CompyMax
Sign inStart free trial

HIPAA compliant practice management software

Almost every practice management vendor says it is HIPAA compliant. Almost none of them mean the same thing by it. This is how to work out what a specific vendor is actually offering you, and where the gaps usually turn out to be.

Last reviewed .

First, a claim to be sceptical of

“HIPAA compliant” on a pricing page is a marketing statement rather than a credential, because no such designation exists — no government body issues one and no auditor can grant one. A vendor saying it is compliant may mean it will sign a business associate agreement, or that it encrypts data at rest, or simply that it sells to clinics.

The question worth asking is narrower and answerable: will you sign a business associate agreement, and which parts of your product does it cover? Everything below follows from that.

What to require before you sign

  • A business associate agreement they will actually sign

    Ask for the executed agreement before you migrate, not after. Ask whether it is their standard form or yours — many vendors will not accept a customer template — and get a copy for your records, because this is the first document a payer or hospital partner asks to see.

  • A written list of which modules are covered

    Practice management suites have grown to include patient portals, e-prescribing, telehealth, marketing, payments and AI note-taking. Coverage is often granted per module. Get the list in writing, dated, rather than accepting that 'the platform' is covered.

  • Role-based access down to the record

    Front desk staff should not see clinical notes because they can see appointments. If access is all-or-nothing by user, you cannot apply the minimum necessary standard however good your policies are.

  • An audit log you can actually read

    You need to be able to answer 'who accessed this record and when' without opening a support ticket. Ask to see the log export, and ask how long entries are retained — some retention periods are shorter than your own record-keeping obligations.

  • Named subprocessors

    Ask who else touches the data: the hosting provider, the clearinghouse, the SMS gateway, any offshore support. Each is a link in your chain, and a thorough reviewer will ask you about them.

  • An export you can leave with

    Confirm you can extract your records in a usable format without a fee. This is a compliance question as much as a commercial one — you are responsible for records you can no longer reach.

The gap is usually around the system, not in it

In practice the practice management system is the part most likely to be properly covered — it is sold to healthcare, the vendor expects the question, and the agreement exists. What trips practices up is the ring of ordinary business tools around it, each adopted separately by whoever needed it.

The calendar the schedule syncs into. The fax line referrals arrive on. The cloud drive where scans get filed. The booking page on the website. The accounting package the bookkeeper reconciles in. The phone system that transcribes voicemail. Any one of those can sit outside an agreement while the expensive clinical system sits comfortably inside one.

We publish researched verdicts on those adjacent tools — what each vendor will sign, on which plan, and what it excludes:

Scheduling clinical staff rather than patients?

Practice management systems handle patient appointments well and clinician rotas badly. If the actual problem is shift and rota scheduling across a clinical team, MedAligna is built for that specifically. Named here because it fits the job, not because of any commercial arrangement — we take no payment for placement anywhere on this site.

Common questions

What is the difference between EHR and practice management software?
An EHR holds the clinical record — notes, results, prescriptions. Practice management software runs the business side — scheduling, registration, billing and claims. Many suites bundle both. For HIPAA purposes the distinction matters less than vendors imply: both hold patient information, so both need to sit under a business associate agreement, and neither is 'automatically compliant' — no such designation exists.
What is the best HIPAA-compliant software for therapists?
For a therapy practice the pragmatic candidates are purpose-built systems that sign their agreement at signup and cover telehealth on every plan — SimplePractice is the clearest example in our research. 'Best' still comes down to the evaluation this page describes: what the agreement covers, which modules fall outside it, and the tools around the system, which is where most gaps actually sit.
Does HIPAA require MDM?
Not by name. The Security Rule requires access controls and device and media controls wherever electronic patient information is reachable, and mobile device management is the usual way to evidence that on phones and laptops. The Security Rule update proposed in January 2025 would tighten this further with mandatory asset inventories and encryption — worth building toward even before it is final.

Your system is covered. Can you prove the rest of it is?

Keep every vendor that touches patient information in one register with agreement status, expiry dates and owners — and export it as part of a dated evidence pack when a payer or partner asks.

Start free trialCheck a vendor free

Keep reading

Looking for the software rather than the explanation? Vendor and BAA register.

Guidance based on how these agreements are commonly structured, not legal advice and not a statement about any particular vendor’s current terms. Confirm what a vendor covers directly with them before you rely on it. We do not sell practice management software and take no payment from any vendor named on this site.