October 6, 2026
This story is fictional. If it sounds like your practice, that’s between you and your privacy officer.
MEMORANDUM
To: Priya Raman, Compliance. From: Doreen Haskell, Practice Administrator. Re: Your question about Corvane
You asked why there is no business associate agreement on file for Corvane Health Services, and I appreciate your coming to me rather than to the doctors. I have been here nineteen years and would like the record to be complete.
Corvane came to us four years ago in the person of Mr. Lisle, who brought sandwiches from the good place on Fourth Street and stayed through lunch. He offered to take over our transcription for less than half of what we were paying, with every dictation back by morning. I said that sounded too good to be true, and he said that in his experience it was the other way around: most things were too true to be good. I have thought about that since.
The work was beautiful. It came back overnight without a single error, even from Dr. Feld, who dictates in the car with the window down. Once a note came back with the name of a patient’s dog filled in, which Dr. Feld had not said aloud, and he joked that Corvane knew his patients better than he did. We all laughed.
I asked about HIPAA, of course. Mr. Lisle said Corvane was HIPAA Certified, Level III, and the next week he brought the certificate. It has a gold seal and a ribbon, and I had it framed. It hangs across from my desk, and I can see it while I write this. When I asked about a business associate agreement, he said the certification covered all of that, and that the paperwork was built in.
The invoices came from a post office box in another state. About a year ago they stopped coming, although the transcription did not. I assumed there had been a billing error on their side, and I did not want to be the one to point it out. We have been very happy.
Last month the transcriptions stopped too. I called Mr. Lisle’s number and got a recording in a language I did not recognize. The website now shows a single page, also in that language. I ran it through a translator. As near as I can tell, it reads: Verified American patients. Complete histories. Bulk pricing available.
I have left the certificate up. Mr. Lisle said it was Level III, and I would not want anyone to think we had settled for less.
Before you read on: What is a HIPAA certification worth? Was Corvane a business associate without a contract? What does the practice owe its patients now?
HHS does not certify anyone as HIPAA compliant, and no certificate takes the place of a business associate agreement. Corvane received and maintained PHI to perform a service for the practice, which made it a business associate under 45 C.F.R. § 160.103 whether or not anyone signed anything. The practice could disclose PHI to it only after obtaining satisfactory written assurances in a contract that meets § 164.504(e) (§ 164.502(e)(1); the Security Rule’s counterpart is § 164.308(b)). Without one, every dictation sent to Corvane over four years was an impermissible disclosure.
In 2016 Raleigh Orthopaedic Clinic paid $750,000 after handing x-ray films for about 17,300 patients to a vendor without a BAA, and OCR’s director called these agreements “more than a mere check-the-box paperwork exercise.” Since the 2013 Omnibus Rule, business associates are directly liable for some HIPAA violations, so Corvane has exposure of its own, though that leaves the practice’s obligations exactly where they were.
The practice has no assurances from the recipient, and the recipient’s website now advertises patient histories for sale, so it cannot show a low probability of compromise under § 164.402, and it must notify every patient whose dictation went to Corvane. If more than 500 residents of a state are affected, the media notice under § 164.406 applies, and with 500 or more in total the Secretary must be notified at the same time as the patients (§ 164.408(b)).
To prevent a repeat, give no vendor credentials, files or system access until a signed BAA is in the contract file. Keep a vendor inventory that shows each BAA’s date, and review it every year. Ask for real evidence of security, such as a recent risk assessment or a SOC 2 report, and remember that neither one is a HIPAA certification either. A vendor that stops billing and keeps working, as Corvane did, is being paid some other way, and a free vendor deserves more scrutiny than one that sends a bill.
Takeaway: No signed BAA, no PHI.