Is QuickBooks HIPAA compliant?
No — Intuit does not sign a business associate agreement for QuickBooks and tells healthcare professionals directly not to enter identifiable health information into QuickBooks Online.
Applies to QuickBooks Online. Last reviewed against Intuit's own documentation. Next review December 14, 2026.
Reviewed by David Kim — Billing and RCM Operations Director.
If you keep using it anyway
- Do not enter individually identifiable health information into QuickBooks Online. This is Intuit's own explicit guidance to healthcare professionals.
- Keep patient-level billing, claims and diagnosis detail in a practice management or medical billing system that will sign an agreement, and post only summary or aggregate revenue entries into QuickBooks.
- Do not attach explanation-of-benefits documents, superbills, claim documents or clinical correspondence to QuickBooks transactions.
- Avoid using patient names as QuickBooks customer records where the record itself would reveal that the person received treatment from your practice.
Does QuickBooks sign a business associate agreement?
Intuit does not offer one. Not available. Intuit publishes no process for QuickBooks customers and states it is not equipped to advise on the subject, directing users to HHS instead.
What this means in practice
Intuit is unusually direct about this: QuickBooks Online is not compliant with the HIPAA privacy standards, healthcare professionals are told not to enter individually identifiable health information into it, and no agreement is offered for QuickBooks Online, Payments or Payroll. Intuit's product terms go further and disclaim being HIPAA-ready, stating it will not assist with compliance.
The difficulty is that the bookkeeper lives in QuickBooks and the natural bookkeeping instinct is to attach the evidence to the transaction. Explanation-of-benefits documents, superbills and claim paperwork get uploaded so the reconciliation is defensible, and a customer record is created per patient so receivables can be chased. At a single-specialty practice, that customer record alone records that a named person was treated by you, before any document is attached.
The clean split most practices land on is to keep patient-level billing, claims and diagnosis detail inside a practice management or medical billing system that will sign an agreement, and to post only summary or aggregate revenue figures into QuickBooks for the general ledger. Your accountant loses nothing that matters and the ledger stops being a patient list.
How organizations get this wrong
The specific mistakes we see with QuickBooks, not generic advice.
- A bookkeeper attaching explanation-of-benefits documents or superbills to transactions so the supporting paperwork sits with the payment.
- Creating one customer record per patient, so the ledger itself becomes a record of who received treatment from your practice.
- Assuming QuickBooks Payments or Payroll sits under different rules from QuickBooks Online, when no agreement is offered for any of them.
- Typing dates of service or procedure detail into memo and description fields because it makes month-end reconciliation quicker.
What the agreement does not cover
- Every QuickBooks Online plan. Intuit states QuickBooks Online is not compliant with the HIPAA standards for privacy.
- Intuit's product terms disclaim that the software and related services are HIPAA-ready or HIPAA-compliant and state Intuit will not assist with or ensure compliance.
- No agreement is offered for QuickBooks Online, QuickBooks Payments or QuickBooks Payroll in Intuit's published documentation.
Use instead
Listed on merit. We take no payment for placement and use no affiliate links.
Tebra
Practice management and medical billing built for covered entities, so patient-level financial data stays under an agreement
AdvancedMD
Handles claims and patient billing under an agreement; export summary totals to QuickBooks for the general ledger only
You just found one. What else is in your stack?
If QuickBooks was a surprise, it is rarely the only one. Most small organizations are running fifteen to thirty tools and have written agreements with a handful of them. A vendor register tracks which of yours touch patient information, which have a signed agreement, when each expires and who owns it — and exports as part of the evidence pack when a client asks.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Intuit’s own published documentation, read on the date shown.
- Is QuickBooks Online HIPAA compliant? — Intuit. Published May 26, 2026. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Intuit’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.