Vendors and business associate agreements

Every vendor that stores or handles client information for you needs a signed business associate agreement (BAA) before client information goes in. When a useful vendor won't sign, you have three options: stop using it, keep client information out of it entirely, or limit what goes in to the bare minimum and document that you accepted the risk.

Vendor positions change. Confirm each one when you sign up and at your annual review, and keep a dated copy of whatever you relied on.

The typical solo-practice stack

Tool type	Examples	BAA?	How it usually works
Electronic health record (EHR) / practice management	SimplePractice, TherapyNotes, Headway-style platforms, Sessions Health	Yes: a core requirement	Often a click-through BAA, effective when you create the account. File a copy anyway.
Email, calendar, file storage	Google Workspace (paid), Microsoft 365 (business plans)	Yes, on paid business plans	Accepted in the admin console and covers specific services only (see Google Workspace HIPAA setup). Free consumer accounts can't be covered.
Telehealth video	The EHR's built-in video; Zoom for Healthcare; Doxy.me	Usually yes	Prefer the EHR's video: one less vendor. Standard Zoom plans don't include a BAA.
Scheduling for consultations	Calendly	Calendly has not offered BAAs	Use it for prospective-client consults only, collect only name, email, phone, and time, and document the risk acceptance. Or use the EHR's booking widget.
Payments	Stripe via the EHR	Payment processing is generally exempt from BAA requirements	Keep clinical detail out of payment descriptions.
Bank / bookkeeping	Business checking; QuickBooks; spreadsheets	Generally no BAA available, and none needed if no protected health information (PHI) goes in	Use aggregate deposits or anonymized IDs, never client names in memos or categories.
Phone / texting	Personal cell; Google Voice (managed Workspace user); dedicated business line apps	Varies	Say what you use the phone for in your Disclosure Statement. Limit client contacts on the phone to first name, last initial, and number.
Personal cloud / operating system	iCloud, Apple Intelligence, OneDrive personal	No BAA available	No clinical files. Document the posture.
Fax	eFax services	Some offer BAAs on HIPAA plans	Only if you actually need fax.
AI tools	ChatGPT, Claude, Gemini consumer; AI scribes	General chatbots: no BAA on standard tiers. Clinical scribes: usually yes.	See the AI policy.
Website contact forms	Squarespace/Wix forms, Formspree	Usually not	Keep the form short and add "Please don't include clinical details here," or link to the EHR's request form instead.

When a vendor won't sign

Record a risk acceptance in the vendor table of your HIPAA policies and procedures and in your HIPAA process log:

Vendor:          [name]
Decision date:   [date]
Used for:        [purpose]
Data allowed:    [the minimum, e.g. name, email, phone, appointment time]
Never entered:   [clinical content, date of birth, insurance, diagnosis, notes]
Why keep it:     [the functional value vs. alternatives]
Review:          at annual risk analysis

Filing BAAs

Save each BAA as a PDF named with the date and vendor (2026-05-01 BAA - [Vendor].pdf).
For click-through agreements, also screenshot the acceptance.
Log each in the process log's BAA register.