Privacy operations · vendors · reviewed 28 August 2026
Business associate and vendor inventory
A system-by-system inventory of vendors that create, receive, maintain, or transmit protected information.
Use the resource →Use before onboarding a vendor and review whenever features, subprocessors, ownership, or data flows change.
This does not determine whether HIPAA applies or whether a particular agreement is sufficient.
Recheck the source links before relying on an older saved copy. Entries stay in this open page. Copy or print the working copy before leaving.
Working resource
Make the invisible facts visible.
Review point 01
Name the service and owner
Record the legal vendor, product, account owner, and operational purpose.
Review point 02
Map the information flow
Describe what information enters, where it is stored, what leaves, and which integrations participate.
Review point 03
Classify the relationship
Document the basis for treating the vendor as a business associate, subcontractor, or another category.
Review point 04
Locate the agreement
Record execution date, renewal, termination, incident-reporting terms, and where the signed copy lives.
Review point 05
Check access and deletion
Record roles, authentication, export, backup, retention, and deletion controls.
Review point 06
Set a review trigger
Choose an owner and date, plus events that require review before the ordinary date.
Private working copy
Carry the review into your own next action.
Your entries remain only in this open page. They are not saved, uploaded, transmitted, or placed in the URL. Use a non-identifying reference—not a client name.
Your working copy
Controlling material
Read the authority, not merely the worksheet.
Educational information only; not legal, clinical, tax, billing, or regulatory advice. A resource cannot resolve facts it was not given or authority that changed after the review date.
