HIPAA Compliant Therapy Platforms: Which Sign a BAA

HIPAA compliant therapy platforms are the ones whose vendor signs a business associate agreement (BAA) with your practice: SimplePractice, Jane, IntakeQ, Healthie, TherapyNotes, Tebra and Carepatron say they do for practice software, and Doxy.me, VSee, Zoom and Google Meet do for video sessions on the terms they name. HHS says covered providers "must use technology vendors that comply with the HIPAA Rules and will enter into HIPAA business associate agreements" for telehealth (HHS). A platform's BAA covers the client records inside it, not the ads that bring clients in. Curve Compliance, which signs a BAA on every plan for HIPAA-compliant ad tracking, checked each vendor's own page on October 26, 2026.

Book a call. A therapy platform's BAA does not reach the ad pixels on your website. Curve Compliance sends conversions to your ad platforms server-side, strips PHI before data reaches an ad platform, and keeps attribution when clients book in Jane App or IntakeQ. Curve's team does the setup. Book a call with Curve.

Which therapy platforms sign a BAA?

Each row comes from the vendor's own page, fetched October 26, 2026. "Specific plans" means the vendor offers its BAA only on the plans it names.

Platform	Signs a BAA?	How the BAA applies	Source
SimplePractice	Yes	You agree to it when you create your trial account, and it carries over to a paid account	SimplePractice support
Jane	Yes	Jane says it can work with you to develop a BAA	Jane guide
IntakeQ	Yes	The account admin signs it inside the account	IntakeQ support
Healthie	Yes	Entered into when your Healthie account is created	Healthie BAA
TherapyNotes	Yes	Built into the Terms of Service for covered entities since April 23, 2026, with nothing to sign	TherapyNotes FAQ; Terms
Tebra	Yes	Incorporated into the Terms of Service for covered entity customers	Tebra BAA
Carepatron	Yes	Entered into when your Carepatron account is created	Carepatron BAA
Doxy.me	Yes	Every user gets one; the individual account BAA covers one provider, and groups use a Clinic BAA	Doxy.me help
VSee	Yes	VSee says it offers the HIPAA-required BAA	VSee
Zoom	Specific plans	Paid plans such as Pro, Business, Business Plus and Enterprise	Zoom support
Google Meet	Specific plans	Google Workspace accounts, after an administrator accepts Google's BAA	Google Workspace Help; covered services

Platform names link to their BAA Directory entries, with the vendor's own words. For practice software beyond therapy, see practice management software that signs a BAA; for video tools across specialties, see telehealth platforms that sign a BAA.

Practice platforms, in the vendors' words

• SimplePractice. "When you create your trial account, you agree to the Business Associate Agreement, the Terms of Service, and the Privacy Policy." It adds: "You don't need to re-agree to or electronically sign the BAA when you upgrade from a trial to a paid account" (SimplePractice).
• Jane. Jane's guide answers "Yes, Jane is HIPAA compliant," and says Jane "can work with you to develop a BAA Agreement" (Jane).
• IntakeQ. "Because IntakeQ has access to your clients' Protected Health Information, it's important to have a Business Associate Agreement, or BAA, on file." The admin signs it under More, Account, on the BAA tab, and "Only the account admin needs to sign the Business Associate Agreement" (IntakeQ).
• Healthie. Its BAA "is made and entered into at the date and time your Healthie account is created" (Healthie).
• TherapyNotes. Effective April 23, 2026, "The BAA is now built directly into the Terms of Service for customers who need one." For a covered entity that agrees to the updated terms, "the BAA is automatically in effect. There is nothing to sign, download, or return" (TherapyNotes). Its terms say telehealth "is included as a component of the Service" (TherapyNotes Terms).
• Tebra. Its BAA "shall be incorporated into the Terms of Service for Customers that are Covered Entities" (Tebra).
• Carepatron. Its BAA "is made and entered into at the date and time your Carepatron account is created" (Carepatron).

Two patterns show up. Some platforms put the BAA in the signup or the terms, so it applies once you accept them. Others ask an admin to sign it in the account. Either way, keep a copy, and check which add-on features the vendor says its BAA covers.

Teletherapy video and phone sessions

HHS puts the rule plainly: "All telehealth services provided by covered health care providers and health plans must comply with the HIPAA Rules" (HHS). That means a video vendor that signs a BAA, set up the way its BAA expects.

• Doxy.me. Doxy.me says all its users get a BAA, and the one on individual accounts "is meant for individual providers only." Practices with more than one provider are told to ask about a Clinic BAA (Doxy.me).
• VSee. "VSee offers the HIPAA-required Business Associate Agreement where VSee agrees to be responsible for keeping all patient information secure and to immediately report any breach of personal health information" (VSee).
• Zoom. "Zoom also enters into BAAs with customers who are subscribed to other paid plans listed on Zoom's Plans & Pricing page." On Pro, you accept the BAA at checkout; for Business, Business Plus or Enterprise, Zoom says to contact Sales. It also notes: "Certain AI features may not be available at this time for healthcare and higher education customers with BAAs in place" (Zoom).
• Google Meet. Google Meet is on Google's covered services list, and Google says "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services" (Google; Google Workspace Help).

Phone sessions follow HHS's audio-only guidance. "The HIPAA Security Rule does not apply to audio-only telehealth services provided by a covered entity that is using a standard telephone line, often described as a traditional landline," but "The HIPAA Security Rule applies when a covered entity uses such electronic communication technologies," such as VoIP and mobile. A carrier that only connects the call needs no BAA; an app that stores recordings or transcripts in its cloud does (HHS). See phone systems that sign a BAA and the Zoom, Google Meet and Teams comparison.

Email, texts and AI tools around the platform

Most practice platforms send their own messages. SimplePractice says "You can set SimplePractice to send clients automated appointment reminders by email, text message, or voice message" (SimplePractice), and "Secure Messaging provides a HIPAA-compliant way to communicate with clients and team members directly in SimplePractice," on its Essential and Plus plans (SimplePractice). For email and texts outside the platform, see email providers that sign a BAA and texting apps that sign a BAA.

AI tools need their own BAA too. OpenAI says "To use the OpenAI API with protected health information (PHI), your organization must first enter into a Business Associate Agreement (BAA) with OpenAI," and "We do not offer a BAA for ChatGPT Business" (OpenAI). Anthropic says it "provides a BAA covering our HIPAA-ready services, such as use of our first-party API, Claude in Microsoft Foundry, or Enterprise plans" (Anthropic). See AI tools that sign a BAA.

Client booking and ad attribution

Many practices fill their calendars with Google or Meta ads, then send clients to book in Jane, IntakeQ or SimplePractice. The platform's BAA covers the booking and the record. It does not cover an ad pixel on your website, which sends data from the visitor's browser to a different company, and Curve's BAA Directory lists Meta and Google Ads as not signing a BAA. See which ad platforms sign a BAA and what counts as PHI on a website.

Therapy pages are sensitive by nature: a page about anxiety or couples counseling says something about the person who books from it. Keep conditions and service names out of what reaches ad platforms, and send each booking as a neutral conversion. Which rules apply depends on your setup, so talk to your counsel. For a side-by-side of tracking tools, see conversion tracking for mental health practices.

How Curve Compliance helps

Your therapy platform's BAA covers client records. Curve Compliance covers your ad tracking, under the BAA it signs on every plan. Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. When a visitor leaves your site to book in Jane App or IntakeQ, Curve keeps the ad click attached and credits bookings made days later to the original ad. Outcomes from Healthie, IntakeQ and Jane reach Curve through Keragon.

Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, events can use neutral names, and Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: HHS, HIPAA Rules for telehealth technology; HHS, audio-only telehealth guidance; SimplePractice BAA; SimplePractice reminders; SimplePractice Secure Messaging; Jane; IntakeQ; Healthie BAA; TherapyNotes BAA FAQ; TherapyNotes Terms of Service; Tebra BAA; Carepatron BAA; Doxy.me; VSee; Zoom; Google Workspace HIPAA; Google covered services; OpenAI; Anthropic.

Frequently Asked Questions

Which therapy platforms are HIPAA compliant?

Platforms whose vendor signs a BAA with your practice, used within it: SimplePractice, Jane, IntakeQ, Healthie, TherapyNotes, Tebra and Carepatron say they sign one, and Doxy.me, VSee, Zoom on paid plans and Google Meet in Google Workspace do for video (SimplePractice; TherapyNotes; Doxy.me; Zoom). HHS says covered providers must use telehealth vendors that comply with the HIPAA Rules and will enter into BAAs (HHS).

Are phone calls HIPAA compliant for therapy?

They can be. HHS says covered entities can provide audio-only telehealth in compliance with the Privacy Rule, applying reasonable safeguards. The Security Rule does not apply to a traditional landline but does apply to VoIP and mobile apps, and an app that stores recordings or transcripts needs a BAA (HHS).

Are there AI platforms that are HIPAA compliant?

Some AI vendors sign a BAA for named products. OpenAI requires a BAA before its API is used with PHI and does not offer one for ChatGPT Business (OpenAI); Anthropic offers one for its HIPAA-ready services (Anthropic). See AI tools that sign a BAA.

What virtual platform is HIPAA compliant?

One whose vendor signs a BAA for the plan you use. Doxy.me gives every user a BAA, VSee offers one, Zoom signs on paid plans, and Google Meet is covered in Google Workspace once an administrator accepts Google's BAA (Doxy.me; VSee; Zoom; Google).

Is Doxy better than Zoom?

For HIPAA, both sign a BAA, so the choice comes down to how your practice works. Doxy.me says all its users get a BAA, with a Clinic BAA for groups (Doxy.me). Zoom signs on paid plans and says certain AI features may not be available to healthcare customers with BAAs in place (Zoom).

Does SimplePractice have text messages?

Yes. SimplePractice can send clients automated appointment reminders by email, text message or voice message, and text reminders come from US phone numbers SimplePractice buys (SimplePractice). Its Secure Messaging, on the Essential and Plus plans, is for messaging clients inside SimplePractice (SimplePractice).

Is TherapyNotes HIPAA compliant?

TherapyNotes says its BAA is built into its Terms of Service for covered entities, effective April 23, 2026, and takes effect when you agree to the updated terms, with nothing to sign (TherapyNotes).

Does my therapy platform's BAA cover my website ads?

No. It covers the data that vendor handles for you. A pixel on your site sends data to Meta or Google, which are not parties to that BAA; see which ad platforms sign a BAA.

Talk to Curve Compliance

Book a call. Your therapy platform covers client records. Curve Compliance covers your ad tracking under the BAA it signs on every plan, with bookings credited to the ad and PHI stripped before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.