Is eClinicalWorks HIPAA compliant?
EHR and practice management for ambulatory practices, with the healow patient portal and app. eClinicalWorks publishes its customer BAA as a form signed by both parties.
eClinicalWorks signs a Business Associate Agreement. eClinicalWorks publishes a customer Business Associate Agreement (version 2025-02-28) with signature blocks for the customer and eClinicalWorks and a blank effective date. The published form provides for execution by both parties; it does not establish whether signing can be completed through a self-service process.
A BAA alone does not make its use HIPAA compliant: set it up as described under What to configure, and cover it in your risk analysis.
Source: eClinicalWorks — HIPAA BAA, Customer (2025) · checked
Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →
BAA details
| Signs a BAA | Yes | eClinicalWorks — HIPAA BAA, Customer (2025) |
|---|
What you still have to configure
- Sign the BAA with eClinicalWorks before patient data goes in, and keep the executed copy with its effective date. source
Limitations
- For a patient's access request, the BAA gives eClinicalWorks 30 business days to provide records it holds — longer than the 30 calendar days you have to act under 164.524, so keep your own copy reachable. source
- The BAA allows eClinicalWorks to aggregate data or de-identify information in accordance with 45 CFR 164.514(a)–(c), and to use the aggregated data or de-identified information for testing, product improvement or other purposes permitted by law, and disclose it to third-party vendors you use (§§2(a)(vi), 3(a)). source
- Breaches and successful security incidents are reported within 30 days, or sooner if state law requires. source
Against our criteria
| BAA without a sales process | Not verified — The published form is executed by both parties (signature blocks); whether a practice can complete it without the sales process is not stated. | eClinicalWorks — HIPAA BAA, Customer (2025) |
|---|---|---|
| BAA on entry-level team plans | Not verified — The published BAA does not say which plans it covers. | eClinicalWorks — HIPAA BAA, Customer (2025) |