Last verified: October 22, 2026, against Intuit's QuickBooks Online HIPAA help article and the QuickBooks Online terms of service. General information, not legal advice.
Is QuickBooks HIPAA compliant? Not for patient information, by Intuit's own account: its help article says QuickBooks Online meets online security standards "but is not compliant with the HIPAA standards for privacy," and it tells health care professionals not to enter identifiable health information. Intuit offers no business associate agreement (BAA) that we could find. You can still keep your practice's books in QuickBooks; you just keep patients out of them. US searchers ask this about 90 times a month, and the phrase costs advertisers around $13.03 a click (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
Short answer from QuickBooks's own documentation
Short answer (verified October 2026): Intuit's help article "Is QuickBooks Online HIPAA compliant?" (opens in a new tab) (updated August 3, 2026) says QuickBooks Online "meets industry standards for online security, but is not compliant with the HIPAA standards for privacy," and: "If you are a health care professional, it is not recommended that you enter 'individually identifiable health information' into the QuickBooks Online program." It mentions no BAA.
We also read the full QuickBooks Online terms of service (opens in a new tab). HIPAA appears once, in the employee-benefits section, where it makes you responsible for your benefit plans' "compliance with respect to the Internal Revenue Code, ERISA, and HIPAA." Nothing in the terms offers a BAA or sets rules for patient data.
What HIPAA requires before patient information goes in
If a vendor stores protected health information (PHI) for your practice, HIPAA requires documented "satisfactory assurance" that it will safeguard the data (45 CFR 164.502(e) (opens in a new tab)), written into a contract that meets 45 CFR 164.504(e) (opens in a new tab). That contract is a BAA; our guide to business associate agreements explains the clauses. Even with one, setup and daily habits decide whether you're compliant.
The payment-processing exception (section 1179)
People often point to section 1179 of the Social Security Act, added by HIPAA in 1996 and often called HIPAA section 1179, to argue that financial tools are exempt. Read the text at 42 U.S.C. 1320d-8 (opens in a new tab). It says HIPAA's administrative simplification rules "shall not apply" to an entity "to the extent" it is "engaged in activities of a financial institution," or in "authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments, for a financial institution." It covers using information to process a payment for health care, plus related work such as audits, customer disputes and complying with subpoenas.
What it doesn't do for a QuickBooks user:
- It isn't about accounting software. Keeping your books, or invoicing patients from your own system, is your practice's billing, not work done for or as a financial institution. Intuit doesn't claim the exception for QuickBooks.
- It doesn't exempt your practice. The exception covers the entity doing the payment work. Your practice is still a covered entity, and your disclosures stay subject to HIPAA, including the minimum necessary standard in 45 CFR 164.502(b) (opens in a new tab).
- It doesn't cover other services from the same company. The test is the activity, not the brand.
Bookkeeping is one place patient data can leak; your website is another. The free marketing audit checks it for privacy risks such as ad pixels on patient forms.
Which QuickBooks plans a BAA can cover
None that we found. Intuit's HIPAA statement applies to QuickBooks Online as a product, not to a tier, so moving to a higher plan doesn't change the answer. This page doesn't give a separate verdict for QuickBooks Desktop, but we found no Intuit page offering a BAA for it either. If your practice relies on Desktop, ask Intuit and keep the reply on file.
Invoices and memos: what counts as PHI
HIPAA's definition of individually identifiable health information includes information about "the past, present, or future payment for the provision of health care to an individual" that identifies the person (45 CFR 160.103 (opens in a new tab)). In a medical practice, an invoice to a named patient is payment information about their care. That makes it PHI.
Where it creeps into QuickBooks:
- Customer records set up per patient, with name, address, phone or date of birth
- Product and service items named after treatments, such as "Botox, 40 units" or "IUD insertion"
- Invoice memos and descriptions carrying CPT or diagnosis codes, or notes like "balance after Delta Dental EOB, crown #14"
- Invoice emails sent to patients from QuickBooks
- Attachments such as superbills or EOBs saved to transactions
Illustrative example: A dermatology practice books each patient payment as an invoice to "Jordan Ruiz" for "Mohs surgery, left cheek." The same revenue posted as "Patient receipts, week of Oct 13, $14,820" from the practice management report gives the accountant what they need and names no one.
Safe uses and unsafe uses for a practice
| Use | Verdict |
|---|---|
| Vendor bills, rent, supplies, payroll, loan payments | Safe: no patient data |
| Patient revenue posted as daily or weekly totals by payer type | Safe if no names or services appear |
| Insurance deposits recorded by payer and date | Safe if remittance details stay in the PM system |
| Per-patient customer records and invoices naming treatments | Unsafe: PHI with no BAA |
| Diagnosis or procedure codes in memos | Unsafe |
| Uploading EOBs or superbills as attachments | Unsafe |
| Bank feeds showing a patient's name on a transfer | Keep to the minimum: don't add detail, and categorize to totals |
Safer setup or alternatives
A setup that keeps QuickBooks useful:
- Run patient billing, statements and balances in your practice management or EHR billing system.
- Export daily or weekly totals and post them to QuickBooks by payer type.
- Rename any treatment-named items to neutral revenue categories.
- Delete or archive per-patient customer records you no longer need, following your record-retention policy.
- Give your bookkeeper or CPA access to QuickBooks only; if they need patient-level detail, that's a separate BAA conversation with them.
If you take card payments, our Stripe and Square verdicts explain how payment processors treat the same section 1179 question. The HIPAA and marketing software hub lists every tool we've checked.
Medfy doesn't sell QuickBooks or do bookkeeping. It follows the same totals-not-names principle in marketing: reports use aggregate numbers only. Patient details from Medfy's website forms and chat stay in separate, encrypted HIPAA databases in the US or Canada, under the BAA Medfy signs with each practice. See how Medfy handles patient data.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Will QuickBooks sign a BAA?
We found no sign that it will. Intuit's help article says QuickBooks Online "is not compliant with the HIPAA standards for privacy" and advises health care professionals not to enter individually identifiable health information. Neither that article nor the QuickBooks Online terms of service offers a business associate agreement. If you need one, ask Intuit directly and get the answer in writing. Verified October 2026.
Is the free version of QuickBooks HIPAA compliant?
Intuit's HIPAA statement applies to QuickBooks Online as a product, not to a particular plan, so no tier, whether a trial or a paid plan, changes the answer. Intuit advises health care professionals not to enter individually identifiable health information into it. Use any version of QuickBooks for your practice's books at a summary level and keep patient-level billing in your practice management system.
Can a practice use QuickBooks without patient information?
Yes, and many do. Record vendor bills, payroll, rent, supplies and bank deposits, and post patient revenue as daily or weekly totals exported from your practice management system rather than as invoices to named patients. The details that turn bookkeeping into PHI are patient names alongside services, diagnosis codes or treatment notes in memos, and per-patient customer records.
What is a HIPAA-compliant alternative to QuickBooks?
For patient billing, the alternative is usually your practice management or EHR billing module, which handles statements, claims and patient balances under a BAA you likely already have. Keep QuickBooks, or any accounting system, for the business side at a summary level. If you need patient-level invoicing outside your EHR, choose a billing tool whose vendor signs a BAA for your plan.