BAAs
How to find the vendors missing a BAA
You can't tell who's missing a BAA by looking at your BAA folder. It only shows the ones you have. Start from the other direction: everyone you pay.
Go through your vendor list once and ask one question about each: do they see, store or handle patient information?
Step by step
1. Pull every payee from the last 12 months of accounts payable, plus anything on company cards.
2. Set aside the ones that clearly never see patient information, like utilities and office supplies.
3. For the rest, ask whether they create, receive, store or send PHI for you. When unsure, ask the department that uses them.
4. For each yes, find the BAA, or the BAA section inside the service agreement, and confirm both sides signed.
5. For each no, write down why, so the next reviewer doesn't start over.
6. Send a BAA to each vendor still missing one, and track the replies.
A worked example
Say accounts payable shows 70 payees. Forty clearly never touch PHI. Of the other 30, 22 have a BAA on file, 3 are physician practices you share records with for treatment, and 5 have nothing.
Those 5 are your list. In a review like this, they're often the quiet ones: an answering service, a records storage company, a consultant who reviewed charts once and still has access.
The vendors people forget, and who doesn't need one
Shredding and records storage. After-hours answering services. Fax services and email. Offsite backup and cloud storage. Remote IT support. Interpreters. Couriers that carry records. Consultants who review charts, and the lawyers and accountants who see PHI in their work. Copier leases deserve a look too, since many machines keep copies of what they scan.
Your own workforce isn't a business associate, and neither is another health care provider when you share PHI to treat a patient (45 CFR 160.103). Mark those exempt with the reason rather than leaving them blank. A blank looks like a miss. A written reason shows you looked.
What to watch
Have you checked your full payables list?
It catches the vendors nobody thinks of as healthcare vendors.
Have you checked IT and software?
Backups, email, fax and remote support can all touch PHI.
Is the BAA inside another contract?
Terms may sit in a section of the service agreement rather than a separate document. Note where they are.
Is it signed by both sides?
A draft in someone's inbox isn't one on file.
What if the vendor won't sign?
Record the refusal. HIPAA expects a BAA before a vendor handles PHI for you, so a refusal is a decision about whether you can keep using them.
Who adds a new vendor to the list?
Without a step at onboarding, the same gap comes back.
How Sapphires helps
- Mark which vendors handle PHI, and each shows a BAA on file, BAA terms inside the contract, or missing.
- A vendor that handles PHI stays flagged until a BAA is in place.
- Mark a vendor exempt with a written reason, such as a treating provider, so the missing list stays meaningful.
- Track a vendor that won't sign with the Refuse to Sign status.
- Start by importing your vendor list from a CSV spreadsheet, up to 500 rows, with a dry run first.
45 CFR 164.502(e): disclosures to business associates
45 CFR 160.103: who is a business associate