Is that tool HIPAA compliant?

Yes for Gmail inside a managed Google Workspace account once a super administrator accepts Google's amendment — a free personal Gmail address cannot be covered at all.

Only if you sign up on a Hushmail for Healthcare plan — the identically priced Small Business, Law and Personal plans are marked as not including a business associate agreement.

Yes — LuxSci includes the agreement at no extra cost, but an authorised officer must sign and return LuxSci's own form, and patient information must stay inside the services it lists as eligible.

Yes — every Paubox account includes a business associate agreement at no extra cost, and Paubox will not finish configuring your email until you have agreed to it.

Yes on a paid Virtru package, but only after you email their BAA address and execute the agreement — Virtru does not issue it automatically, and its subscription terms require you to ask.

Yes, if you run Meet inside a managed Google Workspace account and a super administrator accepts the amendment before any patient visit takes place.

Yes — Teams is named on Microsoft's in-scope services list and the agreement applies to business subscriptions automatically, but you configure the tenant and keep patient information out of anything not on that list.

Yes, if you are on a paid Zoom plan and you execute Zoom's business associate agreement before using Zoom for anything involving patient information.

Yes — doxy.me gives every user a free agreement you generate yourself in account settings, but the version on individual accounts names one provider, so a practice with two or more clinicians needs the clinic version instead.

Yes — you agreed to SimplePractice's business associate agreement when you started your trial, it covers every feature including telehealth on all plans, and you never sign it again.

Yes for VSee Clinic once you email their compliance address and get the agreement signed — but the free VSee Messenger app is excluded, and VSee's own pages disagree about whether the free Clinic tier needs a paid subscription first.

Only on eFax's business-grade plans — the agreement is listed on Business and Corporate, and the consumer Personal plan does not include one, so a solo practice on a cheap eFax number is unprotected.

Yes — Documo states HIPAA compliance comes standard with every plan at no extra fee and that it signs a business associate agreement for healthcare customers, including on its cheapest tier.

Yes if you buy from SRFax's Healthcare Solutions range and request the agreement — the cheaper Standard Solutions plans are sold for general small business use, not healthcare.

Yes — the agreement is built into Spruce's standard terms and applies automatically on trials and both paid plans, but Spruce classes SMS, email, fax and phone as unsecure channels, so only app-to-app messaging inside Spruce is genuinely secure.

Yes — TigerConnect's standard agreement applies automatically through its terms of service unless you negotiate your own, but it is a sales-quoted enterprise product and the invitation text reaching the patient is still ordinary carrier SMS.

Yes, if a super administrator accepts Google's business associate amendment in the Admin console and you keep patient information only inside the specific Google services it covers.

Yes — the agreement already applies to business and enterprise subscriptions automatically through Microsoft's Data Protection Addendum, but you must keep patient information inside the services Microsoft lists as in scope.

Only on Slack's top Enterprise tier with a signed agreement, and only for staff-to-staff messages and file uploads — you may never use Slack to message patients.

Yes, if you are on a Box Enterprise-tier account and you request and sign the agreement before any patient files are stored.

Yes, if you are on a Dropbox team plan and your administrator signs the agreement in the admin console before any patient files are uploaded.

Yes for OneDrive for Business on a Microsoft 365 business subscription, where the agreement applies automatically — but the consumer OneDrive on a personal Microsoft account is a different product and is not covered.

Yes, if you accept the AWS business associate addendum in AWS Artifact and then keep patient data only inside the services on the HIPAA Eligible Services list.

Yes, if you use Google Voice inside a paid Google Workspace account with licenses assigned to the staff who handle patient information, and your administrator accepts Google's amendment first — the free consumer version cannot be used with patient information.

Yes for calls if you are on the Business or Scale plan and sign the agreement — but text messaging is explicitly excluded from it, so anything you text a patient sits outside the agreement entirely.

Yes, if you are a paying customer, ask RingCentral for their business associate agreement and sign it, and keep patient information within the specific services that agreement names.

No — Calendly's customer terms specifically forbid putting patient information into the service and Calendly does not offer a business associate agreement, so it should not be used to book patients or collect their details.

Yes, if you are on the Premium or Powerhouse plan and enter the agreement from your scheduling settings — but it covers Acuity only, and turning HIPAA mode on permanently disables invoices.

Yes, if you buy an Enhanced plan through Docusign sales and sign their business associate addendum first — the self-serve Personal, Standard and Business Pro plans do not include it.

Only on an annual Standard or Premium plan that meets Dropbox's minimum contract value and has a signed agreement — there is no self-serve path and monthly billing does not qualify.

Yes, if you upgrade to Twilio's Security or Enterprise Edition, sign their business associate addendum, and only use the products named on Twilio's HIPAA Eligible Services list.

No — Zapier states plainly that it is not HIPAA compliant and does not sign business associate agreements on any plan, so patient information must never pass through a Zap.

No — Mailchimp does not offer a business associate agreement and its terms put HIPAA responsibility entirely on you, so patient health details must stay out of your audiences, campaigns and merge fields.

No — Intuit does not sign a business associate agreement for QuickBooks and tells healthcare professionals directly not to enter identifiable health information into QuickBooks Online.

Only on Asana's top tier with the HIPAA feature switched on — and even then Asana forbids using it as your system of record or for contacting patients, so it is a staff task tracker and nothing more.

Yes on the Enterprise plan only, once an admin accepts the agreement and clicks Activate HIPAA Compliance — and coverage ends the moment you downgrade to a lower plan.

Yes, if you are on the Enterprise plan, accept the agreement inside workspace settings and lock the workspace down as Notion requires — and even then you may not use Notion to communicate with patients.

Yes, if you are on the Enterprise Scale plan and sign Airtable's Health Information Exhibit — but Airtable says not to use it as a patient portal, and health data must stay out of emails, record sends and anything you name.

Only on specific OpenAI products — ChatGPT for Healthcare, ChatGPT for Clinicians, sales-managed Enterprise or Edu, or the API with Modified Retention — and never on free, Plus, Pro or ChatGPT Business accounts.

Yes now, but only on an Enterprise subscription where a super admin switches on Sensitive Data, identifies the account as a covered entity and accepts the agreement — and only in the specific tools HubSpot lists.

Yes, if you sign Salesforce's business associate addendum through your account representative and it names the specific Salesforce service you are putting patient information into.

Yes, if you are on Zoho CRM Enterprise or Ultimate, email Zoho's legal team for the agreement, and then mark by hand every module and field that will hold patient information.

Yes, if Formstack moves you onto one of its healthcare plans, which comes with a signed agreement but restricts your integrations, email and attachments.

Yes, if you use Forms inside a paid Google Workspace account where a super administrator has accepted Google's amendment — Forms is covered as part of Google Drive.

Yes, if you are on the Gold or Enterprise plan and run Jotform's HIPAA setup wizard, which migrates your whole account to an isolated system and ends with you signing the agreement.

No — Squarespace states its contact form features, including the form block, cannot be part of a HIPAA compliant solution, and its addendum covers Acuity Scheduling and nothing else.

Only on Typeform's enterprise-level plans, after you tell Typeform in advance and it agrees to sign — on the ordinary self-serve plans Typeform's own terms bar you from collecting patient information.