Four Vendors Touch Your Patient Data and You Have Signed With One

Follow a single patient inquiry through your practice and count how many companies read it.

A woman in Garden City types her name, her mobile number, her email and the sentence "I'm 41 and I've been losing hair at the crown for about two years" into the form on your consultation page. She hits submit. By the time your front desk sees it on Monday morning, that sentence has passed through somewhere between four and eight separate companies.

Name one you have a signed agreement with.

For most practices the honest answer is the EMR, which never saw this inquiry at all, because she is not a patient yet. Everything that did touch it sits outside the agreement nobody has read since the day it was signed.

The web host

Your form submission lands on a server before it lands anywhere else. Many popular hosting companies will not sign a healthcare agreement at all, as a matter of published policy, and the sales representative who sold you the plan has no authority to tell you otherwise. The ones that will sign typically charge for a different tier of service and require you to ask.

If your hosting is billed through your agency, you cannot ask. You are not the account holder, and the host has no obligation to answer you.

The form itself

Few practice websites handle their own form submissions. The form is usually a third-party service embedded in the page, and the submission goes to that service's servers first. Sometimes there are two: a form builder and then an automation tool that moves the submission somewhere useful. Each one is a separate company with a separate contract and a separate answer to the question of what it has agreed to protect.

Your agency's shared inbox

This is the link that surprises people. Form notifications almost always go to an agency address as well as yours, because that is how the agency reports lead volume to you. A notification email contains the entire submission in plain text, and it now lives in a Gmail account belonging to a marketing company, searchable by every employee who has access to it, retained until somebody deletes it, which is to say forever.

Voicemail and call transcription

Phone systems transcribe voicemail now by default. A patient leaves a message describing why she is calling, the system converts it to text, and the text arrives by email and sits in a vendor's database. Nobody turned that feature on deliberately. It came switched on.

We treat transcription as off by default on any clinical line and switch it on only after the consent handling is configured, because a transcript of a patient explaining her condition is exactly the thing the rules exist to cover.

Whatever AI somebody opened last week

Somewhere in your practice this month, a staff member pasted a patient message into a chatbot to get help writing a reply. That is the newest link in the chain and the one with the least paperwork behind it. It gets its own post, because the details matter and the usual advice is wrong.

What the enforcement record actually says

The federal regulator has been running a focused enforcement push for roughly two years, and the pattern in it is narrower than most practices assume. Nearly every settlement under that initiative cites the same root failure, and it is not encryption or a missing policy binder. It is the absence of an accurate, thorough assessment of where electronic patient information actually lives.

Regulator leadership has said publicly that the finding appears in four out of five enforcement actions. The settlements are not all seven-figure hospital cases either. Recent agreements include five-figure amounts against single-location clinics and small specialty groups, which is the category most of our readers are in.

Read that failure again and notice what it has in common with the chain above. The assessment is hard to do precisely because nobody has a list of the companies that touch patient information. You cannot assess what you have not enumerated.

The third question is the one that matters

A vendor can sign an agreement with you and then quietly route your data through four subcontractors who have signed nothing. The chain does not stop at your supplier. It runs all the way down, and the obligation follows the data rather than the invoice.

That is the standard we hold ourselves to as a platform, and it is a fair question to ask us as well as everybody else. Any vendor that cannot name its own subcontractors has told you the chain is not documented. A chain that is not documented is not a chain, it is an assumption.

What to do this week

Write the list. Every company that touches a patient inquiry, from the server up. Eight lines on a legal pad is a better assessment than most practices have, and it is the document the regulator asks for first.

Then send the three questions. Consential publishes its own business associate agreement and a privacy hub covering what a website vendor should be willing to put in writing, which is a useful benchmark for reading the replies you get back.