Findings

HIPAA requires a written business associate agreement before a vendor creates, receives, keeps or sends patient information for the practice. A draft is not an agreement, and a signed one covers nothing before it takes effect.

Once the agreement ends, patient data still held or received by the vendor is no longer covered.

Giving patient data to a business associate with no signed BAA is an impermissible disclosure, presumed to be a breach unless the practice documents a low probability that the data was compromised (45 CFR 164.402). Signing a BAA later, lowering the vendor's access or ending the relationship does not undo it, because a BAA cannot cover data disclosed before it was signed; recording the assessment outcome for each period does.

The vendor held our patient data on these days with no BAA on record. A BAA entered afterwards, more than 7 days after the signature date typed in for it, now covers them, and that date is the only thing between those days and a presumed breach (45 CFR 164.402). Check the signed copy and record what it shows, with its filing reference, on the vendor page: the dates entered, or a later signature date, which puts those days back on the record as held without a BAA, each period needing a breach risk assessment. A routine review does not clear this.

The vendor is set up to receive patient data, but the register has no record of any being shared yet (it is in procurement, or not live again). A signed BAA must be in force before the first disclosure. Nothing has been disclosed without one, so this is not a breach; sharing data before the BAA is signed would be. Record the date data is first shared once it is.

When a relationship ends, the vendor must return or destroy our patient data, or extend protections if neither is feasible. Without a certificate there is no evidence it happened.

A BAA must set breach reporting (no later than 60 days), allow termination for a material violation, require return or destruction of data, and bind subcontractors to the same terms.

The vendor is set up to receive patient data, but no go-live date is recorded. While that is so, the register counts no days held without a BAA and a lapsed BAA is not treated as a gap, so an unrecorded go-live would hide exactly those findings. After 90 days without a fresh answer, someone must confirm it: record the date data was first shared, or confirm again that none has been (on the access form or in the annual review).

Subcontractors that handle patient data must agree to the same restrictions as the vendor. The register tracks each one separately because a vendor-level BAA says nothing about whether the vendor actually got those signatures.

For the vendors with the most exposure, a questionnaire the vendor filled in about itself is not enough. A current SOC 2 report or HITRUST certification, an outside auditor's report on the vendor's security, is the usual independent evidence.

A BAA review confirms the agreement still matches what the vendor does. Services change; agreements drift.

The annual questionnaire is how the practice learns that a vendor changed hosting, lost a certification or started using a new subcontractor.

The review is the recurring moment a named person confirms the record is still true.

An alert with no addressee is not a control. Someone at the practice has to notice when the service changes.