Larkspur Clinical Cloud

Business associate agreement

BAA: Signed, in force

Document: Signed Oct 2, 2023
Filed at: BAA-001, compliance share, signed copy
Effective: Oct 2, 2023
Ends: With the service agreement
Next BAA review: Mar 5, 2027 (in 150 days)
Breach notice: 10 days

YesBreach reported within 60 days of discovery
YesWe can terminate if the vendor violates a material term
YesData is returned or destroyed when the relationship ends
YesSubcontractors are bound by the same terms

Signed BAA history

Signed Oct 2, 2023, entered Oct 2, 2023: effective Oct 2, 2023, runs with the service agreement. BAA-001, compliance share, signed copy

Update the BAA

Document stateReference (optional)Date signed (the later signature)The date on the signed copy, not the day you enter it. If an entry more than 7 days after signing covers days the vendor already held our data, those days stay a critical finding until the date is confirmed against the signed copy. Kept as is when you only amend terms.Effective dateOn or after the signature date: a BAA cannot cover data disclosed before it was signed. A renewal signed early can take effect when the current term ends.End date (blank if it runs with the service)Next BAA reviewDays to report a breach

The agreement says We may terminate for a material violation Data is returned or destroyed at the end Subcontractors must agree to the same terms

Attach the copy

Required when you record a newly signed BAA, so anyone checking can open the signed copy. Not needed for a draft or when only amending terms.

FilePDF, PNG or JPEG, up to 5 MB.Or a linkFor example the vendor's trust portal or a shared drive. https only.

Risk tier

High risk

Score 7. Reviewed every 12 months at this tier.

Can reach full patient records+4
EHR or clinical platform carries high inherent risk+2
Passes our patient data to its own subcontractors+1

Before any security evidence points (patient data access, kind of service, remote access and subcontractors) the score is 7, which is high. That part alone decides whether a SOC 2 report or HITRUST certification is required.

8 and up is critical, 5 to 7 high, 2 to 4 moderate, below 2 low. A vendor without patient data is never above moderate. How the score works

Security evidence

The security questionnaire is the vendor's own answers about how it protects data. A SOC 2 report or HITRUST certification is an outside auditor's report on how well the vendor protects data, rather than the vendor's own answers.

Security questionnaire
Dated Jun 8, 2026, valid to Jun 8, 2027
Current
SOC 2 Type II report
Dated May 9, 2026, valid to May 9, 2027
Current
HITRUST certification
Dated Dec 10, 2025, valid to Dec 10, 2027
Current

Before any evidence points it rates high, so it needs a security questionnaire from the last 12 months and a SOC 2 report or HITRUST certification that is still valid.

Record new evidence

Subcontractors

Companies this vendor passes our data to.

Nimbusgrid Hosting
Data center hosting for the EHR, handles patient data
Flow-down confirmed

Add or confirm a subcontractor

Data, access and contacts

Patient data: Full patient records
Remote access: No
Internal owner: Theo Brandt
In the register since: Oct 2, 2023
Contract held by: Ridgeline Medical Group
Sites served: Every site
Patient data first shared: Oct 2, 2023; the vendor holds our patient data
Data handled: Names, contact details and demographics; Clinical notes and diagnoses; Claims, charges and billing codes; Insurance and member IDs; Lab results
Who to call about an incident: Security operations desk, Vendor security office, security@larkspur-clinical.test

Change the contracting entity or sites

Update access and data

Vendors change after intake: a phone vendor starts recording calls, an IT vendor is given EHR admin rights. Record what the vendor touches today. The BAA requirement and risk tier are recomputed from your answers.

What they do for the practiceKind of service

Patient data access

No patient data. Never creates, receives, keeps or sends patient information for us.Limited patient data. Sees a narrow slice, such as names and appointment times, or paper records to destroy.Full patient records. Holds or can reach clinical, billing or insurance records in bulk.

Data handledThey have remote access into our systems

Only if you are lowering access to no patient data

This vendor already holds our patient data, and lowering its access does not take that data back. Record the certificate that confirms it was returned or destroyed. If the vendor keeps the data, keep its access at limited or full.

What happened to the data it heldCertificate date

Who to call about an incident (optional)

Name or deskRoleEmail

Annual reviews

Start the review

Next review May 19, 2027 (in 225 days).

May 19, 2026, Marisol VanceApproved

End of the relationship

When this relationship ends, record the date here. For a vendor with patient data, the register then asks for proof the data was returned or destroyed.

Findings