Clearview Facility Services

Business associate agreement

BAA: Not required

No BAA on file, and none is needed: this vendor does not handle patient information.

Record a BAA

Document stateReference (optional)Date signed (the later signature)The date on the signed copy, not the day you enter it. If an entry more than 7 days after signing covers days the vendor already held our data, those days stay a critical finding until the date is confirmed against the signed copy. Kept as is when you only amend terms.Effective dateOn or after the signature date: a BAA cannot cover data disclosed before it was signed. A renewal signed early can take effect when the current term ends.End date (blank if it runs with the service)Next BAA reviewDays to report a breach

The agreement says We may terminate for a material violation Data is returned or destroyed at the end Subcontractors must agree to the same terms

Attach the copy

Required when you record a newly signed BAA, so anyone checking can open the signed copy. Not needed for a draft or when only amending terms.

FilePDF, PNG or JPEG, up to 5 MB.Or a linkFor example the vendor's trust portal or a shared drive. https only.

Risk tier

Low risk

Score 0. Reviewed every 24 months at this tier.

No risk factors apply.

8 and up is critical, 5 to 7 high, 2 to 4 moderate, below 2 low. A vendor without patient data is never above moderate. How the score works

Security evidence

The security questionnaire is the vendor's own answers about how it protects data. A SOC 2 report or HITRUST certification is an outside auditor's report on how well the vendor protects data, rather than the vendor's own answers.

Security questionnaire
Valid for 12 months once received
Not needed
SOC 2 Type II report
Valid for 12 months once received
Not needed
HITRUST certification
Valid for 24 months once received
Not needed

Record new evidence

Subcontractors

Companies this vendor passes our data to.

None recorded.

Add or confirm a subcontractor

Data, access and contacts

Patient data: No patient data
Remote access: No
Internal owner: Grant Holloway
In the register since: Oct 27, 2024
Contract held by: Ridgeline Medical Group
Sites served: Stonebridge, Riverbend and Riverside Orthopedics
Data handled: None
Who to call about an incident: Not recorded

Change the contracting entity or sites

Update access and data

Vendors change after intake: a phone vendor starts recording calls, an IT vendor is given EHR admin rights. Record what the vendor touches today. The BAA requirement and risk tier are recomputed from your answers.

What they do for the practiceKind of service

Patient data access

No patient data. Never creates, receives, keeps or sends patient information for us.Limited patient data. Sees a narrow slice, such as names and appointment times, or paper records to destroy.Full patient records. Holds or can reach clinical, billing or insurance records in bulk.

Data handledThey have remote access into our systems

If access is limited or full: has any patient data been shared with this vendor yet?

No, none yet (recorded as confirmed today).Yes, first shared on the date below (go-live).

No default: access planned is not data held, but a go-live left unrecorded hides every day held without a BAA. A vendor in procurement needs a signed BAA in force before this date.

Who to call about an incident (optional)

Name or deskRoleEmail

Annual reviews

Start the review

Next review Oct 27, 2026 (in 20 days).

End of the relationship

When this relationship ends, record the date here. For a vendor with patient data, the register then asks for proof the data was returned or destroyed.

Findings