Home → Blog

Compliance

Is your EHR actually HIPAA compliant? Seven questions to ask before you sign

Nobody certifies software for HIPAA, and HHS says so in writing. Seven questions you can verify before you pay, with the good answer and the red flag for each.

November 04, 2026 · 8 min read

Nobody certifies software for HIPAA. There is no HIPAA certification: HHS does not issue one, its Office for Civil Rights does not issue one, and no other federal agency does either. HHS has put it in writing: "there is no standard or implementation specification that requires a covered entity to 'certify' compliance," and, on the badges you see on vendor websites, "HHS does not endorse or otherwise recognize private organizations' 'certifications' regarding the Security Rule." Such certifications "do not absolve covered entities of their legal obligations under the Security Rule" (hhs.gov).

So when a sales page says HIPAA certified, read it as what it is: usually a private firm the vendor paid ran an audit and wrote an attestation. That attestation may be serious work, SOC 2 Type II and HITRUST both are, and it tells you something real about how the vendor runs its own shop. What it does not do is transfer to you. You are the covered entity. The audit was of them.

So drop the question "are you certified," which anybody can answer yes to. Here are seven you can verify before you pay, with the answer that should satisfy you and the answer that should end the conversation.

1. Will you sign a BAA, and can I read it before I pay?

A business associate agreement is not optional and not a favor. Under the Security Rule a covered entity may let a business associate handle electronic PHI "only if the covered entity obtains satisfactory assurances," and the written contract is the Required implementation specification (law.cornell.edu). Any vendor storing one patient record for you is a business associate. No BAA, no legal basis for them to hold your data.

Good answer: here is the PDF, read it now, we sign it on every plan at no extra charge. Check that it names subcontractors, states breach notification timelines back to you, and says what happens to your data when you leave.

Red flag: a BAA only on the enterprise tier. A BAA you cannot see until after you have paid. A BAA that caps their liability at one month of fees and makes you responsible for their security failures. That last one is common, and worth your attorney reading before you sign a multi year commitment. We publish ours and sign it on every plan, which is the point of putting the BAA on the price list.

2. Is PHI encrypted at rest, and where exactly is it hosted?

Note what the rule says, because vendors overclaim in both directions. Encryption at rest is an Addressable implementation specification, not a Required one: "Implement a mechanism to encrypt and decrypt electronic protected health information" (ecfr.gov). Addressable means you assess it and document your decision, not that you can ignore it. In practice, if a vendor does not encrypt at rest in 2026, no reasonable documented decision is available to you.

Good answer: encrypted in transit and at rest, named cloud region, continuous backup, and they will tell you which country the data sits in.

Red flag: "bank level encryption" with no detail, or no answer on hosting location. Ask whether backups are encrypted too. Backups are where the copies nobody thinks about live.

Ours is spelled out on the security page.

3. Is there role based access control?

Access control is a Security Rule standard: "Implement technical policies and procedures for electronic information systems that maintain electronic protected health" information "to allow access only to those persons or software programs that have been granted access rights" (ecfr.gov). In your clinic: the front desk books appointments and takes payments, and does not need to read psychotherapy notes.

Good answer: permissions per user, set by you, granular enough that a receptionist, a billing person and a clinician see different things. Ask to see the screen in a live account, not a slide.

Red flag: one admin role and one staff role. Shared logins. Or "everyone on the team is trusted," which is an answer about your staff, not their software.

4. Is there an audit log of who opened which chart?

Audit controls are a standard too: "Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems" that hold electronic PHI (ecfr.gov). This question separates software built for health care from software with a HIPAA page bolted on.

Good answer: a per record log showing user, action, date and time, readable by you without a support ticket. It matters the day a patient asks who looked at their file, and the day you have to investigate an employee.

Red flag: "we log everything on our side." Logs you cannot read are not your logs. Ask how far back it goes and whether it survives a user being deleted.

5. Can I export everything, and what does it cost?

A compliance question, not a convenience question. Cancelling a subscription does not cancel your retention obligation, and your records are governed by state law and your licensing board too.

Good answer: a self service export of patients, appointments, notes, documents and ledger, in CSV and PDF, that you run yourself, any time, for nothing.

Red flag: "contact support," a professional services quote, a notice period, or an export disabled on the plan you downgrade to before leaving. We give a complete export at no cost, and there is a longer piece on what exports cleanly.

6. Do you use patient data to train AI?

A new question, and most vendor security pages written before 2024 do not answer it. If an AI scribe or assistant is in the product, PHI is reaching a model. Find out whether it stops there.

Good answer: patient data is not used to train models, it is covered by the BAA, the AI subprocessor is named, and there is a contractual no training commitment with that subprocessor. Get it in the BAA or an addendum, not in a blog post.

Red flag: "we may use de-identified data to improve our services," with no description of the method. HIPAA has two defined routes to de-identification, and a vendor who cannot name which one they use has probably not done it.

7. What happens with reminders and email?

This is where PHI actually leaks in small practices, and almost nobody asks about it. Not the database. The outbound messages.

A reminder that says "your colonoscopy with Dr. Reyes is Tuesday at 10" is PHI in a text message on an unencrypted channel. An intake form emailed as an attachment to a Gmail account is PHI in a mailbox with no BAA behind it. A staff member forwarding a patient question to their own phone is a disclosure.

Good answer: reminders send from inside the system with content you control, the template can say as little as "you have an appointment Tuesday at 10," patient messaging runs through a portal rather than ordinary email, and the email and SMS providers are named in the vendor's BAA as subcontractors.

Red flag: reminders that print diagnosis or procedure names by default, no template control, or secure messaging that is just a mailto link.

The part that is not the software's job

This needs saying plainly, because a lot of vendor marketing is built on blurring it. Compliance is a property of your practice, not of your software. You cannot buy it. The best system, correctly configured, covers the technical safeguards and nothing else. What stays yours, whatever you buy:

• The risk analysis. Required, in those words: "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities" to your electronic PHI (law.cornell.edu). A document, written, updated, kept.
• Written policies and procedures, kept six years from creation or from the date last in effect, whichever is later.
• Workforce training. "Implement a security awareness and training program for all members of its workforce (including management)." Including you.
• Access management. Who gets which role, and closing accounts the day somebody leaves. Software gives you the switch. You flip it.
• Breach notification. You notify affected individuals "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach" (law.cornell.edu), plus OCR and sometimes media. Write the process down before you need it.

A vendor who says their product makes your practice HIPAA compliant is either careless with language or selling you something. Ours covers the technical side and signs the BAA. The risk analysis is still yours, and we would rather say so now than have you find out during an investigation. More on where the line sits: what a HIPAA compliant EHR actually means.

Frequently asked questions

Is there such a thing as a HIPAA certified EHR?

No. HHS does not certify software or practices for HIPAA and does not recognize private certifications of Security Rule compliance. What exists are vendor paid third party audits such as SOC 2 Type II and HITRUST, which tell you about the vendor's own controls and do not make your practice compliant.

Does a cash-pay practice have lighter HIPAA obligations?

No. HIPAA applies based on whether you are a covered entity transmitting health information electronically, not on whether you bill insurance. The paperwork is the same for a self-pay clinic. What you skip by not billing payers is the claims machinery, not the Privacy and Security Rules.

What should I ask for in writing before signing?

Four documents: the BAA, the security page with hosting and encryption detail, the export policy including cost and format, and a written statement on whether patient data trains AI models. If a vendor will not put those four in a PDF, that is your answer.

The bottom line

A certification badge is the easiest thing on a vendor's website to produce and the least informative thing on it. The seven questions above take twenty minutes and are all verifiable: read a BAA, click through a permissions screen, open an audit log, run an export. Do that instead. And whatever you buy, write your risk analysis, because that one has your name on it.

DrinCloud is practice management and charting for US cash-pay clinics, with a BAA on every plan, encryption in transit and at rest, per user permissions, a per record audit log, and free data export. We are not ONC certified and we do not bill insurance, both on purpose. See each plan.

← All articles