Third-Party Vendor & Service Documentation

1. Purpose

This document identifies all third-party vendors and external services used by EMStool LLC in the operation of the Cadence platform. It documents whether each vendor receives Protected Health Information (PHI), the Business Associate Agreement (BAA) status, and the risk classification for each service.

2. Vendor Summary

3. Vendor Details

Cloudflare — Zero Trust Tunnel

• What they receive: All HTTPS traffic between users and the Cadence server passes through Cloudflare's network. Traffic is TLS-encrypted end-to-end — Cloudflare terminates the outer TLS but the tunnel protocol encrypts the connection to the origin server.
• PHI exposure: Technically Cloudflare is in the network path but does not access the content of encrypted requests.
• Mitigation: End-to-end TLS encryption limits exposure. BAA to be signed upon upgrade to Business plan.
• Action required: Sign BAA when plan is upgraded.

Cloudflare Realtime — TURN Relay (Clinical Video Consult)

• What they receive: The Clinical Video Consult (OLMC) feature uses WebRTC for live audio/video calls between staff and on-line medical control. Cloudflare Realtime's TURN service is used only as a relay of last resort — when two devices cannot establish a direct peer-to-peer connection (e.g. both behind restrictive NAT/firewalls), encrypted call media is relayed through Cloudflare's TURN servers instead of routing device-to-device.
• PHI exposure: Higher than the Tunnel/CDN relationship above — when a call is relayed, actual call audio/video (which may include clinical conversation) transits Cloudflare's infrastructure, not just encrypted web traffic metadata. Media is SRTP-encrypted end-to-end; Cloudflare relays encrypted packets and does not have the keys to decrypt call content.
• Frequency of relay: Most WebRTC calls connect directly peer-to-peer and never touch the TURN relay at all (industry rule of thumb: roughly 15–20% of calls require relay). Signaling (call setup) is handled by EMStool's own self-hosted signaling server, not Cloudflare — Cloudflare's involvement is limited to media relay on connection-constrained calls.
• Mitigation: SRTP encryption prevents Cloudflare from accessing call content even when relaying. BAA to be signed upon upgrade to Business plan — treat as higher priority than the Tunnel BAA given the difference between metadata and actual PHI-bearing media.
• Action required: Sign BAA when plan is upgraded.

Telnyx — SMS Delivery

• What it does: Delivers SMS text notifications to Cadence staff when a new appointment is added to their schedule. Recipient is always the assigned staff member's own phone number, opted in via explicit mobile consent (mobile_consent flag, required before any SMS is sent).
• Message content: "You have a new appointment scheduled by [coordinator name] on [date] at [time]. View your schedule: [login link]." No patient name, patient identifier, diagnosis, or other patient-related content is included in any SMS body — confirmed directly in _notify.php.
• PHI exposure: None. Message content is staff-facing scheduling metadata only — same content class already carried by the parallel email notification (Resend, below).
• Note: Each Cadence customer instance registers and pays for its own Telnyx number/webhook — no shared relay between customers.

Nominatim — Address Geocoding (Self-Hosted)

• What it does: Converts patient street addresses to latitude/longitude coordinates. Used when patient records are created, edited, or imported.
• Hosting: Self-hosted Docker container on the internal server network using a locally maintained OpenStreetMap dataset for the full United States. No external API calls are made.
• PHI exposure: None — patient addresses are processed entirely within the secure server environment.
• Dataset: Full USA OpenStreetMap extract, updated periodically. Dataset stored on local encrypted storage.

OSRM — Route Optimization (Self-Hosted)

• What it does: Calculates driving routes and travel times between patient appointment locations. Used by the Cadence route optimizer.
• Hosting: Self-hosted Docker container using a locally maintained USA road network dataset. No external API calls are made.
• PHI exposure: None — patient coordinates are processed entirely within the secure server environment.

Gotenberg — PDF Generation (Self-Hosted)

• What it does: Renders HTML to PDF for daily shift reports and summary reports, which may contain patient visit information.
• Hosting: Self-hosted Docker container on the internal server network. No data leaves the server.
• PHI exposure: None — all PDF generation occurs locally.

Resend — Transactional Email

• What it does: Delivers transactional email for account functions (password resets) and staff-facing appointment scheduling notifications — email is the parallel channel to the Telnyx SMS notification above, same trigger (send_appt_notification() in _notify.php), same content class.
• Message content (appointment emails): Coordinator name and appointment date/time, plus a login link. No patient name, patient identifier, diagnosis, or other patient-related content is included — confirmed directly in code.
• PHI exposure: None. Patient data, shift reports, and any PHI are never included in any email.
• Policy: PDF shift reports (which contain PHI) are download-only and are never emailed. This restriction is enforced in code — the email delivery function was removed from EOD report generation on June 1, 2026.

OpenStreetMap Tile Server

• What it does: Serves map tile images for the address verification map shown when adding or editing a patient record.
• PHI exposure: Minimal. Tile requests contain only geographic coordinates (latitude/longitude bounding box) — no patient names, dates of birth, or other identifiers are included in tile requests.
• Note: Coordinates alone, without associated patient identifiers, are not classified as PHI.

Google Maps — Navigation Links

• What it does: When a staff member clicks a patient address to navigate, their device browser opens Google Maps with the destination address or coordinates.
• PHI exposure: Low. Navigation is entirely user-initiated — the address is passed to Google Maps in the browser URL. Google receives the destination address but not the patient's name or any other identifier.
• Risk classification: Low. This is consistent with standard healthcare navigation practice (staff using GPS navigation to patient locations). The Organization does not programmatically transmit patient data to Google — the action is performed by the user's device.
• Mitigation: Staff are trained not to store patient addresses in personal Google accounts or share navigation history.

GitHub — Source Code Repository

• What it does: Hosts the Cadence application source code.
• PHI exposure: None. The repository contains only application code. No patient data, credentials, database contents, or PHI are committed to or stored in the repository. Production credentials are stored in .env files on the server and are explicitly excluded from the repository.

4. BAA Action Log

5. Annual Review Checklist

During the annual policy review, the Security Officer must:

• Verify no new third-party services have been added to the platform without documentation
• Confirm self-hosted services (Nominatim, OSRM, Gotenberg) are still running locally and not proxied externally
• Review Resend usage logs to confirm no PHI is present in email payloads
• Reassess Cloudflare BAA status based on current plan
• Update this document to reflect any changes