors.
Vendor relationships usually begin informally. A billing company wants to look at your accounts before committing, or an IT provider needs access to quote the work, and someone says, "Send a sample and we will sort the paperwork afterward." It feels friendly, and it is exactly where practices get caught.
What happened at Raleigh Orthopaedic
Raleigh Orthopaedic Clinic handed records of about 17,300 patients to a prospective business partner before signing a business associate agreement (BAA), which is a written agreement in which an outside company commits to protecting the patient information it handles for you. The clinic settled with OCR for $750,000.
OCR's message was that covered entities must know who receives their patients' health information and obtain assurances that it will be protected, and that a BAA is more than a check-the-box paperwork exercise. Notice the word "prospective." The records moved early in the relationship, which is when most practices feel least formal about it. A signed agreement that nobody read, and that does not match what the vendor really does, offers little comfort to a practice or its patients.
Billing companies and IT vendors
Nobody has to be careless for this sequence to happen. It takes only a busy week and a friendly vendor. The case does not name billing or IT vendors, so this part is my view as an auditor, and it is not legal advice. If an outside company will handle, store or be able to see patient information, I want a signed BAA in place before anything moves. In most practices that includes the billing company and any IT provider that can reach the systems holding patient data. Vendors that work with health practices usually know the request well, and good software supports compliance, but the agreement is how both sides write down who is responsible for what.
What I would do first
First, I would list every outside company that touches patient information, including billing, IT support, cloud storage, scanning and shredding, and answering services. Second, next to each name I would record what it can see, whether a BAA is signed, the date, and where the copy is kept. Third, I would read each agreement against what the vendor does today, because the paperwork often describes only the first job. Finally, I would set one rule: no real patient records go to a prospective vendor until the agreement is signed, and sample data without real patient information handles most demonstrations. I would also ask each vendor, in plain language, how it protects the information once it has it: who has access, how it is secured, and what it does if something goes wrong. That conversation is part of obtaining assurances, and it often tells you more than the agreement does.
If it would help to sort that list together, book a call with AssureRidge Cyber whenever it suits you.