BAAs, tracked per vendor with an expiry window

The BAA problem is not usually a missing agreement. It is a list nobody maintains, where the vendor added in March never made it onto the sheet and the one signed in 2021 quietly expired.

The policy is composed from your clinic’s facts

Your BAA policy covers who counts as a business associate, the contract terms required before any PHI access, subcontractor flow-down, the duty to report a gap when one is found, and six-year retention.

The tracking runs against your vendor list

Five requirements, and the first is the one that matters:

• Every vendor flagged as touching PHI has an executed BAA document on file, with dates that are still current.
• No BAA is expiring within the next sixty days.
• The policy is adopted, reviewed within twelve months, and its facts have not drifted.

The scope is the useful part. The check does not run against a static list you maintain separately, it runs against the vendors in your system flagged with PHI access. Add a vendor with PHI access and no BAA, and the control drops. The sixty-day window means an expiry surfaces while there is still time to renew rather than after it lapses.

What this is, and what it is not

The system checks that an executed BAA document exists, that it is linked to the vendor, and that its dates are current. It does not read the agreement’s terms or judge whether they are adequate, and it cannot tell you whether the vendor is actually honoring what they signed.

What it does replace is the spreadsheet where a vendor gets added and the BAA column stays blank because nobody was watching that cell.

What an investigator gets

A vendor list where every PHI-touching entry has a signed BAA attached, with effective dates. Documented gaps where they exist, rather than a list that looks complete because the missing vendors were never added. Renewal dates you saw coming.