Do I need a BAA with this vendor?
Two questions: is the vendor a business associate, and will it sign a BAA for the plan you use? The first is below; the second is answered for every product we track.
The short answer
You need a business associate agreement with a vendor if it creates, receives, maintains or transmits protected health information on your behalf — an EHR, email or texting service, cloud storage, telehealth platform, AI tool, billing company or IT provider with access to patient data. You don't need one with vendors that never handle PHI, or with pure conduits such as an internet provider that only transmits data. Whether a vendor will sign a BAA often depends on the plan, so check the product, not just the company.
| BAA needed when | The vendor creates, receives, maintains or transmits PHI for you |
|---|---|
| Not needed | Vendors with no PHI access; transmission-only conduits; your own workforce |
| Plan matters | Many vendors sign BAAs only on business or enterprise plans |
| Rule | 45 CFR 164.502(e), 164.504(e), 164.308(b) |
Step 1 — Is the vendor a business associate?
- Yes, usually: it stores, processes or can access PHI to provide its service — EHR, email, texting, telehealth, cloud storage, backups, AI tools, billing, IT support.
- No: it never handles PHI (for example, an office supplies vendor), or it only transmits data as a conduit, like the postal service or an internet provider.
- Not a vendor relationship: your own employees and volunteers are workforce, not business associates; other providers you share PHI with for treatment are not your business associates.
More on the definition and the conduit exception: business associates and business associate agreements.
Step 2 — Will it sign a BAA?
Jump to: AI medical scribes · AI tools and LLMs · Cloud storage and file sharing · CRM and patient relationship management · HIPAA email services · HIPAA hosting and cloud platforms · Online fax · Online forms and patient intake · Online scheduling · Patient texting and messaging · Phone systems · Practice management and EHR · Telehealth and video visits
AI medical scribes
| Product | Signs a BAA | On which plans | Checked |
|---|---|---|---|
| Freed | Yes | Freed's Terms of Use include a Business Associate Agreement (Schedule A), so it applies to every account when you sign up; team plans also list an organization-wide BAA. | |
| Heidi Health | Yes | Heidi says it makes a BAA available to every covered entity it works with. Third-party reviews differ on which plans include a signed BAA — confirm with Heidi before relying on a free or entry plan. |
Found an outdated or wrong fact? Report it
AI tools and LLMs
| Product | Signs a BAA | On which plans | Checked |
|---|---|---|---|
| Amazon Bedrock | Yes | HIPAA eligible; requires an AWS business associate agreement before using it with PHI. | |
| Azure OpenAI (Microsoft Foundry) | Yes | Included by default via the Microsoft Products and Services Data Protection Addendum for in-scope Azure services; no separate contract to sign. | |
| BastionGPT | Yes | Professional ($20/user/month), Professional Plus ($45), Enterprise ($75) | |
| ChatGPT (Free, Go, Plus, Pro and Business) | No | OpenAI's HIPAA guide lists Free, Plus, Pro and ChatGPT Business as not eligible; eligible ChatGPT services are ChatGPT for Healthcare, ChatGPT for Clinicians and Enterprise/Edu with the Regulated Workspace. | |
| ChatGPT for Clinicians | Conditional | ChatGPT for Clinicians (eligible verified clinicians) | |
| ChatGPT for Healthcare and Enterprise | Conditional | ChatGPT for Healthcare, ChatGPT Enterprise with Regulated Workspace, ChatGPT FedRAMP | |
| Claude (Anthropic) | Conditional | Claude Enterprise (HIPAA activated), Anthropic API, Claude in Microsoft Foundry | |
| CompliantChatGPT | Yes | The terms make a standard BAA available through Settings or on request, and say it may apply to all plan tiers, including trial and paid subscriptions. | |
| Gemini in Google Workspace | Conditional | Workspace editions eligible for Google's HIPAA BAA | |
| Google Cloud Vertex AI and Gemini Enterprise | Yes | Gemini Enterprise and Generative AI on Google Cloud are listed among products covered by the Google Cloud BAA. | |
| Microsoft 365 Copilot | Conditional | Commercial and GCC Microsoft 365 plans with Copilot | |
| OpenAI API | Conditional | Admins of eligible organizations accept the standard BAA and enable HIPAA compliance support in API Organization settings > General; only the HIPAA endpoints OpenAI lists are covered. |
Found an outdated or wrong fact? Report it
Cloud storage and file sharing
| Product | Signs a BAA | On which plans | Checked |
|---|---|---|---|
| Box | Conditional | Enterprise, Enterprise Plus, Enterprise Advanced | |
| Dropbox | Yes | Standard, Business, Advanced, Business Plus, Enterprise | |
| Google Drive (Google Workspace) | Yes | Google Drive, including Docs, Forms, Sheets, Slides and Vids, is on Google Workspace's HIPAA Included Functionality list. | |
| OneDrive for Business (Microsoft 365) | Yes | OneDrive for Business is listed among in-scope Office 365 services; the BAA is included by default for covered entities and business associates. |
Found an outdated or wrong fact? Report it
CRM and patient relationship management
| Product | Signs a BAA | On which plans | Checked |
|---|---|---|---|
| HubSpot | Conditional | Enterprise subscriptions (Marketing, Sales, Service, Data and Content Hub, Smart CRM) | |
| Microsoft Dynamics 365 | Yes | Dynamics 365 is listed among Microsoft's in-scope cloud services; the BAA comes by default through the Online Services Data Protection Addendum for covered entities and business associates. | |
| Pipedrive | No | Pipedrive's Terms of Service (section 7.3) prohibit processing sensitive information and say its services are not designed to comply with industry-specific regulations such as HIPAA. We found no BAA offered. | |
| Salesforce | Conditional | Customers contact their account representative for a Business Associate Addendum; Sales Cloud, Service Cloud, Health Cloud and the Lightning Platform are on the covered services list, covered only if the signed BAA includes them. | |
| Zoho CRM | Conditional | Zoho provides a BAA template on request (legal@zohocorp.com); the BAA names the covered Zoho applications, and Zoho says no PHI should flow through any Zoho application until a signed BAA is in place. |
Found an outdated or wrong fact? Report it
HIPAA email services
| Product | Signs a BAA | On which plans | Checked |
|---|---|---|---|
| Google Workspace | Yes | Accepted electronically in the Admin console (Account settings > Legal and compliance). Covers the services on Google's HIPAA Included Functionality list. | |
| Hushmail for Healthcare | Yes | Healthcare Basic, Healthcare Essentials, Healthcare Growth | |
| Microsoft 365 | Yes | Included by default through the Microsoft Online Services Data Protection Addendum for covered entities and business associates; covers in-scope services including Exchange Online. | |
| Paubox | Yes | Paubox states that BAAs are included with all accounts. | |
| Proton Mail | Yes | Available to all Proton users on request: email privacy@support.proton.me with the subject "HIPAA BAA". |
Found an outdated or wrong fact? Report it
HIPAA hosting and cloud platforms
| Product | Signs a BAA | On which plans | Checked |
|---|---|---|---|
| Amazon Web Services (AWS) | Yes | Requires an AWS business associate agreement; only services on the HIPAA eligible list may be used with PHI. | |
| Aptible | Yes | Every deployment includes a signed BAA. | |
| Atlantic.Net HIPAA Hosting | Yes | A BAA is included with all HIPAA hosting plans. | |
| Google Cloud | Yes | Google Cloud BAA covers its infrastructure in all regions and a published list of supported products. | |
| Microsoft Azure | Yes | Included by default through the Microsoft Products and Services Data Protection Addendum for in-scope Azure services. | |
| Supabase | Conditional | Team (from $599/month, plus the paid HIPAA add-on and usage), Enterprise (with the paid HIPAA add-on) |
Found an outdated or wrong fact? Report it
Online fax
| Product | Signs a BAA | On which plans | Checked |
|---|---|---|---|
| Documo Cloud Fax | Yes | Solo Cloud Fax ($25/month billed annually), Business Cloud Fax, Enterprise Cloud Fax, Custom Platform | |
| eFax Corporate | Yes | eFax says: "Both eFax Business and eFax Corporate offer BAA standard with their software." | |
| Fax.Plus | Conditional | Enterprise | |
| iFax | Conditional | iFax says it provides a signed Business Associate Agreement for healthcare clients; HIPAA features start at the Plus plan. Confirm coverage for the plan you choose. | |
| RingCentral Fax | Yes | RingCentral makes a BAA available to its paying covered-entity customers; RingCentral Fax is listed among the covered services, alongside RingEX and RingCX. | |
| SRFax | Yes | SRFax says it will sign a Business Associate Agreement; the healthcare plan page links "Request a BAA" to its contact page and does not tie the BAA to particular plans. |
Found an outdated or wrong fact? Report it
Online forms and patient intake
| Product | Signs a BAA | On which plans | Checked |
|---|---|---|---|
| Cognito Forms | Conditional | Enterprise | |
| Formstack Forms | Conditional | Forms, with the HIPAA add-on, Suite, with the HIPAA add-on, Enterprise and Salesforce solutions | |
| Google Forms | Yes | Google lists Google Forms under Google Drive among the Workspace services in its BAA; a super administrator accepts the BAA in the Admin console. | |
| IntakeQ | Yes | IntakeQ (forms), PracticeQ | |
| Jotform | Conditional | Gold ($129/month, or $99/month billed annually), Enterprise | |
| Microsoft Forms | Yes | Forms is listed among the in-scope Office 365 services; Microsoft's BAA comes by default through the Online Services Data Protection Addendum for covered entities and business associates. | |
| Typeform | Conditional | Enterprise, Growth Custom |
Found an outdated or wrong fact? Report it
Online scheduling
| Product | Signs a BAA | On which plans | Checked |
|---|---|---|---|
| Acuity Scheduling | Conditional | Premium ($55/month billed annually, $69 monthly), Powerhouse (named in Acuity's HIPAA help article) | |
| Calendly | No | Calendly's Customer Terms (section 13(d)) require that customer data not contain protected health information or information subject to HIPAA. | |
| Google Calendar appointment schedules | Yes | Google Calendar is listed among the Workspace services included in Google's BAA; a super administrator accepts the BAA in the Admin console. | |
| Setmore | Conditional | Pro (with Setmore Health), Team (with Setmore Health) | |
| Square Appointments | Conditional | Square's HIPAA Business Associate Agreement applies "including when you use Square Appointments, Invoices", limited to configurations where Square acts as a business associate. |
Found an outdated or wrong fact? Report it
Patient texting and messaging
| Product | Signs a BAA | On which plans | Checked |
|---|---|---|---|
| OhMD | Yes | Core ($300/month) | |
| Spruce Health | Yes | Basic ($24/user/month), Communicator ($49/user/month) |
Found an outdated or wrong fact? Report it
Phone systems
| Product | Signs a BAA | On which plans | Checked |
|---|---|---|---|
| 8x8 X Series | Conditional | X Series | |
| Dialpad | Yes | Dialpad says healthcare industry customers can sign a Business Associate Agreement with one click. | |
| Google Voice | Conditional | Google lists "Google Voice (managed users only)" among the Workspace services in its BAA; a super administrator accepts the BAA in the Admin console. | |
| Nextiva | Yes | Nextiva requires customers using its HIPAA products to sign its Business Associate Agreement; phone service, virtual fax and video conferencing are named among the covered services. | |
| Quo | Conditional | Business ($23 per user/month billed annually, $33 monthly), Scale | |
| RingCentral RingEX | Yes | RingCentral makes a BAA available to its paying covered-entity customers; RingEX is listed among the covered services, with RingCentral Fax, RingCX and several AI products. | |
| Weave | Yes | Weave publishes a Business Associate Agreement addendum that supplements the underlying agreement, including the Terms of Service, and is effective upon execution of that agreement; subcontractors are bound to the same restrictions. |
Found an outdated or wrong fact? Report it
Practice management and EHR
| Product | Signs a BAA | On which plans | Checked |
|---|---|---|---|
| eClinicalWorks | Yes | eClinicalWorks publishes a customer Business Associate Agreement (version 2025-02-28) with signature blocks for the customer and eClinicalWorks and a blank effective date. The published form provides for execution by both parties; it does not establish whether signing can be completed through a self-service process. | |
| Elation Health | Yes | Elation publishes a standard Business Associate Agreement that "is effective as of the date Covered Entity presses 'I agree'" and covers the services under the practice's existing agreement with Elation. | |
| SimplePractice | Yes | The SimplePractice BAA is entered into at the date and time your account is created and is part of its Terms of Service. | |
| Tebra | Yes | Tebra's Business Associate Agreement "shall be incorporated into the Terms of Service for Customers that are Covered Entities" and takes effect on the account's Activation Date (BAA last updated March 17, 2025). | |
| TherapyNotes | Yes | TherapyNotes' help center describes the BAA as part of the Terms of Service accepted during account setup, with no separate signature step (reported since April 23, 2026). Confirm the current terms in your account. |
Found an outdated or wrong fact? Report it
Telehealth and video visits
| Product | Signs a BAA | On which plans | Checked |
|---|---|---|---|
| doxy.me | Yes | All users get a free BAA, generated in Account Settings > BAA. | |
| Google Meet (Google Workspace) | Yes | Google Meet is on Google Workspace's HIPAA Included Functionality list; the BAA is accepted in the Admin console. | |
| Microsoft Teams (Microsoft 365) | Yes | Microsoft Teams is listed among in-scope Office 365 services; the BAA is included by default for covered entities and business associates. | |
| Zoom | Conditional | Zoom signs BAAs with customers on its paid plans (Pro, Business, Business Plus, Enterprise). Pro customers accept the U.S. BAA at checkout or in Plan Management; Business, Business Plus and Enterprise customers sign through sales. |
Found an outdated or wrong fact? Report it
A BAA being available doesn't mean every feature is covered — each product page lists exclusions, required settings and the vendor's own source and the date we checked it. Alphabetical; no vendor pays us — methodology.
Frequently asked questions
Do I need a BAA with every vendor?
No. You need one with vendors that are business associates — those that create, receive, maintain or transmit PHI on your behalf. Vendors that never touch PHI, and pure conduits that only transmit data, do not need one.
What if a vendor refuses to sign a BAA?
Then you should not give it PHI. Choose a vendor that signs one, or use the service only in ways that keep PHI out of it.
Does a BAA make a tool HIPAA compliant?
No. A BAA is the contract that lets the vendor handle PHI for you. You still have to use the covered plan and services, configure them as the vendor requires, and cover them in your risk analysis.