Vendors, BAAs, and risk questionnaires

When you select Vendors on the left, you land on Vendor Management (dashboard Step 8). Before you can do much here, you build the vendor's profile, so all their information lives in one tidy spot.

Not sure whether a vendor needs a BAA? The Support Center covers the basics, and every situation depends on its facts, so book a call if you'd like to talk one through.

Add a vendor

1. In Add Vendor, fill in Vendor Name and Relationship to PHI (for example Billing, IT Support, Cloud Storage). Both are required.
2. Add a Contact Email if you want the portal to email the vendor for you. Address, contact name, and phone are optional.
3. Already have a signed BAA? Tick BAA signed and enter the Executed on date.
4. Hit Save Vendor last to store the profile.

The Vendor Register lists your vendor profiles. Click the company you want, and its Vendor Profile comes up top.

E-sign a BAA inside the portal (recommended)

Scroll down a tad from the top of the profile and you'll find BAA E-Sign Status.

1. 1

   Check the contact email

   Make sure Contact Email is filled in and click Save Changes.

2. 2

   Start the BAA

   In BAA E-Sign Status, hit Send BAA.

3. 3

   Sign your side

   Check Your Full Name and Your Title. The signature you saved in Initial settings loads automatically. Click Sign & Generate E-Sign Link.

   

4. 4

   Send it

   Review the email preview and hit Send Email. (Prefer to send it yourself? Click Skip, I'll send it myself and use Copy Link.)

   

5. 5

   Confirmation

   You'll see BAA Ready. Click Done. The status becomes Awaiting Signature.

   

6. 6

   Your vendor signs

   They open the link, review, sign, and click Sign Agreement. No account needed. See what your vendor sees.

7. 7

   Download the executed copy

   You'll get an email, "BAA countersigned by (vendor)". Reload the Vendor Profile: it shows Signed with both signatures. Click Download Executed BAA for the PDF.

Already have a BAA you're happy with?

You're welcome to store it right on the Vendor Profile.

1. Vendor Profile > Upload Existing BAA.
2. Browse or drag and drop the file (PDF, DOC, DOCX, PNG, or JPG, up to 10 MB). You'll see "BAA uploaded. Marked as signed."
3. Enter BAA Executed On in the details form and click Save Changes.

Prefer paper?

Vendor Profile > Download & Email BAA > Email BAA to Vendor sends an unsigned copy. When the signed copy comes back, upload it with Upload Existing BAA.

Vendor risk questionnaire

To do your due diligence on a vendor, send them the Vendor Risk Assessment.

1. Vendor Profile > Vendor Risk Assessment > Send Risk Assessment to Vendor. It's emailed to the Contact Email, or use Copy Link to send it yourself.
2. Your vendor answers 20 questions in 5 categories (data security, access controls, incident response, physical security, compliance history).
3. Reload the Vendor Profile to see Risk Assessment Results: an overall risk level, a score, a category breakdown, and recommendations. Export Report downloads them.

Annual BAA review

Finally, at the bottom of the profile, you conduct your Annual BAA Review. BAAs in the portal don't expire; instead, you record a review each year.

1. Vendor Profile > Annual BAA Review.
2. Confirm Reviewer. Optionally write a Review Statement (leave it blank and the portal writes one).
3. Click Record Annual Review.

After 12 months, the profile shows "Annual review needs attention" and your dashboard shows "Vendor annual reviews due soon". The portal never sends reminder emails about BAAs, so keep an eye on your dashboard.