The vendor stack: labs, supplies, shredding, waste, interpreters

The accounts to open before the first patient

A new solo practice generally opens seven kinds of vendor accounts before seeing patients: an EHR and practice email, a phone or answering service, a document-destruction vendor, an interpreter service, a bookkeeping system, the licensing board's own renewal portal, and — for practices billing Medicaid — that state's specific Medicaid enrollment portal. Not every account carries the same obligations, and sorting them by whether they touch protected health information is the fastest way to know which ones need a contract before the first login.

• EHR, email, and any cloud storage — touches PHI directly; needs a signed BAA
• Phone / answering service — often touches PHI (messages, scheduling); confirm before signing up
• Document shredding — touches PHI in physical form; needs a BAA
• Interpreter service — touches PHI during the session itself; needs a BAA
• Bookkeeping software — usually touches billing data, not clinical PHI, but confirm what it stores
• Licensing board portal — no PHI; not a business associate, just an account to maintain
• State Medicaid portal — a payer relationship, not a typical business associate

The BAA test: which vendors actually need one

A vendor is a business associate — and needs a signed BAA before it touches anything — whenever it creates, receives, maintains, or transmits PHI on the practice's behalf; the test is about what the vendor actually handles, not what kind of company it is 1Ref 1HHS Office for Civil Rights (2026).Business Associates.That vendors creating, receiving, maintaining, or transmitting PHI on the practice's behalf are business associates requiring a signed BAA, applied to shredding, interpreter, and EHR/email vendors.. A shredding service handling paper charts qualifies. An interpreter present during a clinical session qualifies. An office-supply vendor delivering paper and toner generally doesn't, because it never touches PHI at all.

Building a written map — the baa map — of exactly which vendors touch PHI and which don't is worth doing once, at launch, rather than reasoning through it fresh every time a new vendor gets added. The map only needs three columns: the vendor, what it touches, and whether a signed BAA is on file — but it has to actually exist somewhere the practice can produce it if asked.

The licensing board's own portal

Every state licensing board maintains its own online account for renewals, continuing education tracking, and address or name changes — it isn't a vendor in the business-associate sense, but it's an account that has to be set up and kept current from day one, since a lapsed renewal notice going to the wrong email is an entirely avoidable problem. New York's Office of the Professions and New Hampshire's Office of Professional Licensure and Certification are two examples of boards running this kind of portal directly 2Ref 2New York State Office of the Professions (2026).New York State Office of the Professions.That New York's licensing authority runs its own licensee portal, used as one example of a state board maintaining this kind of account.3Ref 3New Hampshire Office of Professional Licensure and Certification (2026).New Hampshire Office of Professional Licensure and Certification.That New Hampshire's licensing authority runs its own licensee portal, used as a second example that each state board's system is separate., and each state's board runs its own separately — there's no shared login across states.

Setting the portal's contact email to the same practice email used everywhere else, rather than a personal address that might change, keeps renewal notices from getting lost in an inbox nobody checks anymore.

The practice phone line and the escalation path behind it

Setting up the practice line as a dedicated number — whether through a VoIP service or an answering service — separate from a personal cell phone is one of the first vendor decisions most new practices make, and it matters because any voicemail or message system that stores patient callback information is very likely handling PHI. Confirm that with the vendor directly rather than assuming a phone company is automatically exempt from a BAA the way an office-supply vendor is.

Knowing each vendor's actual escalation path — who to call, and how fast, when the phone system or the EHR itself goes down mid-day — matters as much as the initial signup, and it's worth confirming before an outage forces the question. A vendor with no clear escalation contact beyond a general support email is a bigger operational risk than the sign-up form suggests.

Document shredding and the vendors that touch paper PHI

A shredding or document-destruction vendor is a business associate the moment it handles anything with patient information on it — intake forms, printed chart notes, old billing statements — and needs the same signed BAA as any digital vendor before the first pickup. A locked collection bin on-site with a scheduled pickup is the common setup; leaving paper PHI in a regular recycling bin defeats the purpose of having a shredding vendor at all.

The same logic applies to any vendor disposing of retired hardware — an old laptop or a fax machine's internal storage can hold PHI long after the device looks empty, so hardware disposal deserves the same BAA-or-skip-it test as paper shredding.

Interpreter services and the ADA obligation behind them

A private health care office is a public accommodation under Title III of the ADA, which means effective communication — including a qualified interpreter for a patient who needs one — is an obligation, not a courtesy extended when convenient 4Ref 4U.S. Department of Justice (2026).The Americans with Disabilities Act.That Title III of the ADA applies to private health care offices as public accommodations, requiring effective communication including qualified interpreters.. An interpreter vendor account, set up before it's urgently needed, is what makes that obligation practically workable instead of a same-day scramble.

Because an interpreter present during a session hears and often documents clinical content, the interpreter service is a business associate and needs its own BAA, the same as the EHR vendor — a detail that's easy to miss when an interpreter is treated as a one-off contractor rather than a standing vendor relationship.

Bookkeeping, Medicaid portals, and the accounts nobody budgets for

A bookkeeping system or bookkeeping service is the account most new practices set up last and need first — categorizing income by payer and tracking expenses from the very first deposit is far easier than reconstructing twelve months of a mixed statement later. It usually handles billing and financial data rather than clinical PHI, but confirm what the specific product stores before assuming it falls outside BAA territory entirely.

A practice billing a state Medicaid program needs an account with that state's specific portal — New York's eMedNY is one example of what a state Medicaid enrollment and billing system looks like, distinct from any commercial payer's provider portal 5Ref 5New York State Department of Health (2026).eMedNY.New York Medicaid's provider-facing portal, cited as one concrete example of a state-specific Medicaid enrollment and billing system, not a national standard.. And where a payer contract references quality measures, an account with a reporting vendor may follow: several HEDIS measures reach directly into outpatient behavioral health care, including measures payers use to evaluate network performance 6Ref 6National Committee for Quality Assurance (2026).HEDIS.That HEDIS measures reach into outpatient behavioral health care, supporting the claim that a quality-reporting vendor account can follow from a payer contract., so a quality-reporting login can end up on the vendor list even though it isn't a business associate in the traditional sense.