.
VANDERBILT UNIVERSITY MEDICAL CENTER

VU Architectural and HIPAA System requirements

IT System Procurement

Purchasing Process to Procure a Computer System

Departments MUST use this process when procuring with a purchasing requisition:

  1. Use current purchasing requisition (if you do not have a requisition dated 5-04 or later, please ensure you follow the steps below and include the correct attachments).
  2. Make sure the front of the requisition is filled out completely and signed.
  3. Make sure the back of the requisition is filled out completely and signed, which includes the sole source information as well as the new information system question and paragraph. It should be similar to the following:
Is this purchase a computer or software system that will store, display, or transmit electronic patient information, now or in the future? _____yes _____ no. If yes, please read and sign below:
My signature below certifies that I am abiding by the VUMC Health Insurance Portability and Accountability Act (HIPAA) and IT Procurement guidelines (see http://www.mc.vanderbilt.edu/root/vumc.php?site=rfi).
I have attached the vendor contract to this Purchase Requisition that includes, if applicable:
1) the Business Associates Agreement (BAA), and 2) the VUMC Architectural and HIPAA centric RFP/RFI both found at http://www.mc.vanderbilt.edu/root/vumc.php?site=rfi.
Applicability for these is indicated on the website. For any questions related to these attachments or the Vanderbilt IT Procurement process, please contact IT.Procurements.and.Contracting@vanderbilt.edu .
or visit the website above.
Signature ___________________ Print Name____________________ Date __/_____/____

Click here to write to the IT Procurement and Contract team. One of us will reply to you within 2 business days.

Business Associate Agreement

The Business Associate Agreement (BAA) MUST be included with each information system procurement contract if that system will contain electronic protected health information (EPHI) and the data will be visible to an outside entity, either by maintenance, support or information sharing. 

The BAA is not designed to be a stand alone agreement. The agreement either needs to be a reference in the main agreement that ties the BAA to the specific relationship or an amendment needs to be drafted if the main agreement has already been signed. 

 

Click here to access the latest BAA on our HIPAA webpage

Click here to write to the IT Procurement and Contract team.  One of us will reply to you within 2 business days.

Other Information Technology documents

The VUMC Architectural and HIPAA centric RFI/RFP

All contracts that include information systems SHOULD have an RFI/RFP included as an attachment.  This document should be filled out by your vendor indicating Yes or No answers.  This completed document should be an attachment and should be referred to in your contract. 

If you have questions as to how to interpret the answers once you receive this back from your vendor, please write or call (at 322-2841) the IT Procurement and Contract team.  This team includes Contracts Administration, Central Procurement and Informatics.  One of us will reply to you within 2 business days.

This page was last updated February 1, 2008 and is maintained by Grace Upleger