No shortcut through the access field

A finding should only clear when the fact behind it changes. The obvious shortcut would be to open a vendor with patient data and simply mark it "No patient data": every patient data rule would stop applying, and ending the relationship would never ask for the data back.

The register does not allow it. Lowering a vendor from limited or full access to none does not take back the data it already holds, so the change is refused unless it also records that the data was returned or destroyed, with the date on the certificate, as HIPAA requires a BAA to provide for.

A certificate is still not a clean record. Under HIPAA, every day the vendor held the data with no signed BAA in force was a disclosure that is presumed to be a breach unless a risk assessment shows a low probability that the data was compromised. Those days stay on the record, and a critical finding stays open until the assessment outcome is recorded for each period, with its date and who carried it out. Ending the relationship works the same way. Only a vendor whose signed BAA covered every day of the holding is told to keep the BAA on file.

Try it on a fresh demo with Ironbark IT Services: under "Update access and data", choose "No patient data" and save without a certificate. The form refuses. Add a destruction certificate and it goes through, and the critical finding changes to "Held patient data without a BAA". Tallow Creek Scanning shows the same finding on a finished project. The database itself enforces all of this, and nobody, not even someone with full access to the database, can change when a vendor was added or rewrite the record of when it held our data or had a signed BAA.