One number that matters

The dashboard opens on BAA coverage: 14 of 17 active vendors with patient data have a signed BAA in force today. That is the first question an auditor, a payer questionnaire or the federal HIPAA regulator will ask, and the vendors that are not covered are named right under it.

Coverage is computed, never typed. A vendor with patient data and no BAA is "required, missing". A draft is not coverage. A signed BAA that takes effect later is "signed, not yet in force", and is not counted until that day. A signed BAA past its end date is "expired", even if the vendor is still in use. Nobody can mark a vendor compliant by changing a status field.