Is that tool HIPAA compliant?

Yes for Gmail inside a managed Google Workspace account once a super administrator accepts Google's amendment — a free personal Gmail address cannot be covered at all.

Only if you sign up on a Hushmail for Healthcare plan — the identically priced Small Business, Law and Personal plans are marked as not including a business associate agreement.

Yes — LuxSci includes the agreement at no extra cost, but an authorised officer must sign and return LuxSci's own form, and patient information must stay inside the services it lists as eligible.

Yes — every Paubox account includes a business associate agreement at no extra cost, and Paubox will not finish configuring your email until you have agreed to it.

Yes on a paid Virtru package, but only after you email their BAA address and execute the agreement — Virtru does not issue it automatically, and its subscription terms require you to ask.

No — Apple publishes no business associate agreement for FaceTime, and the COVID-era enforcement discretion that once let providers use it for telehealth expired on August 9, 2023.

Yes, if you run Meet inside a managed Google Workspace account and a super administrator accepts the amendment before any patient visit takes place.

Yes — GoTo's business associate addendum is published as a standing legal document that takes effect simply by using the services after its publication, and GoTo sells a dedicated Healthcare plan with recording and chat switched off.

Yes — Teams is named on Microsoft's in-scope services list and the agreement applies to business subscriptions automatically, but you configure the tenant and keep patient information out of anything not on that list.

Yes, but only on the Whereby Embedded platform with a signed agreement and the documented configuration — the compliance offering is aimed at products that embed video, not at teams looking for a meeting app.

Yes, if the business associate agreement you request from Zoho names Zoho Meeting — Zoho publishes a Meeting-specific HIPAA page and names the exact fields it treats as patient information, which is more than most vendors in this category put in writing.

Yes, if you are on a paid Zoom plan and you execute Zoom's business associate agreement before using Zoom for anything involving patient information.

Yes — Doximity builds its business associate agreement into the terms of service, effective the moment a clinician registers, which makes the free Dialer one of the rare covered tools a solo clinician can adopt in an afternoon.

Yes — doxy.me gives every user a free agreement you generate yourself in account settings, but the version on individual accounts names one provider, so a practice with two or more clinicians needs the clinic version instead.

Yes — you agreed to SimplePractice's business associate agreement when you started your trial, it covers every feature including telehealth on all plans, and you never sign it again.

Yes — Tebra is built for covered entities and states that it commits through a business associate agreement, so the work is executing it and configuring access rather than deciding whether the vendor will sign.

Yes for VSee Clinic once you email their compliance address and get the agreement signed — but the free VSee Messenger app is excluded, and VSee's own pages disagree about whether the free Clinic tier needs a paid subscription first.

Only on eFax's business-grade plans — the agreement is listed on Business and Corporate, and the consumer Personal plan does not include one, so a solo practice on a cheap eFax number is unprotected.

Yes — Documo states HIPAA compliance comes standard with every plan at no extra fee and that it signs a business associate agreement for healthcare customers, including on its cheapest tier.

Not as sold. MyFax's own terms forbid storing patient information unless you have already executed a business associate agreement with them, and its own FAQ sends anyone wanting HIPAA-compliant faxing to a different product — eFax Corporate.

Yes if you buy from SRFax's Healthcare Solutions range and request the agreement — the cheaper Standard Solutions plans are sold for general small business use, not healthcare.

No — Meta's own platform terms state that it 'is not a Business Associate' and that the WhatsApp Cloud API 'is not HIPAA compliant', and no WhatsApp product on any tier comes with an agreement.

Yes — the agreement is built into Spruce's standard terms and applies automatically on trials and both paid plans, but Spruce classes SMS, email, fax and phone as unsecure channels, so only app-to-app messaging inside Spruce is genuinely secure.

Yes — TigerConnect's standard agreement applies automatically through its terms of service unless you negotiate your own, but it is a sales-quoted enterprise product and the invitation text reaching the patient is still ordinary carrier SMS.

Yes, if a super administrator accepts Google's business associate amendment in the Admin console and you keep patient information only inside the specific Google services it covers.

Yes — the agreement already applies to business and enterprise subscriptions automatically through Microsoft's Data Protection Addendum, but you must keep patient information inside the services Microsoft lists as in scope.

Only on Slack's top Enterprise tier with a signed agreement, and only for staff-to-staff messages and file uploads — you may never use Slack to message patients.

Yes, if you are on a Box Enterprise-tier account and you request and sign the agreement before any patient files are stored.

Yes, if you are on a Dropbox team plan and your administrator signs the agreement in the admin console before any patient files are uploaded.

Yes on a Google Workspace or Cloud Identity account where a super administrator has accepted Google's business associate amendment — but Drive on a personal Google account cannot be covered, because there is no administrator to accept it.

Yes for OneDrive for Business on a Microsoft 365 business subscription, where the agreement applies automatically — but the consumer OneDrive on a personal Microsoft account is a different product and is not covered.

Conditionally — SpiderOak accepts that it acts as a business associate and points to a route for requesting an agreement, but says it supports only 'certain customers' subject to HIPAA, so settle eligibility before you commit.

Yes — Tresorit states plainly that it signs business associate agreements, which is more than most encrypted-storage vendors will say, but you still have to ask for one and plan for what zero-knowledge encryption costs you.

Yes, if you accept the AWS business associate addendum in AWS Artifact and then keep patient data only inside the services on the HIPAA Eligible Services list.

Yes — Google signs an agreement covering its entire infrastructure rather than a walled-off healthcare region, but only products on its covered list may touch patient data and what you build on top remains yours to configure.

Yes, and unusually there is nothing to sign — the agreement already applies if you bought Azure under a Microsoft licensing agreement, but only services in Microsoft's audit scope may hold patient data and everything you build on top is yours to secure.

Yes, if you use Google Voice inside a paid Google Workspace account with licenses assigned to the staff who handle patient information, and your administrator accepts Google's amendment first — the free consumer version cannot be used with patient information.

Yes for calls if you are on the Business or Scale plan and sign the agreement — but text messaging is explicitly excluded from it, so anything you text a patient sits outside the agreement entirely.

Yes, if you are a paying customer, ask RingCentral for their business associate agreement and sign it, and keep patient information within the specific services that agreement names.

No — Calendly's customer terms specifically forbid putting patient information into the service and Calendly does not offer a business associate agreement, so it should not be used to book patients or collect their details.

Yes inside Google Workspace once an administrator has accepted the agreement — Google names Calendar in its included functionality — but an invitation is a disclosure, and whatever you type in the title travels to every attendee's inbox.

Yes on the Standard plan and above, where SimplyBook.me's HIPAA feature and a signed business associate agreement are both stated to be available — but the agreement is affirmed on a marketing page rather than in the help or legal documentation, so get it in writing before the first patient books.

Yes, if you are on the Premium or Powerhouse plan and enter the agreement from your scheduling settings — but it covers Acuity only, and turning HIPAA mode on permanently disables invoices.

Yes, if the business associate agreement you execute with Zoho names Zoho Bookings — and if you keep the reason for the appointment out of the booking form.

Yes, on signNow's corporate plans once you have asked support to sign the business associate agreement — HIPAA features are off by default on every account until that happens.

Yes, if you buy an Enhanced plan through Docusign sales and sign their business associate addendum first — the self-serve Personal, Standard and Business Pro plans do not include it.

Only on an annual Standard or Premium plan that meets Dropbox's minimum contract value and has a signed agreement — there is no self-serve path and monthly billing does not qualify.

Yes, but only as an optional capability on annual Enterprise plans with a minimum contract value — PandaDoc will sign a business associate agreement, and nothing below Enterprise has a route to one.

Yes, if you request Zoho's business associate agreement and the executed document names Zoho Sign — Zoho says the agreement itself defines which of its services are covered.

Yes, if you upgrade to Twilio's Security or Enterprise Edition, sign their business associate addendum, and only use the products named on Twilio's HIPAA Eligible Services list.

No — Zapier states plainly that it is not HIPAA compliant and does not sign business associate agreements on any plan, so patient information must never pass through a Zap.

Yes on the Enterprise plan, where ActiveCampaign lists HIPAA support and says a business associate agreement is available — but the agreement text, the request route and what is excluded under it are not published, so all three have to be settled with sales.

No — Mailchimp does not offer a business associate agreement and its terms put HIPAA responsibility entirely on you, so patient health details must stay out of your audiences, campaigns and merge fields.

Yes, unusually for email marketing — Zoho will sign a business associate agreement and names Zoho Campaigns among its services, but the agreement has to name it and the marketing rules still apply on top.

No — Intuit does not sign a business associate agreement for QuickBooks and tells healthcare professionals directly not to enter identifiable health information into QuickBooks Online.

Only on Asana's top tier with the HIPAA feature switched on — and even then Asana forbids using it as your system of record or for contacting patients, so it is a staff task tracker and nothing more.

Yes on the Enterprise plan only, once an admin accepts the agreement and clicks Activate HIPAA Compliance — and coverage ends the moment you downgrade to a lower plan.

Yes, if you are on the Enterprise plan, accept the agreement inside workspace settings and lock the workspace down as Notion requires — and even then you may not use Notion to communicate with patients.

Yes, if you are on the Enterprise Scale plan and sign Airtable's Health Information Exhibit — but Airtable says not to use it as a patient portal, and health data must stay out of emails, record sends and anything you name.

Yes, if your AWS account has an executed business associate agreement and you stay off the two model families AWS carves out of Bedrock's HIPAA eligibility.

Yes on Claude Enterprise or the first-party API, once an organization owner has activated HIPAA compliance and accepted the agreement — consumer plans are not covered, and Anthropic excludes a long and specific list of features from the plans that are.

Yes inside Google Workspace once an administrator has accepted the agreement — Google names the Gemini app, the Gemini Mac app and Gemini in Workspace as included functionality, and excludes Gemini in Chrome by name.

Yes for Microsoft 365 Copilot and Copilot Chat used under a commercial Microsoft 365 licence, where the agreement already applies — but the consumer Copilot signed into with a personal account is a different product and is not named in scope.

Only on specific OpenAI products — ChatGPT for Healthcare, ChatGPT for Clinicians, sales-managed Enterprise or Edu, or the API with Modified Retention — and never on free, Plus, Pro or ChatGPT Business accounts.

Yes now, but only on an Enterprise subscription where a super admin switches on Sensitive Data, identifies the account as a covered entity and accepts the agreement — and only in the specific tools HubSpot lists.

Yes, if you sign Salesforce's business associate addendum through your account representative and it names the specific Salesforce service you are putting patient information into.

Yes, if you are on Zoho CRM Enterprise or Ultimate, email Zoho's legal team for the agreement, and then mark by hand every module and field that will hold patient information.

Yes, if Formstack moves you onto one of its healthcare plans, which comes with a signed agreement but restricts your integrations, email and attachments.

Yes, if you use Forms inside a paid Google Workspace account where a super administrator has accepted Google's amendment — Forms is covered as part of Google Drive.

Yes, if you are on the Gold or Enterprise plan and run Jotform's HIPAA setup wizard, which migrates your whole account to an isolated system and ends with you signing the agreement.

No — Squarespace states its contact form features, including the form block, cannot be part of a HIPAA compliant solution, and its addendum covers Acuity Scheduling and nothing else.

Only on Typeform's enterprise-level plans, after you tell Typeform in advance and it agrees to sign — on the ordinary self-serve plans Typeform's own terms bar you from collecting patient information.