COMPLIANCE INTELLIGENCE / REQUIREMENTS BEFORE REASSURANCE
The right requirements. The evidence to decide.
Start with the rules and assurances that matter to your work. Find the published evidence, understand its limits and know what to ask before you commit.
01 / FIND THE EVIDENCE
Your requirements. A more precise shortlist.
Find published claims that discuss your framework. A matching mention can describe a capability, condition or limitation. Read the statement before drawing a conclusion.
Purpose labels are curated against exact current evidence. Workflow support does not establish supplier assurance. Unclassified mentions remain available under “All published mentions”.
Product roles and BAA labels appear only when their reviewed supporting claims are current and published. BAA availability is conditional on the supplier’s terms; it does not establish an executed agreement or compliance. Missing evidence stays unknown.
Carepatron describes healthcare practice-management, documentation and administrative workflows. Its help center explains BAA acceptance at account creation and how that process relates to subscription upgrades.
CARE DELIVERY & OPERATIONS / HIPAA SCOPE
Vendor documents BAA availability
The help center says the BAA is accepted during signup, including the free plan, and no new acceptance is needed on a paid upgrade. Confirm the applicable version and third-party integration boundaries.
vendor asserted · Reviewed 11/2/2026
Carepatron's BAA help article states that account creation includes acceptance of its BAA and that moving to a paid subscription does not require a new acceptance. This is a vendor-described HIPAA contracting process, not verification of a buyer's assent or third-party service coverage.
Doxy.me describes a telehealth platform. Its current Free/Premium help documentation discusses HIPAA safeguards, BAAs and subcontractor agreements; buyers should reconcile those statements with their account and selected apps.
CARE DELIVERY & OPERATIONS / HIPAA SCOPE
Vendor documents BAA availability
Current Free/Premium help documentation says Doxy.me will sign a BAA. Confirm the account-specific agreement and separate app features; older Clinic-plan guidance should not be generalized to every current service.
vendor asserted · Reviewed 11/2/2026
Doxy.me's Free/Premium help documentation states that it will sign a BAA acknowledging its HIPAA business-associate role. This documents vendor availability; the buyer must confirm the agreement applying to the account and selected services.
Jane describes clinic-management workflows including scheduling, documentation, telehealth and billing. Its terms offer a standard BAA on request for subscribers subject to HIPAA.
CARE DELIVERY & OPERATIONS / HIPAA SCOPE
Vendor documents BAA availability
Jane's terms offer a standard BAA on request to HIPAA-subject subscribers. Confirm the service, region and optional features covered; signup alone should not be assumed to complete the request.
vendor asserted · Reviewed 11/2/2026
Jane's terms say it will enter its standard BAA on request with subscribers subject to HIPAA. Scope: a conditional contracting offer, not an executed agreement, automatic acceptance at signup or proof of compliant practice operations.
OhMD describes patient communication across calls, messages and related practice workflows. Its practice page distinguishes a standard BAA from Enterprise custom-agreement options.
CARE DELIVERY & OPERATIONS / HIPAA SCOPE
Vendor documents BAA availability
The practice page lists a standard BAA in agreements and a custom BAA for Enterprise. Confirm the plan, communication channels and selected AI or telehealth functions in the actual contract.
vendor asserted · Reviewed 11/2/2026
OhMD's practice page states that a standard HIPAA BAA is included in agreements and that a custom BAA is available with its Enterprise package. Buyers should confirm service and channel scope; this is not proof of an executed customer agreement.
Spruce Health describes healthcare communication workflows. Its organization terms include a BAA where applicable and distinguish communication that leaves the protected platform boundary.
CARE DELIVERY & OPERATIONS / HIPAA SCOPE
Vendor documents BAA availability
Organization terms include an applicable Attachment A BAA. Those terms separately identify unsecure channels such as ordinary email and SMS; review channel choice and patient authorization for the actual workflow.
vendor asserted · Reviewed 11/2/2026
Spruce's organization terms incorporate a BAA as Attachment A where applicable and describe its HIPAA business-associate relationship. This is a posted contractual framework, not proof of the buyer's acceptance or compliance of its chosen channels.
A current published claim makes a product discoverable here. Its original classification remains visible. A negative statement, a restricted feature or a qualified promise can also mention a framework: matching text is not a positive compliance assessment.
A BAA is a scoped agreement.
HHS explains that a cloud provider handling ePHI on behalf of a covered entity or business associate may itself be a business associate, even when it cannot decrypt the data. Establish the relationship, obtain the appropriate agreement and assess the safeguards for the service you intend to use.
SOC 2 is an assurance report; ISO 27001 concerns an information security management system. Neither label alone answers your HIPAA deployment question. Ask for the relevant report or certificate, its scope, date and exclusions, and evaluate what it actually covers.
The HIPAA Security Rule addresses administrative, physical and technical safeguards. Your risk analysis, workforce practices, integrations and configuration remain part of the assessment. Review before sharing PHI and when material circumstances change.
Identify who decides the purposes and who processes on instructions. Review the DPA, subprocessors, transfers, rights assistance and retention for the actual service. A vendor privacy claim or an EU hosting option leaves those questions open.
Assess the intended purpose, operator role and current applicable obligations before selecting controls. A mapping platform can help organize work; its policy pack does not establish legal applicability, a completed conformity assessment or customer compliance.
A claim starts the conversation. Evidence moves it forward.
Review the service handling protected health information, its BAA and shared responsibilities. Prepare a scoped assessment before sharing PHI.
A BAA offering is not an executed agreement or a compliance finding. These questions prepare a review; they are not an exhaustive assessment.
Answers stay in this page’s memory. Export before leaving or switching frameworks; switching clears answers. Record source links and review notes, never patient information or credentials. “Evidence received” is not a finding of compliance.
01 / Scope & responsibilityWhich exact service, edition and deployment will handle our PHI, and in what role?
Request a data-flow diagram, service schedule and responsibility matrix. Identify your covered-entity or business-associate role and each recipient before evaluating controls.
02 / The agreementWill you sign a BAA covering that service before receiving PHI?
Request the proposed BAA and the covered-service list. Check permitted uses, subcontractor obligations, incident reporting, return or destruction and termination provisions with your reviewer.
Request names, functions, processing locations and the contractual flow-down. Include model providers, logging, support and backup services; do not assume the main vendor contract covers every integration.
04 / AI & secondary useCan prompts, outputs or patient records be retained or used for model training?
Request service-specific terms and configured retention/training settings. Document permitted uses and exceptions; an enterprise promise may not apply to a consumer account or another model endpoint.
05 / Access & identityHow are access privileges approved, limited, reviewed and removed?
Request role definitions, authentication options, privileged-access controls and joiner/leaver procedures. Test access boundaries with synthetic records, including support access.
06 / Security safeguardsHow are ePHI risks assessed and safeguards maintained?
Request a current risk-analysis summary, remediation ownership, encryption/key-management design and relevant assurance scope. Compare the actual service boundary; SOC 2 or ISO documentation does not substitute for a HIPAA assessment.
07 / AuditabilityCan we investigate who accessed or changed patient information?
Request sample audit events, log retention, export options and access protections. Test whether the actions and identities your investigation needs are recorded without leaking PHI into general logs.
08 / Incidents & notificationsHow will you detect, investigate and report security incidents and breaches?
Request the response process, contractual reporting commitments, escalation contacts and a recent exercise summary. Separate incident reporting from the legal determination and notification of a breach.
09 / Continuity & recoveryHow will patient information remain available during disruption?
Request backup, restoration and contingency procedures with recovery-test evidence. Agree acceptable recovery objectives for your clinical workflow; test downtime procedures before launch.
10 / Retention, rights & exitHow can we retrieve, amend where applicable, retain and remove records?
Request export formats, assistance with applicable individual rights, deletion exceptions and backup schedules. Reconcile retention duties and contract termination with your own policies.
11 / Your deploymentWhich controls and responsibilities remain with our team?
Request an implementation checklist covering configuration, integrations, workforce training, access reviews and risk acceptance. Assign an owner and evidence date to each unresolved item.
12 / Change & re-reviewWhat triggers a new review after purchase?
Request change notices for terms, models, subprocessors, features and material incidents. Recheck scope before connecting new data or activating another service; retain dated decisions and evidence.
QUESTIONS ANSWERED
Before you shortlist.
Does GovernAtlas certify these products?
No. Discovery links published claims to their sources. Inclusion, payment and a framework mention do not establish compliance or suitability for your deployment.
What if a vendor has no matching evidence?
Our current coverage may be incomplete. Use the checklist to ask the vendor for documents and submit public sources for editorial review. An unknown result is not an adverse finding.
Can I use the checklist for a clinical AI tool?
Use it for the PHI-handling review, then separately evaluate clinical safety, intended use, human oversight and any applicable medical-device requirements. HIPAA alone does not establish clinical safety or effectiveness.
Can companies pay for a better evidence classification?
No. Public research and this checklist stay free. Company subscriptions do not change editorial gates, evidence classifications or search eligibility.
GovernAtlas editorial buying method · reviewed November 2, 2026. Primary references: HHS business associates, HHS risk analysis. The checklist is a preparation aid, not an exhaustive legal assessment.