Demonstration environment. Fictional organization, fictional vendors, synthetic data throughout. Changes you make stay in this browser only.

ParvinCorpVendor & BAA Register

Ridgeline Health Partners. Multi-specialty physician group, 6 sites, 14 providers.

Signed in as

Signed in as

Marisol Vance, Compliance Officer. Runs the register. Adds vendors, records BAAs and security evidence, and completes the annual reviews. Sees the audit trail.

DashboardCoverage and risk
FindingsGaps to close
ReviewsAnnual review cycle
ReportPrint for partners or auditors
VendorsThe register
Add a vendorIntake and BAA check
CalendarDue in the next 90 days
OrganizationEntities, regions and sites
Audit trailWho changed what
Guided tourWhat this does
Appearance

VendorsMenu

DashboardCoverage and risk FindingsGaps to close ReviewsAnnual review cycle ReportPrint for partners or auditors VendorsThe register Add a vendorIntake and BAA check CalendarDue in the next 90 days OrganizationEntities, regions and sites Audit trailWho changed what Guided tourWhat this does

Appearance

Vendors / Tallgrass Analytics

Moderate riskBAA: Signed, in forceScheduled

Tallgrass Analytics

Payer mix and denial trend dashboards. Analytics or reporting. Limited patient data.

Findings (1)

Plain rules over the facts below. Fix the fact and the finding clears.

Medium findingSecurity questionnaire older than 12 months
Last questionnaire was received on Sep 21, 2025.
Next step: Send the vendor this year's security questionnaire and record the date it comes back under Security evidence.
Owner: Keisha Okafor
Fix it under Security evidence
Draft a request to the vendor
Sending this does not clear the finding. Record the signed BAA, report, confirmation or certificate on this page once the vendor sends it.
```
Subject: Annual security questionnaire: Tallgrass Analytics

Hello Customer success,

Please complete our annual security questionnaire for the services Tallgrass Analytics provides to Ridgeline Health Partners. The last one we received is dated Sep 21, 2025.

It tells us about changes since last year to where our data is hosted, your certifications and the subcontractors you use. Reply to this message and we will send the form.

Thank you,
Marisol Vance
Compliance Officer, Ridgeline Health Partners
```
Open in email to success@tallgrass-analytics.test
Why this matters
The annual questionnaire is how the practice learns that a vendor changed hosting, lost a certification or started using a new subcontractor.

Business associate agreement

BAA: Signed, in force

Document: Signed Mar 20, 2026
Filed at: BAA-012, one-year pilot
Effective: Mar 20, 2026
Ends: Mar 20, 2027
Next BAA review: Nov 20, 2026 (in 45 days)
Breach notice: 60 days

YesBreach reported within 60 days of discovery
YesWe can terminate if the vendor violates a material term
YesData is returned or destroyed when the relationship ends
YesSubcontractors are bound by the same terms

Signed BAA history

Signed Mar 20, 2026, entered Mar 20, 2026: effective Mar 20, 2026, ends Mar 20, 2027. BAA-012, one-year pilot

Update the BAA

Document stateReference (optional)Date signed (the later signature)The date on the signed copy, not the day you enter it. If an entry more than 7 days after signing covers days the vendor already held our data, those days stay a critical finding until the date is confirmed against the signed copy. Kept as is when you only amend terms.Effective dateOn or after the signature date: a BAA cannot cover data disclosed before it was signed. A renewal signed early can take effect when the current term ends.End date (blank if it runs with the service)Next BAA reviewDays to report a breach

The agreement says We may terminate for a material violation Data is returned or destroyed at the end Subcontractors must agree to the same terms

Attach the copy

Required when you record a newly signed BAA, so anyone checking can open the signed copy. Not needed for a draft or when only amending terms.

FilePDF, PNG or JPEG, up to 5 MB.Or a linkFor example the vendor's trust portal or a shared drive. https only.

Risk tier

Moderate risk

Score 4. Reviewed every 12 months at this tier.

Handles some patient data+2
Analytics or reporting carries medium inherent risk+1
No security questionnaire in the last 12 months+1

Before any security evidence points (patient data access, kind of service, remote access and subcontractors) the score is 3, which is moderate. That part alone decides whether a SOC 2 report or HITRUST certification is required.

8 and up is critical, 5 to 7 high, 2 to 4 moderate, below 2 low. A vendor without patient data is never above moderate. How the score works

Security evidence

The security questionnaire is the vendor's own answers about how it protects data. A SOC 2 report or HITRUST certification is an outside auditor's report on how well the vendor protects data, rather than the vendor's own answers.

Security questionnaire
Dated Sep 21, 2025, valid to Sep 21, 2026
Out of date
SOC 2 Type II report
Dated Jun 28, 2026, valid to Jun 28, 2027
Current
HITRUST certification
Valid for 24 months once received
Not needed

Before any evidence points it rates moderate, so it needs a security questionnaire from the last 12 months. A SOC 2 report or HITRUST certification is welcome but not required.

Record new evidence

KindDate on the document

Attach the copy

Required: the report, certification or completed questionnaire this date comes from.

FilePDF, PNG or JPEG, up to 5 MB.Or a linkFor example the vendor's trust portal or a shared drive. https only.

Subcontractors

Companies this vendor passes our data to.

None recorded.

Add or confirm a subcontractor

Entering an existing name updates that subcontractor.

NameWhat they do for the vendor

Handles our patient data Vendor has confirmed it signed the same terms

Data, access and contacts

Patient data: Limited patient data
Remote access: No
Internal owner: Keisha Okafor
In the register since: Mar 20, 2026
Contract held by: Ridgeline Management Services
Sites served: Every site
Patient data first shared: Mar 20, 2026; the vendor holds our patient data
Data handled: Claims, charges and billing codes; Names, contact details and demographics
Who to call about an incident: Customer success, Account team, success@tallgrass-analytics.test

Change the internal owner

Change the contracting entity or sites

Contract and sitesEntity that holds the contract

Sites it serves

Leave every box clear if it serves every site.

East Region

Main CampusJefferson ParkEastgate Family Care

West Region

StonebridgeRiverbendRiverside Orthopedics

This vendor serves every site today. Ticking any site limits it to the sites you tick, and it will no longer serve every site.

Yes, change which sites this vendor serves as ticked above.

Update access and data

Vendors change after intake: a phone vendor starts recording calls, an IT vendor is given EHR admin rights. Record what the vendor touches today. The BAA requirement and risk tier are recomputed from your answers.

What they do for the practiceKind of service

Patient data access

No patient data. Never creates, receives, keeps or sends patient information for us.Limited patient data. Sees a narrow slice, such as names and appointment times, or paper records to destroy.Full patient records. Holds or can reach clinical, billing or insurance records in bulk.

Data handled

Names, contact details and demographicsClinical notes and diagnosesClaims, charges and billing codesInsurance and member IDsLab resultsImages and radiology reportsVoice recordings and dictationPaper records for storage or destructionPayment card data (not patient data)Employee and payroll data (not patient data)

They have remote access into our systems

Only if you are lowering access to no patient data

This vendor already holds our patient data, and lowering its access does not take that data back. Record the certificate that confirms it was returned or destroyed. If the vendor keeps the data, keep its access at limited or full.

What happened to the data it heldCertificate date

Who to call about an incident (optional)

Name or deskRoleEmail

Annual reviews

Start the review

Next review Apr 9, 2027 (in 185 days).

Apr 9, 2026, Marisol VanceApproved

End of the relationship

When this relationship ends, record the date here. For a vendor with patient data, the register then asks for proof the data was returned or destroyed.

Date the relationship ended

Documents (3)

Copies anyone checking can open: signed BAAs, security reports, questionnaires and certificates. Newest first. Attached copies are never removed.

Security questionnaireSecurity questionnaire (sample). Attached Sep 21, 2025 by Marisol Vance.Open the copy
SOC 2 reportSOC 2 report (sample). Attached Jun 28, 2026 by Marisol Vance.Open the copy
Signed BAASigned BAA (sample). Attached Mar 20, 2026 by Marisol Vance.Open the copy

Attach a document

What it is

Attach the copy

An older signed BAA, an amendment, or anything an auditor will ask to see.

FilePDF, PNG or JPEG, up to 5 MB.Or a linkFor example the vendor's trust portal or a shared drive. https only.

Notes (1)

What happened with this vendor, in order, with who wrote each note and when. Notes are never edited; a correction is a new note.

One-year pilot. Receives a monthly claims extract. This year's security questionnaire went out with the renewal paperwork and has not come back.
At intake, Mar 20, 2026

Add a note

Note

Saved with your name and today's date, and recorded in the audit trail.

History of this record

Recorded automatically when anything changes. Nobody can edit it.

Open in the audit trail

Completed the annual review: ApprovedMarisol Vance, Apr 9, 2026
Added Tallgrass Analytics with limited patient data accessMarisol Vance, Mar 20, 2026
Recorded a signed BAA (BAA-012, one-year pilot)Marisol Vance, Mar 20, 2026

A ParvinCorp product. Demo data is fictional.