Home → Features → HIPAA compliant EHR
A HIPAA ready EHR, and the truth about what that phrase can and cannot mean
There is no such thing as a HIPAA certified EHR. No government body certifies software for HIPAA, and any vendor who tells you otherwise is selling you a logo. What exists is a vendor who will sign a BAA, build the safeguards the Security Rule asks for, and tell you plainly where the responsibility stays with you. That is what this page is about.
The BAA, signed, included, not an upsell
Under HIPAA, a vendor that handles protected health information on your behalf is a business associate, and you need a Business Associate Agreement with them before a single record goes in.
- Signed at no extra cost on every plan, including the $49 one
- Available to read in full before you sign up, at /baa/
- Covers the whole platform, not a subset of modules
- Several vendors charge for this one or gate it behind a higher plan
Encryption and where the data actually lives
The Security Rule calls encryption addressable rather than required, which some vendors read as optional. We do not.
- TLS in transit and encryption at rest, on every plan
- Hosted on Microsoft Azure, in United States regions
- Constant backups, with a documented restore path
- No patient data is used to train any AI model
Access control, because most breaches are internal
The common HIPAA failure is not an attacker. It is a member of staff opening a record they had no business opening.
- Permissions by role: reception never needs the clinical note
- Each user with their own named account, never a shared login
- Two-factor authentication available on every account
- Access can be restricted by IP if your practice needs that
The audit trail an investigator will ask for
If a complaint arrives, the question is who opened this record, when, and why. If you cannot answer it, the safeguards do not help you.
- Every view and every change recorded with user and timestamp
- Consents signed remotely, stored with the record of who signed
- Document retention under your control, not ours
- Full CSV export of everything, free, whenever you ask
Patient communication that does not leak
The place most small practices actually break HIPAA is the message, not the server.
- Documents and results delivered through the portal, not by plain email
- Appointment reminders that carry logistics, never clinical detail
- TCPA consent for texts captured in the intake and stored
- Telehealth in the browser, with no third-party meeting link
What stays your job, stated plainly
No software makes a practice HIPAA compliant. It can only make compliance possible. These parts are yours.
- Your risk analysis and your written policies
- Training your staff and documenting that you did
- Who you give access to, and taking it away when they leave
- Your own devices, your network and your password habits
- Your breach notification process if something does go wrong
Why nobody can sell you a HIPAA certified EHR
HHS does not certify software for HIPAA, and neither does any other federal body. There is no register, no seal and no audit that confers it. Vendors who display a HIPAA badge are usually showing you a third-party attestation they paid for, which is not nothing, but it is not certification and it does not transfer to you.
What you can actually verify is concrete: will they sign a BAA, is the data encrypted at rest, is there an audit trail, can you control access by role, and can you get your data out. Ask those five questions of any vendor, including us.
This is a different thing from ONC certification, which is real and which we do not have. ONC certification exists so that software can participate in federal incentive programmes and certain payer workflows. If your practice needs it, you need a certified product and we are not one.
HIPAA ready is the honest phrase
We say HIPAA ready rather than HIPAA compliant because compliance is a property of your practice, not of a piece of software. The platform gives you the safeguards. Whether your practice is compliant depends on your risk analysis, your policies, your training and the way your staff actually behave on a Tuesday afternoon.
If a vendor tells you that buying their product makes you compliant, that sentence alone tells you how carefully they read the rule. The security page goes through the technical detail, and the BAA is published in full so your attorney can read it before you pay anything.
What we are not
DrinCloud is not ONC certified, does not submit insurance claims, has no e-prescribing and carries no CPT code database. Those are real gaps and they matter to some practices. We publish them on the pricing index and on every comparison page rather than letting you find out later.
Frequently asked questions
Is DrinCloud HIPAA certified?
No, and neither is any other EHR, because no body certifies software for HIPAA. What we do is sign a BAA at no cost, encrypt data in transit and at rest, control access by role, keep a full audit trail and let you export everything whenever you want.
Do you sign a Business Associate Agreement?
Yes, on every plan including the $49 one, at no extra charge. You can read it in full before signing up.
Where is the data hosted?
On Microsoft Azure, in United States regions, encrypted at rest with constant backups.
Are you ONC certified?
No. ONC certification exists for software taking part in federal incentive programmes and certain payer workflows. We do not have it, and if your practice needs it you need a different product.
Do you use patient data to train AI?
No. The AI scribe drafts a note from the session you recorded and that content is not used to train any model.
What happens to my data if I leave?
You export all of it as CSV, free, whenever you want, without asking us and without a notice period. We consider an export that costs money or takes a support ticket to be a form of lock-in.
Start in 3 minutes
Sign up online at the price you see, with no setup fee and no minimum term. HIPAA ready, BAA included, and your data exportable in full from day one.