HIPAA BAA inventory maintenance

Overview

Without current BAAs you cannot legally attribute responsibility for PHI processing.

Inventory fields

Vendor legal name, service scope, effective date, renewal trigger, data categories, subprocessors link.

Cadence

Quarterly export vs AP/vendor payments—new SaaS shadow IT kills compliance.

Storage

Encrypted repository; restricted ACL; version history immutable log if possible.

Triggers

New telehealth vendor onboarding must block go-live until countersigned BAA archived.

Audit evidence

Spreadsheet export + sample signed PDFs zipped for OCR or counsel—not email scattering.