Plain definitions of the terms used on vendor cards and category tables. Each entry says how the term is used on this site; the legal definitions live in 45 CFR Parts 160 and 164.
Business associate agreement (BAA)
A written contract between a covered entity (or another business associate) and a vendor that will create, receive, maintain or transmit PHI on its behalf. It sets permitted uses, safeguards, breach reporting and flow-down to subcontractors. On this site "BAA available" means the vendor publishes a way to sign one for a named plan.
Protected health information (PHI)
Individually identifiable health information handled by a covered entity or business associate, in any form: a patient name next to an appointment, a voicemail about a result, a fax of a referral. Electronic PHI (ePHI) is the same information in electronic form.
Covered entity
A health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with standard transactions. Most clinics and practices are covered entities.
Business associate
A person or organization that handles PHI for a covered entity, for example a cloud host, an email provider, a billing service or a team chat vendor. Business associates must sign a BAA and are directly liable under the Security Rule.
Subcontractor
A vendor's own vendor that touches PHI. A business associate must have a BAA with each subcontractor; a vendor's "sub-processor list" is where to look.
HIPAA eligible
A vendor's term for a service that can be used with PHI under its BAA when configured as the vendor requires. "Eligible" is not "compliant": the customer still has to configure the service and run its own program. AWS and OpenAI use the word this way.
HIPAA compliant
Not a property a product can have. Compliance describes how an organization handles PHI: a signed BAA, correct configuration, policies, training and a risk analysis. On this site no vendor is called "compliant"; cards report BAA availability and scope.
HIPAA certified
Does not exist. HHS runs no certification program and recognizes no certificate. Badges that say "HIPAA certified" describe a vendor's self-assessment or a third-party review, not a legal status.
Covered services
The products or features a vendor names as inside its BAA. Anything not listed is outside: a common trap is a core product that is covered and an add-on (AI assistant, marketplace app, consumer version) that is not.
Excluded features
Features a vendor explicitly leaves out of its BAA, or features the vendor does not mention at all. On cards, "excluded" is used only when the vendor says so; "not stated" when it does not.
Minimum necessary
The Privacy Rule standard that uses and disclosures of PHI are limited to what is needed for the purpose. In practice it drives role-based access and the question of who in a chat channel can see what.
Security Rule
The part of HIPAA that sets administrative, physical and technical safeguards for ePHI: risk analysis, access controls, audit logs, encryption decisions, contingency plans. Vendor controls on cards (encryption, audit log, SSO) map to its technical safeguards.
Privacy Rule
The part of HIPAA that governs uses and disclosures of PHI and patient rights. It is why a BAA exists at all: the covered entity may share PHI with a vendor only with satisfactory assurances in writing.
Breach notification
The duty to notify individuals, HHS and sometimes the media after a breach of unsecured PHI. A BAA sets how fast the vendor must tell you; your own deadlines run from when you knew or should have known.
Zero data retention (ZDR)
A setting or contract term under which an AI or API vendor does not store prompts and outputs after the request completes. Several AI vendors make ZDR, or limited retention, a condition of their BAA.
Verdict (on this site)
One of four labels: Yes (BAA on every plan), Conditional (BAA on specific plans, services or on request), No (vendor says it does not sign one, or forbids PHI), Unknown (no public statement). See how we verify.