Patient Portal Solution: Forms, Messages, and the BAA

How four patient portal vendors score on the six jobs

Vendor	Forms	Secure messaging	Documents
SimplePractice	Paperless intake, every plan	Essential, not in the every-plan list	Intake named, not a read-only handout
Jane	Intake in My Account	Practitioner starts the thread	Shared files in My Account
Practice Better	Intake in portal; Starter lists forms	Starter lists it	Programs, documents, shared handouts
Sessions Health	Consents and intake to sign	Named on portal and pricing	To complete and sign, not a read-only handout

Vendor	Payments	Booking	BAA
SimplePractice	Online payments, every plan	Requests on Starter; widget on Plus	Made at account creation if BA definition met
Jane	Jane Payments, if enabled	If online booking is on	DPA listed, BAA not named
Practice Better	Invoices in portal; Starter lists it	Book and reschedule; Starter lists it	HIPAA claim, agreement not shown
Sessions Health	Cards and AutoPay, both columns	Requests and cancellations	HIPAA claim, BAA not named

SimplePractice

Demo question: On Essential, send a portal message, finish one intake as the client, and open the agreement you signed.

Jane

Demo question: Have the client try to start a message before you do, share one file that is not an intake form, and ask for the agreement.

Practice Better

Demo question: On Starter, book, message, open a handout, pay a test invoice, and open the agreement.

Sessions Health

Demo question: Send a consent to sign, reply as the client, and ask for the agreement by name.

Prices and plans reflect provider pages read October 8, 2026. Educational only; confirm the live plan before you buy.

What a patient portal solution has to prove

You are not shopping a login screen. You are shopping the six jobs your client does when you are not in the room.

A patient portal solution has to take a form, a secure message, a document, a payment, and a booking, and sit under an agreement you can sign. A badge does not close any of those jobs. A hospital portal is a different product. The form, the message, and the copay have to land on the therapy chart you already keep.

The four patient portal vendors above are the ones to put a fictional client through. Drop a name that cannot show the screen.

If the visit itself has to open on the chart, run the telemedicine EHR test. That buy is the record. Stay with the six jobs when the question is what the client can do between sessions.

If the gap is the note after the hour, use best therapy notes software. Do not buy a second portal to fix a note you have not tested.

If the gap is a check-in, a journal prompt, or a measure you assign between sessions, start with best AI patient engagement software. That buy is the clinical thread. It is not the login for intake and payment.

Six jobs on the demo

Print this before the call. Write the answer from the product, not from the slide.

A pass is a click you watched. Not offered means the vendor does not sell that piece on the plan you will buy. Fail means you needed a workaround, including email. Treat a blank cell as a fail until someone shows you the screen.

The agreement is not the badge

A page that says HIPAA, PIPEDA, GDPR, or PHIPA has told you the vendor’s claim. It has not handed you the contract.

45 CFR § 164.502(e) says a covered entity may disclose protected health information to a business associate and may allow that associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the associate will appropriately safeguard the information. The same subsection says that assurance must be documented through a written contract or other written agreement or arrangement. 45 CFR § 160.103 defines a business associate.

Ask for the PDF on the demo. If the host cannot open it, you do not have a patient portal solution you can put a real client in.

Jane is the clearest split on this shortlist. My Account can take a form, a file, a balance, and a booking. The security and trust page still does not list the agreement. Practice Better and Sessions Health publish the compliance claim and do not name the agreement on the pages cited above. SimplePractice publishes the agreement text and limits it to accounts that meet the definition. Read that limit before you treat account creation as a signed BAA for every use.

Do not let a payer’s portal rule stand in for that contract, and do not let the contract stand in for the payer. If the login works and the claim still needs a workaround, the billing test is the next hour, not a second portal.

When the six jobs pass

You now have a marked sheet. The next decision is small.

• Form, message, document, payment, booking, and agreement pass: you can send a real client to that login.
• The portal passes and the agreement is missing: do not move a real client. Book the next vendor.
• Messaging or booking sits on a higher plan: price that plan, or keep looking.
• The client still needs email for a handout or a copay: you bought a login, not the six jobs.
• The login passes and the remaining gap is the note after the hour: do not replace the portal to fix the note.

Emosapien is not this purchase. The features page says it listens through the video call you already run, drafts SOAP, DAP, BIRP, or GIRP notes, and writes them back to your EHR. Run the six jobs in the portal you are about to buy. Keep that portal if it passes.

If the login you already have survived the six jobs, and the remaining gap is the draft you still write by hand, start on the free plan and run a fictional session there.

Start on the free plan

Download the Therapy Software Buying Pack

Mark the six jobs on paper while the host is still on the line. A memory of a good demo is not a pass.

References

• U.S. Department of Health and Human Services. (2013). Definitions. 45 C.F.R. § 160.103.
• U.S. Department of Health and Human Services. (2013). Uses and disclosures of protected health information: General rules. 45 C.F.R. § 164.502.