HIPAA-compliant task management for clinic teams

Most clinic work is not a project. It is a steady stream of follow-ups that start in a conversation and get lost: a broken otoscope, a missing insurance card, a new hire without system access. Chanty turns any message into a task with an owner, due date and status, and tracks it on a simple list or Kanban board inside your team chat. Chanty is HIPAA-compliant with a signed BAA on the Business and Enterprise plans. It is basic task management for operational follow-up. It is not a full project management suite, an EHR or a clinical task system. This page explains what that means, which plan you need, and what HIPAA still expects from your clinic.

What makes task or project management software HIPAA compliant

No software is "HIPAA certified." HIPAA has no official certification for software. When a vendor stores or transmits protected health information (PHI) for you, it is a business associate. You need a signed business associate agreement (BAA) with that vendor before any PHI goes into the tool. Under 45 CFR 164.502(e) and 164.504(e), a covered entity may let a business associate create, receive, maintain or transmit PHI on its behalf only with satisfactory assurances documented in a written contract.

Check the technical safeguards. The technical safeguards in the HIPAA Security Rule (45 CFR 164.312) apply to covered entities and business associates, not to tools, but any tool holding PHI should let you meet them. They cover five standards: access control (unique user ID, emergency access, automatic logoff, encryption and decryption), audit controls, integrity, person or entity authentication, and transmission security. Some specifications, including encryption and automatic logoff, are addressable rather than required. When you evaluate a task or PM tool, ask about:

• Access control: can you limit who sees which tasks, channels and files?
• Unique user logins: does every staff member have their own account, with no shared front-desk login?
• Audit controls: what activity is logged, and who can review it?
• Transmission security: is data encrypted in transit?

Watch the plan tier. Many vendors sign BAAs only on their top tiers. Integrations usually sit outside the BAA, even when the main product is covered.

The tool does not make you compliant. Your clinic is still responsible for:

• configuring roles
• removing access when staff leave
• securing phones and laptops
• training staff
• applying the minimum-necessary rule (45 CFR 164.502(b)), so task text contains only the PHI needed to do the job

Task management vs project management: what a clinic actually needs

Project management suites are built for multi-phase projects with dependencies, timelines and portfolios. That fits an EHR migration or opening a new location. It does not fit the daily work of running a clinic.

Daily clinic work is short and recurring. Typical examples:

• An exam-room device stops working and needs a repair call.
• Gloves or vaccine cooler logs need a reorder.
• Admin needs to follow up on prior-auth paperwork.
• A new hire needs EHR and email access by Monday.
• A policy update must be read by everyone.
• A request from one location needs to be handled by another.

ABA and therapy clinics have a similar pattern:

• Staff coverage questions get raised in chat.
• RBT onboarding has many small steps.
• Procedure documents need to be shared with every new team member.

Chanty helps with the conversation and the follow-up. It does not do shift scheduling or session notes. The schedule and clinical documentation stay in the systems built for them.

A simple test helps: does the work start in a conversation? If it does, tasks tied to chat usually work better than a separate PM tool that staff forget to open.

How tasks work in Chanty

Tasks in Chanty live inside the same workspace as your HIPAA-compliant chat for staff. The request, the discussion and the follow-up stay in one place.

• Message to task in one click. Turn any message into a task, or create one from scratch. Each task has an assignee, a due date, a status and a priority.
• List or Kanban. Track work as a list, or move cards across a built-in Kanban board.
• Teambook. This hub gathers tasks, files, links, pinned messages and conversations in one place.
• Context stays with the task. Discussion continues in the thread where the task started. Unlimited searchable message history is included on every plan, including Free.
• Works where staff are. Apps are available for iOS, Android, macOS, Windows and web. The interface looks like WhatsApp, so front desk and deskless staff need little training.
• Voice notes. Staff can send a voice note when typing between patients is not practical. When a task needs a live discussion, use HIPAA-compliant video calls for staff.

[Screenshot: turning a message into a task]

[Screenshot: Kanban board with clinic operations tasks]

[Screenshot: Teambook hub]

See all Chanty features for healthcare teams.

Clinic workflows you can run with chat-based tasks

• Front desk to admin handoff. A front desk message about missing insurance paperwork becomes a task assigned to billing, due Thursday. Keep PHI to the minimum necessary. A patient initial and account number is often enough; a full history is not.
• Facilities and supplies. Someone reports a broken autoclave in the location channel. The office manager assigns it to the person who calls the vendor. The card moves from "To do" to "Waiting on vendor" to "Done."
• New staff onboarding. Assign IT access, training documents and policy acknowledgements as separate tasks with owners and dates. Share the documents in the same workspace with HIPAA-compliant file sharing.
• Multi-location groups. Set up one channel per site plus a shared operations channel. HQ can assign and track work across locations without a separate tool. Read more about team collaboration across locations.

These are operational workflows. Clinical orders, results, care plans and urgent clinical alerts belong in your EHR and approved clinical communication systems, not in Chanty tasks.

HIPAA, BAA and security by plan

	Free	Business	Enterprise
BAA	Not available	Signed BAA	BAA plus negotiated MSA
PHI	Do not store PHI	Permitted under the BAA, which covers all team-space data, including messages, files, voice notes, tasks and Teambook	Permitted under the BAA (same scope)
Limits	Up to 5 members, 10 integrations, 20 GB per team	20 GB storage per user; 3 free guests per paid seat	Custom
Login and access	Standard login	One-time-code login, 2FA, SSO, IP allowlisting	SAML SSO, directory sync, SCIM, IP allowlisting
Roles and governance	Not included	Customizable roles and retention (retention applies to messages, files, voice notes, tasks and Teambook)	Unlimited custom roles, DLP and governance controls
Guests	Guest access to selected conversations	3 free guest seats per paid member	Guest access to selected conversations
Data residency	No regional commitment	No regional commitment	US, EU or APAC; on-premise option
AI agents	Not included	Not included	Included, with agent governance
Price	Free	Paid plan, billed per member	Custom, through sales

Encryption. On all plans, data is encrypted in transit with TLS 1.2+, and file storage is encrypted. This is not end-to-end encryption.

Certifications. Chanty is SOC 2 Type II and ISO 27001 certified, with reports covering the Chanty services available on request. For details, see security, HIPAA and BAA details.

Integrations. Third-party integrations are outside Chanty's BAA scope. This includes Trello, Asana, Jira, Google Drive, Dropbox, Zapier and others. Check each vendor's own BAA before sending PHI through them.

When Chanty tasks are not the right fit

• Complex projects. Task management is basic, with list and Kanban views only. There are no dependencies, Gantt charts, portfolios or resource planning. If you are running a multi-month EHR migration, use a dedicated PM tool.
• Scheduling and HR. There is no built-in shift scheduling, time tracking or HR functions. Keep using your workforce management system.
• PHI in a PM suite. If you need a full PM suite that holds PHI, confirm the vendor offers a BAA and on which tier. You can check whether popular tools are HIPAA compliant before you decide.
• Pairing a PM tool with Chanty. Notifications from Trello, Asana, Jira, ClickUp, Monday.com, Wrike and Basecamp can post into Chanty channels. Keep PHI out of integration payloads unless both vendors' BAAs cover them.

AI agents for follow-up work (Enterprise only)

On the Enterprise plan, you can mention an AI agent in a thread the same way you mention a teammate. It reads the thread, does the job and reports back in the same conversation, where everyone can see it. For example, an agent can summarize open supply requests for a location. You can bring an AI model or agent your organization already uses, or build your own.

Control comes with it:

• Per-role interaction levels set who each agent takes orders from.
• The same 120+ permission settings apply to agents and people.
• Agents can be seen and revoked.
• A real-time audit trail logs every agent action.
• Conversations are not used to train outside models.

AI agents and connected external models are outside the standard BAA. Do not route PHI to agents unless a separate written agreement covers the agents and the models you connect.

Setup checklist before staff start assigning tasks

1. Choose Business or Enterprise and sign the BAA before anyone shares PHI.
2. Configure roles and permissions. Set up guest access for contractors and vendors, limited to the conversations they need.
3. Agree on task conventions. Decide who can assign tasks, how tasks are named (for example, "Location – Issue – Owner"), when due dates are required, and what counts as done.
4. Write a minimum-necessary rule for task text. Specify which identifiers staff may include in task text and which they may not.
5. Secure access. Turn on 2FA or SSO, define retention, and add Chanty to your offboarding checklist so access is removed on a person's last day.
6. Start small. Begin with one team or location, review after a few weeks, then expand.

For related procedures and templates, see the operations library for clinics. When you are ready, sign up at https://www.chanty.com/signup.

FAQ

Is Chanty's task management HIPAA compliant?

Chanty is HIPAA-compliant with a signed BAA on the Business and Enterprise plans. The BAA covers all data in the team space, including messages, files, voice notes, tasks and Teambook. It is not compliant on the Free plan. Your clinic remains responsible for roles, access, training and the minimum-necessary rule.

Which Chanty plan do I need to put PHI in tasks?

You need Business or Enterprise, with a signed BAA in place first. Choose Enterprise if you need SAML SSO, SCIM, DLP, data residency or AI agents.

Can I use the free plan for clinic tasks?

Only for tasks that contain no PHI. The Free plan has no BAA and is limited to 5 members, 10 integrations and 20 GB per team.

Is Chanty a replacement for Asana, monday.com or other project management software?

For daily operational follow-up, often yes. For complex projects with dependencies, Gantt charts or portfolios, no. Those tools can send notifications into Chanty if you use both.

Does Chanty sign a BAA, and does it cover integrations?

Chanty signs a BAA on Business and Enterprise. Third-party integrations are outside its BAA scope. Check each vendor's own BAA.

Can tasks be assigned across multiple clinic locations?

Yes. Use channels per site and a shared operations channel, then assign tasks to any member of the workspace.

Is this suitable for ABA clinics?

It suits operational coordination in ABA clinics, such as onboarding, coverage questions and procedure sharing. It does not handle shift scheduling, session notes or treatment plans.

Can AI agents create or follow up on tasks, and is that covered by the BAA?

AI agents are available on Enterprise only. Their actions are governed by permissions and logged in an audit trail. Agents and connected models are outside the standard BAA, so do not send PHI to agents unless a separate written agreement covers the models you connect.

Does Chanty handle shift scheduling or clinical task lists?

No. Chanty has no shift scheduling, time tracking or HR functions. Clinical orders, results and clinical task lists belong in your EHR.