Template
Updated June 20, 20265 min readVendor BAA tracking template
Download a BAA tracker and learn what clinics should record for vendors that create, receive, maintain, or transmit PHI.
What belongs in a BAA tracker
A useful tracker records the vendor, service, PHI involvement, BAA status, effective date, renewal or expiration date, risk level, owner, and evidence location. The evidence location is what keeps the tracker from becoming another disconnected spreadsheet.
Review vendors by risk
Not every vendor needs the same review depth. Start with vendors that touch PHI, provide critical patient operations, support identity or email, or host backups and documentation.
Avoid vague statuses
Statuses like 'probably signed' or 'with legal' do not help during review. Use clear states such as missing, requested, signed, expired, not applicable, or under review.
BAA tracker fields
Vendor and service description.
PHI handling decision.
BAA status and dates.
Risk level.
Internal owner.
Evidence location.
Next review date.