What it deliberately does not do

It holds no patient data. It records vendors, agreements, dates and contacts, so it needs no BAA of its own to run.

Copies of signed BAAs, security reports, questionnaires and certificates can be attached to each vendor as a file or linked from where they are kept, and an attached copy is never removed. It sends no email itself: request letters open in your own email program, and the dashboard's "Coming up" list and the calendar are where reminders would come from.

How often each vendor is reviewed, and how recent a security report has to be to count, are suggested starting points, not HIPAA rules: HIPAA asks for satisfactory assurances and sets no schedule. Each one is stated wherever it is used. This register is a record keeping tool, not legal advice.