You can sign a perfect Business Associate Agreement and still lose the program on day two if schedulers forward everything to a phone that uses personal mail. The BA never agreed to safeguard that mailbox. Neither did the practice, in writing.
Find the forwards
Ask IT or the email admin for inbox rules. Ask staff directly in training: "Who checks clinic mail on a personal account?" Treat answers as a process problem, not a firing offense, or you will never hear the truth.
Remove the reason to forward
Give people mobile access to the real HIPAA inbox. Make the official tool faster than the workaround. HIPAA Companion healthcare email is a staff inbox on your domain, with archiving, so "I needed it on my phone" is not an excuse to leave the BAA.
Put a no-forwarding rule in the sanction policy. Disable forwarding technically where you can. Review it when someone leaves so their personal rules do not keep receiving PHI.