HIPAA-Compliant Apps and Software: What Qualifies and Which Categories Clinics Need

No app is HIPAA compliant on its own, and no official HIPAA certification for software exists. A tool is safe to use with protected health information (PHI) when three things line up. First, the vendor signs a business associate agreement (BAA) that covers the service and plan you use. Second, the product has the required safeguards. Third, your practice configures and uses it correctly. This guide gives you a five-question test for any vendor and a map of the software categories clinics need, so you can judge any "HIPAA-compliant apps" list yourself.

What makes an app or software HIPAA compliant

HIPAA compliance describes how an organization handles PHI. It is not a property of a product. The same app can be appropriate in one practice and a risk in another, depending on the plan purchased, the contract signed and how staff use it.

There is no government certification for HIPAA software. HHS does not certify or endorse products. When a vendor says "HIPAA certified," it is using a marketing phrase. Some vendors pass third-party audits, and those reports have value, but no audit replaces the obligations HIPAA places on you and your vendors.

A tool is usable with PHI when three conditions are met:

1. A signed BAA covers the specific service and plan your practice uses.
2. Safeguards are in place. The Security Rule requires administrative, physical and technical safeguards. A vendor's product supports the technical side, such as access controls, encryption and audit logs.
3. Configuration and policies are correct. Roles are set, two-factor authentication is on, departing staff lose access the same day, and staff know what may and may not be shared.

These responsibilities are shared. The vendor secures its infrastructure and application. The practice controls who has accounts, which devices staff use, how offboarding works, what training staff receive and which data goes into which tool. A vendor with a perfect security program cannot stop a front desk coordinator from texting a patient's insurance card to a personal phone.

For related topics, see our healthcare communication and HIPAA guides.

The BAA: the first thing to check

A business associate is a person or company that creates, receives, maintains or transmits PHI on behalf of a covered entity. Before sharing PHI with that vendor, the covered entity must have a written agreement in place. The agreement commits the vendor to safeguard the data, report breaches and limit its use.

Cloud vendors count. A cloud service that stores PHI is generally a business associate even if it never views the data, and even if the data is encrypted.

Check three things about any BAA:

• Which plan it covers. Many vendors offer a BAA only on specific paid tiers. The free plan or consumer version of the same app is usually not covered. If your practice upgrades one team but leaves another on a free workspace, only the paid workspace is covered.
• Which services it covers. Some BAAs list covered services by name. Add-ons, AI features, marketplace apps and integrations may be excluded. AI tools raise their own questions, covered in HIPAA and AI, including whether ChatGPT is HIPAA compliant.
• Who signs and when. The BAA must be signed before PHI enters the tool, not after an incident.

The conduit exception. Services that only transmit data and do not store it, such as the postal service or an internet service provider, may not need a BAA. HHS interprets this exception narrowly. Any app that keeps messages, files or recordings is storing data, so it does not qualify as a conduit.

Safeguards to look for in any HIPAA-compliant platform

When you review a vendor's security or trust page, look for these controls.

Access controls

• A unique login for each user, with no shared front desk accounts
• Role-based permissions, so billing staff, clinical staff and contractors see different things
• Single sign-on (SSO) and two-factor authentication

Encryption

• In transit: data is encrypted as it moves between the device and the vendor's servers, typically with TLS.
• At rest: stored data and files are encrypted on the vendor's systems.
• End-to-end: only the sender and recipient devices can decrypt the content.

HIPAA does not specifically require end-to-end encryption. Encryption is an addressable implementation specification. You must implement it or document why an equivalent measure is reasonable. Encryption in transit and at rest, combined with access controls, is a common approach.

Records and recovery

• Audit logs that show who accessed or changed what
• Retention settings, so you control how long messages and files are kept
• Backups and documented recovery procedures
• The ability to remove a user's access remotely when they leave, including on mobile devices

Breach notification The BAA should state how quickly the vendor will notify you of a breach or security incident.

Supporting evidence Many vendors share SOC 2 Type II reports or ISO 27001 certificates. These show that an independent auditor reviewed the vendor's controls. They are useful signals, but they do not substitute for a BAA.

Categories of HIPAA-compliant software clinics use

No single app covers everything. Most practices run a stack of tools, and each one that touches PHI needs its own review.

• Clinical systems. These include the EHR/EMR, e-prescribing and specialized clinical communication platforms. They are the system of record for patient care: charts, orders, results and clinical handoffs.
• Practice management. This covers scheduling, billing, insurance verification and patient intake forms.
• Patient-facing communication. This includes patient portals, patient messaging and texting, telehealth video and website live chat. See HIPAA-compliant telehealth platforms for the video side.
• Staff communication and coordination. This covers team chat, internal calls, announcements, shared files and assigned tasks for operational work. Examples include covering a call-out, restocking supplies, fixing a broken printer at one location and confirming that a policy update reached everyone.
• Supporting infrastructure. This includes email, phone systems, fax, cloud file storage, e-signature and compliance management tools. For the compliance tools, see HIPAA compliance software compared.

Category	Typical job	What to verify
EHR/EMR	Clinical records, orders, results	BAA, audit logs, access by role, integration scope
Practice management	Scheduling, billing, intake	BAA, which modules it covers, patient form storage
Patient communication	Portal messages, texts, telehealth	BAA, patient consent workflow, recording storage
Staff chat and coordination	Internal messages, calls, tasks, files	BAA on your specific plan, retention, offboarding, mobile app coverage
Email	Internal and external email	BAA, encryption for outbound messages to patients
Phone and fax	Calls, voicemail, faxed records	BAA, voicemail and fax storage, call recording
Cloud storage and e-signature	Shared documents, signed forms	BAA, sharing permissions, link expiry
Compliance software	Risk assessments, training, policies	Whether it stores PHI at all, and what evidence it produces

Mobile and cloud apps: extra checks for phones

Phones are where most informal PHI sharing happens. Staff often coordinate a schedule change, a lab courier pickup or a patient's late arrival in a personal group chat because that is the app they already have open.

Personal messengers and SMS. WhatsApp groups, iMessage threads and plain text messages are common shadow IT in clinics. Before any of these carries PHI, confirm whether the provider offers a BAA at all. If no BAA is offered, the tool should not carry PHI, however convenient it is. Our guide to HIPAA texting rules covers the options in more detail.

Device controls. Even an approved app can leak PHI through the phone:

• Require a screen lock and a short auto-lock time.
• Confirm that an admin can sign a user out remotely when a phone is lost or someone leaves.
• Check whether message previews show on the lock screen. Turn off content previews where possible.
• Check whether images received in the app save automatically to the phone's photo gallery, which may sync to a personal cloud account.

Cloud-based apps. Ask where data is hosted and whether the BAA covers the mobile apps as well as the web version. Some vendors offer regional hosting only on higher plans.

Bring-your-own-device (BYOD). If staff use personal phones, the BYOD policy is the practice's responsibility, not the vendor's. Write down which apps are approved, what happens to work data when someone leaves, and who to tell when a phone is lost.

Specialty practices: therapy, med spa, ABA, dental and home care

The same test applies regardless of specialty. Vertical software usually covers clinical records, scheduling and billing. Examples include therapy note platforms, med spa booking systems, ABA data collection tools, dental practice management and home care visit tracking. That software rarely covers all staff communication. The gap usually shows up between shifts, between locations and between the front desk and the back office.

Therapists and solo practitioners. Whether HIPAA applies depends on how you bill and transmit information. See does HIPAA apply to therapists. If it applies, start by confirming a BAA with your notes platform, your telehealth tool and any messaging tool you use with clients or colleagues.

Med spas and wellness businesses. Whether a med spa is a covered entity depends on the services it offers and whether it bills health plans electronically. A cash-only aesthetics business may fall outside HIPAA. A practice that bills insurance for medical services likely falls inside it. Get a determination from your counsel rather than assuming either way.

ABA, dental and home care. These practices often run several tools at once, with staff working across homes, schools or multiple sites.

Multi-tool stacks. List every tool that touches PHI and confirm a BAA for each. Include the connections between tools. An integration that copies appointment details from your scheduling system into an email digest or a chat channel moves PHI into another vendor's environment, and that vendor needs to be covered too.

A five-question test for any "HIPAA-compliant app" list

Lists of HIPAA-compliant apps go out of date quickly as vendors change plans and contracts. Ask these five questions instead:

1. Will the vendor sign a BAA, and on which plan? Get the plan name in writing.
2. What does the BAA exclude? Look specifically at AI features, integrations, marketplace apps and the free tier.
3. Which safeguards are documented? Look for a security or trust page that covers encryption, access controls, audit logs and breach notification.
4. Can we control roles, retention, login and offboarding ourselves? You need to remove a departing employee's access in minutes without opening a support ticket.
5. Does the tool fit the job? Decide whether you are buying a clinical record, a patient communication tool or a tool for internal staff coordination. A tool that is compliant but used for the wrong job still creates risk.

For specific products, see our popular tools checked for HIPAA.

Where staff chat fits, and where Chanty fits

Many practices have a compliant EHR, scheduling system and patient portal. Even so, staff still coordinate everyday operations over internal email, personal texts or WhatsApp groups:

• The front desk asks who is covering a call-out.
• A clinic manager tells three locations about a new check-in procedure.
• Someone flags that the autoclave needs service.

None of that belongs in the EHR, and much of it should not be on personal phones.

A staff chat with a BAA covers this internal operational coordination alongside your clinical systems. It does not replace the EHR, patient messaging, telehealth or clinical alerting. Clinical handoffs and urgent clinical alerts belong in systems built and validated for them.

Chanty is team chat and work coordination for clinic staff. It brings chats, calls, announcements, files and assigned tasks into one workspace, so an operational request ends with an owner, a deadline and a follow-up.

HIPAA and BAA. Chanty supports HIPAA compliance with a signed BAA on the Business and Enterprise plans. The Free plan has no BAA and should not be used for PHI.

Security. Data is encrypted in transit with TLS 1.2+, and file storage is encrypted. Business adds customizable roles, two-factor authentication and SSO.

What the BAA does not cover. Third-party integrations fall outside Chanty's BAA scope. AI agents are an Enterprise-only feature, so confirm the BAA scope for agents and any connected models before using them with PHI.

Your responsibilities. Your practice still configures roles, manages access and offboarding, secures devices and trains staff.

Read more about HIPAA-compliant chat for clinic staff and Chanty security, HIPAA and BAA details.

Try Chanty for your team

FAQ

Is there such a thing as HIPAA-certified software?

No. There is no official HIPAA certification for software, and HHS does not certify or endorse products. "HIPAA certified" is a marketing phrase. Look for a signed BAA and documented safeguards instead.

What makes an app HIPAA compliant?

Three things together:

• a BAA covering the service and plan you use
• safeguards such as access controls, encryption and audit logs
• correct configuration and staff policies at your practice

The vendor alone cannot make an app compliant.

Does a free version of an app count as HIPAA compliant?

Usually not. Many vendors offer a BAA only on specific paid plans, and the free tier is excluded. Confirm the plan name in the BAA before you put any PHI into the tool.

Are WhatsApp or iMessage HIPAA compliant for staff?

Check whether the provider offers a BAA. Without a BAA, the app should not carry PHI. Personal messengers also make offboarding hard, because the work conversation stays on the former employee's phone.

Do I need a BAA with every software vendor?

You need one with every vendor that creates, receives, maintains or transmits PHI on your behalf. A tool that never touches PHI does not need a BAA. A tool that stores PHI does, even if the vendor never reads it. The narrow conduit exception applies only to transmission-only services.

Is end-to-end encryption required by HIPAA?

No. Encryption is an addressable implementation specification. HIPAA does not mandate end-to-end encryption specifically. Encryption in transit and at rest, combined with access controls and a BAA, is a common way to meet the requirement.

What HIPAA-compliant apps do therapists need?

Start with the tools that hold client information:

• your notes or practice management platform
• your telehealth tool
• any messaging or email tool used with clients

Confirm a BAA for each. If you are unsure whether HIPAA applies to your practice, check how you bill and transmit information first.

Can a HIPAA-compliant app make my practice compliant?

No. An app with a BAA and strong safeguards handles the vendor's share of the work. Your practice is still responsible for risk assessments, policies, staff training, access management, device security and choosing the right tool for each job.