You manage contracts for an Accountable Care Organization (ACO). The ACO has negotiated a business associate agreement with a patient billing Outsource. You get a word from your analyst that the vendor's attorney has added language that stipulates that only a subset of the employees or included (excluding others from the training obligations).

In framing a situation summary for your company's privacy officer, what issues and options will you summarize?

What other options are there (if the data privacy of the healthcare sector is recognized and the vendor uses certified coders for billing services to improve on information privacy and transparency between the vendor and the hospital)?