How-To Guides

Doximity is HIPAA compliant for provider-to-provider communication — secure messaging, encrypted fax, and masked calls. Here's where it ends and what your practice still needs.

FaceTime is not HIPAA compliant. Apple does not sign a HIPAA BAA for FaceTime under any account type. OCR's COVID-era enforcement discretion ended May 11, 2023. Using FaceTime for patient telehealth today is a violation.

Traditional fax is generally HIPAA compliant when proper safeguards are in place. Internet fax requires a BAA with your provider. Here's what small clinics need to know.

Personal @gmail.com accounts are never HIPAA compliant. Gmail inside Google Workspace can be compliant — but only after you sign a BAA with Google in the Admin console. Here's exactly what's required.

Gemini for Google Workspace can be HIPAA compliant with a signed BAA. The consumer Gemini at gemini.google.com is not. Here is what small clinics need to know before staff start using AI assistants.

Personal Google Docs is not HIPAA compliant. Google Docs within Google Workspace can be — but only after signing Google's BAA and disabling link sharing on PHI documents. Here is what small clinics need to know.

Personal Google Drive is not HIPAA compliant. Google Workspace Drive can be — but only after a BAA is signed and link sharing is locked down. Here is what small clinics need to know.

Personal Google Forms is not HIPAA compliant. Google Forms within Google Workspace can be — but responses are stored in Drive and Sheets, which must also be covered. Here is what small clinics need to know.

Google Meet can be HIPAA compliant — but only through a paid Google Workspace account with a signed BAA. Free personal accounts have no HIPAA coverage whatsoever.

Personal Google Sheets is not HIPAA compliant. Google Sheets within Google Workspace can be — but patient tracking spreadsheets are common and the risk is often missed. Here is what small clinics need to know.

Personal Google Voice is not HIPAA compliant. Google Voice for Workspace can be — but only after a BAA is signed, and voicemail transcripts create a separate risk most clinics miss. Here's the full picture.

HubSpot is HIPAA compliant only through its Healthcare Hub on Enterprise contracts. Standard HubSpot tiers — including Starter and Professional — cannot store PHI. Here's what that means for your practice.