When it starts
The first BAA makes you a business associate. Now every client and every subcontractor needs one.
Every client and every subcontractor that touches PHI now needs a BAA, and you must be able to produce each one.
If nothing changes
Where this goes.
Your first clinic, practice or billing client asks for a BAA before you touch their systems. You get one drafted; it goes out as an attachment.
The office manager forwards it, someone signs a version, and the next client gets the same document the same way. Your own subcontractors need one from you too.
OCR made vendor accountability its 2026 enforcement priority. The HIPAA Security Rule update is still proposed, not final; if it lands, more BAAs will need updating. Either way the question is the same: which agreement, which date, which text.
A client’s compliance officer, or an OCR investigator, asks for the BAA, its date and its exact text.
Or nobody waits: the migration starts anyway, with no BAA at all.
What Yesmark changes.
- Every client is askedEach one gets a link, reads the full text and presses Accept. No account.
- One list shows who has acceptedThe version each client is on, and the date. Anyone still pending is one click from a reminder.
- When the terms change, everyone is asked againPublish the new version once. Nobody is moved to it without seeing it.
This week
Three things to do this week.
Keep the negotiated BAA for the hospital system that imposed its own. That one is a contract you sign.
Put your standard BAA on Yesmark: the text you would send any practice, and the one you send your subcontractors. No PHI enters Yesmark, only the agreement and who accepted it.
Send the next client a link, not an attachment. The record is written before access is granted, and your list shows who has a BAA.
Put your latest terms on Yesmark today.
Free for 3 sets of terms and 5 clients. No card, no time limit.
For firms like yours