Which vendors does a therapist actually need a BAA with?
A Business Associate Agreement is required with any vendor that can create, receive, maintain, or transmit your clients’ protected health information (45 CFR 164.502(e)). Most therapists are missing at least one. Here is the therapist-specific list.
SimplePractice, TherapyNotes, Healthie, usually offered, but you must actually sign it.
Anyone who processes claims or statements on your behalf.
Standard consumer Gmail is not covered without a business agreement.
Booking, reminders, and intake-form collectors.
Consumer Dropbox/Drive tiers generally are not covered.
Any video platform carrying session data.
The newest gap, many do not sign BAAs at all.
If they can access client information.
A BAA written for a small practice
The generic legal-template BAAs are written for enterprise vendor relationships. Ours is sized for a therapy practice and customized to you. Free preview before you pay.
Want to see your own vendor list analyzed?
The BAA has a live generator: check off the tools your practice uses and watch the tracker fill in, vendor by vendor, free to preview.
Generate your Business Associate Agreement now →