Demonstration environment. Fictional organization, fictional vendors, synthetic data throughout. Changes you make stay in this browser only.
ParvinCorpVendor & BAA Register

Ridgeline Health Partners. Multi-specialty physician group, 6 sites, 14 providers.

Signed in as

Marisol Vance, Compliance Officer. Runs the register. Adds vendors, records BAAs and security evidence, and completes the annual reviews. Sees the audit trail.

ReportMenu
DashboardCoverage and riskFindingsGaps to closeReviewsAnnual review cycleReportPrint for partners or auditorsVendorsThe registerAdd a vendorIntake and BAA checkCalendarDue in the next 90 daysOrganizationEntities, regions and sitesAudit trailWho changed whatGuided tourWhat this does
Appearance
Contract held by
Any entity
Serves
Any site

Regions

Sites in East Region

Sites in West Region

Ridgeline Health Partners

BAA coverage report

As of Oct 7, 2026. Whole organization.

14 of 17 active vendors with patient data have a signed BAA in force today. Last review completed by Marisol Vance on Sep 17, 2026 (Ironbark IT Services).

Download the register
VendorPatient dataRisk tierBAABAA effectiveBAA endsSOC 2 or HITRUSTLast reviewOpen findings
Greyhawk Imaging ReadsFull patient recordsHighSigned, in forceDec 11, 2025With the serviceSOC 2, Jul 9, 2026Jul 19, 20261 critical
Ironbark IT ServicesFull patient recordsHighDraft, not signedNoneNoneSOC 2, Mar 21, 2026Sep 17, 20261 critical
Quillstone TranscriptionFull patient recordsHighExpiredOct 8, 2023Aug 23, 2026SOC 2, Mar 21, 2026Nov 11, 20251 critical
Northgate Revenue PartnersFull patient recordsCriticalSigned, in forceNov 6, 2024Nov 11, 2027SOC 2, Aug 13, 2025 (out of date)Jul 29, 20262 high
Chimeline Patient MessagingLimited patient dataModerateSigned, in forceSep 2, 2025With the serviceSOC 2, Jul 19, 2026Aug 8, 20261 high
Copperleaf Voice NotesLimited patient dataModerateSigned, in forceMay 20, 2026With the serviceSOC 2, Apr 30, 2026Jun 29, 20261 high
Pinecrest Text RemindersLimited patient dataModerateSigned, not yet in forceOct 21, 2026With the serviceSOC 2, Aug 28, 2026Never1 high
Bridgewater Claims ExchangeFull patient recordsHighSigned, in forceAug 29, 2022With the serviceSOC 2, Jun 29, 2026Mar 21, 2026None
Tallgrass AnalyticsLimited patient dataModerateSigned, in forceMar 21, 2026Mar 21, 2027SOC 2, Jun 29, 2026Apr 10, 2026None
Vaultline BackupFull patient recordsCriticalSigned, in forceJul 29, 2024With the serviceSOC 2, Aug 8, 2026Apr 20, 2026None
Bluefern TelehealthFull patient recordsHighSigned, in forceFeb 14, 2025Dec 15, 2028HITRUST, Mar 21, 2026Aug 23, 2026None
Cobalt Lab LinkFull patient recordsHighSigned, in forceSep 2, 2025With the serviceSOC 2, Mar 21, 2026Aug 28, 2026None
Larkspur Clinical CloudFull patient recordsHighSigned, in forceOct 3, 2023With the serviceSOC 2, May 10, 2026May 20, 2026None
Evenstar Answering ServiceLimited patient dataModerateSigned, in forceSep 2, 2025With the serviceSOC 2, May 30, 2026Jun 19, 2026None
Hollis and Reyes LLPLimited patient dataModerateSigned, in forceMay 25, 2025With the serviceNone on fileDec 11, 2025None
Kiteway Check-InLimited patient dataModerateSigned, in forceOct 22, 2025With the serviceSOC 2, Jun 9, 2026Oct 22, 2025None
Paperwise Secure ShredLimited patient dataModerateSigned, in forceApr 20, 2024With the serviceNone on fileJul 9, 2026None

Signed, in force means a signed BAA covers today. Signed, not yet in force means it takes effect later. BAA effective is the day the signed copy covers from. A SOC 2 report or HITRUST certification is an outside auditor's report on how well the vendor protects data, rather than the vendor's own answers. Open findings counts critical and high findings; medium housekeeping is on the findings page. Vendors with no patient data do not need a BAA and are left off this page. This register is a compliance tool, not legal advice.

Open critical findings (4)

  • Greyhawk Imaging Reads: Days held without a BAA were covered by a BAA entered later, not yet confirmed. The BAA entered on Sep 17, 2026 with a signature date of Dec 11, 2025 (280 days earlier) covers 280 days the vendor held our patient data before it was entered: Dec 11, 2025 to Sep 16, 2026. Confirm the dates against the signed copy.
  • Ironbark IT Services: Patient data without a signed BAA. A BAA was drafted but never signed. Patient data has been held without one since Aug 8, 2026 (61 days).
  • Quillstone Transcription: BAA has expired but the vendor is still active. The BAA ended on Aug 23, 2026. Patient data has been held without one since Aug 24, 2026 (45 days).
  • Tallow Creek Scanning: Held patient data without a BAA, no breach risk assessment. Held patient data from Feb 9, 2026 to Jul 4, 2026 (146 days) while no signed BAA was in force. No breach risk assessment is recorded.