HIPAA vendor checklist: which of your tools sign a BAA?

How to use it

Three steps

1. List every tool that could see patient information. Include the obvious (EHR, scheduler, CRM) and the easy-to-miss: email, calendar, chat, video, forms, e-signature, file storage, email marketing, phone and messaging apps, and any browser extension or AI tool staff use.
2. Check each against the table below and the vendor's own page. A "conditional" BAA usually means a specific plan, an add-on or a setting you must turn on.
3. Tick "signed" only when you have the BAA, accepted in the admin console or signed and filed. Then decide what to do with every tool that can't sign one: stop using it for PHI, or replace it.

A practice that's a HIPAA covered entity is responsible for these agreements, not the vendor. If you're not sure whether you're a covered entity (many cash-pay med spas and wellness businesses aren't sure), ask your compliance advisor; the checklist is still good hygiene either way.

For every vendor

Six questions to ask before you sign

1. Which plan, add-on or setting does the BAA require? Get it in writing.
2. Which products or features does it cover? AI features, mobile apps and integrations are common gaps.
3. Where is the data hosted, and who are the subprocessors?
4. How quickly will they notify you of a breach? HIPAA's outer limit for a business associate is 60 days from discovery.
5. Is there an audit trail of who viewed or changed records?
6. How do you get your data back when you leave, and how is it deleted?

Fewer vendors, fewer agreements

The simplest way to shorten this list is to stop spreading patient information across tools. Many practices end up with a scheduler, a forms tool, a chat app, a note-taker and a spreadsheet of leads, each needing its own BAA (or quietly lacking one). JBMOnboard360 puts client records, scheduling and booking requests, intake forms, e-signed consents, invoices, team chat and AI meeting summaries under one Business Associate Agreement, included on every plan and hosted on AWS in the United States. Professional is $79 per user per month billed annually ($99 monthly).

It won't replace everything on the list: JBMOnboard360 is not an EHR, doesn't take US card payments, doesn't send SMS, and its WhatsApp concierge is for general questions only, never PHI. Keep your EHR and payments tools, and use the checklist to make sure each one has its BAA.