Demonstration environment. Fictional organization, fictional vendors, synthetic data throughout. Changes you make stay in this browser only.
ParvinCorpVendor & BAA Register

Ridgeline Health Partners. Multi-specialty physician group, 6 sites, 14 providers.

Signed in as

Marisol Vance, Compliance Officer. Runs the register. Adds vendors, records BAAs and security evidence, and completes the annual reviews. Sees the audit trail.

ReportMenu
DashboardCoverage and riskFindingsGaps to closeReviewsAnnual review cycleReportPrint for partners or auditorsVendorsThe registerAdd a vendorIntake and BAA checkCalendarDue in the next 90 daysOrganizationEntities, regions and sitesAudit trailWho changed whatGuided tourWhat this does
Appearance
Contract held by
Any entity
Serves
Any site

Regions

Sites in East Region

Sites in West Region

Ridgeline Health Partners

BAA coverage report

As of Oct 6, 2026. Whole organization.

14 of 17 active vendors with patient data have a signed BAA in force today. Last review completed by Marisol Vance on Sep 16, 2026 (Ironbark IT Services).

Download the register
VendorPatient dataRisk tierBAABAA effectiveBAA endsSOC 2 or HITRUSTLast reviewOpen findings
Greyhawk Imaging ReadsFull patient recordsHighSigned, in forceDec 10, 2025With the serviceSOC 2, Jul 8, 2026Jul 18, 20261 critical
Ironbark IT ServicesFull patient recordsHighDraft, not signedNoneNoneSOC 2, Mar 20, 2026Sep 16, 20261 critical
Quillstone TranscriptionFull patient recordsHighExpiredOct 7, 2023Aug 22, 2026SOC 2, Mar 20, 2026Nov 10, 20251 critical
Northgate Revenue PartnersFull patient recordsCriticalSigned, in forceNov 5, 2024Nov 10, 2027SOC 2, Aug 12, 2025 (out of date)Jul 28, 20262 high
Chimeline Patient MessagingLimited patient dataModerateSigned, in forceSep 1, 2025With the serviceSOC 2, Jul 18, 2026Aug 7, 20261 high
Copperleaf Voice NotesLimited patient dataModerateSigned, in forceMay 19, 2026With the serviceSOC 2, Apr 29, 2026Jun 28, 20261 high
Pinecrest Text RemindersLimited patient dataModerateSigned, not yet in forceOct 20, 2026With the serviceSOC 2, Aug 27, 2026Never1 high
Bridgewater Claims ExchangeFull patient recordsHighSigned, in forceAug 28, 2022With the serviceSOC 2, Jun 28, 2026Mar 20, 2026None
Tallgrass AnalyticsLimited patient dataModerateSigned, in forceMar 20, 2026Mar 20, 2027SOC 2, Jun 28, 2026Apr 9, 2026None
Vaultline BackupFull patient recordsCriticalSigned, in forceJul 28, 2024With the serviceSOC 2, Aug 7, 2026Apr 19, 2026None
Bluefern TelehealthFull patient recordsHighSigned, in forceFeb 13, 2025Dec 14, 2028HITRUST, Mar 20, 2026Aug 22, 2026None
Cobalt Lab LinkFull patient recordsHighSigned, in forceSep 1, 2025With the serviceSOC 2, Mar 20, 2026Aug 27, 2026None
Larkspur Clinical CloudFull patient recordsHighSigned, in forceOct 2, 2023With the serviceSOC 2, May 9, 2026May 19, 2026None
Evenstar Answering ServiceLimited patient dataModerateSigned, in forceSep 1, 2025With the serviceSOC 2, May 29, 2026Jun 18, 2026None
Hollis and Reyes LLPLimited patient dataModerateSigned, in forceMay 24, 2025With the serviceNone on fileDec 10, 2025None
Kiteway Check-InLimited patient dataModerateSigned, in forceOct 21, 2025With the serviceSOC 2, Jun 8, 2026Oct 21, 2025None
Paperwise Secure ShredLimited patient dataModerateSigned, in forceApr 19, 2024With the serviceNone on fileJul 8, 2026None

Signed, in force means a signed BAA covers today. Signed, not yet in force means it takes effect later. BAA effective is the day the signed copy covers from. A SOC 2 report or HITRUST certification is an outside auditor's report on how well the vendor protects data, rather than the vendor's own answers. Open findings counts critical and high findings; medium housekeeping is on the findings page. Vendors with no patient data do not need a BAA and are left off this page. This register is a compliance tool, not legal advice.

Open critical findings (4)

  • Greyhawk Imaging Reads: Days held without a BAA were covered by a BAA entered later, not yet confirmed. The BAA entered on Sep 16, 2026 with a signature date of Dec 10, 2025 (280 days earlier) covers 280 days the vendor held our patient data before it was entered: Dec 10, 2025 to Sep 15, 2026. Confirm the dates against the signed copy.
  • Ironbark IT Services: Patient data without a signed BAA. A BAA was drafted but never signed. Patient data has been held without one since Aug 7, 2026 (61 days).
  • Quillstone Transcription: BAA has expired but the vendor is still active. The BAA ended on Aug 22, 2026. Patient data has been held without one since Aug 23, 2026 (45 days).
  • Tallow Creek Scanning: Held patient data without a BAA, no breach risk assessment. Held patient data from Feb 8, 2026 to Jul 3, 2026 (146 days) while no signed BAA was in force. No breach risk assessment is recorded.