BAA Registry

Source of truth: apps/api/src/config/baa-registry.yml

Every third-party service capable of receiving PHI is registered per-environment with BAA status, effective date, and region. Services call BaaRegistry.assertCovered(vendor, service, env) at module init. Missing coverage in prod → service refuses to start (FR-032).

Dual approval — recorded 2026-04-25. Project-owner approval (#273, #274, #275) and compliance-team approval (confirmed 2026-04-26) are both on file for the 2026-04-25 batch covering all 14 PHI-capable vendors. The CLAUDE.md § Development Phase — Approval Deferral pause for compliance-reviewer sign-off is closed for this batch; the production fail-closed gate (FR-032) now passes for every registered vendor.

Current vendors (summary)

All BAAs / agreements signed as of 2026-04-25.

Vendor	Staging	Prod	Rationale
MongoDB Atlas	✓ signed	✓ signed	Core DB
MongoDB Atlas (Research)	✓ signed	✓ signed	Research-subsystem cluster
Azure	✓ signed	✓ signed	Compute + Key Vault + Monitor
OpenAI	✓ signed	✓ signed	LLM primary (GPT-4o)
Google Cloud (Vertex AI)	✓ signed	✓ signed	LLM fallback (Gemini)
Voyage AI	✓ signed	✓ signed	Embeddings (pathway library matcher)
Epic	✓ signed	✓ signed	FHIR R4 EHR integration (data-recipient attestation)
Google Workspace	✓ signed	✓ signed	IdP (GIS)
Microsoft Entra ID	✓ signed	✓ signed	IdP (MSAL)
NEJM	✓ signed	✓ signed	Publisher AI partner
JAMA · JBJS · Clinical Ortho (LWW shared)	✓ signed	✓ signed	Journal content
JOR · JBMR-B (Wiley shared)	✓ signed	✓ signed	Journal content
Spine · Acta · J. Arthroplasty (Elsevier shared)	✓ signed	✓ signed	Journal content
NCCN	✓ signed	✓ signed	Guidelines
Cochrane	✓ signed	✓ signed	Systematic reviews
ClinicalTrials.gov	✓ signed	✓ signed	Public US Gov — no PHI outbound
ClinVar	✓ signed	✓ signed	Public NIH-NCBI — no PHI outbound
DrugBank	✓ signed	✓ signed	Commercial license (no PHI outbound)

Current tracker: docs/research-infrastructure/pending-requirements.md.

Registry schema

environments:
  production:
    vendors:
      - name: OpenAI
        services:
          - LLM completions (apps/ml LLMClient)
        baa_signed: true
        effective_date: "2026-01-15"
        approval_status: active        # for deferred: pending_compliance | pending_commercial_license
        target_signoff_date: null      # for deferred: target date
        region: US
        evidence_ref: "compliance-system/tickets/BAA-OPENAI-PROD"
        notes: >-
          Zero-retention endpoint. Prompt + completion never used for training.

Dev-phase deferral posture

Per CLAUDE.md § Development Phase — Approval Deferral, during dev phase:

• BAA registry entry is still required — every integration PR registers the vendor
• baa_signed: false is acceptable in dev/QA if approval_status: pending_compliance + target_signoff_date
• Production still fails closed on baa_signed: false — this gate never turns off

When BAAs countersign, the entry flips to baa_signed: true + effective_date: <signing-date> + evidence_ref: <doc-link> via a one-line PR.

Current deferral list: empty as of 2026-04-25. Every registered vendor is signed for both staging and prod. The BaaGovernance startup probe emits pending_compliance_vendors=[] on registry_check.passed. The pattern above stays documented for any future vendor that lands ahead of its countersigned agreement.

Compliance-checklist probes

Several probes verify the registry at every PR:

• p4_6 — BAA registry has OpenAI + Google Cloud for staging + prod (FR-405)
• Additional per-vendor probes in compliance-checklist.yml
• Registry-coverage probe for any service that imports a 3rd-party SDK

When a new vendor lands

Use the hipaa-baa-check skill to verify or update the registry. The skill:

• Confirms every PHI-processing vendor for target env is covered
• Refuses changes that would introduce an uncovered vendor
• Emits a check report

See /hipaa-baa-check.