HIPAA eligible vs HIPAA compliant: what vendors mean

Neither label, by itself, tells you whether a tool can handle protected health information (PHI) in your clinic’s workflow. Evaluate the exact plan, business associate agreement (BAA), covered services, exclusions, and your clinic’s responsibilities—not just the wording on a product page.

HIPAA guides

HIPAA eligible vs HIPAA compliant: the practical difference

Treat these labels as starting points for questions, not approval decisions. Their meaning may depend on how a vendor defines them and which services its documentation addresses.

Vendor wording	What it may indicate	What it does not establish	What to check next
HIPAA eligible	A service may be available for a HIPAA-related use under specified conditions.	That your subscription, features, or workflow meet those conditions.	Eligible plans, agreement requirements, and covered services.
HIPAA compliant	The vendor may be describing a particular offering, configuration, or contractual arrangement.	That every product or use of the product is covered.	The scope behind the claim and the responsibilities assigned to your clinic.
BAA available	The vendor may offer an agreement for certain customers or services.	That your clinic has completed that agreement or that every feature is included.	How to execute the BAA and what it covers and excludes.

“HIPAA eligible” is vendor terminology, not a universal regulatory category: AWS uses it for specified services subject to its terms and customer responsibilities. HHS does not certify or endorse particular products, and describing a product as “HIPAA compliant” does not establish that every customer workflow complies.

HIPAA Compliant Wiki reports BAA availability by plan, covered services, exclusions, sources, and verification dates. It does not treat compliance as an inherent product property or audit vendors.

What to check before a tool handles PHI

Start with a concrete workflow: “Reception staff will upload referral documents, share them with designated employees, and download them on clinic-managed laptops.” That is more useful than asking whether a vendor is broadly suitable for healthcare.

Identify:

• The product and plan: Include the subscription name and any add-ons.
• The features: Storage, sharing, reminders, exports, automation, and AI may require separate review.
• The agreement: Establish whether a BAA is available for that arrangement and how your clinic completes it.
• The scope: Match the intended data and services to the agreement’s covered-services list and exclusions.

Do not assume an agreement for one service covers the vendor’s entire catalog. Check the agreement and any documents it incorporates. Under 45 CFR §164.504(e), the applicable business-associate contract must establish permitted and required uses and disclosures of PHI and specified safeguards; it does not replace either party’s independent HIPAA obligations.

Separate documented facts from unresolved questions. “The covered-services list names document storage” is evidence. “It probably includes the new transcription feature” is an assumption.

Use this purchasing checklist:

• The intended plan is eligible under the vendor’s terms.
• The applicable agreement has been executed.
• The intended workflow falls within the documented scope.
• Exclusions and separate-agreement requirements have been reviewed.
• Configuration and operating responsibilities have named owners.

This is a review aid, not a legal safe harbor. For a closer look at scope language, see how to read a vendor BAA.

How the distinction shows up in everyday clinic tools

The following examples are hypothetical. They illustrate questions to investigate, not any actual vendor’s terms.

Scheduling and appointment reminders

A practice selects a scheduling service with a BAA. The front desk also wants to send appointment reminders by email and text.

The review question is not simply whether scheduling is covered. Are both reminder channels included? Does a separate delivery provider receive appointment information? What documentation covers that provider and the information sent to it?

Do not treat the scheduling agreement as an answer to those questions unless its scope supports that conclusion.

File sharing

A clinic plans to store referral PDFs and share folders with staff. Occasionally, an employee needs to share a document with an outside specialist.

Compare the subscription and named storage service with both workflows. Then ask who can create external links, whether recipients must authenticate, and how access can be withdrawn. A covered storage service and an appropriate sharing configuration are separate review subjects.

Staff chat and automation

An employee posts a file in an internal staff conversation. An automation then copies the file to an external storage account.

Trace each step: the conversation, the automation service, and the destination storage. Which agreement covers each service? Does the transfer introduce another provider or account outside the approved arrangement?

The original chat agreement should not be treated as evidence of coverage for every destination.

AI added to an existing tool

A clinic already uses a document service and wants to enable its new summarization feature.

Ask whether that feature is included in the agreement, which model receives the content, and whether another agreement or configuration is required. Existing approval of document storage does not answer those questions. See using AI tools with PHI.

Where coverage can stop: plans, features, and integrations

These are review categories, not exclusions that apply to every vendor.

Review category	Question to resolve	Documentation to examine
Subscription restrictions	Does the agreement apply to the exact plan being purchased?	BAA eligibility terms and subscription documents.
Service restrictions	Which products or services are named as covered?	Covered-services list and referenced documents.
Optional features	Are recording, transcription, AI, or other add-ons included?	Feature-specific terms, exclusions, and separate agreements.
Connected third parties	What happens when data reaches an integration or external destination?	Each provider’s applicable agreement and service scope.

Read the covered-services list and exclusions alongside the BAA. A general security page may describe controls without answering whether your particular service is contractually covered.

Do not infer BAA availability from price, an enterprise label, encryption, or a security certification.

When something is unclear, document a specific question. For example:

Feature: Automated appointment reminders.
Proposed PHI flow: Patient name, contact details, and appointment time move from scheduling to the text-delivery service.
Clarification requested: Identify the agreement and covered-service language applicable to that flow, including any separate provider or excluded feature.

Request a written response tied to the relevant terms rather than a general assurance that the platform supports healthcare.

What remains the clinic’s responsibility

Contractual scope and clinic operations need separate attention. Ask your privacy and IT owners:

• Access: Who needs access to each workspace, folder, or record?
• Sharing: Who can invite outsiders, create links, or export information?
• Offboarding: Who removes access when someone leaves or changes roles?
• Devices: Which devices may access or download the information?
• Retention: Which retention options apply, and who chooses and reviews them?
• Integrations: Who approves connections and checks where data goes?
• Training: Do staff understand the approved workflow and its limits?

These are review areas, not universal configuration settings. Their application depends on the clinic’s circumstances, obligations, and intended use. Applicable HIPAA standards remain mandatory, and “addressable” implementation specifications are not simply optional. HIPAA does not prescribe a general medical-record retention period.

A signed BAA is not a substitute for evaluating the actual workflow and the clinic’s responsibilities.

For the broader distinction between a vendor arrangement and an organization’s obligations, read what HIPAA compliant means.

How to read the directory’s verdicts

Vendor entries use yes, conditional, no, or unknown. Each verdict must cite the vendor’s own BAA or trust page and include a verification date.

Read the verdict together with its plan and service scope:

• Yes is not blanket approval of every possible use.
• Conditional requires attention to the stated conditions.
• No needs supporting evidence, not an assumption based on missing information.
• Unknown means the available evidence does not support a definite answer.

No source means unknown. Missing public documentation should not be converted into approval—or a claim that the vendor refuses to sign BAAs.

Use the directory to check a vendor’s BAA availability and scope. When revisiting an earlier assessment, consult recent changes in vendor HIPAA status and check whether the supporting terms still match your arrangement.

HIPAA Compliant Wiki is published by Chanty, Inc. Ownership and payment do not determine placement in category tables. The directory is a reference, not an audit, certification service, or legal advice.

Questions to ask before approving a tool

Bring these questions to the vendor and the clinic’s approval owner:

• Which exact plan and services does the BAA cover, and how do we complete the agreement?
• Are all features in our intended workflow included, excluded, or subject to a separate agreement?
• Where does PHI leave the service through exports, integrations, or connected AI features?
• What documentation covers those destinations?
• Which responsibilities remain with our clinic, and who owns them?
• How will we review coverage when the vendor changes its terms?

Assign responsibility for that last review before purchase. See what to do when BAA terms change.

FAQ

Does HIPAA eligible mean a tool is ready to receive PHI?

The label alone does not establish readiness. Check the eligible plan, agreement requirements, covered services, exclusions, and intended workflow. Use the vendor’s documented meaning rather than assuming a universal definition.

Is a signed BAA enough to approve a clinic workflow?

A signed BAA does not answer every workflow question. Review whether the intended services are covered and how the clinic will manage access, sharing, devices, and staff practices. The agreement and operational review serve different purposes.

Does a vendor’s BAA cover every feature and integration?

Do not assume so. Check covered-services lists, exclusions, add-on terms, and connected providers. An integration or AI feature needs its own scope review rather than inheriting approval from the main product.

Can a free plan be used with PHI?

Price alone does not establish BAA availability or coverage. Check the exact plan and terms; do not assume all free plans lack BAAs or all paid plans include them. Read free plans and BAA availability.

What should we do when a vendor’s HIPAA wording is unclear?

Describe the feature and proposed PHI flow, then request written clarification tied to the applicable agreement and covered-services language. Keep the question unresolved until you have supporting evidence; do not turn ambiguous wording into approval or rejection.