General information, not legal advice — confirm with your compliance officer or attorney. Each verdict page linked below carries its own "last verified" date.
There is no such thing as HIPAA compliant software you can buy off the shelf. HIPAA governs how your practice and its vendors handle protected health information (PHI), so the useful question is narrower: does the vendor sign a business associate agreement (BAA) for the plan you're on, and does patient data actually flow through the tool? This hub applies that test to the software around a practice: marketing, productivity, payments and infrastructure. Each tool gets a dated verdict page built from the vendor's own documentation.
Practice managers search for this constantly. "hipaa compliant software" is searched about 3,600 times a month, "is google workspace hipaa compliant" 590, "is hubspot hipaa compliant" 170, "is calendly hipaa compliant" 170, "is zapier hipaa compliant" 170 and "is grammarly hipaa compliant" 140 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
What makes software 'HIPAA compliant': the BAA plus your setup
HIPAA has no product certification. As Microsoft's HIPAA page puts it, there's "currently no certification standard that the Department of Health and Human Services approves" for business associates (Microsoft (opens in a new tab)). A "HIPAA compliant" badge on a vendor's website is marketing, not a status.
What the law does define is the business associate: a vendor that "creates, receives, maintains, or transmits protected health information" for your practice (45 CFR 160.103 (opens in a new tab)). "Maintains" matters. A cloud tool that only stores your data qualifies, even if nobody there ever looks at it. Before such a vendor handles PHI, you need written assurances from it (45 CFR 164.502(e) (opens in a new tab)), and that contract must set permitted uses, safeguards and breach reporting (45 CFR 164.504(e) (opens in a new tab)).
The BAA is half the answer. The other half is yours:
- Plan. Many vendors sign only for their top tier. HubSpot, Notion, Airtable and Grammarly all limit their BAA to Enterprise-level plans.
- Configuration. Vendors list the settings their BAA assumes. Google's implementation guide (opens in a new tab) says customers are responsible "for ensuring that they use Google services in compliance with HIPAA."
- Use. Microsoft says plainly that "using Microsoft services doesn't on its own achieve HIPAA compliance."
So the test for any tool is two questions, in order: does patient data flow through it, and if so, is there a BAA for your plan and have you set it up the way the vendor requires?
Map where patient data flows in your marketing stack
You can't check tools you don't know about. Spend an hour on this exercise with whoever built your website and runs your marketing.
- List every tool that receives patient-related data: form builder, CRM, scheduler, automation (Zapier and similar), email and texting, chat widget, analytics, session recording, payment links, and any spreadsheet that holds patient lists.
- Trace four kinds of data through them: form submissions, chat transcripts, appointment requests and patient lists (exports, uploads, review-request lists).
- Draw each hop. Where does the data start, where is it copied, who gets notified, where does it end up?
- Mark each tool "PHI" or "no PHI," and for each PHI tool note whether a BAA is on file for your plan.
Illustrative example: Brightwater Dermatology's contact form asks "What would you like to be seen for?" The form tool emails the answer to the front desk's personal Gmail, a zap copies it into a Google Sheet, and a session-recording script runs on the thank-you page. That's four places PHI lands, and only the form tool had a BAA.
Most practices find at least one surprise: an automation a freelancer built years ago, or a free account someone opened "just for the website."
Tools that touch PHI vs tools that shouldn't
Sort your list into two groups. The first group needs a BAA because patient data flows through it. The second group should be kept free of patient data, so it doesn't need one.
| Tools that touch PHI (BAA required) | Tools that shouldn't (keep PHI out) |
|---|---|
| Website forms and form builders | Design tools for ads and posts |
| CRM and patient inbox | Social media scheduling |
| Online scheduling and booking | Ad platforms (Google, Meta) |
| Email, texting and chat with patients | Session recording and heatmaps |
| Payment processing tied to visits | Writing assistants and grammar tools |
| Cloud storage, hosting and backups | Project boards and team wikis |
The right-hand column isn't "safe tools." It's tools whose job doesn't need patient data, which you keep that way with rules and settings. Ad platforms, in particular, should never receive patient data. Tracking pixels on pages where patients enter health information can send it to them anyway.
Tool-by-tool checks: CRM, scheduling, design, automation, writing, analytics
Each verdict below is copied from its page, verified against the vendor's own documentation in October 2026. Plans and terms change, so open the page before you decide.
Marketing, CRM and scheduling
| Tool | BAA position (October 2026) | Full check |
|---|---|---|
| HubSpot | BAA through Sensitive Data on Enterprise editions; none documented for Starter or Professional | Is HubSpot HIPAA compliant: plans, Sensitive Data settings and forms |
| GoHighLevel | BAA for agencies that buy HighLevel's $297/month HIPAA add-on, switched on per sub-account | GoHighLevel and HIPAA: the agency BAA chain and questions to ask |
| Calendly / Acuity | Calendly: no BAA found, and its terms bar PHI. Acuity: BAA on Premium | Calendly and Acuity scheduling: booking fields and safer setups |
Design, automation, writing and analytics
| Tool | BAA position (October 2026) | Full check |
|---|---|---|
| Canva | No BAA found; HIPAA isn't on its trust portal | Canva and patient photos: authorizations and a safe design workflow |
| Zapier | Won't sign a BAA; terms bar PHI on every plan | Zapier automations and PHI: common zaps and safer patterns |
| Grammarly | BAA only for Grammarly for Business Enterprise | Grammarly and HIPAA: extensions, AI rewrite and staff rules |
| Hotjar / Microsoft Clarity | Hotjar: no BAA found. Clarity: not in Microsoft's HIPAA scope | Hotjar and Microsoft Clarity: masking and page exclusion |
Productivity and workspace
| Tool | BAA position (October 2026) | Full check |
|---|---|---|
| Google Workspace | BAA accepted in the Admin console; covered services only | Google Workspace BAA: acceptance steps and settings |
| Notion | BAA on the Enterprise plan only | Is Notion HIPAA compliant: plans and accidental PHI in wikis |
| Airtable | HIPAA on Enterprise Scale with a signed addendum | Is Airtable HIPAA compliant: patient trackers in spreadsheet-databases |
| monday.com | BAA on the Enterprise plan with the HIPAA compliance feature enabled | Is monday.com HIPAA compliant: boards, plans and safe use |
| Asana | BAA once the HIPAA feature is enabled; never on the free plan; confirm your tier with Asana | Is Asana HIPAA compliant: tasks, plans and safe use |
| Loom | Can't sign a BAA, per Loom's help center | Is Loom HIPAA compliant: screen recordings that show patient data |
| SurveyMonkey | BAA and HIPAA-enabled accounts on Enterprise only | Is SurveyMonkey HIPAA compliant: patient surveys and plans |
Payments, support and infrastructure
| Tool | BAA position (October 2026) | Full check |
|---|---|---|
| Stripe | No BAA found; its services agreement bars PHI in some data flows | Is Stripe HIPAA compliant: payment data and what a processor sees |
| Square | BAA built into its terms, only for services Square marks HIPAA-enabled, such as Appointments and Invoices | Is Square HIPAA compliant: front-desk payments and receipts |
| PayPal and Venmo | No BAA found; PayPal Invoicing terms bar uses that make PayPal handle PHI | PayPal and Venmo: patient payments and privacy |
| QuickBooks | No BAA mentioned; Intuit says QuickBooks Online isn't compliant with HIPAA's privacy standards | Is QuickBooks HIPAA compliant: invoices and customer records |
| Zendesk | BAA with a security or compliance add-on, required settings and a signed agreement | Is Zendesk HIPAA compliant: support tickets that contain PHI |
| AWS | BAA accepted in AWS Artifact; PHI only in HIPAA-eligible services | Is AWS HIPAA compliant: eligible services and shared responsibility |
Forms, websites, CRM and communication
Four sibling guides carry their own verdicts. Form builders such as Jotform and Google Forms are in HIPAA-compliant forms. Squarespace, Wix, WordPress and similar platforms are in website builders and HIPAA. CRM selection, including Salesforce and Zoho, is in patient CRM and HIPAA. Gmail, Slack, Zoom and texting are in email, video and messaging tools.
When a tool won't sign a BAA: workarounds that hold up
Some workarounds remove PHI from the tool's path. Those hold up:
- Remove the fields. A scheduler that asks only for a name and time exposes less than one asking for symptoms, though at a medical practice the booking itself can still be PHI.
- Alert without the details. Send staff "New request received" and keep the submission in a covered system.
- Exclude the pages. Don't load analytics or recording scripts on form, booking or thank-you pages.
- Move the PHI step. Keep the uncovered tool for marketing, and handle anything patient-specific in your EHR or a covered CRM.
- Swap for a covered alternative. Acuity Premium instead of Calendly, or automations inside a covered Google Workspace instead of Zapier.
Others don't hold up:
- "We only use first names or initials." Combined with a visit reason or a time, it still identifies someone.
- "They're SOC 2 certified." A security audit isn't a BAA.
- "We're on the paid plan." Many vendors sign only for Enterprise tiers.
- "The patient filled in the form themselves." The data still reached a vendor on your behalf.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Keeping your tool list current
A one-off audit decays within months. Keep a simple register and update it on a schedule:
| Tool | Owner | Plan | PHI? | BAA on file | Last reviewed |
|---|---|---|---|---|---|
| Illustrative: CRM | Practice manager | Enterprise | Yes | Signed Mar 2026, in shared drive | Sep 2026 |
| Illustrative: design tool | Marketing lead | Pro | No | Not needed | Sep 2026 |
Review it at least every six months, and immediately when:
- someone adds a new tool or browser extension;
- you change a plan, because a downgrade can drop BAA coverage;
- a vendor updates its terms or HIPAA page;
- you switch agencies or the person who built your automations leaves.
Every verdict page in this guide is re-verified against the vendor's own pages at least every six months, and its last-verified date is shown at the top.
How Medfy keeps patient data in one protected place
Medfy is AI marketing for independent practices in the US and Canada, built HIPAA-compliant by design. The parts that touch patients sit under one BAA that Medfy signs with your practice before any patient data flows:
- Your website, rebuilt and hosted on your domain, with HIPAA-compliant forms.
- The patient CRM and inbox, where every form and message lands, access-controlled with role-based permissions and an audit log of who saw what.
- The HIPAA AI chat widget, a $49/month add-on that captures new-patient requests into the CRM.
Patient information is stored in separate, encrypted HIPAA databases in the US or Canada. Marketing uses aggregate numbers only, and ad platforms never receive patient data. Medfy doesn't provide online scheduling, email or SMS marketing, so those tools still need their own checks from the tables above. Plans are on Medfy pricing, and the safeguards are described in how Medfy handles patient data.
A free marketing audit is a quick way to start your own check: its ads review flags privacy risks such as tracking pixels on patient forms.
Frequently asked questions
What makes software HIPAA compliant?
No software is HIPAA compliant on its own, and there's no government certification for it. Software can be used compliantly when the vendor signs a business associate agreement for your plan, you configure it the way that agreement assumes, and staff use it only for approved tasks. Check all three for every tool that touches patient information, and confirm with your compliance officer or attorney.
Does every tool my practice uses need a BAA?
No. A vendor needs a BAA only if it creates, receives, maintains or transmits protected health information for your practice. A design tool used only with stock images, or a project board with no patient details, doesn't. But a form, scheduler, CRM, automation or analytics script that touches patient data does. Map your data flows first, then confirm the list with your compliance officer or attorney.
Is a vendor's 'HIPAA compliant' badge enough?
No. A badge or a security audit such as SOC 2 says nothing about your plan or your contract. What counts is a signed business associate agreement that covers the exact product and plan you use, plus the settings the vendor requires. Several vendors limit their BAA to top-tier plans. Ask for the agreement itself, and have your compliance officer or attorney read it.
What if a tool we rely on won't sign a BAA?
Keep patient information out of it by design. Remove health questions from its forms, send staff alerts without patient details, exclude its scripts from form and booking pages, or move the patient-facing step into a covered system. If none of that works, replace the tool. Ask your compliance officer or attorney whether data already sent needs a breach risk assessment.
How often should we review our software for HIPAA?
Review the full tool list at least every six months, and again whenever you add a tool, change a plan, switch agencies or lose the staff member who set something up. Vendors change plans and terms often, which is why every verdict page in this guide carries its own last-verified date. Record each review and confirm significant changes with your compliance officer.