HCHIPAA Compliant Wiki

Recent changes in vendor HIPAA status

Every change to a verdict, a plan list or an exclusion is recorded here with the date and the vendor page that triggered it. New cards appear when they are first verified. Vendors and readers can report a change through the correction form.

2026-10-20

  • Adobe Acrobat: card added, verdict Conditional, BAA from Acrobat Sign Solutions for enterprise.
  • Amazon Bedrock: card added, verdict Yes, BAA from All AWS accounts.
  • Atlantic.Net: card added, verdict Conditional, BAA from HIPAA Developer.
  • Chanty: card added, verdict Conditional, BAA from Business.
  • Constant Contact: card added, verdict Conditional, BAA from All plans (on request).
  • Dialpad: card added, verdict Conditional, BAA from All paid Dialpad accounts (Dialpad Connect Standard, Pro, Enterprise; Dialpad Support; Dialpad Sell).
  • Discord: card added, verdict Unknown.
  • DocHub: card added, verdict Conditional, BAA from Site License.
  • Doximity GPT: card added, verdict Yes, BAA from Member (free).
  • Doxy.me: card added, verdict Yes, BAA from Free.
  • Dropbox Sign: card added, verdict Conditional, BAA from Standard (annual).
  • eFax: card added, verdict Conditional, BAA from eFax Business.
  • FaceTime: card added, verdict Unknown.
  • Fax.Plus: card added, verdict Conditional, BAA from Enterprise.
  • Fireflies.ai: card added, verdict Conditional, BAA from Enterprise.
  • Formstack: card added, verdict Conditional, BAA from Forms (HIPAA add-on).
  • Gmail in Google Workspace: card added, verdict Conditional, BAA from Business Starter.
  • GoDaddy: card added, verdict Conditional, BAA from Microsoft 365 email (plans GoDaddy represents as HIPAA-compliant).
  • Google Chat: card added, verdict Conditional, BAA from Google Workspace (admin-managed; accepted in the Admin console).
  • Google Cloud Platform: card added, verdict Yes, BAA from All Google Cloud accounts.
  • Google Drive: card added, verdict Conditional, BAA from Google Workspace (paid editions).
  • Google Meet: card added, verdict Conditional, BAA from Google Workspace (paid editions).
  • Google Voice: card added, verdict Conditional, BAA from Google Voice for Google Workspace (Starter, Standard, Premier licenses) on a Workspace account whose administrator has accepted the Google Workspace BAA.
  • GoTo Meeting: card added, verdict Conditional, BAA from GoTo Meeting for Healthcare.
  • Grasshopper: card added, verdict No.
  • Gravity Forms: card added, verdict No.
  • Grok: card added, verdict Conditional, BAA from API (enterprise).
  • GroupMe: card added, verdict Unknown.
  • HumbleFax: card added, verdict Unknown.
  • Hushmail for Healthcare: card added, verdict Conditional, BAA from Healthcare Basic.
  • iCloud: card added, verdict No.
  • iFax: card added, verdict Conditional, BAA from Plus.
  • iMessage: card added, verdict No.
  • Liquid Web: card added, verdict Conditional, BAA from Standalone HIPAA server.
  • Mailchimp: card added, verdict Unknown.
  • Microsoft Forms: card added, verdict Conditional, BAA from Office 365 / Microsoft 365 commercial subscriptions.
  • MyFax: card added, verdict Unknown.
  • Nextiva: card added, verdict Conditional, BAA from Nextiva HIPAA-compliant ("HC") service offerings designated on the quote: NextivaONE, Nextiva Contact Center, NEXT, XBert AI, Core / Engage / Power Suite (NextivaCx).
  • OpenEvidence: card added, verdict Yes, BAA from Individual clinician accounts (standard BAA).
  • Outlook / Exchange Online in Microsoft 365: card added, verdict Conditional, BAA from Microsoft 365 Business (Basic, Standard, Premium).
  • PandaDoc: card added, verdict Conditional, BAA from Enterprise.
  • Paubox: card added, verdict Yes, BAA from Email Suite Standard.
  • Perplexity: card added, verdict Conditional, BAA from Enterprise (Enterprise Pro / Enterprise Max).
  • Proton Mail: card added, verdict Conditional, BAA from All Proton plans (on request).
  • Qualtrics: card added, verdict Conditional.
  • RingCentral: card added, verdict Conditional, BAA from Paid RingEX plans (all tiers).
  • Sfax: card added, verdict Conditional, BAA from Plus.
  • ShareFile: card added, verdict Conditional, BAA from Premium.
  • Signal: card added, verdict Unknown.
  • SRFax: card added, verdict Conditional, BAA from Healthcare Lite.
  • SurveyMonkey: card added, verdict Conditional, BAA from Enterprise.
  • Telegram: card added, verdict Unknown.
  • Vonage Business Communications: card added, verdict Conditional, BAA from Vonage Communications APIs – Enterprise accounts (Video, Voice, Messages, Verify APIs).
  • Webex: card added, verdict Unknown.
  • WeTransfer: card added, verdict Unknown.
  • WhatsApp: card added, verdict No.
  • WP Engine: card added, verdict No.

2026-10-19

  • Acuity Scheduling: card added, verdict Conditional, BAA from Premium (formerly Powerhouse).
  • Adobe Acrobat Sign: card added, verdict Conditional, BAA from Acrobat Sign Solutions for enterprise.
  • Amazon Web Services: card added, verdict Conditional, BAA from All AWS accounts (no plan tiers).
  • Anthropic Claude: card added, verdict Conditional, BAA from Claude Enterprise (HIPAA enabled by the Primary Owner).
  • Box: card added, verdict Conditional, BAA from Enterprise.
  • Calendly: card added, verdict No.
  • DocuSign: card added, verdict Conditional, BAA from Enhanced plans (contact sales).
  • Dropbox: card added, verdict Conditional, BAA from Standard.
  • Google Forms: card added, verdict Conditional, BAA from Google Workspace paid editions administered in the Admin console (Business Starter, Business Standard, Business Plus, Enterprise, Essentials, Frontline, Education, Nonprofits).
  • Google Gemini: card added, verdict Conditional, BAA from Google Workspace editions where Gemini Apps is a core service: Business Starter, Business Standard, Business Plus, Enterprise Standard, Enterprise Plus, Essentials, Enterprise Essentials, Enterprise Essentials Plus, Frontline Starter/Standard/Plus, Nonprofits, Education Fundamentals/Standard/Plus.
  • Google Workspace: card added, verdict Conditional, BAA from Google Workspace paid editions administered in the Admin console (Business Starter, Business Standard, Business Plus, Enterprise, Essentials, Frontline, Education, Nonprofits).
  • HubSpot: card added, verdict Conditional, BAA from Marketing Hub Enterprise.
  • Jotform: card added, verdict Conditional, BAA from Gold.
  • Microsoft 365: card added, verdict Conditional, BAA from Microsoft 365 Business Basic.
  • Microsoft Azure: card added, verdict Conditional, BAA from All Azure customers under a volume licensing or online subscription agreement (no plan tiers).
  • Microsoft Copilot (Microsoft 365 Copilot): card added, verdict Conditional, BAA from Microsoft 365 Copilot Business (add-on, up to 300 users).
  • Microsoft Teams: card added, verdict Conditional, BAA from Microsoft Teams Essentials.
  • Notion: card added, verdict Conditional, BAA from Enterprise.
  • OpenAI ChatGPT and OpenAI API: card added, verdict Conditional, BAA from ChatGPT for Healthcare.
  • Otter.ai: card added, verdict Conditional, BAA from Enterprise.
  • PayPal (and Venmo): card added, verdict No.
  • Salesforce: card added, verdict Conditional, BAA from HIPAA Covered Services listed on the Business Associate Addendum Restrictions page (edition eligibility not stated).
  • Slack: card added, verdict Conditional, BAA from Enterprise (Enterprise Grid / Enterprise+).
  • Square: card added, verdict Conditional, BAA from Square Free.
  • Squarespace: card added, verdict Conditional, BAA from Acuity Scheduling Premium (Powerhouse).
  • Stripe: card added, verdict No.
  • Typeform: card added, verdict Conditional, BAA from Enterprise.
  • Wix: card added, verdict Conditional, BAA from Business.
  • WordPress.com: card added, verdict Unknown.
  • Zapier: card added, verdict No.
  • Zoom: card added, verdict Conditional, BAA from Pro.