HIPAA compliant database and app builders
Spreadsheet-database hybrids, frequently used to build informal patient trackers nobody assessed.
These platforms are good at exactly the thing that gets practices into trouble: someone builds a working patient tracker in an afternoon without involving anyone technical. It fills a real gap, it spreads because it is useful, and it accumulates names, contact details and clinical notes in a tool chosen for convenience rather than assessed for risk.
Coverage here usually sits on the vendor's most expensive tier and is arranged through an account team rather than a checkbox, so the tracker exists long before anyone asks about paperwork. The exclusions are unusually specific and unusually easy to trip over: outbound automation emails, share-this-record links, base and table names, form or portal use, AI features needing separate terms. And because coverage attaches to the plan, a downgrade at renewal quietly removes it while every record stays in place.
Can be used with patient information
Each of these requires a signed agreement and, usually, specific settings. Open an entry for the exact conditions.
What to check before you adopt one
- Find out which plan carries coverage and what it costs before anyone builds anything, since these terms are typically reserved for the vendor's highest tier.
- Check the vendor's position on using the platform as a patient-facing portal or intake form, which some advise against even under a signed agreement.
- Ask whether outbound features such as automation emails and record-sharing links are excluded, given that they push data beyond the platform's own controls.
- Confirm that the names of bases, tables, views, interfaces and workspaces are not expected to hold patient details, since naming fields are rarely covered.
- Agree what happens on downgrade or non-renewal, because coverage ending does not remove the records already stored.
The expensive mistake
Building the tracker first and asking about the agreement at renewal. By then the base is embedded in daily work, the required plan costs several times what the team pays now, and the automations that made it useful turn out to be the excluded ones. Settle the plan and the exclusions before the first table is created, not after fifty people depend on it.
Tracking which of these your organization uses?
The vendor and BAA register keeps every tool that touches patient information, its agreement status and its renewal date in one place — seeded from this research. See pricing.
Information, not certification and not legal advice. Each entry reflects that vendor’s published documentation as read on the date shown on its page. Vendors change terms without notice — confirm anything you rely on directly with them.