HIPAA Compliant Practice Management Software: BAAs

Healthie, IntakeQ, Jane, SimplePractice and Tebra each say they sign a business associate agreement (BAA) for their practice management and EHR software, and Boulevard, Mindbody, Vagaro, Square and Acuity Scheduling offer one on their own terms, per the vendor quotes in Curve's BAA Directory. No software is HIPAA compliant by itself: HHS says "OCR does not endorse, certify, or recommend specific technology or products" (HHS), so what counts is a signed BAA plus how you use the tool. A practice management BAA covers the patient data inside that system, not the ad pixels on your booking pages. Curve Compliance keeps ad attribution when patients book through these tools, strips PHI before data reaches an ad platform and signs its own BAA on every plan.

Book a call. Your practice software BAA covers the chart. Curve Compliance covers the ads around it: it keeps the ad click when a patient leaves your site to book, credits the booking to the ad that drove it, and removes PHI before anything is sent to an ad platform. Curve's team does the setup. Book a call with Curve.

Which practice management software signs a BAA

Each row comes from the vendor's own words, quoted in Curve's BAA Directory, with the date Curve last checked that vendor's page. Each name links to its Directory entry, which carries the full quote. Rows are grouped by BAA status, not ranked.

Platform	Signs a BAA?	Conditions, per the vendor	Checked	Source
Healthie	Yes	Entered into when your Healthie account is created	Oct 1, 2026	Healthie BAA
IntakeQ	Yes	The account admin signs it inside IntakeQ	Sep 29, 2026	IntakeQ Support
Jane	Yes	Jane says it "can work with you to develop a BAA Agreement"	Sep 29, 2026	Jane Guide
SimplePractice	Yes	Agreed when you create your account; carries over to paid plans	Oct 1, 2026	SimplePractice Support
Tebra	Yes	Part of Tebra's Terms of Service for customers that are covered entities	Oct 1, 2026	Tebra BAA
Mindbody	Yes, on request	US businesses subject to HIPAA request it by Support Request; covers SOAP Notes and Progress Notes only	Oct 26, 2026	Mindbody Terms; Mindbody Support
Vagaro	Yes, for US businesses	Signed in Vagaro when you turn on HIPAA Compliant Notifications	Oct 26, 2026	Vagaro Support
Square	Yes, for HIPAA-enabled features	Square Appointments, Invoices and other features Square identifies as HIPAA-enabled	Oct 5, 2026	Square HIPAA BAA
Boulevard	On a specific add-on	HIPAA Coverage add-on; signed in the Boulevard dashboard	Oct 26, 2026	Boulevard Support
Acuity Scheduling	On specific plans	Powerhouse and Premium plans, once the account is made HIPAA-enabled	Sep 29, 2026	Squarespace Help
Zocdoc	No public statement	Ask Zocdoc directly	Sep 29, 2026	Directory entry

"Yes" means the vendor offers a BAA. It does not mean every feature is covered. Mindbody says "The BAA covers these features only," meaning its SOAP Notes and Progress Notes; Square says "Not all Services are HIPAA-enabled"; and Squarespace says of Acuity, "Your Business Associate Addendum (BAA) doesn't cover other Squarespace features" (Mindbody; Square; Acuity). Read the covered features before PHI goes into a tool.

What "HIPAA compliant" means for practice software

Practice management software is usually a cloud service, and HHS's cloud guidance settles what that vendor is under HIPAA: "When a covered entity engages the services of a CSP to create, receive, maintain, or transmit ePHI (such as to process and/or store ePHI), on its behalf, the CSP is a business associate under HIPAA." HHS adds: "This is true even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data" (HHS). So a scheduling, charting or billing platform that holds your patients' records needs a BAA with you before PHI goes in.

The BAA is the start. HHS says the HIPAA Rules "do not endorse or require specific types of technology" and instead require "reasonable and appropriate administrative, technical, and physical safeguards" (HHS). The Security Rule names some of them, such as "Unique user identification" and "Automatic logoff" (45 CFR 164.312). For the agreement itself, see what a BAA is and what a business associate is; for the data it protects, see what ePHI is.

Patient portals and telehealth inside practice software

Many of these platforms also run the patient portal and the video visit. Healthie lists Scheduling, Telehealth & Webinars, Messaging and Patient Portal among its features (Healthie). SimplePractice says its teletherapy "is fully integrated into our EHR" (SimplePractice), and Jane says you can "Host secure video appointments right from your Jane account" (Jane).

HHS treats those logged-in areas as the highest-risk place for tracking. Its guidance says "Regulated entities may have user-authenticated webpages, which require a user to log in before they are able to access the webpage, such as a patient or health plan beneficiary portal or a telehealth platform," and "Tracking technologies on a regulated entity's user-authenticated webpages generally have access to PHI" (HHS). Keep ad pixels off portal and visit pages entirely. For video tools on their own, see HIPAA compliant telehealth platforms.

What the practice software BAA does not cover

A BAA binds you and the vendor. It does not reach a third company that receives data from your website. When a booking page or widget carries an ad pixel, the visitor's browser sends data straight to the ad platform, and Curve's BAA Directory lists Meta and Google Ads as not signing a BAA (see which ad platforms sign a BAA).

HHS describes this case. When a patient books through a clinic website that uses third party tracking, "the website might automatically transmit information regarding the appointment and the individual's IP address to a tracking technology vendor" (HHS). That example sits in the guidance's section on user-authenticated webpages. The same HHS page notes that on June 20, 2024, a federal court in Texas vacated the part of the guidance about connecting an IP address with a visit to an unauthenticated public page addressing health conditions or providers, and that "HHS is evaluating its next steps in light of that order." To check your own flow, see the booking widget leak audit and HIPAA compliant scheduling software.

Keeping ad attribution when patients book through these tools

Most practices run ads to a website, then send the patient to a tool like Jane or IntakeQ to book. The ad click is lost at the hand-off, and a pixel on the booking step can carry appointment details. A setup that fixes both:

• Keep pixels off booking, portal and visit pages. Nothing that sends data to an ad platform should load behind a login.
• Carry the ad click through the hand-off. Store the click ID on your side when the visitor lands, so a booking made days later can still be matched.
• Get the outcome back from the tool. Bookings and visits come back through webhooks, an integration platform, or an offline upload from your CRM or EHR.
• Send a neutral event, server-side. Report "booked" with no appointment type, provider or reason, and only the fields each platform needs; see the minimum necessary rule for ad tracking. Which events fit your setup is a legal question, so talk to your counsel.

How to choose practice management software for HIPAA

• Get the BAA from the vendor itself. A "HIPAA compliant" badge is not a BAA. Look for the agreement on the vendor's own legal or support page, or in your contract.
• Check which features it covers. Mindbody limits its BAA to two features, and Boulevard tells customers to "Keep PHI out of non-encrypted areas of the Boulevard Services, including all emails and text messages to Clients" (Boulevard).
• Check the plan or add-on. Acuity needs the Powerhouse or Premium plan, Boulevard its HIPAA Coverage add-on, and Vagaro a setting you turn on before signing.
• Check access and audit controls. The Security Rule asks for "Audit controls" on systems with ePHI (45 CFR 164.312), so confirm the tool has roles and activity logs.
• Check how outcomes leave the system. If you run ads, ask how bookings and visits can reach your ad platforms without PHI.

How Curve Compliance helps

Curve Compliance handles the ad side of a practice that books through practice management software, under the BAA it signs on every plan. When a visitor leaves your site to book, Curve keeps the ad click through schedulers such as IntakeQ, Jane App, OptiMantra, Boulevard, ZocDoc, Mindbody, Vagaro, Square and Acuity; plain booking links are handled automatically, and Curve's team sets up embedded widgets. Bookings made days later still match. Healthie outcomes reach Curve through Keragon, as do outcomes from Athenahealth, OptiMantra, IntakeQ and Jane, and Curve also takes offline conversion uploads from a CRM or EHR, crediting each to the original ad click. See Curve and Healthie and booked appointment attribution.

Curve sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. It checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Each platform receives only a fixed list of fields, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve's free website scan lists the pixels and trackers on your booking pages. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: HHS, Guidance on HIPAA and Cloud Computing; HHS, Use of Online Tracking Technologies; 45 CFR 164.312; Healthie; SimplePractice, Telehealth; Jane, Telehealth; Google, HIPAA compliance on Google Cloud and Google Workspace; vendor BAA pages as linked in the table, via Curve's BAA Directory.

Frequently Asked Questions

Which practice management software is HIPAA compliant?

No software is HIPAA compliant on its own, but Healthie, IntakeQ, Jane, SimplePractice and Tebra say they sign a BAA, and Boulevard, Mindbody, Vagaro, Square and Acuity Scheduling offer one on their own terms (BAA Directory). Compliance then depends on the plan, the features you use and your own safeguards.

Which apps are HIPAA compliant?

HHS does not certify apps: "OCR does not endorse, certify, or recommend specific technology or products" (HHS). An app can be used in a HIPAA compliant way when its vendor signs a BAA that covers the PHI you put in it and you apply your own safeguards. Curve's BAA Directory quotes each vendor's own terms; for a wider list, see HIPAA compliant software.

What online platforms are HIPAA compliant?

Any cloud platform that holds PHI for you is a business associate and needs a BAA, and HHS says "This is true even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data" (HHS). Check which services the vendor's BAA covers; Google, for one, lists the Workspace services its BAA includes (Google).

Are patient portals HIPAA compliant?

A portal can be, when its vendor signs a BAA and you set it up within the HIPAA Rules. HHS calls portals user-authenticated webpages where tracking generally has access to PHI, and says a regulated entity "must configure any user-authenticated webpages that include tracking technologies to allow such technologies to only use and disclose PHI in compliance with the HIPAA Privacy Rule" (HHS). Keep ad pixels off portal pages.

What virtual platform is HIPAA compliant?

For video visits, Doxy.me says every user gets a BAA, Zoom enters into BAAs on paid plans, and Google Meet and Microsoft Teams fall under Google's and Microsoft's BAAs for business accounts (Doxy.me; Zoom; Google Meet; Microsoft Teams). SimplePractice and Jane build video into the practice platform. See HIPAA compliant telehealth platforms.

Does SimplePractice have text messages?

Yes, for reminders: SimplePractice says its telehealth software "will even send automated text and email appointment reminders" (SimplePractice). Its BAA is agreed when you create your account (Directory entry). For texting tools in general, see HIPAA compliant texting apps.

Is there a version of Zoom that is HIPAA compliant?

Yes, Zoom's paid plans with a signed BAA. Zoom says it offers Pro, Business, Business Plus and Enterprise plans to healthcare customers and also enters into BAAs with customers on its other paid plans (Zoom; Directory entry). See Zoom vs Google Meet vs Teams.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, keeps ad attribution when patients book through practice software, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week.

Talk to Curve Compliance

Book a call. Your practice software holds the chart. Curve Compliance credits the bookings and visits it records to the ads that drove them, with PHI stripped before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.