HIPAA compliant practice management software? Who signs a BAA
Practice management and EHR systems for therapy and small medical practices — how each puts its BAA in place, from which plan, and what that agreement covers.
Practice management and EHR at a glance
Practice management and EHR systems hold the whole patient record, so check that the BAA covers every module that handles PHI on your behalf, including the portal and messaging, and that access follows each person's role. Ordinary financial payment processing can fall outside the BAA requirement. We compare 5 products in Practice management and EHR. 5 sign a Business Associate Agreement (eClinicalWorks, Elation Health, SimplePractice, Tebra, TherapyNotes). Every value links to the vendor's own documentation and shows when it was checked.
| Sign a BAA | eClinicalWorks, Elation Health, SimplePractice, Tebra, TherapyNotes |
|---|---|
| Products compared | 5 |
| Compared on | BAA without a sales process, BAA on entry-level team plans |
2 more facts
| Commissions | None — no vendor pays us |
|---|---|
| Facts checked since | 2026-10-06 |
Comparison
Alphabetical. No vendor pays us for listings, rankings or referrals — methodology.
| Product | Signs a BAA | BAA without a sales process | BAA on entry-level team plans |
|---|---|---|---|
| eClinicalWorks | Yes | Not verified | Not verified |
| Elation Health | Yes | Yes | Not verified |
| SimplePractice | Yes | Yes | Yes |
| Tebra | Yes | Yes | Yes |
| TherapyNotes | Yes | Yes | Yes |
Found an outdated or wrong fact? Report it
What to check before you choose
- How the BAA is put in place
- Many practice systems include a BAA in their terms or sign one on request. Confirm it covers the modules you will use, including the patient portal, payments and messaging.
- Roles and the access trail
- HIPAA requires access limited to what each role needs and audit controls (164.308(a)(4), 164.312(b)). Look for role-based access for front desk, billing and clinicians, and an audit trail of who opened which chart.
- Psychotherapy notes
- Therapists who keep psychotherapy notes need a place for them separate from the client record (psychotherapy notes).
- Connected services
- E-fax, labs, claims clearinghouses and reminder services connect to the system. For each, work out who it is to you: your own business associate (you need a BAA with it), a subcontractor of your practice-management vendor (the vendor's agreement with it covers that, 164.504(e)(2)(ii)(D)), or a provider receiving information for treatment (no BAA needed).
- Export and exit
- You must be able to give patients copies of their records and keep records for the period state law sets. Check export formats and what happens to your data when you leave.
Common mistakes
- One shared login at the front desk.
- Former staff accounts left active after they leave.
- Exporting reports to personal email or unencrypted spreadsheets.
How we compare
- BAA without a sales process
- You can put the BAA in place yourself — it is included in standard terms or accepted in account settings — rather than requesting it and waiting for approval.
- BAA on entry-level team plans
- The BAA is available on the vendor's entry-level business or team plan, not only on enterprise tiers.
Requirements behind these criteria
- Business associate agreements (BAAs) →§ 164.502(e)
- Psychotherapy notes →§ 164.501
- Right of access →§ 164.524
- Minimum necessary →§ 164.502(b)