Directory · verified September 8, 2026

The support and operations directory: who will actually sign a BAA.

Seventeen vendors in three groups, plus five more in prose: the patient-support firms, healthcare virtual assistants, and remote-monitoring device vendors an operator buys when the program outgrows the founders. Each is described in its own words, with prices quoted verbatim where they are public and "not stated" recorded where they are not. Every claim was verified against the vendor's own pages on September 8, 2026; scale and rank claims are quoted, not adopted.

The finding that organized this page: of 22 vendors, four say in public they will sign a business associate agreement, one publishes an explicit refusal with its reasoning attached, one hedges with "BAA-ready safeguards", one acknowledges the business-associate role without committing to sign, and fifteen do not address it at all, including every remote-monitoring vendor here. HIPAA badges are common; BAA sentences are rare. Ask before you compare hourly figures.

Read this first: EmbedCare operates the support layer these vendors sell into, so read this as an interested party's carefully sourced notes and verify against each vendor directly. Inclusion implies no relationship or endorsement, nothing is ranked, and no vendor paid to appear. An absence recorded here means the claim was not on the pages we could reach on the verification date, not that the vendor would refuse. Vendor pages change on their own schedules; the only terms that bind anyone are the ones in your contract. Corrections: anthony@embedcare.com.

Healthcare-specific patient-support staffing.

Every vendor here claims healthcare specialization on its own site, and this is the only group where the BAA question has published answers: four of five address it. The first two rows are deliberately adjacent, not alphabetized. Hello Rache and Ataraxis run the same offshore staffing model at hourly figures within about a dollar-fifty of each other, and publish opposite answers on who signs.

General CX and BPO firms with a healthcare vertical.

Each of these sells outside healthcare too, and says so. The buyer-facing consequence is concrete: only one of the six commits in public to signing a BAA, and one other reaches the halfway house of “BAA-ready safeguards”. Horatio leads the group because it is the row a DTC telehealth operator will recognize itself in, despite publishing neither a price nor a BAA answer.

RPM devices, connectivity, and fulfillment.

Ordered by architecture rather than brand, because that is what a buyer can act on: gateway-mediated, then natively cellular with no hub, then vendor-agnostic, then Bluetooth-first, and roughly in order of how much of the operation each vendor absorbs. Not one vendor in this group states a BAA commitment, and only one publishes a price. The question this ordering surfaces is who ships, who supports, and who bills, which every vendor answers differently.

Refill and retention operations: a layer, not yet a category.

The obvious fourth group does not exist, and pretending otherwise would manufacture a category the evidence does not support. Three vendors sell adjacent versions of the same work to three different buyers. Honey Healthsells it as software: its platform processes refills against clinical protocols and "approves, denies, or issues partial refills automatically based on established criteria", documenting into the EHR, with complex cases teed up for a prescriber. That is the clearest evidence the work can be productized, and it is also one module among roughly twenty on a back-office platform, priced nowhere on its site. Its trust center could not be reached from our environment, so its BAA posture is recorded as not found on the pages we could load rather than as an absence, which is why it sits here and not in the matrix above. Ameridial sells the same work as labor, to pharmacies and PBMs: refill reminder outreach, refill coordination, adherence follow-up, and barrier identification. Wellth sells adherence to Medicare Advantage, Medicaid, and marketplace plans, where the unit is a plan member rather than a cash-pay patient, so a DTC operator is not its buyer.

For a recurring-Rx program, that means refill continuity is still something you build, staff from the support vendors above, or buy inside an operated platform, and the retention benchmarks are the reason it matters more than any line item on this page.

Three vendors we could not row, and why.

A row that cannot state a vendor's price, devices, or BAA posture is not a row, so three remote-monitoring names are named here instead. Withings Health Solutionsblocks automated fetches on its professional pages, and the only document we could obtain from its own domain is a HIPAA compliance guide self-dated January 2024, so nothing from it is presented as a current statement. What that document does say is worth one sentence: Withings writes that its cloud services "could make WITHINGS a business associate" and describes its assessment as a business associate, without ever committing to execute an agreement. Prevouncesells cellular-connected devices it calls "clinically validated" rather than FDA-cleared, and publishes no price, no BAA language, no HIPAA language, and no named integration on the page we checked. HealthSnapcalls itself "the leading Virtual Care Management Platform", its own superlative, and states neither a price, a BAA posture, a device set, nor a named integration.

Two more names were dropped entirely rather than guessed at. AdhereTech's site returned server errors on every attempt, so no claim is made about it either way, and Peak Support blocked our requests outright. One candidate turned out to be miscategorized on inspection: Prompt Health is an outpatient rehab EHR, not a support vendor, and does not belong on this page at all. This page is re-verified on the quarterly runbook cadence, and additions require the same same-day verification pass it was built from.

Questions operators actually ask.