A small primary care practice runs on tasks that pass between people: refill requests, referrals, prior authorizations and abnormal results. Each one is protected health information. Team chat that signs a Business Associate Agreement turns those tasks into threads the whole team can see and close, instead of texts that live on one MA's phone. A 6 to 15 person practice can set it up in a day.
A practice built on handoffs
A small primary care practice has two or three physicians, nurse practitioners or physician assistants, an RN or LPN, three to five medical assistants (MAs), a front desk, a referral coordinator, a prior authorization specialist who may also bill, and a practice manager. Some practices add a care coordinator for chronic care patients. Every one of them spends the day passing tasks to someone else and waiting for something back.
The handoffs are the problem. A refill question sits in the provider's inbox for two days. The referral coordinator does not know the cardiology office called back. The prior auth was denied and nobody told the MA who promised the patient an answer. People fix this with texts, and the texts carry patient names.
The daily tasks that run through chat
- Refills. The MA has a request for a blood pressure medication, the patient's last visit was 14 months ago, and the provider needs to decide whether to refill for 30 days and book a visit.
- Referrals. The cardiology office needs the last ECG before they will schedule, and the referral coordinator needs an MA to send it today.
- Prior authorization. The payer denied a request for an MRI, and the authorization specialist needs the provider's note on failed conservative treatment to appeal.
- Abnormal result. A potassium came back high on a patient seen this morning. The nurse needs the provider's instructions and a decision on who calls the patient.
- Room flow. 'Room 3 is ready, here for a physical and a knee', or 'Dr. V is running 30 minutes behind, let the 2:00 know'.
Chat is not the chart
A decision made in chat still has to be documented in the EHR. The refill goes through the EHR's prescribing tool, the result note goes into the chart, the referral gets logged. Chat is where the question gets asked and answered fast, and where the task gets a thread and a reaction when it is done. If your EHR has a task system the team actually uses, chat sits beside it for the back-and-forth. If it does not, chat becomes the task list.
What is PHI here and what is not
Protected health information (PHI) is anything that identifies a patient and relates to their health, care or payment. A name with a medication is PHI. A name with a lab value is PHI. A chart number with a referral is PHI. 'Room 3 ready' is not. 'Dr. V running 30 minutes behind' is not. 'The cardiology office changed its fax number' is not.
A primary care practice that bills insurance electronically is a covered entity under HIPAA, so the Privacy and Security Rules apply to the practice directly. Every vendor that stores staff messages is a business associate and must sign a Business Associate Agreement (BAA), the contract committing it to protect PHI under HIPAA, before handling a message (45 CFR 164.502(e)). WhatsApp, Facebook Messenger and carrier SMS will not sign one. Our plain-English guide to what a BAA is covers what the agreement should say.
A channel map for a 6 to 15 person practice
| Channel | Who is in it | What goes there |
|---|---|---|
| #clinic-flow | MAs, providers, nurse, front desk | Rooms ready, running behind, add-ons, no clinical detail |
| #refills (private) | MAs, providers, nurse | Refill requests needing a decision, one thread per patient |
| #referrals (private) | Referral coordinator, MAs, providers | Records needed, specialist callbacks, status by patient |
| #prior-auth (private) | Authorization specialist, providers, MAs | Requests, denials, appeals, documentation needed |
| #results (private) | Nurse, providers, the MA making calls | Abnormal results, who calls, what was advised |
| #front-desk | Front desk, practice manager | Phones, insurance questions, forms, wait times |
| #providers-private | Physicians, NPs, PAs | Clinical questions, coverage, protocol changes |
| #managers-private | Practice manager, physician owners | Staffing, contracts, incidents |
One thread per task. The MA posts the refill, the provider replies in the thread, the MA reacts with a check mark when it is done. The channel stays readable and the practice manager can see what is still open.
Mistakes primary care practices make
- A WhatsApp group for the MAs to ask providers questions, with names, medications and photos of faxes. WhatsApp signs no BAA, and an MA who leaves keeps every message.
- Personal SMS between the nurse and a provider for abnormal results, because the provider answers texts faster than the EHR inbox.
- Facebook Messenger between front desk staff for schedules, which absorbs patient names within weeks.
- A referral status spreadsheet emailed to personal addresses so the coordinator can work from home.
Each one is a reasonable answer to a slow EHR inbox. The replacement has to be faster than the inbox too.
Setting it up in a day
- The practice manager creates the workspace and invites each person by work email. It is invite-only, so nobody joins from a forwarded link.
- Create the channels above. Every channel with patient content is private; #clinic-flow and #front-desk are open.
- Providers are managers of #refills, #results and #providers-private; MAs and the nurse are members; the front desk is not in any clinical channel. The biller can be a viewer in #prior-auth if she only needs to read status.
- Turn on passkeys so the exam room computers and the MAs' phones sign in with Face ID or Touch ID, and rely on the 15-minute inactivity lock.
- Post the thread rule in each clinical channel's topic: one thread per patient task, check mark when done.
- Pick a date to retire the WhatsApp group and the text threads, and have the practice manager leave last.
Yodl's Team plan is $10 a month per location, with five users, 20 GB of file storage and a signed BAA, plus $2 a month for each additional person. A 12-person practice pays $24. The admin panel includes an audit viewer with CSV export, retention settings and a legal hold, which is what you want when a patient complaint or a payer audit asks who handled a refill. Like Slack and Microsoft Teams, Yodl is encrypted in transit and at rest rather than end-to-end, which is what keeps search and the audit log working.
When the refill thread should stop living on one MA's phone, Yodl is $10 a month for five people, with the signed BAA on every plan.
Primary care runs on handoffs. Give refills, referrals, prior auths and results their own private channels inside a BAA-covered tool, one thread per task, and document the decision in the chart.
Frequently asked questions
Should we use chat or the EHR inbox for refills?
Both. The decision and the prescription live in the EHR. Chat is for the quick question that would otherwise sit in the inbox for two days, with the thread closed once the EHR work is done.
Can the front desk be in the clinical channels?
Usually not. Keep #refills, #results and #referrals private to clinical staff, and put what the front desk needs, such as a patient to expect for a visit, in #clinic-flow without clinical detail.
Is a chart number PHI?
Yes. It is a record identifier that links to one person. Keep it inside the BAA-covered tool like a name.
What if a provider works at two of our locations?
One account works across locations. Each location is a separate $10 plan with five users, and the provider is simply a member of both sets of channels.