Templates
Free BAA tracker template (Excel)
Most agencies can name their EHR and billing vendors. Fewer can say, on the spot, which of their 40 or 60 vendors touch PHI and which of those have a signed BAA on file. Surveys and audits ask exactly that.
This tracker gives you one row per vendor. Mark whether they touch PHI, whether a BAA is on file, when it was signed and when to review it, and which contract it covers. The status column works itself out: Missing BAA, Review overdue, Contract ends soon, or On file.
A second tab checks one BAA against the 13 terms HIPAA requires a business associate contract to have, each with its rule, so you can see what an older or vendor-written BAA leaves out.
Download the BAA tracker (free; Excel, works in Google Sheets and Numbers)
What to watch
Does the vendor create, receive, keep or send PHI for you?
That's what makes a vendor a business associate. Staffing, billing, IT, answering services and shredding companies often do, not just the EHR.
Is there a reason no BAA is needed?
Sharing PHI with another provider to treat a patient doesn't need one, and your own staff aren't business associates. Write the reason down so the gap doesn't look like a miss later.
Is the BAA tied to the contract it covers?
When the vendor contract ends, the BAA says what happens to the PHI: returned, destroyed, or kept protected. If nobody connects the two, that step gets skipped.
Do the vendor's subcontractors touch PHI?
The BAA has to require the vendor to get the same promises from its own subcontractors.
When was the BAA last looked at?
Many BAAs were signed years ago on the vendor's paper. A review date keeps them from going stale.
How Sapphires helps
- Every vendor shows whether a BAA is on file, inside the contract, or missing.
- Mark a vendor as not needing a BAA, with the reason, so it stops being flagged.
- Each BAA sits with its vendor and their contracts, so the contract's end date is in front of you.
- Notice and renewal dates land on one calendar, with a daily email before they pass.
45 CFR 164.504(e): what a business associate contract must say
45 CFR 164.314(a): Security Rule terms for business associate contracts
45 CFR 160.103: who is a business associate
HHS: sample business associate agreement provisions