Is Your Third-Party Vendor Using a Fourth-Party Vendor for Your Service?

That is not always the case.

Your third-party vendor may use another company for software, patient enrollment, clinical staffing, billing, devices, call-center support, or data storage. That fourth party may use additional subcontractors of its own.

This arrangement can be reasonable and effective. It can also introduce fragmented accountability, compliance concerns, and operational risk when it is not properly disclosed or managed.

The issue is not whether subcontractors exist. The issue is whether the clinic knows who is doing the work, who can access patient data, and who is accountable when something goes wrong.

International employees and outsourced services are not the same

A vendor with employees located outside the United States is not necessarily outsourcing its service.

Those individuals may be direct employees operating within the vendor’s systems, policies, training, management structure, and quality controls.

That is different from a vendor contracting with a separate company to perform a core part of the service.

Both models require diligence, especially when protected health information is involved. HHS does not categorically prohibit storing or processing electronic PHI outside the United States,

but it advises organizations to consider the additional privacy, security, and enforcement risks in their required risk analysis.

The clinic should understand:

• Whether workers are employees or subcontractors
• Where they are located
• Which company manages and trains them
• What patient information they can access
• How performance and security are monitored
• Who is responsible for their actions

Geography matters, but the employment and accountability structure matters just as much.

Outsourcing software is common and understandable

Many small ancillary-service companies do not build their own software.

A billing company offering CCM or RPM may license another company’s platform. A healthcare startup may use an established care-management system rather than spending years and significant capital building one.

Platforms such as ChronicCareIQ, ThoroughCare, HealthArc, and Phamily support care-management workflows that can be used by practices and other service organizations.

This is not inherently concerning. Nearly every healthcare company relies on external software, cloud infrastructure, communications tools, or integrations.

Using proven technology may be smarter than rebuilding capabilities that already exist.

The clinic should still know:

• Who owns the platform
• Whether the vendor is licensed to use it for clients
• Where the data resides
• Which integrations are included
• What happens if the software relationship ends
• Whether the clinic can retrieve its data
• Who supports the system when it fails

A full-service vendor should also explain whether it is developing proprietary capabilities or expects to remain dependent on another company’s platform. That dependency can affect

pricing, product flexibility, integration priorities, and continuity.

Outsourcing the clinical workforce creates a different risk

I become more cautious when a vendor markets a full-service clinical model but does not employ or directly control the care-management team serving the clinic.

The clinic may believe it hired one accountable partner. Operationally, however, the relationship may involve:

1. The medical practice 2. The full-service vendor 3. The software company 4. A separate clinical-staffing company 5. Additional subcontractors supporting data, communications, or billing

Every additional layer can create another handoff. That may affect:

• Care-manager continuity
• Training consistency
• Response times
• Clinical escalation
• Quality assurance
• Credentialing
• Patient experience
• Data access
• Accountability when performance declines

A subcontracted clinical model can still work well. But it should not be presented as though the vendor directly employs and manages every person delivering the service.

Transparency makes the model easier to evaluate

Phamily provides a useful example of publicly disclosing a multi-party model.

In a 2024 oncology collaboration, Phamily explained that its technology would support the program while Sweeten Health nurses provided care-management services. The announcement explicitly identified each company and its role.

In another publicly announced model, Evergreen Nephrology’s clinical staff use Phamily’s

platform to deliver connected kidney care.

These arrangements may involve multiple organizations, but the roles are visible. The clinic can evaluate the technology provider, clinical employer, and operating model separately.

That is far better than learning after implementation that the vendor which sold the service is not the company employing the people speaking with patients.

ChronicCareIQ’s current public materials, by comparison, primarily position it as software for organizations that want to operate care management with their own teams. If a reseller or service company uses ChronicCareIQ, the practice should evaluate that service company’s staffing and management independently from the software platform.

What an in-house care-management team can accomplish

Companies such as 1Bios, Medimote, and Advanta Biometrics publicly present full-service care-management models in which care coordinators or care managers operate as extensions of the clinic.

1Bios specifically describes its model as enrollment, monitoring, patient care, and billing support delivered under one roof through its own technology, team, and processes. Its public materials also identify a dedicated U.S.-based care staff and proprietary AI platform.

Advanta’s model demonstrates the operational advantages of keeping the care-management team in-house. Advanta represents that its dedicated, U.S.-based care managers are managed directly within one unified clinical and operational structure.

That allows Advanta to assume significantly more of the clinic’s administrative burden rather than limiting its service to monthly patient calls and time documentation.

Through detailed workflows, Advanta’s team can support care coordination involving:

• Imaging orders and follow-up
• Laboratory work and results
• Specialist and community referrals
• Medication and care-plan follow-up
• Post-hospital outreach
• Patient scheduling and access
• Care-gap identification
• Escalation back to the appropriate clinic team member

Because the care managers, workflows, technology, and performance management operate within the same delivery structure, Advanta can train its team around the clinic’s specific

expectations and continuously improve those workflows.

Advanta reports that this purposeful workflow design produces nearly twice the monthly billable-service attainment of more limited care-management models. That performance figure is company-reported and should be validated against the clinic’s patient population, baseline, payer mix, and proposed implementation.

When a vendor directly manages its care team, it can align staffing, training, workflows, escalation, documentation, and financial performance around the clinic’s objectives.

Fewer operational handoffs can allow the vendor to assume more responsibility and create greater value for both patients and the practice.

Even when a vendor publicly describes “our care team,” the practice should still confirm the employment, supervision, and subcontracting structure in writing.

When can subcontracting become a legal or compliance problem?

Subcontracting itself is not illegal.

CMS allows certain care-management and RPM activities to be furnished by qualifying auxiliary personnel under the required level of supervision, and some of those personnel may be contracted. However, the billing practitioner remains responsible for satisfying applicable coverage, supervision, documentation, and billing requirements.

Problems can arise when:

• PHI is disclosed without the required agreements and safeguards
• Personnel lack required qualifications or licensure
• Required supervision is not provided
• Services are billed but not properly performed or documented
• Multiple organizations bill incompatible services for the same patient and period
• The subcontracting arrangement violates a payer or client contract
• The clinic is misled about who is delivering the service
• Financial arrangements implicate fraud-and-abuse laws

Under HIPAA, a business associate must establish an appropriate business associate agreement with a subcontractor before disclosing PHI for work performed on behalf of the

covered entity. The same restrictions must continue downstream.

The OIG also makes clear that billing for services not rendered or services performed by improperly supervised or unqualified personnel can create false-claims exposure.

The clinic should have qualified healthcare counsel and compliance professionals review its specific arrangement. A vendor saying, “Everyone does it this way,” is not a legal opinion.

Why directly managed care teams can be advantageous

A vendor that directly employs and manages its care team can often create a clearer line of accountability. Potential advantages include:

• Consistent hiring and credentialing standards
• Unified training
• Direct performance management
• Standardized clinical protocols
• Faster escalation and problem resolution
• Greater continuity for patients
• Fewer contractual handoffs
• Better alignment between technology and clinical operations
• Clearer ownership of quality and outcomes

Direct employment does not automatically produce better care. A poorly managed internal team can underperform, while a well-governed subcontractor can deliver excellent results.

The advantage is structural: the clinic has fewer parties to coordinate and less ambiguity about who owns performance.

Ask before you sign

Practices should require a written view of the complete delivery model. Ask:

• Who owns the software?
• Who employs the people contacting our patients?
• Are any core services subcontracted?
• Which organizations can access PHI?
• Where are staff and data located?
• Who holds the downstream BAAs?
• Who credentials, trains, and supervises clinical personnel?
• Who manages escalations and quality assurance?
• Can subcontractors change without our approval or notice?
• What happens if a subcontractor relationship ends?
• Who is financially and legally accountable for performance?

The contract should require disclosure of material subcontractors, advance notice of significant changes, appropriate data protections, defined service levels, and clear accountability.

There is nothing inherently wrong with a fourth-party vendor. There is something wrong with a clinic believing it purchased one operating model when it actually received another.

Know who owns the technology. Know who employs the care team. Know who can access your data. Know who is accountable to your patients.

If the vendor will not answer those questions clearly, that is the answer.