Demonstration environment. Fictional organization, fictional vendors, synthetic data throughout. Changes you make stay in this browser only.

Ridgeline Health Partners. Multi-specialty physician group, 6 sites, 14 providers.

Signed in as

Marisol Vance, Compliance Officer. Runs the register. Adds vendors, records BAAs and security evidence, and completes the annual reviews. Sees the audit trail.

DashboardCoverage and risk
FindingsGaps to close
ReviewsAnnual review cycle
ReportPrint for partners or auditors
VendorsThe register
Add a vendorIntake and BAA check
CalendarDue in the next 90 days
OrganizationEntities, regions and sites
Audit trailWho changed what
Guided tourWhat this does
Appearance

Add a vendorMenu

DashboardCoverage and risk FindingsGaps to close ReviewsAnnual review cycle ReportPrint for partners or auditors VendorsThe register Add a vendorIntake and BAA check CalendarDue in the next 90 days OrganizationEntities, regions and sites Audit trailWho changed what Guided tourWhat this does

Appearance

Add a vendor

Answer what the vendor will actually touch. The register decides from your answers whether a BAA is required and computes the risk tier; you do not pick either.

Vendor nameWhat they do for the practiceKind of serviceInternal owner

Will they create, receive, keep or send patient information for us?

No patient data. Never creates, receives, keeps or sends patient information for us.Limited patient data. Sees a narrow slice, such as names and appointment times, or paper records to destroy.Full patient records. Holds or can reach clinical, billing or insurance records in bulk.

For limited or full access: has any patient data been shared with this vendor yet?

Yes. It already has our data (an existing vendor you are adding to the register). Give the day it was first shared, even years ago.No, none yet. The vendor is in procurement: it needs a signed BAA before go-live, and you record the date when data starts to flow.

Patient data first shared on (if yes)There is no default: a vendor recorded as not live has no days counted as held without a BAA, so the answer matters. Every day since the date above with no signed BAA in force counts as held without one.

What data will they handle?

Names, contact details and demographicsClinical notes and diagnosesClaims, charges and billing codesInsurance and member IDsLab resultsImages and radiology reportsVoice recordings and dictationPaper records for storage or destructionPayment card data (not patient data)Employee and payroll data (not patient data)

They will have remote access into our systems

Contract and sitesEntity that holds the contract

Sites it serves

Leave every box clear if it serves every site.

East Region

Main CampusJefferson ParkEastgate Family Care

West Region

StonebridgeRiverbendRiverside Orthopedics

Notes (optional)

A ParvinCorp product. Demo data is fictional.