Demonstration environment. Fictional organization, fictional vendors, synthetic data throughout. Changes you make stay in this browser only.
ParvinCorpVendor & BAA Register

Ridgeline Health Partners. Multi-specialty physician group, 6 sites, 14 providers.

Signed in as

Marisol Vance, Compliance Officer. Runs the register. Adds vendors, records BAAs and security evidence, and completes the annual reviews. Sees the audit trail.

VendorsMenu
DashboardCoverage and riskFindingsGaps to closeReviewsAnnual review cycleReportPrint for partners or auditorsVendorsThe registerAdd a vendorIntake and BAA checkCalendarDue in the next 90 daysOrganizationEntities, regions and sitesAudit trailWho changed whatGuided tourWhat this does
Appearance

Vendors

Every outside company the practice pays, with what it touches, its BAA and its risk tier. A vendor serving every site matches any site you pick.
Patient data, no current BAAActive vendors with patient data and no signed BAA in force today.Show all vendors
Risk tier
BAA
Patient data
Contract held by
Any entity
Serves
Any site

Regions

Sites in East Region

Sites in West Region

Clear

3 vendors, worst first

Download these as CSVAdd a vendor
Ironbark IT Services

Managed IT: servers, backups and help desk. IT managed services, full patient records. Owner: Theo Brandt.

Ridgeline Management Services. Serves: Every site.

Critical findingHigh riskBAA: Draft, not signed

1 finding: Patient data without a signed BAA

Quillstone Transcription

Dictation transcription for clinic notes. Transcription or dictation, full patient records. Owner: Dr. Amara Singh.

Ridgeline Medical Group. Serves: Stonebridge and Riverside Orthopedics.

Critical findingHigh riskBAA: Expired

1 finding: BAA has expired but the vendor is still active

Pinecrest Text Reminders

Appointment reminder texts and two-way scheduling messages. Patient messaging or reminders, limited patient data. Owner: Owen Castellano.

Ridgeline Medical Group. Serves: Eastgate Family Care.

High findingModerate riskBAA: Signed, not yet in force

2 findings: BAA needed before any patient data is shared; Annual review overdue or never done