HIPAA & BAA Directory
Is it HIPAA compliant?
Whether a tool can be used with protected health information comes down to one question: will the vendor sign a Business Associate Agreement (BAA)? Here is where popular tools stand. No tool is HIPAA compliant by itself — a signed BAA and correct configuration are always required.
Key takeaways
- No tool is HIPAA compliant by itself — compliance depends on a signed BAA plus correct configuration and your own safeguards.
- The deciding question for any vendor is whether they will sign a Business Associate Agreement at all.
- Some vendors sign only on specific paid plans, so the plan you are on matters as much as the vendor you chose.
- Vendor terms change; every entry here cites the vendor’s official source and the month it was verified.
BAA availability by tool
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is Google Workspace HIPAA compliant? | Conditionally — on specific plans |
| Is Microsoft 365 HIPAA compliant? | Yes — with a signed BAA |
| Is Zoom HIPAA compliant? | Conditionally — on specific plans |
| Is Slack HIPAA compliant? | Conditionally — on specific plans |
| Is Dropbox HIPAA compliant? | Conditionally — on specific plans |
| Is Box HIPAA compliant? | Conditionally — on specific plans |
| Is DocuSign HIPAA compliant? | Conditionally — on specific plans |
| Is Twilio HIPAA compliant? | Conditionally — on specific plans |
| Is Amazon Web Services (AWS) HIPAA compliant? | Yes — with a signed BAA |
| Is Microsoft Azure HIPAA compliant? | Yes — with a signed BAA |
| Is Google Cloud Platform HIPAA compliant? | Yes — with a signed BAA |
| Is Cloudflare HIPAA compliant? | Conditionally — on specific plans |
| Is OpenAI (ChatGPT / API) HIPAA compliant? | Conditionally — on specific plans |
| Is Anthropic (Claude) HIPAA compliant? | Conditionally — on specific plans |
| Is Mailchimp HIPAA compliant? | No — vendor will not sign a BAA |
| Is Twilio SendGrid HIPAA compliant? | No — vendor will not sign a BAA |
| Is Jotform HIPAA compliant? | Conditionally — on specific plans |
| Is Calendly HIPAA compliant? | No — vendor will not sign a BAA |
| Is Typeform HIPAA compliant? | Conditionally — on specific plans |
| Is Salesforce HIPAA compliant? | Conditionally — on specific plans |
| Is HubSpot HIPAA compliant? | Conditionally — on specific plans |
| Is Zendesk HIPAA compliant? | Conditionally — on specific plans |
| Is Notion HIPAA compliant? | Conditionally — on specific plans |
| Is Google Analytics HIPAA compliant? | No — vendor will not sign a BAA |
| Is Epic HIPAA compliant? | Yes — with a signed BAA |
| Is Oracle Health (Cerner) HIPAA compliant? | Yes — with a signed BAA |
| Is athenahealth HIPAA compliant? | Yes — with a signed BAA |
| Is eClinicalWorks HIPAA compliant? | Yes — with a signed BAA |
| Is NextGen Healthcare HIPAA compliant? | Yes — with a signed BAA |
| Is Tebra (Kareo) HIPAA compliant? | Yes — with a signed BAA |
| Is DrChrono HIPAA compliant? | Conditionally — on specific plans |
| Is SimplePractice HIPAA compliant? | Yes — with a signed BAA |
| Is Jane App HIPAA compliant? | Yes — with a signed BAA |
| Is AdvancedMD HIPAA compliant? | Conditionally — on specific plans |
| Is Practice Fusion HIPAA compliant? | Conditionally — on specific plans |
| Is Doxy.me HIPAA compliant? | Yes — with a signed BAA |
| Is Microsoft Teams HIPAA compliant? | Conditionally — on specific plans |
| Is Spruce Health HIPAA compliant? | Conditionally — on specific plans |
| Is Updox HIPAA compliant? | Yes — with a signed BAA |
| Is OhMD HIPAA compliant? | Yes — with a signed BAA |
| Is TigerConnect HIPAA compliant? | Yes — with a signed BAA |
| Is Klara HIPAA compliant? | Conditionally — on specific plans |
| Is Weave HIPAA compliant? | Yes — with a signed BAA |
| Is NexHealth HIPAA compliant? | Yes — with a signed BAA |
| Is RingCentral HIPAA compliant? | Yes — with a signed BAA |
| Is Cisco Webex HIPAA compliant? | Yes — with a signed BAA |
| Is Paubox HIPAA compliant? | Yes — with a signed BAA |
| Is Hushmail HIPAA compliant? | Yes — with a signed BAA |
| Is LuxSci HIPAA compliant? | Yes — with a signed BAA |
| Is Proton Mail HIPAA compliant? | Yes — with a signed BAA |
| Is Front HIPAA compliant? | Conditionally — on specific plans |
| Is Help Scout HIPAA compliant? | Yes — with a signed BAA |
| Is Zoho Mail HIPAA compliant? | Yes — with a signed BAA |
| Is Google Drive HIPAA compliant? | Yes — with a signed BAA |
| Is Microsoft OneDrive HIPAA compliant? | Yes — with a signed BAA |
| Is SharePoint HIPAA compliant? | Yes — with a signed BAA |
| Is Citrix ShareFile HIPAA compliant? | Yes — with a signed BAA |
| Is Egnyte HIPAA compliant? | Yes — with a signed BAA |
| Is Tresorit HIPAA compliant? | Yes — with a signed BAA |
| Is Sync.com HIPAA compliant? | Yes — with a signed BAA |
| Is Google Forms HIPAA compliant? | Conditionally — on specific plans |
| Is Microsoft Forms HIPAA compliant? | Conditionally — on specific plans |
| Is SurveyMonkey HIPAA compliant? | Conditionally — on specific plans |
| Is Formstack HIPAA compliant? | Yes — with a signed BAA |
| Is Cognito Forms HIPAA compliant? | Yes — with a signed BAA |
| Is Gravity Forms HIPAA compliant? | No — vendor will not sign a BAA |
| Is Wufoo HIPAA compliant? | No — vendor will not sign a BAA |
| Is Acuity Scheduling HIPAA compliant? | Yes — with a signed BAA |
| Is Zoho CRM HIPAA compliant? | Conditionally — on specific plans |
| Is Pipedrive HIPAA compliant? | No — vendor will not sign a BAA |
| Is Keap HIPAA compliant? | Conditionally — on specific plans |
| Is ActiveCampaign HIPAA compliant? | Conditionally — on specific plans |
| Is Klaviyo HIPAA compliant? | No — vendor will not sign a BAA |
| Is GoHighLevel (HighLevel) HIPAA compliant? | Conditionally — on specific plans |
| Is Constant Contact HIPAA compliant? | Conditionally — on specific plans |
| Is Freshdesk HIPAA compliant? | Conditionally — on specific plans |
| Is Intercom HIPAA compliant? | Conditionally — on specific plans |
| Is Stripe HIPAA compliant? | No — vendor will not sign a BAA |
| Is Square HIPAA compliant? | Yes — with a signed BAA |
| Is PayPal HIPAA compliant? | No — vendor will not sign a BAA |
| Is QuickBooks HIPAA compliant? | No — vendor will not sign a BAA |
| Is Bill.com (BILL) HIPAA compliant? | Conditionally — on specific plans |
| Is Dropbox Sign HIPAA compliant? | Conditionally — on specific plans |
| Is Adobe Acrobat Sign HIPAA compliant? | Conditionally — on specific plans |
| Is PandaDoc HIPAA compliant? | Conditionally — on specific plans |
| Is SignNow HIPAA compliant? | Conditionally — on specific plans |
| Is Asana HIPAA compliant? | Conditionally — on specific plans |
| Is Trello HIPAA compliant? | No — vendor will not sign a BAA |
| Is monday.com HIPAA compliant? | Conditionally — on specific plans |
| Is ClickUp HIPAA compliant? | Conditionally — on specific plans |
| Is Smartsheet HIPAA compliant? | Conditionally — on specific plans |
| Is Airtable HIPAA compliant? | Conditionally — on specific plans |
| Is Confluence (Atlassian) HIPAA compliant? | Conditionally — on specific plans |
| Is Jira (Atlassian) HIPAA compliant? | Conditionally — on specific plans |
| Is Google Gemini HIPAA compliant? | Conditionally — on specific plans |
| Is Microsoft 365 Copilot HIPAA compliant? | Conditionally — on specific plans |
| Is Perplexity HIPAA compliant? | Conditionally — on specific plans |
| Is Otter.ai HIPAA compliant? | Conditionally — on specific plans |
| Is Fireflies.ai HIPAA compliant? | Conditionally — on specific plans |
| Is Loom HIPAA compliant? | No — vendor will not sign a BAA |
EHR & practice management
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is Epic HIPAA compliant? | Yes — with a signed BAA |
| Is Oracle Health (Cerner) HIPAA compliant? | Yes — with a signed BAA |
| Is athenahealth HIPAA compliant? | Yes — with a signed BAA |
| Is eClinicalWorks HIPAA compliant? | Yes — with a signed BAA |
| Is NextGen Healthcare HIPAA compliant? | Yes — with a signed BAA |
| Is Tebra (Kareo) HIPAA compliant? | Yes — with a signed BAA |
| Is DrChrono HIPAA compliant? | Conditionally — on specific plans |
| Is SimplePractice HIPAA compliant? | Yes — with a signed BAA |
| Is Jane App HIPAA compliant? | Yes — with a signed BAA |
| Is AdvancedMD HIPAA compliant? | Conditionally — on specific plans |
| Is Practice Fusion HIPAA compliant? | Conditionally — on specific plans |
Work & project management
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is Notion HIPAA compliant? | Conditionally — on specific plans |
| Is Google Analytics HIPAA compliant? | No — vendor will not sign a BAA |
| Is Asana HIPAA compliant? | Conditionally — on specific plans |
| Is Trello HIPAA compliant? | No — vendor will not sign a BAA |
| Is monday.com HIPAA compliant? | Conditionally — on specific plans |
| Is ClickUp HIPAA compliant? | Conditionally — on specific plans |
| Is Smartsheet HIPAA compliant? | Conditionally — on specific plans |
| Is Airtable HIPAA compliant? | Conditionally — on specific plans |
| Is Confluence (Atlassian) HIPAA compliant? | Conditionally — on specific plans |
| Is Jira (Atlassian) HIPAA compliant? | Conditionally — on specific plans |
Email & marketing
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is Google Workspace HIPAA compliant? | Conditionally — on specific plans |
| Is Microsoft 365 HIPAA compliant? | Yes — with a signed BAA |
| Is Mailchimp HIPAA compliant? | No — vendor will not sign a BAA |
| Is Twilio SendGrid HIPAA compliant? | No — vendor will not sign a BAA |
| Is Keap HIPAA compliant? | Conditionally — on specific plans |
| Is ActiveCampaign HIPAA compliant? | Conditionally — on specific plans |
| Is Klaviyo HIPAA compliant? | No — vendor will not sign a BAA |
| Is GoHighLevel (HighLevel) HIPAA compliant? | Conditionally — on specific plans |
| Is Constant Contact HIPAA compliant? | Conditionally — on specific plans |
Cloud storage & file sharing
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is Dropbox HIPAA compliant? | Conditionally — on specific plans |
| Is Box HIPAA compliant? | Conditionally — on specific plans |
| Is Google Drive HIPAA compliant? | Yes — with a signed BAA |
| Is Microsoft OneDrive HIPAA compliant? | Yes — with a signed BAA |
| Is SharePoint HIPAA compliant? | Yes — with a signed BAA |
| Is Citrix ShareFile HIPAA compliant? | Yes — with a signed BAA |
| Is Egnyte HIPAA compliant? | Yes — with a signed BAA |
| Is Tresorit HIPAA compliant? | Yes — with a signed BAA |
| Is Sync.com HIPAA compliant? | Yes — with a signed BAA |
Forms & surveys
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is Jotform HIPAA compliant? | Conditionally — on specific plans |
| Is Typeform HIPAA compliant? | Conditionally — on specific plans |
| Is Google Forms HIPAA compliant? | Conditionally — on specific plans |
| Is Microsoft Forms HIPAA compliant? | Conditionally — on specific plans |
| Is SurveyMonkey HIPAA compliant? | Conditionally — on specific plans |
| Is Formstack HIPAA compliant? | Yes — with a signed BAA |
| Is Cognito Forms HIPAA compliant? | Yes — with a signed BAA |
| Is Gravity Forms HIPAA compliant? | No — vendor will not sign a BAA |
| Is Wufoo HIPAA compliant? | No — vendor will not sign a BAA |
Messaging & meetings
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is Zoom HIPAA compliant? | Conditionally — on specific plans |
| Is Slack HIPAA compliant? | Conditionally — on specific plans |
| Is Twilio HIPAA compliant? | Conditionally — on specific plans |
| Is Microsoft Teams HIPAA compliant? | Conditionally — on specific plans |
| Is RingCentral HIPAA compliant? | Yes — with a signed BAA |
| Is Cisco Webex HIPAA compliant? | Yes — with a signed BAA |
| Is Intercom HIPAA compliant? | Conditionally — on specific plans |
| Is Loom HIPAA compliant? | No — vendor will not sign a BAA |
Patient communication
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is Doxy.me HIPAA compliant? | Yes — with a signed BAA |
| Is Spruce Health HIPAA compliant? | Conditionally — on specific plans |
| Is Updox HIPAA compliant? | Yes — with a signed BAA |
| Is OhMD HIPAA compliant? | Yes — with a signed BAA |
| Is TigerConnect HIPAA compliant? | Yes — with a signed BAA |
| Is Klara HIPAA compliant? | Conditionally — on specific plans |
| Is Weave HIPAA compliant? | Yes — with a signed BAA |
| Is NexHealth HIPAA compliant? | Yes — with a signed BAA |
AI tools
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is OpenAI (ChatGPT / API) HIPAA compliant? | Conditionally — on specific plans |
| Is Anthropic (Claude) HIPAA compliant? | Conditionally — on specific plans |
| Is Google Gemini HIPAA compliant? | Conditionally — on specific plans |
| Is Microsoft 365 Copilot HIPAA compliant? | Conditionally — on specific plans |
| Is Perplexity HIPAA compliant? | Conditionally — on specific plans |
| Is Otter.ai HIPAA compliant? | Conditionally — on specific plans |
| Is Fireflies.ai HIPAA compliant? | Conditionally — on specific plans |
E-signature & documents
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is DocuSign HIPAA compliant? | Conditionally — on specific plans |
| Is Dropbox Sign HIPAA compliant? | Conditionally — on specific plans |
| Is Adobe Acrobat Sign HIPAA compliant? | Conditionally — on specific plans |
| Is PandaDoc HIPAA compliant? | Conditionally — on specific plans |
| Is SignNow HIPAA compliant? | Conditionally — on specific plans |
Secure email
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is Paubox HIPAA compliant? | Yes — with a signed BAA |
| Is Hushmail HIPAA compliant? | Yes — with a signed BAA |
| Is LuxSci HIPAA compliant? | Yes — with a signed BAA |
| Is Proton Mail HIPAA compliant? | Yes — with a signed BAA |
| Is Zoho Mail HIPAA compliant? | Yes — with a signed BAA |
Billing & finance
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is Stripe HIPAA compliant? | No — vendor will not sign a BAA |
| Is Square HIPAA compliant? | Yes — with a signed BAA |
| Is PayPal HIPAA compliant? | No — vendor will not sign a BAA |
| Is QuickBooks HIPAA compliant? | No — vendor will not sign a BAA |
| Is Bill.com (BILL) HIPAA compliant? | Conditionally — on specific plans |
Cloud infrastructure
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is Amazon Web Services (AWS) HIPAA compliant? | Yes — with a signed BAA |
| Is Microsoft Azure HIPAA compliant? | Yes — with a signed BAA |
| Is Google Cloud Platform HIPAA compliant? | Yes — with a signed BAA |
| Is Cloudflare HIPAA compliant? | Conditionally — on specific plans |
CRM & sales
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is Salesforce HIPAA compliant? | Conditionally — on specific plans |
| Is HubSpot HIPAA compliant? | Conditionally — on specific plans |
| Is Zoho CRM HIPAA compliant? | Conditionally — on specific plans |
| Is Pipedrive HIPAA compliant? | No — vendor will not sign a BAA |
Customer support
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is Zendesk HIPAA compliant? | Conditionally — on specific plans |
| Is Front HIPAA compliant? | Conditionally — on specific plans |
| Is Help Scout HIPAA compliant? | Yes — with a signed BAA |
| Is Freshdesk HIPAA compliant? | Conditionally — on specific plans |
Scheduling
| Tool | Will the vendor sign a BAA? |
|---|---|
| Is Calendly HIPAA compliant? | No — vendor will not sign a BAA |
| Is Acuity Scheduling HIPAA compliant? | Yes — with a signed BAA |
How to read this directory
A BAA is the contract that lets a vendor handle protected health information on your behalf. Without one, using a tool with PHI is a violation regardless of how secure the product is — encryption and SOC 2 reports are not substitutes for the agreement.
What each status means
- Yes — with a signed BAA: the vendor will sign, and you need to actually execute it before any PHI is involved
- Conditionally — on specific plans: the vendor signs only on certain paid tiers, or only after an administrator accepts an amendment
- No — vendor will not sign a BAA: the tool cannot be used with PHI, and the page suggests alternatives
Even where a BAA is available, coverage is usually scoped to specific services. Add-ons, marketplace apps, beta features, and some AI functionality frequently fall outside it, so check what the agreement actually covers rather than assuming it covers the whole product.
Frequently asked questions
Is any software "HIPAA compliant" on its own?
No. HIPAA compliance is a property of your organization, not a product. Even where a vendor signs a Business Associate Agreement, you remain responsible for executing it, configuring the tool correctly, restricting access to PHI, training staff, and maintaining your own administrative, physical, and technical safeguards.
What is a BAA and when do I need one?
A Business Associate Agreement is the contract required before a vendor may create, receive, maintain, or transmit protected health information on your behalf. You need one with every such vendor — and their subcontractors that touch PHI need one too.
What if a vendor will not sign a BAA?
Then the tool cannot be used with PHI, no matter how secure it is. The individual tool pages list alternatives that will sign, along with the steps to move workflows across.
How current is this information?
Every entry cites the vendor’s official source and the month it was last verified. Vendor terms change, so confirm current terms directly with the vendor before relying on any BAA claim.