> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Free Tool: HIPAA/BAA Readiness Checklist

> A free, no-sign-up self-assessment on orbit.devotel.io that walks the five tenant-owned HIPAA posture steps — PHI-scope attestation, BAA execution, the HIPAA mode toggle, role-based PHI access, and minimum-necessary audit — and links each open item to its deep guide.

# Free Tool: HIPAA/BAA Readiness Checklist

The [HIPAA/BAA readiness checklist](https://orbit.devotel.io/en/tools/hipaa-checklist)
is a free, browser-side self-assessment on the [developer tools hub](https://orbit.devotel.io/en/tools).
Mark each of the five tenant-owned steps you already have covered, and the
panel scores your readiness in plain language and links each open item to
the docs page that configures it — no account required.

Everything on the page is advisory: HIPAA posture is tenant-owned — you
attest whether Protected Health Information (PHI) is in scope and configure
the controls, and the checklist only reports the coverage you self-attest.

## What the checklist walks

The checklist covers the five steps that make up a HIPAA-ready posture on
Orbit:

1. **PHI-scope attestation** — declare whether PHI enters your traffic.
   The attestation starts (or relaxes) the BAA lifecycle — `not_required`
   is the default until you attest otherwise, and flipping PHI into scope
   moves the lifecycle to pending so the execute step opens without a
   separate call ([the BAA flow](/compliance/baa)).
2. **BAA execution** — a workspace owner signs the Business Associate
   Agreement: template preview, typed-name e-signature, a stored executed
   PDF, and a one-year term with re-execution opening 60 days before
   expiry. Only `executed` satisfies the HIPAA-enable and PHI-send gates
   ([the BAA flow](/compliance/baa)).
3. **HIPAA mode toggle** — the workspace owner turns HIPAA mode on per
   organization: opt-in, off by default, BAA-gated, with disable requiring
   re-authentication. The toggle activates (or relaxes) the enhanced
   control set ([HIPAA compliance controls](/compliance/hipaa), and the
   end-to-end sequence in the [HIPAA posture guide](/compliance/hipaa-posture-guide)).
4. **Role-based PHI access** — message-content and PHI audit-log reads are
   restricted to designated roles: owners and admins read content,
   developers and viewers do not touch the PHI access log, billing roles
   read neither. Map each surface to the people in your workspace before
   go-live ([HIPAA compliance controls](/compliance/hipaa), sequenced in
   the [HIPAA onboarding guide](/guides/hipaa-onboarding)).
5. **Minimum-necessary audit** — every PHI read is logged with a reason
   code so you can prove minimum-necessary access, and the rolling audit
   row lines up with the PHI-channel matrix that keeps PHI out of channels
   it should never use ([HIPAA compliance controls](/compliance/hipaa),
   with the downloadable evidence in [audit log export](/compliance/audit-export)).

Each item links to the same docs pages from the tool itself, so a visitor
can open the controls without signing up.

<Note>
  The steps are a summary layer over the deep guides — [HIPAA compliance
  controls](/compliance/hipaa) and the [BAA flow](/compliance/baa) are the
  authoritative references, and the tool links them from each item.
</Note>

## Tenant-owned framing

<Warning>
  Every step on the checklist is **tenant-owned**: the checklist questions
  a posture you configure on your own workspace. Orbit does not mandate
  HIPAA mode — the toggle is off unless a workspace owner turns it on, and
  the legal determination that PHI is in scope is yours to make with
  counsel. What Orbit supplies is the e-sign pipeline and the enforcement
  point: the send-time gate rejects PHI traffic with `HIPAA_BAA_REQUIRED`
  until a BAA is executed. Nothing on the tool page enforces or verifies
  the coverage you mark — the self-assessment is exactly that. This tool is
  not legal advice.
</Warning>

## When to use it

Run the checklist as the **pre-go-live self-attestation** before you touch
the BAA gate on a live workspace: it names the five items your compliance
owner must already have covered — PHI scope attested, BAA executed, HIPAA
mode toggled, PHI access restricted to the right roles, and the
minimum-necessary audit row readable — so the first production send does
not stall at the send-time gate with `422 HIPAA_BAA_REQUIRED`. Re-run it
after the BAA renewal reminder, a role change, or a new channel launch; a
fresh self-check takes under a minute.

## Relation to the four-gate BAA state machine

The checklist mirrors the BAA state machine documented on the [BAA
page](/compliance/baa): `not_required` (the default), `pending` (PHI in
scope, not yet signed), `executed` (signed and inside the one-year term —
the only state that satisfies the gates), and `expired` (term elapsed,
gates close again until re-execution; the window opens 60 days early). The
step order on the tool follows the same lifecycle: attestation opens it,
execution satisfies it, and the remaining steps configure the controls the
organization runs while the agreement is live. See [the BAA
flow](/compliance/baa) for the full state table and gate verdicts.

## See also

* [Business Associate Agreement (BAA) flow](/compliance/baa) — attestation
  states, e-sign, one-year term, re-execution window
* [HIPAA compliance controls](/compliance/hipaa) — the opt-in toggle, the
  roles-versus-surface matrix, the PHI audit row
* [HIPAA posture guide](/compliance/hipaa-posture-guide) — assemble the
  whole posture end to end for an auditor or buyer
* [HIPAA onboarding](/guides/hipaa-onboarding) — the ordered sequence from
  BAA to audit-ready
* [Audit log export](/compliance/audit-export) — queued, tamper-evident
  export of the audit trail for evidence requests