Demonstration environment. Fictional organization, fictional vendors, synthetic data throughout. Changes you make stay in this browser only.
ParvinCorpVendor & BAA Register

Ridgeline Health Partners. Multi-specialty physician group, 6 sites, 14 providers.

Signed in as

Marisol Vance, Compliance Officer. Runs the register. Adds vendors, records BAAs and security evidence, and completes the annual reviews. Sees the audit trail.

VendorsMenu

Vendors

Every outside company the practice pays, with what it touches, its BAA and its risk tier. A vendor serving every site matches any site you pick.
Risk tier
BAA
Patient data
Contract held by
Any entity
Serves
Riverside Orthopedics

Regions

Sites in East Region

Sites in West Region

Clear

17 vendors, worst first

Greyhawk Imaging Reads

Overnight radiology reads. Teleradiology or remote reads, full patient records. No owner.

Ridgeline Medical Group. Serves: Riverside Orthopedics.

Critical findingHigh riskBAA: Signed, in force

2 findings: Days held without a BAA were covered by a BAA entered later, not yet confirmed; No internal owner

Ironbark IT Services

Managed IT: servers, backups and help desk. IT managed services, full patient records. Owner: Theo Brandt.

Ridgeline Management Services. Serves: Every site.

Critical findingHigh riskBAA: Draft, not signed

1 finding: Patient data without a signed BAA

Quillstone Transcription

Dictation transcription for clinic notes. Transcription or dictation, full patient records. Owner: Dr. Amara Singh.

Ridgeline Medical Group. Serves: Stonebridge and Riverside Orthopedics.

Critical findingHigh riskBAA: Expired

1 finding: BAA has expired but the vendor is still active

Northgate Revenue Partners

Outsourced billing, coding and denial follow-up. Billing or coding service, full patient records. Owner: Keisha Okafor.

Ridgeline Management Services. Serves: Every site.

High findingCritical riskBAA: Signed, in force

2 findings: Subcontractor handles our data without confirmed terms; High-risk vendor with no independent security evidence

Chimeline Patient Messaging

Appointment reminders by text and voice. Patient messaging or reminders, limited patient data. Owner: Owen Castellano.

Ridgeline Medical Group. Serves: Every site.

High findingModerate riskBAA: Signed, in force

1 finding: Signed BAA is missing required terms

Copperleaf Voice Notes

Ambient dictation pilot for two clinics. Transcription or dictation, limited patient data. Owner: Dr. Amara Singh.

Ridgeline Medical Group. Serves: Riverside Orthopedics.

High findingModerate riskBAA: Signed, in force

1 finding: Not recorded as live for months: confirm no patient data is being shared

Bridgewater Claims Exchange

Electronic claims and remittance clearinghouse. Claims clearinghouse, full patient records. Owner: Keisha Okafor.

Ridgeline Management Services. Serves: Every site.

Medium findingHigh riskBAA: Signed, in force

1 finding: BAA is past its review date

Tallgrass Analytics

Payer mix and denial trend dashboards. Analytics or reporting, limited patient data. Owner: Keisha Okafor.

Ridgeline Management Services. Serves: Every site.

Medium findingModerate riskBAA: Signed, in force

1 finding: Security questionnaire older than 12 months

Vaultline Backup

Offsite backup of servers and imaging archive. Cloud hosting or backup, full patient records. Owner: Theo Brandt.

Ridgeline Management Services. Serves: Every site.

Critical riskBAA: Signed, in force
Bluefern Telehealth

Video visits and virtual waiting room. Telehealth platform, full patient records. Owner: Dr. Amara Singh.

Ridgeline Medical Group. Serves: Every site.

High riskBAA: Signed, in force
Larkspur Clinical Cloud

Hosted EHR and practice management system. EHR or clinical platform, full patient records. Owner: Theo Brandt.

Ridgeline Medical Group. Serves: Every site.

High riskBAA: Signed, in force
Hollis and Reyes LLP

Outside counsel for malpractice defense. Legal, accounting or consulting, limited patient data. Owner: Marisol Vance.

Ridgeline Management Services. Serves: Every site.

Moderate riskBAA: Signed, in force
Brightwater CPA Group

Annual financial audit and tax filings. Legal, accounting or consulting, no patient data. Owner: Owen Castellano.

Ridgeline Management Services. Serves: Every site.

Low riskBAA: Not required
Clearview Facility Services

Nightly cleaning at all clinic locations. Facilities, supplies or staffing, no patient data. Owner: Grant Holloway.

Ridgeline Medical Group. Serves: Stonebridge, Riverbend and Riverside Orthopedics.

Low riskBAA: Not required
Ledgerly Payroll

Payroll and benefits administration. Legal, accounting or consulting, no patient data. Owner: Owen Castellano.

Ridgeline Management Services. Serves: Every site.

Low riskBAA: Not required
Pinecrest Office Supply

Office and exam room supplies. Facilities, supplies or staffing, no patient data. Owner: Grant Holloway.

Ridgeline Medical Group. Serves: Every site.

Low riskBAA: Not required
Tillway Payments

Card payments at the front desk and online. Payment processing, no patient data. Owner: Keisha Okafor.

Ridgeline Medical Group. Serves: Every site.

Low riskBAA: Not required