How to Get a Business Associate Agreement Signed With a Vendor
Solomon Amos · 30 Oct 2026 · 9 min read
legal
There is no HIPAA certification. HHS declined to create certification criteria in the Security Rule preamble (68 FR 8334, 20 February 2003). The artefact that matters is a business associate agreement, so CertReports records whether a vendor offers a BAA, where it says so, and when that was captured.
No vendor carries expired or lapsed HIPAA evidence yet.
It is a vendor claim. The verifiable facts are a BAA (public, on request or not offered), a HIPAA-mapped SOC 2 or HITRUST assessment, and the products the BAA covers.
Many vendors sign a BAA only for specific plans or products. Confirm the covered products with the vendor before sending protected health information.
Solomon Amos · 30 Oct 2026 · 9 min read
Solomon Amos · 25 Oct 2026 · 9 min read