AI Scribe Vendor Uses an Undisclosed Offshore Subcontractor
North Valley Medical Group employs 180 providers across six clinics and contracts with an AI scribe vendor that records visits and generates draft notes. The business associate agreement prohibits subcontractors without written approval and requires PHI to be stored and processed in the United States. During a routine vendor audit, the group's compliance analyst finds that the vendor sends audio recordings to a subcontractor in the Philippines for quality review. The subcontractor has no business associate agreement with the vendor. About 1,200 encounters over three weeks are affected, including behavioral health and adolescent visits. The vendor says the audio is encrypted in transit and deleted after 24 hours, and no unauthorized access has been detected. The contract gives the group audit rights and termination for cause. The CISO wants to terminate immediately; the COO says the tool saves clinicians 90 minutes daily.
1. Does the subcontractor arrangement require breach notification to patients, regulators, or both? Walk through the decision.
Read the worked answer
Begin with the contract and the facts, not the vendor's assurance. The vendor allowed a subcontractor without approval and outside the United States, so PHI was disclosed to an entity not bound by a business associate agreement. That is a security incident. Whether it is a reportable breach depends on a documented four-factor risk assessment. Factor one: the audio includes behavioral health and adolescent visits, so the data is highly sensitive. Factor two: the recipient is offshore quality-review staff who were not authorized under the contract. Factor three: quality reviewers likely listened to the recordings, so acquisition occurred even if no external attacker was involved. Factor four: encryption in transit and 24-hour deletion reduce risk, but they do not eliminate it because the subcontractor had no confidentiality obligation. The presumption of breach is therefore hard to rebut. The vendor must notify the group as a business associate; the group decides patient and regulator notification. With 1,200 affected individuals, HHS notification is immediate, and state law may require attorney general or consumer notices. Adolescent and behavioral health records may trigger extra notice duties. Require a forensic report, preserve records, suspend the data flow, and involve counsel before accepting the vendor's no-unauthorized-access claim.
2. What third-party risk management changes should the group make before continuing the vendor relationship?
Read the worked answer
Re-tier the vendor as high risk and make continued use conditional on cure. Require a complete subcontractor register, prior written approval, flow-down business associate agreements, US-only processing, and a prohibition on offshore access without explicit authorization. Add geo-fencing or technical controls that enforce the data-location requirement, not just contractual promises. Strengthen audit rights, require an annual SOC 2 Type II report and penetration test, and obtain evidence of subcontractor security training and access reviews. Set incident notification at 24 hours or less, require cooperation with the group's breach assessment, and add termination and transition assistance. Monitor the vendor through periodic attestations and sample audits. The COO's productivity argument does not override the unauthorized disclosure, but immediate termination may disrupt care documentation and destroy leverage. A short cure period with verified remediation is reasonable if the vendor accepts the controls. If the vendor refuses, invoke termination for cause and transition to a compliant tool.