# Vendors and business associate agreements

> **Every vendor that stores or handles client information for you needs a signed business associate agreement (BAA) before client information goes in.** When a useful vendor won't sign, you have three options: stop using it, keep client information out of it entirely, or limit what goes in to the bare minimum and document that you accepted the risk.

Vendor positions change. Confirm each one when you sign up and at your annual review, and keep a dated copy of whatever you relied on.

---

## The typical solo-practice stack

| Tool type | Examples | BAA? | How it usually works |
|---|---|---|---|
| **Electronic health record (EHR) / practice management** | SimplePractice, TherapyNotes, Headway-style platforms, Sessions Health | Yes: a core requirement | Often a click-through BAA, effective when you create the account. File a copy anyway. |
| **Email, calendar, file storage** | Google Workspace (paid), Microsoft 365 (business plans) | Yes, on paid business plans | Accepted in the admin console and covers specific services only (see [Google Workspace HIPAA setup](https://toolkit.marcusberley.com/google-workspace-hipaa-setup/)). Free consumer accounts can't be covered. |
| **Telehealth video** | The EHR's built-in video; Zoom for Healthcare; Doxy.me | Usually yes | Prefer the EHR's video: one less vendor. Standard Zoom plans don't include a BAA. |
| **Scheduling for consultations** | Calendly | Calendly has not offered BAAs | Use it for prospective-client consults only, collect only name, email, phone, and time, and document the risk acceptance. Or use the EHR's booking widget. |
| **Payments** | Stripe via the EHR | Payment processing is generally exempt from BAA requirements | Keep clinical detail out of payment descriptions. |
| **Bank / bookkeeping** | Business checking; QuickBooks; spreadsheets | Generally no BAA available, and none needed if no protected health information (PHI) goes in | Use aggregate deposits or anonymized IDs, never client names in memos or categories. |
| **Phone / texting** | Personal cell; Google Voice (managed Workspace user); dedicated business line apps | Varies | Say what you use the phone for in your Disclosure Statement. Limit client contacts on the phone to first name, last initial, and number. |
| **Personal cloud / operating system** | iCloud, Apple Intelligence, OneDrive personal | No BAA available | No clinical files. Document the posture. |
| **Fax** | eFax services | Some offer BAAs on HIPAA plans | Only if you actually need fax. |
| **AI tools** | ChatGPT, Claude, Gemini consumer; AI scribes | General chatbots: no BAA on standard tiers. Clinical scribes: usually yes. | See the [AI policy](https://toolkit.marcusberley.com/ai-policy/). |
| **Website contact forms** | Squarespace/Wix forms, Formspree | Usually not | Keep the form short and add "Please don't include clinical details here," or link to the EHR's request form instead. |

---

## When a vendor won't sign

Record a risk acceptance in the vendor table of your [HIPAA policies and procedures](https://toolkit.marcusberley.com/hipaa-policies-and-procedures/) and in your [HIPAA process log](https://toolkit.marcusberley.com/hipaa-process-log/):

```
Vendor:          [name]
Decision date:   [date]
Used for:        [purpose]
Data allowed:    [the minimum, e.g. name, email, phone, appointment time]
Never entered:   [clinical content, date of birth, insurance, diagnosis, notes]
Why keep it:     [the functional value vs. alternatives]
Review:          at annual risk analysis
```

## Filing BAAs

- Save each BAA as a PDF named with the date and vendor (`2026-05-01 BAA - [Vendor].pdf`).
- For click-through agreements, also screenshot the acceptance.
- Log each in the process log's BAA register.