Guide sources and teaching inputs checked . Vendor directory claims retain their own review dates.
Begin with the workflow
Identify the information, who will process it and why. Determine whether your practice is a covered entity or business associate; cash-pay alone does not settle that question. If a vendor will process PHI on a regulated entity’s behalf, assess the applicable business-associate requirements.
A business associate agreement defines permitted handling and responsibilities. It does not establish that every feature, connector or account at that vendor is suitable for your use.
Match the agreement to the service
Use the directory’s dated scope and primary source as a starting point. Confirm the actual account, plan, organization, feature and downstream services with the vendor and your privacy lead. Keep the executed agreement and any required configuration steps with the workflow’s approval record.
Some vendors incorporate an agreement into their terms; others use a self-service or sales process. Confirm it applies to your account rather than assuming a marketing promise completes that process. Recheck scope after a plan or feature change.
Check agreements you may already have
Fathom’s standard terms incorporate its published BAA when HIPAA applies, without stating a plan exclusion. Its free plan includes recordings and transcripts; its pricing table separately advertises a signed BAA on Enterprise. Keep the applicable terms with your account record and confirm that arrangement before a patient workflow. A meeting transcript still needs clinical-note review.
For Google Workspace, a super administrator can review and accept the BAA under Account > Account settings > Legal and compliance. The current covered-functionality list includes managed Gemini, Docs, Sheets, Forms, Meet and Apps Script. A modest first project is a structured intake feeding a visit-preparation sheet, with restricted sharing and clinician review. Check feature licensing; personal Google accounts and third-party add-ons do not inherit this agreement.
Review the rest of the path
Assess access, risk, retention, logs, integrations and safeguards alongside the agreement. Test with fictional inputs first. Do not introduce PHI until the actual workflow is approved; a “will sign a BAA” label is not a green light by itself.
Copy a prompt to try
Note template for a visit type
Documentation
Draft a blank note template for a {{visit_type}} visit in {{specialty}}.
Give me headings and field names only. Cover:
- what the visit was for
- what was assessed
- what was discussed
- what happens next, and by when
Leave every field empty. Do not write example content, and do not
suggest what a clinical field should say.
At the end, list the fields you were unsure whether to include.
Takes a visit type and a specialty. No patient goes into it — what comes back is an empty form you fill in wherever the record already lives. It will not tell you what to assess, and it does not know what your EHR or your payers require.