What you hand over

The coverage report is one landscape page for the partners' meeting, the cyber insurance renewal questionnaire, a payer audit or a request from the federal HIPAA regulator: 14 of 17 vendors with patient data covered, one row per vendor with its BAA dates, latest SOC 2 or HITRUST and last review, and every open critical finding. Every cell carries a word, so it reads on a black and white copier. It says the date it was printed and any filters applied.

The calendar lists everything falling due in the next 90 days by month, one line per vendor per day, so a vendor with its BAA review, annual review and questionnaire due the same day is one task.