Rule: no hospital, doctor, lab or pharmacy is contacted until an order shows Paid. Booking controls stay locked until then.