Compliance Check
Business Associate Agreement Tracker
Maintain a HIPAA-aware vendor roster for your solo therapy practice. Track every BAA, see signed/pending/missing counts, get expiration warnings, and export the roster as CSV for your compliance files.
BAA Tracker Summary
Track every vendor that touches PHI and the status of your HIPAA Business Associate Agreements.
Total vendors
3
Signed
1
Pending
1
Missing
1
Add a Vendor
Track the vendor, the service they provide, and the BAA status.
Vendor Roster
Data is saved locally in your browser. Use export to share a copy with your compliance team.
| Vendor | Service | Status | Signed | Expires | Notes | Actions |
|---|---|---|---|---|---|---|
| EasyMindCare | EHR + telehealth | 2026-01-15 | 2027-01-15 | BAA on file. SOC 2 Type II available on request. | ||
| Example Billing Service | Medical billing | — | — | Requested BAA 2026-02-10; awaiting counter-signed copy. | ||
| Consumer Cloud Drive | File storage | — | — | No BAA. Migrate to a HIPAA-covered vendor. |
Founder's Club offer
Related Tools
Explore other therapist calculators
Compare this result with a few adjacent planning tools for pricing, overhead, or private-practice transition decisions.
Compliance Check
HIPAA Compliance Checklist for Solo Practices
Walk through the administrative, physical, and technical safeguards a solo therapist needs for HIPAA compliance with an interactive checklist.
Open toolCompliance Check
HIPAA Risk Assessment Quiz
Answer a short HIPAA readiness quiz for your therapy practice and get a risk-level snapshot, your top operational gaps, and a secure EHR next-step recommendation.
Open toolLegal Compliance
Notice of Privacy Practices Builder
Generate a baseline Notice of Privacy Practices document covering required HIPAA disclosures and patient rights.
Open toolHow the BAA tracker is organized
Every vendor that touches PHI in your therapy practice needs a current Business Associate Agreement. This tracker keeps a single roster of every vendor, the service they provide, the BAA status, the signed date, and the expiration date so nothing slips through annual reviews.
The roster is stored locally in your browser. Use the export button to download a CSV of the tracker for your compliance binder or to share with a HIPAA attorney during your annual review.
Use it for situations like
- A first-time HIPAA inventory of every vendor that touches PHI.
- An annual BAA renewal review for an established practice.
- Onboarding a new EHR, billing service, or AI notetaker.
- Documenting BAAs before hiring a contractor or virtual assistant.
FAQ
Questions therapists ask before using this calculator
Which vendors need a BAA from my therapy practice?
Any vendor that creates, receives, maintains, or transmits PHI on your behalf must sign a BAA. Common examples include your EHR, telehealth platform, billing service, cloud storage, transcription, and AI notetakers.
How often should I review my BAA inventory?
Review at least annually and any time you onboard a new vendor. Track BAA expiration dates and plan to renew or re-execute 60 days before they lapse so you do not have a coverage gap.
Can a vendor refuse to sign a BAA?
Some vendors (especially consumer-grade services) will refuse to sign a BAA. If that happens, you cannot use them for PHI. Switch to a HIPAA-covered alternative or remove PHI from the workflow before using the vendor.
What is the difference between a BAA and a DPA?
A Business Associate Agreement is a HIPAA-specific contract required of business associates. A Data Processing Agreement is the GDPR/privacy-law equivalent. Some vendors sign a combined BAA + DPA; ask the vendor which document they have on file.
Is this tracker HIPAA compliant?
The tracker stores vendor metadata (names, service types, dates, notes) in your browser. It does not collect or store client PHI, so it is safe to use for compliance housekeeping without signing a BAA for the tool itself.