Illustrative deliverable / free assessment
Vendor-agreement gap register
A working document that helps your team get more value from its existing tools. Put the evidence, unanswered questions, and next actions in one place.
Fictional example. These vendors and findings illustrate the format. They are not customer results, compliance findings, or a legal determination.
1. Scope and evidence
Example scope: three vendors supporting one healthcare operations workflow. Inputs: a vendor list, agreement index, and sanitized contract excerpts. The register records what was provided and what still needs confirmation. No patient records are needed.
2. Agreement register
“Not located” means absent from the reviewed materials. It does not establish that an agreement is missing or legally required.
| Vendor / use | Evidence reviewed | BAA evidence status | Open question | Owner / next action |
|---|---|---|---|---|
| Example vendor A Scheduling support | Agreement index and executed BAA copy | Documented | Does the agreement cover the current service and data flow? | Privacy owner: confirm scope and record the source reference. |
| Example vendor B Workflow assistant | Order form and vendor list | Not located in reviewed materials | Is a BAA applicable, and does procurement hold a separate agreement? | Procurement + privacy: request the agreement and confirm applicability. |
| Example vendor C Public website analytics | Sanitized service description | Applicability needs review | What data is collected and where is it sent? | System owner + privacy: validate the data flow before concluding. |
3. Prioritized next steps
- Confirm the data flows and accountable owner for each vendor.
- Locate agreement evidence and ask privacy or legal to resolve applicability questions.
- Select one confirmed gap for a pilot with an owner, baseline, and acceptance criteria.
4. A pilot decision your team can make
Example acceptance criteria: every in-scope vendor has an owner, each evidence gap has a documented resolution or assigned follow-up, and the buyer reviews the final decision brief. If a supported technical control is included, agree its test and evidence requirements in the pilot scope.
The free assessment is $0. A paid pilot has a scoped fixed fee. Annual coverage has custom pricing. Scope and fees are agreed before paid work begins.
Reference: HHS guidance on business associates. Your privacy and legal teams determine which obligations apply.