The HIPAA-safe tool stack for a solo telehealth practice

A solo cash-pay telehealth practice needs a BAA with every tool that holds patient information: the EHR, intake forms, scheduling, texting, email and any automation that touches records. Payments are the main exception. Keep patient details in tools that sign, and use everything else for practice-side work only.

What is a BAA, and who needs one?

A business associate agreement (BAA) is a contract in which a vendor agrees to protect the patient information it handles for you. HIPAA requires one with every vendor that creates, receives, stores or sends protected health information (PHI) on your behalf. HHS publishes sample BAA provisions if you want to see what one contains.

PHI is broader than most owners expect. A name plus an appointment reason is PHI. So is an email address on a list called "TRT patients". If a tool can see who your patients are and anything about their care, it needs a BAA.

We use "signs a BAA" rather than "HIPAA compliant" throughout. A vendor can't be compliant for you. It can only sign a BAA and give you the settings to use it safely.

What are the layers of a solo practice stack?

Most solo hormone, weight-loss and functional medicine practices run on eight layers. Each one either holds patient information or doesn't, and that decides whether it needs a BAA.

1. EHR: charts, orders, notes. Always holds PHI.
2. Intake forms: health history and consent. Always holds PHI.
3. Scheduling: holds PHI once the booking page asks why someone is coming in.
4. Payments: consult fees, lab fees, programs. Covered by a separate exception, explained below.
5. Texting and phone: reminders and replies. Holds PHI as soon as a patient texts back about symptoms.
6. Email: your practice inbox and any marketing tool.
7. Automation: the glue between tools, like Zapier, Make or Keragon.
8. Files and team notes: shared drives, Notion, Slack, the VA's task list.

Which tool should each layer use?

For each layer, pick one tool that signs a BAA on the plan you can afford, and keep patient details out of the rest. The table shows a pattern that works for a solo owner, with BAA status checked on October 14, 2026.

The simplest stack is the shortest one. An EHR that handles forms, scheduling, reminders and billing removes four BAAs from your list. Add separate tools only where the EHR falls short. Our EHR comparison for cash-pay practices covers which ones do what.

How do payments fit if Stripe won't sign a BAA?

HIPAA excludes ordinary payment processing from the business associate rules, so you can take card payments through a processor that doesn't sign a BAA. Stripe is reported not to sign one and publishes no BAA. The catch: nothing about the patient's care can travel with the payment.

That means neutral line items. "Initial consult" and "Lab fee" are fine. "Menopause hormone consult" or "Weight-loss program, month 2" puts health information into Stripe's descriptions, receipts and metadata. The same goes for custom fields on a payment link that ask about symptoms.

Square is a different case. Its HIPAA BAA is part of its terms and covers services Square marks as HIPAA-enabled, such as Appointments and Invoices. For the detail on payment links, read Is Stripe HIPAA compliant?

What are the most common mistakes?

Most problems in small practices come from tools that were set up before anyone thought about HIPAA, and then kept. These five come up most often.

• Patient email in a personal Gmail account. Google's BAA is accepted in the Workspace Admin console and covers Workspace accounts. A personal @gmail.com account has no Admin console, so move to a paid Workspace account and accept the BAA.
• Texting patients from a personal cell. Your carrier and your phone's backups have no BAA with you. A practice number on Spruce or Quo's Business plan keeps messages in one place and under a BAA. Our guide to HIPAA-safe texting covers the options.
• A free form builder for intake. Jotform signs a BAA only on Gold or Enterprise. A free or lower plan, or a website contact form, shouldn't collect health history.
• Symptoms in CRM notes. HubSpot signs a BAA only on Enterprise with sensitive data turned on. On Free, Starter or Professional, a note like "fatigue, low libido, wants labs" is PHI in a tool with no BAA.
• Zapier between the form and the EHR. Zapier doesn't sign a BAA, so a Zap that copies intake answers into a sheet moves PHI through it. Use the EHR's own integrations or a tool that signs, such as Keragon.

Where should patient data live, and where should it never appear?

Patient information should live in as few places as possible, all of them under a BAA. In most solo practices that is the EHR, the texting tool and the practice email. Everything else should hold only what a stranger could see without learning anything about anyone's health.

Places patient details should never appear:

• payment descriptions, receipts and metadata
• marketing email lists, tags and segments
• ad platforms, pixels and the custom audiences you upload
• Calendly or other booking pages with no BAA
• the VA's personal email, notes app or task tool
• Slack or Notion below Enterprise

Your VA works inside the same rules. Give them a login to the tools that sign, not copies of patient details in tools that don't. Our guide to what to hand a VA goes through the tasks.

Worked example: one patient through a solo NP's stack

Here is how one new patient moves through a HIPAA-safe stack for a solo NP with one VA. The patient, Dana M., found the practice through an ad.

1. Dana fills in a short inquiry form on the website: name, email and the service she's interested in, with no health questions. It goes to the practice's Workspace inbox, which is under Google's BAA.
2. The VA sends her the intake link from the EHR. Her health history goes straight into the EHR, which signs a BAA.
3. The EHR sends a lab-fee payment link. The Stripe line item reads "Lab fee", and nothing else.
4. Reminders go out by text from the practice's Spruce number. When Dana replies with a question about her results, the reply stays in Spruce.
5. Dana joins the monthly newsletter in Flodesk under a general "Newsletter" list, not a list named after her program.

Each step that touches her care sits in a tool with a BAA. The tools without one see only what any website visitor could share.

A one-page checklist

1. List every tool the practice uses, including the VA's.
2. Mark each one: does it hold patient names tied to anything about their care?
3. For each "yes", confirm the vendor signs a BAA on your plan. The BAA checker does this for the 31 tools in our table.
4. Sign or accept each BAA and keep a copy with the date.
5. Turn on each vendor's HIPAA settings (Jotform, Acuity, HubSpot and GoHighLevel all have one).
6. Move patient details out of every tool that doesn't sign.
7. Rename payment line items to neutral terms.
8. Rename marketing lists and tags so none names a condition or program.
9. Move patient texting off personal phones.
10. Re-check BAA terms every quarter, because plans and terms change.

Want a second pair of eyes on how patients move through your tools? Request a free patient journey map. Don't include any patient information in the form.

This is general information, not legal advice. Confirm BAA terms with each vendor.

Common questions

Do you need a BAA with every vendor?

No, only with vendors that create, receive, store or send patient information for you. Your EHR, intake forms, texting tool and practice email need one. A tool that never sees patient details, like a design app or a general newsletter list, doesn't.

Is Stripe HIPAA compliant?

Stripe is reported not to sign a BAA. You can still take payments through it, because HIPAA excludes ordinary payment processing from the business associate rules, as long as descriptions, receipts and metadata contain no health details.

Is Google Workspace HIPAA compliant?

Google signs a BAA for Workspace accounts, accepted in the Admin console. It covers Gmail, Drive, Calendar and Meet. You still have to accept the BAA and use only the covered services. A personal Gmail account isn't covered.

Can you use a free form builder for intake?

Not for health history. Free form builders don't sign a BAA. Use your EHR's intake forms or a form tool that signs on your plan, such as Jotform Gold or IntakeQ.

Does a marketing email list need a BAA?

Only if it holds patient information. A general newsletter list doesn't. A list or tag that shows someone is a patient in a specific program does, and tools like Mailchimp don't sign a BAA.