What should you check before you call an EHR a HIPAA compliant EHR?

A written Business Associate Agreement on the plan you buy, encryption in transit and at rest, unique user access you can limit, an audit log you can open, and a backup and export path you can leave with. Then watch those clicks in the demo. A homepage that says HIPAA is not the contract.

Is there HIPAA certified EHR software?

No. HIPAA requires a written business-associate contract. A vendor may hold a third-party assessment. That report is not the contract in 45 CFR § 164.504(e). You still sign a BAA and run your own risk analysis under 45 CFR § 164.308.

Is HIPAA compliant EHR software different from a HIPAA compliant EMR?

For a therapy practice, EHR and EMR usually name the same system of record: schedule, notes, billing, and the chart. Marketing pages flip the label. Score the BAA, encryption, access, audit log, and export. Do not buy on the three-letter name.

Does a signed BAA make the EHR HIPAA compliant?

No. A BAA is required when a vendor creates, receives, maintains, or transmits PHI for you. It is the written assurance, not a security certificate. You still confirm encryption, access controls, audit logs, backup, and export on the plan you actually buy.

What HIPAA questions should you put to any EHR vendor?

Ask for the BAA on this plan, where encryption applies, who can open whose chart, whether you can export the audit log, how backups are tested, and how you get a full chart out if you leave. Write the answers in the room. A blank line stays open until someone shows the click.

hipaa compliant ehrBAAtherapy ehrpractice management

HIPAA Compliant EHR: What to Check Before You Sign

Marcus Reilly · Practice Operations Editor · October 23, 2026 · 6 min read

Outline

Scroll the table sideways to view every column

EHR	BAA offered	Encryption	Access controls
SimplePractice	Yes; all customers	Encrypted at every touchpoint (Trust Center); ask at rest vs in transit	Team permissions; two-step login
Jane	HIPAA named; BAA not published	TLS 1.2 in transit; AES-256 at rest	Access levels; 2-step verification
Upheal	Yes; agreed at signup	TLS 1.2 or later in transit; strong encryption named	Roles; least privilege named
TheraNest	Not on the Ensora security page	At rest and in transit	Least privilege; confirm roles on demo

The same four systems, with the audit log and the backup and export path.

Scroll the table sideways to view every column

EHR	Audit log	Backup and export	Still open on the demo
SimplePractice	Every change to the record	Export ~60 days after close; PDF or XML	Show a backup restore
Jane	Owner Activity Log by staff and date	Encrypted daily to yearly backups; free export on close	Open the Activity Log as the owner
Upheal	Access logged and monitored	Backup and disaster recovery named	Export a full chart you can open
TheraNest	Company SIEM; confirm the practice log	Confirm backup and chart export	Open a practice-facing audit export

Vendor facts are based on each vendor’s own public US pages, read October 10, 2026. Terms can change after that date. A blank or “confirm” cell is not a pass.

A HIPAA compliant EHR is the chart you can defend after those clicks, not the one with the loudest privacy headline. HIPAA compliant EHR software and HIPAA compliant EMR software are the same buying test under different labels.

If you still need a fit shortlist for scheduling and claims, use the best EHR for private practice roundup. If the gap is your one-person HIPAA program rather than the vendor row, use HIPAA for solo therapists. If you are leaving a chart, run the therapy EHR data export checklist before you cancel.

Put these questions to any vendor

A third-party report is not the written contract 45 CFR § 164.502(e) requires before a vendor may create, receive, maintain, or transmit PHI for you. That assurance must be documented in a written contract. 45 CFR § 164.504(e) is the content of that contract. 45 CFR § 164.312 is the technical-safeguard list you are scoring: access control, audit controls, integrity, authentication, and transmission security.

Score a HIPAA compliant EHR on the BAA, the log, and the export, not on the badge. Write the answers before you leave the call.

Worksheet template HIPAA questions for any EHR vendor

Vendor and plan. [name and the plan that will hold PHI]

BAA. Is a Business Associate Agreement executed on this plan before any client chart moves? [yes / no / not shown]

Encryption. Where is ePHI encrypted in transit, and where is it encrypted at rest? [answer]

Access controls. Unique logins, roles, and multi-factor on clinician accounts? [present / missing]

Audit log. Can you open a log that shows who viewed or changed a test chart? [opened / not shown]

Backup. When was the last restore test, and who can request one? [date or not shown]

Export. Pull one synthetic client as a file you can open on a machine you control. [format / failed]

Subprocessors. Who else can see ePHI, and is each one under a BAA? [list or not shown]

Training on client content. Does session content train public models? [no / yes / not shown]

Incident notice. How soon will they tell you about a security incident? [time or not shown]

Worked example: one signing week

Worked example Dana, LCSW, two-clinician practice, mixed commercial

Dana is replacing a spreadsheet-and-portal stack. She bills commercial insurance. A second clinician starts in six weeks. She needs a HIPAA compliant EHR she can defend, not a slogan.

Vendor shortlist. SimplePractice, Jane, Upheal, TheraNest.

BAA. SimplePractice states a BAA with all customers, viewable on its site. Upheal publishes a BAA and says covered entities agree at signup. Jane names HIPAA on the cloud security white paper and does not publish a BAA on the security-and-trust pages. TheraNest’s parent security page does not name a BAA. Dana keeps Jane and TheraNest only if someone produces the signed agreement before a live chart moves.

Encryption. SimplePractice’s Trust Center says notes, messages, and billing are encrypted at every touchpoint; ask the demo to say where that covers storage and transmission. Jane names TLS 1.2 in transit and AES-256 at rest, including backups. Upheal names TLS 1.2 or later in transit and strong encryption. Ensora says customer data is encrypted at rest and in transit. Dana still asks each demo to show a session over HTTPS and to say whether backups are encrypted.

Access controls. SimplePractice names team permissions and two-step login. Jane names access levels and 2-step verification the owner can enforce. Upheal names role and least-privilege access and unique logins. Ensora describes least privilege for company staff. Dana opens a second login and tries to hide one test chart from the biller.

Audit log. SimplePractice names audit logs of every change to a patient record. Jane gives the owner an Activity Log by staff, date, and type of access. Upheal logs and monitors access to personal data. Ensora describes company SIEM logging. Dana treats TheraNest as unproven until a practice-facing log opens on a test chart.

Backup and export. SimplePractice gives about 60 days after close to export, including PDF or XML for a patient record. Jane encrypts daily through yearly backups, tests recovery, and will export free of charge if the owner closes the account. Upheal names backup and disaster recovery and does not name the export file on the privacy page. TheraNest backup and chart export are not on the Ensora security page Dana used. She will not sign TheraNest until a synthetic client export opens on her laptop.

She keeps a system only if the BAA, the two-factor login, the audit log, and one export all work without a workaround. HIPAA compliant EMR software is the same test under a different label.

What the Security Rule actually asks you to score

Do not outsource the risk analysis to a homepage. 45 CFR § 164.308(a)(1)(ii)(A) requires an accurate and thorough assessment of risks to ePHI you hold. 45 CFR § 164.312 is the technical list. Access control includes unique user identification. Audit controls mean hardware, software, or procedural mechanisms that record and examine activity in systems that contain ePHI. Transmission security covers the session you run on cafe Wi-Fi. Encryption is addressable. If a vendor cannot tell you where it applies, write that down.

A BAA that you have not executed does not cover the PHI already in the trial. Start on a synthetic client. Move a live chart only after the agreement is in place on the plan you will buy.

When you leave, the export is part of the same duty. Count notes, psychotherapy notes held separately, plans, claims, and audit history against the live chart. Keep the old system paid until that count matches.

Keep the chart. Draft the note beside it

Emosapien is not one of the four EHRs. It does not hold the designated record set. It drafts notes for you to review, in SOAP, DAP, BIRP, or GIRP, and it can sit beside the record you already run. A BAA is available on Professional and Enterprise before PHI moves through the clinical workflow. Session content is not used to train public models. Encryption, access control, and audit logging are part of that stack. SimplePractice write-back is live. Confirm the live connector before you treat paste as a plan.

Download the BAA Review Checklist

Use the checklist to match the agreement to the access, audit-log, backup, and export paths you see in the demo.

Free PDF: BAA Review Checklist for Therapists

Record the contract and security questions before any real chart moves.

Vendor, covered-entity, plan-tier, owner, and review-date fields
Checks for permitted uses, safeguards, subcontractors, and incident notice
Return, destruction, export, and backup-lifecycle prompts
Clause-versus-product evidence fields and counsel escalation questions

Free. We'll email the PDF link right away and add you to the therapist toolkit, sent every two weeks. Unsubscribe any time.

References

U.S. Department of Health and Human Services. (n.d.). 45 CFR § 164.308. Administrative safeguards. Cornell Law School Legal Information Institute.
U.S. Department of Health and Human Services. (n.d.). 45 CFR § 164.312. Technical safeguards. Cornell Law School Legal Information Institute.
U.S. Department of Health and Human Services. (n.d.). 45 CFR § 164.502. Uses and disclosures of protected health information: general rules. Cornell Law School Legal Information Institute.
U.S. Department of Health and Human Services. (n.d.). 45 CFR § 164.504. Uses and disclosures: organizational requirements. Cornell Law School Legal Information Institute.