HIPAA Vendor & BAA Register
One register for every vendor you use — pre-filled with BAA facts for 70 tools we track, each with its source and check date.
What you get
A free Excel workbook for tracking every vendor you use that may handle PHI: whether it is a business associate, whether your BAA is signed, what the BAA covers, required settings and review dates. A directory tab is pre-filled from the hipaa.systems database with BAA availability, plans, setup steps and limits for 70 tools, and picking a product fills in its BAA status automatically. Works in Excel and Google Sheets.
| Format | Excel (.xlsx) — opens in Google Sheets |
|---|---|
| Pre-filled tools | 70 |
| Updates | Refreshed from our database every quarter |
| Price | Free — email required |
| Why keep one | HIPAA requires a BAA with each business associate, and business associates need one with subcontractors that handle PHI (45 CFR 164.308(b), 164.502(e)); one register is our recommendation |
Get the register
Preview of the directory
| Product | Category | Signs a BAA | Checked |
|---|---|---|---|
| 8x8 X Series | Phone systems | Conditional | 2026-10-17 |
| Acuity Scheduling | Online scheduling | Conditional | 2026-10-17 |
| Amazon Bedrock | AI tools and LLMs | Yes | 2026-10-06 |
| Amazon Web Services (AWS) | HIPAA hosting and cloud platforms | Yes | 2026-10-06 |
| Aptible | HIPAA hosting and cloud platforms | Yes | 2026-10-06 |
| Atlantic.Net HIPAA Hosting | HIPAA hosting and cloud platforms | Yes | 2026-10-06 |
| Azure OpenAI (Microsoft Foundry) | AI tools and LLMs | Yes | 2026-10-06 |
| BastionGPT | AI tools and LLMs | Yes | 2026-10-06 |
62 more in the download. The same facts are free on the site — see the BAA checker.
The register is one part of the HIPAA compliance kit we're preparing, which links vendors to risk analysis, policies, training and evidence.
What's inside
- Your vendors — a working register: vendor, plan, what it does for you, handles PHI?, business associate?, BAA signed and when, services covered, required settings, owner, next review.
- Directory — every tool we track: BAA availability, plans with a BAA, how to get it, what to configure, what isn't covered, check date, vendor source and our page.
- Start here — how to use it and what the BAA values mean.
Facts change: confirm with the vendor before you rely on one, and tell us if something is out of date. Not legal advice.