Every entry on this site answers one question: will this vendor sign a Business Associate Agreement (BAA) for the service you want to put protected health information (PHI) into, and on which plan? We do not certify anything. HIPAA has no certification, and no product is "HIPAA compliant" on its own. Compliance is a property of how an organization uses a tool under a signed BAA, with the right configuration and its own policies.
The verdict scale
| Verdict | Meaning |
|---|---|
| Yes | The vendor signs a BAA on every plan, including free tiers, for the services listed on the card. |
| Conditional | The vendor signs a BAA, but only on specific plans, for specific services, or on request. The card names the plans and the exclusions. |
| No | The vendor states publicly that it does not sign a BAA, or its terms prohibit PHI in the service. |
| Unknown | We found no public statement from the vendor. We do not guess; the card says what we looked for and where. |
A "conditional" verdict is not a warning. Most serious business tools are conditional: the BAA exists, and you have to be on the right plan.
What counts as evidence
Only the vendor's own published pages: the BAA or business associate addendum itself, the trust or compliance center, help-center articles, terms of service and the pricing page. Every fact on a card has a source link, a verbatim quote from that page and the date we checked it. We do not use third-party blogs, review sites, forum posts by non-staff, or press coverage as evidence for a verdict. If a vendor's statement exists only in a sales conversation, it is not on the card.
When a vendor publishes something that is ambiguous (for example, "HIPAA-ready" without naming plans), we record the quote and keep the verdict at the lower of the possible readings.
What a card records
- Which plans include or allow a BAA, and which plans are excluded.
- How the BAA is obtained: accepted in an admin console, requested from support, or signed with sales.
- Which services the BAA covers and which features are outside it (consumer apps, free tiers, AI add-ons, web search, beta features, third-party integrations).
- Security controls the vendor publishes: encryption in transit and at rest, audit logs, access controls, single sign-on, data residency, SOC 2, HITRUST, ISO 27001. "Not published" means the vendor's pages did not say; it does not mean the control is missing.
- The entry price of the cheapest plan that allows a BAA, as shown on the vendor's pricing page on the day we checked. Prices change; the source and date are on the card.
Re-checks and the change log
Every card shows the date it was last verified and the date of the next scheduled check. The fifty most-viewed vendors are re-checked every quarter; the rest at least once a year, and sooner when a vendor changes plans or a reader reports a change. Every change to a verdict, a plan list or an exclusion is written to the card's change log and to the site-wide change feed, with the source that triggered it.
Category tables
Category pages compare the vendors in one category on the same columns. Rows are sorted by verdict, then by the lowest plan that includes a BAA and its price. Nothing else moves a row: no vendor pays for placement, and no vendor can be removed from a table by asking.
Who publishes this site and why that matters
The site is published by Chanty, Inc., the company behind Chanty, a team chat product that competes with some of the vendors listed here (Slack, Microsoft Teams, Google Chat and others). Chanty's own card uses the same template, the same evidence rules and the same verdict scale as every other card. Cards for Chanty's competitors and for Chanty itself carry a disclosure line. Chanty does not appear in a category table unless it has a verified card, and it is never placed above vendors with a better-sourced verdict.
Corrections
Vendors and readers can send corrections through the correction form. We ask for a link to the vendor's own page that supports the change. Corrections that come with a source are usually applied within five business days and appear in the change log with credit to the submitter if they want it.