What “HIPAA compliant” means—and does not

In this directory, “HIPAA compliant” is shorthand for a scoped assessment: whether a vendor offers a business associate agreement (BAA), which plan qualifies, which services it covers, and what conditions or exclusions apply. It is not a permanent product label or approval of everything your clinic might do with that tool.

What “HIPAA compliant” means in this directory

The useful question is not simply “Is this software compliant?” It is: “What evidence supports using this plan, service, and workflow with protected health information (PHI)?”

Consider a hypothetical clinic choosing a file-sharing tool. The vendor advertises a BAA, but the clinic still needs to establish:

• Whether its purchased plan qualifies.
• Whether its agreement has been signed.
• Whether the service storing the files is covered.
• Whether previews, sharing features, or connected applications introduce exclusions or additional requirements.

An answer about the vendor’s contract does not establish that every possible use—or the organization using it—meets HIPAA requirements.

A vendor’s business associate agreement does not make an organization’s use of its software HIPAA compliant: the organization must also meet its own obligations, including risk analysis and risk management. Business-associate vendors also have direct HIPAA obligations.

This guide explains how to interpret the directory’s findings. It is not an organizational compliance program or a comprehensive definition of HIPAA compliance.

How to read yes, conditional, no, and unknown

Read the verdict together with its scope, supporting source, and verification date in the vendor entry. The label alone is not enough.

Verdict	What it means	What not to infer
Yes	Vendor-owned documentation supports an affirmative answer within the entry’s explicitly stated scope.	Every plan, feature, integration, or workflow is approved.
Conditional	Documentation establishes availability subject to specified plan, contract, service, or configuration requirements.	Your clinic already meets those conditions.
No	Authoritative documentation establishes that the stated scope is not supported—for example, that a particular plan has no BAA available.	Every other service offered by that vendor has the same status.
Unknown	There is insufficient authoritative evidence to establish the answer.	The vendor has been proven noncompliant.

The distinction between yes and conditional depends on the question being answered. A documented answer about BAA availability on a named plan is narrower than approval of a proposed workflow with unresolved requirements.

A BAA has boundaries: plan, service, and exclusions

A statement that a vendor “offers a BAA” leaves important questions unanswered. Availability is not the same as an agreement executed for your organization, and an agreement’s coverage must be read rather than assumed.

For an ordinary software business-associate relationship, a binding written BAA must be in place before the vendor handles PHI on the organization’s behalf. It may be part of a services contract or a separate agreement and must establish required permissions, safeguards, and responsibilities; it cannot authorize uses HIPAA otherwise prohibits or, by itself, establish compliance.

For a hypothetical shared-folder workflow, examine the actual path of a document:

• Purchased plan: Is this the plan identified in the vendor’s BAA documentation?
• Storage service: Is the service holding the document included?
• Additional capabilities: What does the documentation say about previews, public links, exports, or other features the clinic intends to use?
• Connected destination: Does opening or sending the file move it into another service with separate terms?

These are questions to resolve, not claims that every agreement includes or excludes those capabilities.

A security badge cannot answer which legal entity signed the agreement or which services it covers. Keep the agreement and its service definitions alongside the workflow description. For a closer contract review, use how to read a vendor BAA.

Everyday clinic workflows: what needs checking

The following examples are hypothetical. They describe questions to investigate, not approved workflows or actual vendor policies.

A scheduling entry or appointment reminder could contain PHI if it identifies a patient and connects that person to receiving health care. Shared medical records, laboratory reports, hospital bills, and AI prompts, uploads, transcripts, or summaries could contain PHI when they include identifiable health, care, or payment information. Removing a name alone does not establish de-identification.

Scheduling and reminders

Suppose a scheduling tool holds patient names, appointment details, and visit notes, then sends reminders through a separate delivery service.

Ask what information each component receives and whether both scheduling and reminder delivery fall within the documented coverage. Scheduling information should not automatically be classified the same way in every context; assess the actual content and use.

A BAA reference on the scheduling product’s website does not, by itself, answer the reminder-service question.

Shared documents and task boards

Suppose a clinic attaches a patient-related document to an internal task. Staff then discuss it in comments and open an attachment preview.

Check the attachment store, comments, preview service, and any connected document editor. Record where information goes rather than treating the task board as a single undifferentiated service. Do not assume that covering the main application also covers every connected component.

AI inside an otherwise approved tool

Suppose an approved workspace adds an AI assistant that can summarize selected documents. Review that feature separately before allowing it to receive PHI.

Ask which service processes the content, what agreement applies, and whether the feature introduces exclusions or additional conditions. The parent product’s status is not evidence that the AI feature has the same coverage.

When an AI provider handles PHI on a regulated organization’s behalf as a business associate, applicable HIPAA and BAA requirements apply. A BAA does not automatically authorize model training or other secondary uses; those uses must be evaluated against HIPAA and the agreement’s actual permissions and restrictions.

See using AI tools with PHI for the scope questions specific to AI.

What a vendor’s HIPAA claim does not prove

The directory does not use “HIPAA certified” as a verdict or accept that wording as a substitute for evidence of BAA availability and service coverage.

Security controls and independent assurance reports answer different questions from a contract. Encryption may be relevant to a security review; an assurance report may provide evidence about specified controls. Neither, by itself, establishes that your chosen service is covered by your agreement or that your clinic’s use meets its obligations.

HHS does not recognize private Security Rule certifications as relieving HIPAA obligations, and OCR does not endorse or certify particular products. Security controls and assurance reports may inform an assessment, but neither a certification, a report, nor an individual control establishes HIPAA compliance by itself.

Likewise, “HIPAA eligible” should not be read as documented approval of your proposed use. Compare the terms in HIPAA eligible versus HIPAA compliant.

When documentation is missing, do not fill the gap with assumptions about a vendor’s reputation, size, or security features. An unknown verdict identifies an evidence gap to resolve.

What your clinic still needs to decide and manage

Use the vendor entry to support a review of the intended workflow—not to replace that review.

Review item	Practical question for the clinic
Intended data flow	What information will enter the tool, where will it be stored, and where can it leave?
Applicable contract	Which agreement applies to this organization, account, and plan? Has it been executed?
Covered services	Does the documented scope include each service and feature the workflow uses?
Access settings	Who can view, edit, download, export, or share the information?
Connected tools	Which integrations, automations, external accounts, or AI services receive content?
Ongoing ownership	Who reviews changes to plans, terms, enabled features, and user access?

The clinic also needs to address access management, offboarding, device security, and staff practices. This is a practical review framework, not an exhaustive legal standard.

A non-exhaustive HIPAA operational checklist includes workforce access and offboarding procedures under 45 CFR §164.308(a)(3)–(4), technical access controls under §164.312(a), workstation and device safeguards under §164.310(b)–(d), and workforce training, sanctions, and incident procedures under §164.308. Addressable specifications require assessment and appropriate implementation or documented justification and, when appropriate, an equivalent alternative; they are not simply optional.

For example, imagine a former employee still has access to a shared workspace containing patient-related files. The vendor’s documented BAA availability does not answer whether that person’s access should remain active. Contract coverage and day-to-day administration are separate questions.

Assign someone to manage account removal and review access settings rather than treating vendor selection as the end of the work. App builders and evaluators needing a broader implementation framework can consult HIPAA app requirements.

Use the directory as evidence, not certification

Start with vendor entries and their documented scope for plan eligibility, covered services, exclusions, supporting sources, and verification dates. Use HIPAA guides for explanations of recurring contract and workflow questions.

The directory reports vendors’ published terms and controls. It does not audit vendors, certify organizations, provide legal advice, or grant approval for a proposed use.

Published by Chanty, Inc. Ownership is disclosed; payment and publisher interest do not determine verdicts or placement in category tables.

FAQ

Does a signed BAA mean every feature in a tool can handle PHI?

No. Check the agreement’s covered services, exclusions, and conditions against the features you intend to use. Do not assume integrations, AI features, or connected services share the main application’s coverage.

What does an unknown verdict mean?

It means the directory lacks sufficient authoritative evidence to establish the answer. It is not proof of noncompliance. Resolve the missing plan, contract, or service-scope information before treating the entry as support for PHI use.

Is “HIPAA eligible” the same as “HIPAA compliant”?

Do not treat the terms as interchangeable. Neither phrase, standing alone, establishes that your organization’s agreement covers its proposed workflow. Look for the documented plan, services, requirements, and exclusions.

Does choosing a tool with a BAA make our clinic HIPAA compliant?

No. BAA availability addresses only part of the assessment. Your clinic still needs to establish applicable contract coverage and manage its own use, including access, connected services, devices, and staff practices.