Is SimplePractice HIPAA compliant?
Yes — you agreed to SimplePractice's business associate agreement when you started your trial, it covers every feature including telehealth on all plans, and you never sign it again.
Applies to SimplePractice practice management and telehealth. Last reviewed against SimplePractice's own documentation. Next review December 29, 2026.
Reviewed by Dr. Anita Desai, MD — Psychiatrist, solo private practice.
What you must do
- Nothing to request. SimplePractice states that creating a trial account means agreeing to the business associate agreement, the terms of service and the privacy policy.
- No re-signing on upgrade — you do not re-agree when moving from a trial to a paid account.
- Keep a copy of the published agreement text for your compliance file, since there is no separately countersigned document.
- Before switching on AI add-ons such as Note Taker, read the separate addendum for AI products — those features sit under it rather than the main agreement.
- Since 17 June 2026 SimplePractice may retain de-identified, de-coupled transcripts to improve AI features. Set the retention preference at clinician, client or session level if you do not want this.
- Recording a session raises state consent law. SimplePractice supplies a consent form and notes a number of states require all-party consent.
- Export your data before cancelling — SimplePractice de-identifies records within 64 days of termination.
Does SimplePractice sign a business associate agreement?
Yes. SimplePractice offers one. All plans. The agreement is accepted at trial signup before any plan is chosen, and telehealth is included on every plan. Nothing to request. Acceptance happens when you tick the box and start the free trial. Read or save the current text at simplepractice.com/baa.
What this means in practice
There is nothing to request here. You accepted SimplePractice's business associate agreement the moment you ticked the box to start a trial, alongside the terms of service and privacy policy, and you do not sign it again when you move onto a paid subscription. The text sits publicly on their site, which is what you keep for your file.
Coverage is not plan-gated. Telehealth is included at no extra cost on every plan, and the agreement reaches the whole platform rather than a named list of modules. Two things are limited by plan rather than by the agreement: secure client messaging is absent from the entry tier, and adding non-clinician team members needs the top plan.
The part that deserves attention is the AI add-on. Note Taker runs under a separate addendum, not the main agreement, and since 17 June 2026 SimplePractice may keep de-identified, de-coupled transcripts to improve its AI features unless you change the retention setting. Recording a session also brings state consent law into play, which SimplePractice flags but leaves to you.
How organizations get this wrong
The specific mistakes we see with SimplePractice, not generic advice.
- Switching on Note Taker without reading the AI addendum — de-identified transcript retention is the default and must be turned off per clinician, client or session.
- Recording sessions without all-party consent. SimplePractice supplies a consent form but does not check your state's recording law for you.
- Buying the entry plan and then needing to message clients securely, so staff improvise with personal email or text.
- Cancelling without exporting first. Records are de-identified within 64 days of termination, while your own retention obligations outlive the subscription.
What the agreement does not cover
- Secure client messaging on the entry plan — a plan limit rather than an agreement limit, but it pushes staff toward uncovered channels.
- Adding non-clinician team members such as schedulers and billers, which requires the top plan.
- AI add-on products including Note Taker, governed by a separate AI addendum.
- SimplePractice does not publish a position on signing a customer's own agreement template.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
Free self-serve agreement if you only need the video visit and keep records elsewhere
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with SimplePractice, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from SimplePractice’s own published documentation, read on the date shown.
- SimplePractice BAA, Terms of Service, and Trust & Security information — SimplePractice. No publication date given. Read July 29, 2026.
- SimplePractice Business Associate Agreement — SimplePractice. No publication date given. Read July 29, 2026.
- Note Taker FAQs — SimplePractice. No publication date given. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects SimplePractice’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.