A list of vendors on a shared drive is not a Business Associate register — it is a backlog waiting to be found. Business Associates is the register §164.502(e) expects: every relationship, every PHI touch, every subcontractor, every signed date.
What it does
- Catalogs every BA with the data categories they touch and the systems they touch them in.
- Models the downstream chain: BAs’ subcontractors with flow-down obligations.
- Flags BAs missing a current signed agreement with a visible owner for closing the gap.
- Links each relationship to its vendor risk tier and to the signed BAA.
How it maps to HIPAA
The register implements the operational side of §164.502(e) (uses and disclosures to BAs), §164.504(e) (BAA contents and subcontractor flow-down), and §164.308(b)(1) (written contract requirements for the Security Rule).
Where it fits
Business Associates is a Privacy module capability; the contract artefact is held in BAA Management, and risk tiering is in Vendor Risk.