Yes SimplePractice's published BAA is available on Starter, Essential, Plus and the free trial, and the vendor's published terms list no excluded features. Verified 2026-10-28.
A practice can use SimplePractice's EHR and practice management features with PHI once the BAA is in effect. The BAA is part of the Terms of Service, so there is no separate signing step or upgrade to request.
Short answer
The BAA amends the SimplePractice Terms of Service and is entered into automatically when an account is created. The covered service is SimplePractice EHR / practice management. The Trust Center shows HITRUST CSF certification. That certification does not replace the practice's own HIPAA duties: access control, staff training, policies and breach response stay with the customer. Other tools are checked in All vendor HIPAA checks.
Which plans include a BAA
Under the BAA and PHI definitions, a business associate agreement is the contract that lets a vendor handle PHI for a covered entity. SimplePractice builds it into its terms, so it applies to every plan.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Starter | Yes | Automatic at account creation, as part of the terms | Not published by the vendor |
| Essential | Yes | Automatic at account creation, as part of the terms | Not published by the vendor |
| Plus | Yes | Automatic at account creation, as part of the terms | Not published by the vendor |
| Free trial | Yes | Automatic at account creation, as part of the terms | Not published by the vendor |
No plan is listed as excluded from the BAA.
Pricing context: Starter is from $49/month billed monthly, with a promotional $24.50/month for the first 3 months. Essential and Plus prices are on the SimplePractice pricing page.
What the BAA covers and what it excludes
Covered, within the SimplePractice EHR / practice management:
- Scheduling
- Online booking
- Client portal
- Telehealth
- Secure messaging
- Billing
Telehealth and secure messaging are both in the covered list. A solo therapist running video sessions and sending session reminders through the client portal is using covered features, provided the BAA is in effect on the account.
Excluded: no excluded features are listed on the pages checked. That is not the same as everything being covered. Features outside the list above, and anything connected from outside SimplePractice, are not shown to be covered.
Email: the pages checked do not describe a separate email product or how the BAA treats email. Treat HIPAA-compliant email as not published by the vendor. Do not send PHI by ordinary email on the assumption that it is covered.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Yes |
| ISO 27001 | Not published by the vendor |
Unpublished does not mean absent. An evaluator building a vendor inventory should request these details from SimplePractice, especially encryption, audit logging and SSO, before recording them as present or missing.
HITRUST CSF certification is not HIPAA certification, and it does not extend to every feature or to how a practice configures its account.
How to use SimplePractice with PHI
Compliance depends on the BAA, your configuration and your organization's own policies, not on the software alone. The HIPAA guides cover the surrounding policy work. A working checklist:
- Confirm the BAA applies to your account and keep a copy with your vendor records.
- Give each staff member only the access their job needs. A front-desk coordinator who schedules appointments does not need access to clinical notes. Use whatever role settings your plan offers.
- Enforce strong login practices: unique credentials per person, no shared logins, and any additional sign-in protection the vendor offers.
- Use the client portal and secure messaging for PHI, not personal email or text messages.
- Train staff and document your policies, including what may be sent through which channel.
- Remove access the day a clinician or administrator leaves, and secure the phones and laptops that sign in.
- Keep PHI out of third-party tools that lack their own BAA, including automation tools and shared spreadsheets that receive exported appointment or client data.
Alternatives with a BAA
Scheduling and practice tools that publish BAA terms, by verdict:
- Is Acuity Scheduling HIPAA compliant?: conditional; BAA from the Premium plan (formerly Powerhouse).
- Google Calendar: conditional; BAA through Google Workspace paid editions.
- Jane App: yes; BAA from the Balance plan.
- Square: conditional; BAA from Square Free.
- Vagaro: conditional; plan not specified.
Browse the full scheduling and practice-tool comparison in HIPAA-compliant software by category.
Sources
- SimplePractice Business Associate Agreement — BAA page, checked 2026-10-28. "This BUSINESS ASSOCIATE AGREEMENT ("BAA"), is made and entered into at the date and time your SimplePractice account is created ("Effective Date") and is between you ("Covered Entity") and SimplePractice LLC ("Business Associate"). This BAA, which supersedes any previous business associate agreement between the parties, amends, supplements, and is made a part of the Terms of Service"
- Trust Center | SimplePractice — Trust center, checked 2026-10-28. "HITRUST CSF Certified"
- SimplePractice pricing — Pricing page, checked 2026-10-28. "$49 billed monthly […] $79 billed monthly […] $99 billed monthly"
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-28. Status changes across all vendors are listed in Recent changes in vendor HIPAA status.
FAQ
Does SimplePractice sign a BAA, and on which plans?
Yes. The BAA is part of the Terms of Service and takes effect at account creation, so it applies to Starter, Essential, Plus and the free trial. Any extra cost for the BAA is not published by the vendor.
Is SimplePractice telehealth covered by the BAA?
Telehealth is in the covered list for the SimplePractice EHR / practice management, alongside secure messaging, the client portal, scheduling, online booking and billing. No exclusions are listed on the pages checked.
Does SimplePractice have HIPAA compliant email?
Not published by the vendor. The sources checked do not describe a SimplePractice email product or how the BAA treats email. Use the client portal and secure messaging for PHI rather than ordinary email.
Is the BAA available during the free trial?
Yes. The BAA is entered into automatically at account creation as part of the terms, which includes trial accounts.
Does HITRUST certification mean SimplePractice is HIPAA certified?
No. The Trust Center shows HITRUST CSF certification, but HIPAA has no certification, and HITRUST does not cover every feature or replace your own safeguards, policies and training.