HCHIPAA Compliant Wiki

HIPAA-compliant software by category

Every table on this site compares vendors in one category on the same columns: verdict, the lowest plan that includes a business associate agreement (BAA), how the BAA is obtained, the starting price of that plan, and the security controls the vendor publishes. Rows are sorted by facts, never by opinion or payment. Each row links to the vendor card, where the sources and the verification date live.

Categories

  • AI tools: which models and assistants sign a BAA, and which features they exclude.
  • Team chat and messaging apps: staff chat with retention, export and admin controls.
  • Email providers: mailbox services that sign a BAA; consumer accounts never do.
  • Forms and form builders: intake, consent and surveys that store PHI.
  • Fax services: online fax with a BAA for sending, receiving and storage.
  • E-signature tools: signed consents and authorizations.
  • Phone systems and VoIP: voicemail, recordings, SMS and fax under one BAA or not.
  • Video conferencing: meetings, recordings and AI features in scope.
  • File sharing: storage and sharing with access controls and audit logs.
  • Hosting: clouds and web hosts that sign a BAA for named services.
  • Developer platforms: Developer platforms: clouds, serverless, databases and APIs that sign a BAA for named services.
  • Cloud storage: business plans with a BAA; personal accounts of the same brands never qualify.
  • Backup: business backup with a BAA, encryption at rest and controlled retention.
  • Document management: storage, editing, sharing and e-signature of PHI documents under one BAA.
  • Website builders: which platforms sign a BAA when a site collects PHI, and which prohibit it.
  • Scheduling: practice calendars with a BAA versus general booking tools that prohibit PHI.
  • CRM: editions that include a BAA and the features it excludes.
  • Marketing, ads and analytics: the few that sign a BAA and the big ones that refuse.
  • AI scribes: BAA coverage for recording, transcription and drafts.
  • AI transcription: which plans sign a BAA and whether recordings train models.

How to read a table

"Yes" means the vendor signs a BAA on every plan, including free tiers. "Conditional" means it signs only on specific plans, for specific services, or on request; the row names them. "No" means the vendor states it does not sign a BAA or its terms prohibit PHI. "Unknown" means we found no public statement. "Not published by the vendor" in a control column means the vendor's pages did not say, not that the control is missing.

A BAA is necessary, not sufficient. Configuration, policies, training and your own risk analysis remain your responsibility. See how we verify HIPAA status.