Demonstration environment. Fictional organization, fictional vendors, synthetic data throughout. Changes you make stay in this browser only.
ParvinCorpVendor & BAA Register

Ridgeline Health Partners. Multi-specialty physician group, 6 sites, 14 providers.

Signed in as

Marisol Vance, Compliance Officer. Runs the register. Adds vendors, records BAAs and security evidence, and completes the annual reviews. Sees the audit trail.

VendorsMenu
DashboardCoverage and riskFindingsGaps to closeReviewsAnnual review cycleReportPrint for partners or auditorsVendorsThe registerAdd a vendorIntake and BAA checkCalendarDue in the next 90 daysOrganizationEntities, regions and sitesAudit trailWho changed whatGuided tourWhat this does
Appearance
Vendors / Ironbark IT Services
High riskBAA: Draft, not signedReview due soon

Ironbark IT Services

Managed IT: servers, backups and help desk. IT managed services. Full patient records.

Findings (1)

Plain rules over the facts below. Fix the fact and the finding clears.

  • Critical findingPatient data without a signed BAA

    A BAA was drafted but never signed. Patient data has been held without one since Aug 8, 2026 (61 days).

    Next step: Get the BAA signed by both parties (or stop sharing patient data until one is in force), then record it under Business associate agreement on the vendor page.

    Owner: Theo Brandt

    Fix it under Business associate agreement
    Draft a request to the vendor

    Sending this does not clear the finding. Record the signed BAA, report, confirmation or certificate on this page once the vendor sends it.

    Subject: Signed business associate agreement needed: Ridgeline Health Partners and Ironbark IT Services

Hello Service desk,

We do not have a business associate agreement signed by both parties and in force for the services Ironbark IT Services provides to Ridgeline Health Partners. Our records show the agreement is still an unsigned draft (Draft 2, with vendor legal).

HIPAA requires a signed agreement to be in place while a vendor receives, keeps or sends patient information for us. Please return a copy signed by your authorized signer, with the date it takes effect, as soon as you can, and let us know who to contact if anything is holding it up.

Thank you,
Marisol Vance
Compliance Officer, Ridgeline Health Partners
    Open in email to help@ironbark-it.test
    Why this matters

    HIPAA requires a written business associate agreement before a vendor creates, receives, keeps or sends patient information for the practice. A draft is not an agreement, and a signed one covers nothing before it takes effect.

Patient data held without a BAA

Every day the vendor held our patient data with no signed BAA in force, worked out from the holding and BAA histories below. These periods never disappear: a BAA signed later does not cover them. Each needs a breach risk assessment (45 CFR 164.402).

  • Holding our patient data since Aug 8, 2026 (61 days so far) while no signed BAA was in force. Still running today.

    This period ends when a BAA is signed or the vendor stops holding the data. It can be assessed once it has ended; until then it is a critical finding above.

Business associate agreement

BAA: Draft, not signed
Document
Draft
Filed at
Draft 2, with vendor legal
Effective
Not recorded
Ends
With the service agreement
Next BAA review
Not set
Breach notice
30 days
  • YesBreach reported within 60 days of discovery
  • YesWe can terminate if the vendor violates a material term
  • YesData is returned or destroyed when the relationship ends
  • YesSubcontractors are bound by the same terms
Update the BAA

The vendor has held patient data with no signed BAA in force since Aug 8, 2026. A BAA covers the data from the day it takes effect, and it cannot take effect before it was signed. Any days before that stay on the record as held without a BAA and need a breach risk assessment.

The agreement says
Attach the copy

Required when you record a newly signed BAA, so anyone checking can open the signed copy. Not needed for a draft or when only amending terms.

Risk tier

High risk

Score 7. Reviewed every 12 months at this tier.

  • Can reach full patient records+4
  • IT managed services carries high inherent risk+2
  • Has remote access to our systems+1

Before any security evidence points (patient data access, kind of service, remote access and subcontractors) the score is 7, which is high. That part alone decides whether a SOC 2 report or HITRUST certification is required.

8 and up is critical, 5 to 7 high, 2 to 4 moderate, below 2 low. A vendor without patient data is never above moderate. How the score works

Security evidence

The security questionnaire is the vendor's own answers about how it protects data. A SOC 2 report or HITRUST certification is an outside auditor's report on how well the vendor protects data, rather than the vendor's own answers.

  • Security questionnaire

    Dated Sep 7, 2026, valid to Sep 7, 2027

    Current

  • SOC 2 Type II report

    Dated Mar 21, 2026, valid to Mar 21, 2027

    Current

  • HITRUST certification

    Valid for 24 months once received

    Not needed

Before any evidence points it rates high, so it needs a security questionnaire from the last 12 months and a SOC 2 report or HITRUST certification that is still valid.

Record new evidence
Attach the copy

Required: the report, certification or completed questionnaire this date comes from.

Subcontractors

Companies this vendor passes our data to.

None recorded.

Add or confirm a subcontractor

Entering an existing name updates that subcontractor.

Data, access and contacts

Patient data
Full patient records
Remote access
Yes, into our systems
Internal owner
Theo Brandt
In the register since
Aug 8, 2026
Contract held by
Ridgeline Management Services
Sites served
Every site
Patient data first shared
Aug 8, 2026; the vendor holds our patient data
Data handled
Clinical notes and diagnoses; Names, contact details and demographics; Claims, charges and billing codes
Who to call about an incident
Service desk, Help desk, help@ironbark-it.test
Change the contracting entity or sites
Contract and sites

Sites it serves

Leave every box clear if it serves every site.

East Region

West Region

This vendor serves every site today. Ticking any site limits it to the sites you tick, and it will no longer serve every site.

Update access and data

Vendors change after intake: a phone vendor starts recording calls, an IT vendor is given EHR admin rights. Record what the vendor touches today. The BAA requirement and risk tier are recomputed from your answers.

Patient data access
Data handled
Only if you are lowering access to no patient data

This vendor already holds our patient data, and lowering its access does not take that data back. Record the certificate that confirms it was returned or destroyed. If the vendor keeps the data, keep its access at limited or full.

The vendor has held patient data with no signed BAA in force since Aug 8, 2026 (no signed BAA was in force). Lowering access ends that period on the certificate date; it stays on the record as a critical finding until a breach risk assessment is recorded. Signing a BAA does not change the past.

Who to call about an incident (optional)

Open conditions, follow-up due Oct 17, 2026 (in 10 days)

Working with administrator access and no signed BAA. Theo to get their legal team to sign this month, or remove their access.

Escalated by Marisol Vance on Sep 17, 2026. The next review closes them if it approves outright.

Annual reviews

Start the review

Next review Oct 17, 2026 (in 10 days).

End of the relationship

When this relationship ends, record the date here. For a vendor with patient data, the register then asks for proof the data was returned or destroyed.

The vendor has held patient data with no signed BAA in force since Aug 8, 2026 (no signed BAA was in force). Ending the relationship ends that period on the end date; it stays on the record as a critical finding until a breach risk assessment is recorded.

Documents (2)

Copies anyone checking can open: signed BAAs, security reports, questionnaires and certificates. Newest first. Attached copies are never removed.

  • Security questionnaireSecurity questionnaire (sample). Attached Sep 7, 2026 by Marisol Vance.Open the copy
  • SOC 2 reportSOC 2 report (sample). Attached Mar 21, 2026 by Marisol Vance.Open the copy
Attach a document
Attach the copy

An older signed BAA, an amendment, or anything an auditor will ask to see.

Notes (1)

What happened with this vendor, in order, with who wrote each note and when. Notes are never edited; a correction is a new note.

  1. Started work before the BAA came back from their lawyers. Administrator access to every server. Escalated at intake review; Theo is chasing their legal team for the signature.

    At intake, Aug 8, 2026

Add a note

Saved with your name and today's date, and recorded in the audit trail.

History of this record

Recorded automatically when anything changes. Nobody can edit it.

Open in the audit trail
  1. Completed the annual review: EscalatedMarisol Vance, Sep 17, 2026
  2. Recorded security questionnaireMarisol Vance, Sep 7, 2026
  3. Recorded a draft BAA (Draft 2, with vendor legal)Marisol Vance, Aug 10, 2026
  4. Added Ironbark IT Services with full patient data accessMarisol Vance, Aug 8, 2026