Which practice tools sign a BAA

Of 31 tools that cash-pay practice owners commonly ask about, 15 sign a BAA on a standard or named plan, 4 only on Enterprise or a top tier, and 2 with a paid add-on. Five don't sign one, and for five more we couldn't confirm either way. Each row names the plan and links to the vendor's own page.

Last checked: October 14, 2026. Vendor terms change, so we re-check this table every quarter. Confirm the current terms with the vendor before any patient detail goes in.

Which practice tools sign a BAA?

Here is the short version, as of October 2026. The tables below give the plan, the conditions and the source for each one.

• Sign a BAA: Keragon, Acuity Scheduling (Premium or Powerhouse), Jotform (Gold or Enterprise), IntakeQ, Google Workspace, Microsoft 365 (business plans), Paubox, Spruce Health, Quo (Business or Scale), Square (HIPAA-enabled services), Healthie, OptiMantra, Jane (on request), Zoom and Doxy.me.
• Enterprise or top tier only: HubSpot, Twilio, Notion and Slack.
• With a paid add-on: GoHighLevel (HIPAA package) and Google Voice (a Voice license on a paid Workspace account).
• No BAA: Zapier, Calendly, Mailchimp, Stripe (reported) and a personal Gmail account.
• Not confirmed: Make, Flodesk, Kit, ManyChat and Practice Better. Treat these as "no" until the vendor confirms in writing.

Zoom says it signs BAAs, but its public pages don't name the plan, so ask Zoom which one you need. To check only the tools you use, try the BAA checker.

The full table, by category

Every row was checked on October 14, 2026 against the vendor's own site, help center, terms or trust page. Where no vendor page settled it, we say so and link the best source we found.

Intake forms

Scheduling

Email

Email marketing

Texting, phone and DMs

Automation

CRM

Payments

EHR and practice management

Video visits

Notes and team chat

What does "signs a BAA" mean in this table?

A business associate agreement (BAA) is a contract in which a vendor agrees to protect the patient information it handles for you, as HIPAA requires. "Yes" means the vendor offers one on the plan shown. It doesn't mean the tool makes your practice compliant.

We write "signs a BAA" rather than "HIPAA compliant" on purpose. A vendor can't be compliant on your behalf. You still need to pick the right plan, turn on the vendor's HIPAA settings and use the tool the way its BAA allows.

Many BAAs come with limits. Slack and Notion can't be used to talk with patients. Google's BAA leaves out third-party add-ons. Acuity switches off some calendar syncs once HIPAA is on. Read the conditions in each row before you rely on it.

What about tools with no BAA?

A tool with no BAA can still have a place in your practice. It just can't hold patient information. Use it for practice-side work, and keep names tied to health details, intake answers, lab information and appointment reasons out of it.

• Stripe: HIPAA's payment-processing exception lets you take payments without a BAA, as long as descriptions, metadata and receipts say "Consult" or "Lab fee" and nothing about the condition. See Stripe payment links in a medical practice.
• Calendly: fine for a general discovery call with no health questions on the booking page.
• Zapier: fine for moving practice-side data, like a new ad lead's name and email into a sheet, with no health details. For anything that touches patient records, use a tool that signs, such as Keragon.
• Mailchimp, Flodesk, Kit: fine for a general newsletter. Don't build lists or tags around conditions or programs, because a tag like "TRT patients" is itself health information.

For how these pieces fit together, read the HIPAA-safe tool stack for a solo cash-pay telehealth practice.

How we check

For each tool we look for the vendor's own statement: a BAA document, a HIPAA help article, the pricing page, the terms of use or a trust page. We record what it says, the plan it names and the date we checked. We don't rely on third-party "is X HIPAA compliant" sites unless the vendor publishes nothing, and then we mark the row "reported" or "not confirmed".

We re-check every row each quarter and whenever a vendor announces a change. We have no affiliate links on this page. Spot an error? Email hello@telesystemaic.com with the tool and a link to the vendor's page. Please don't include any patient information.

Changelog

• October 14, 2026: First version, 31 tools checked.

This is general information, not legal advice. Confirm BAA terms with each vendor.

Common questions

Does Zapier sign a BAA?

No. Zapier says it does not sign a business associate agreement, so it can't be used to move patient information. Keragon is an automation tool that includes a BAA on its paid plans (as of October 2026).

Does HubSpot sign a BAA?

Only on Enterprise. HubSpot signs a BAA on its Enterprise hubs once sensitive data is turned on with the health data and HIPAA settings. Free, Starter and Professional plans can't hold health information (as of October 2026).

Does Google Workspace sign a BAA?

Yes. Google offers its BAA to Workspace customers, who accept it in the Admin console. It covers Gmail, Drive, Calendar and Meet, and Google Voice for managed users. A personal Gmail account isn't covered (as of October 2026).

Does Calendly sign a BAA?

No. Calendly staff said in July 2026 that Calendly doesn't offer a BAA and isn't meant for health information. Acuity Scheduling offers one on its Premium and Powerhouse plans.

Is a tool HIPAA compliant if it signs a BAA?

Not on its own. A BAA means the vendor agrees to protect the patient information it holds for you. You still have to use the right plan, turn on its HIPAA settings and follow its limits.