HIPAA Compliant Software List: Tools That Sign a BAA

HIPAA compliant software is software whose vendor signs a business associate agreement (BAA) for the data it handles for you, used within the plan and settings that BAA covers. HHS does not vouch for any product: it says "OCR does not endorse, certify, or recommend specific technology or products" (HHS). Of the 181 tools in Curve's BAA Directory, each answered from the vendor's own page, 45 sign a BAA, 78 sign only on specific plans or products, 35 do not sign, and 23 have no public statement; all 8 ad platforms checked are listed as not signing. Curve Compliance signs a BAA on every plan for HIPAA-compliant ad tracking.

Book a call. A list of tools that sign a BAA still leaves your ad platforms, which don't. Curve Compliance sends conversions to Meta, Google Ads and your other ad platforms server-side, strips PHI before data reaches an ad platform, and signs a BAA on every plan. Curve's team does the setup. Book a call with Curve.

What HIPAA compliant software means

HIPAA regulates organizations, not products. A vendor becomes a business associate when it "creates, receives, maintains, or transmits protected health information" for a covered entity (45 CFR 160.103). Before sharing PHI with it, a covered entity needs "satisfactory assurance that the business associate will appropriately safeguard the information," and that assurance "must be documented through a written contract or other written agreement" (45 CFR 164.502(e)). That contract is the BAA, and the rules list what it must say (45 CFR 164.504(e)).

Vendors say the same. Docusign's FAQ says "A company's products, including Docusign's, cannot be HIPAA compliant" (Docusign), Qualtrics says "Individual tools are not HIPAA compliant or non-compliant" (Qualtrics), and OpenAI says accepting a BAA and enabling HIPAA support "do not, by themselves, make your application HIPAA compliant" (OpenAI). So HIPAA compliant software means three things together: a signed BAA, a plan that BAA covers, and your own setup and safeguards. See what a business associate agreement is.

HIPAA compliant software by category

Counts come from the BAA Directory, where each entry quotes the vendor's own page with the date checked. The Sign a BAA column includes vendors that sign only on specific plans. Each roundup lists the tools in that job with their plans.

Category	Tools checked	Sign a BAA	Do not sign	No public statement	Roundups
Scheduling and intake	17	15	1	1	practice management software; therapy platforms; scheduling software
Video, reviews and SMS	14	9	4	1	telehealth platforms; Zoom, Google Meet and Teams
CRM and email	23	16	6	1	email providers; marketing automation
Call tracking and phones	12	11	1	0	phone systems; fax services; call tracking
Messaging and payments	12	4	3	5	texting apps
Support and chat	3	2	1	0	chatbots and website chat
Forms and landing pages	16	12	1	3	form builders; survey tools; e-signature tools
Automation and workspace	30	25	2	3	cloud storage
Site builders	7	3	3	1	website hosting
Analytics and data	26	14	5	7	analytics; session replay
AI assistants	7	7	0	0	AI tools
HIPAA ad tracking	6	5	0	1	server-side tracking
Ad platforms	8	0	8	0	ad platforms

Two roundups cut across these categories: therapy platforms covers practice software and video together, and e-signature tools covers the signing step after a form. For a vendor not listed, search the BAA Directory by name.

Tools that don't sign: ad platforms and consumer apps

The largest group that does not sign is advertising. Meta's Business Tools Terms say you will not share data that "includes or is based on, directly or otherwise, health information" (Meta). Google says "Google does not intend use of the Communication Features to create obligations under the Health Insurance Portability and Accountability Act" for its Google Ads call features (Google). See which ad platforms sign a BAA.

Consumer services are the other group. Apple's iCloud terms say a covered entity or business associate will "not use any component, function or other facility of the Service to create, receive, maintain or transmit any 'protected health information'" (Apple). Personal email, personal storage and consumer messaging apps often sit outside a vendor's BAA even when its business plans are covered, so check the plan, not the brand; see cloud storage that signs a BAA and texting apps that sign a BAA.

How to check a vendor's BAA yourself

• Find the vendor's own page. Look for a help article, trust center or legal page that says it signs a BAA. A page that only says HIPAA, or a security report, is not the same thing.
• Match the plan. Many vendors sign only on named plans or editions. Confirm that the plan you pay for, or will buy, is on the list.
• Match the product. A BAA can cover some products and not others. Google, for example, says "Third-party applications including add-ons are not included" in what its Workspace BAA covers (Google); read the vendor's list of covered services.
• Read the terms. Check that the BAA has the required terms, such as safeguards, breach reporting and returning or destroying PHI at the end (45 CFR 164.504(e)). The sample BAA shows what they look like.
• Keep a copy and set it up. Save the signed or accepted agreement, then turn on the settings the vendor ties to it.

Your own setup matters as much as the vendor. Which tools need a BAA depends on what data reaches them, so talk to your counsel.

How Curve Compliance helps

Most of the software on this list handles patient data inside your practice. Ad tracking is where data leaves for companies that do not sign. Curve Compliance closes that gap under the BAA it signs on every plan: it replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, with a fixed list of fields for each platform, contact identifiers off by default on Meta, Google Ads and TikTok, and every event checked for PHI-like patterns so PHI is stripped before data reaches an ad platform.

Curve keeps attribution when visitors leave to book in tools such as IntakeQ, Calendly, Acuity and Jane App, and receives outcomes from booking systems, CRMs and EHRs, crediting each to the original ad click. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: HHS Guidance on HIPAA and Cloud Computing; 45 CFR 160.103; 45 CFR 164.502; 45 CFR 164.504; Meta Business Tools Terms; Google Ads communication features terms; iCloud Terms and Conditions; OpenAI BAA help; Docusign for Healthcare; Qualtrics data security and privacy; Google Workspace HIPAA; Curve's BAA Directory.

Frequently Asked Questions

What software is HIPAA compliant?

Software whose vendor signs a BAA for the plan you use, set up within it; HHS does not certify any product (HHS). Of the 181 tools in Curve's BAA Directory, 123 sign in some form, most of them only on specific plans.

Which apps are HIPAA compliant?

Apps whose vendor signs a BAA with you for that app, configured the way the BAA expects. Check the category roundups above or search the BAA Directory by name; consumer apps and ad platforms often do not sign.

Are there AI platforms that are HIPAA compliant?

Some AI vendors sign a BAA for named products. OpenAI requires a BAA before its API is used with PHI (OpenAI); see AI tools that sign a BAA for the others the directory covers.

Is ChatGPT HIPAA compliant?

Only under a BAA, on the products OpenAI names. OpenAI says to contact sales for a BAA for a sales-managed ChatGPT Enterprise or Edu account, that "We do not offer a BAA for ChatGPT Business," and that eligible clinicians on ChatGPT for Clinicians have a separate in-product BAA flow (OpenAI). See is ChatGPT HIPAA compliant.

Which companies are HIPAA compliant?

HIPAA applies to covered entities and their business associates, and HHS says "OCR does not endorse, certify, or recommend specific technology or products" (HHS). For a vendor, what counts is whether it signs a BAA with you; the BAA Directory quotes each vendor's answer.

What online platforms are HIPAA compliant?

Web-based tools whose vendor signs a BAA for your plan: practice software, telehealth, email, forms and storage all have options. Start with the category table above; each roundup quotes the vendor's page.

Which platforms are HIPAA compliant?

HHS keeps no approved list (HHS); a platform fits when its vendor signs a BAA for your use and you set it up within it. For care delivery, see telehealth platforms and practice management software; for advertising, see which ad platforms sign a BAA.

Does signing a BAA make software HIPAA compliant?

Not by itself. OpenAI says accepting a BAA does not, by itself, make your application HIPAA compliant (OpenAI), and the HIPAA rules also require your own safeguards and the BAA's required terms (45 CFR 164.504(e)).

Talk to Curve Compliance

Book a call. The software on this list covers your practice. Curve Compliance covers your ad tracking under the BAA it signs on every plan, with conversions sent server-side and PHI stripped before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.