Inventory subprocessors: email hygiene tools, fax SaaS, backup, and support firms with remote access.
Renew BAAs when services materially change; version control them like code.
Internal champions should own vendor reviews, not only procurement.
Related posts
Archiving regulated communications
If you cannot retrieve it, you cannot defend it—or release it to patients.
First steps when something might have gone wrong
Speed and documentation matter more than perfection in the first hour.
Fax workflows when the world is going digital
Fax persists in healthcare because it is familiar—not because it is magically secure.
Encrypted email in healthcare: where to start
Not every mailbox needs military-grade tooling—but unencrypted PHI to consumer Gmail is indefensible.