Is SimplePractice HIPAA Compliant?

Short answer

Is SimplePractice HIPAA compliant? Yes. SimplePractice is built specifically for mental and behavioral health practitioners and includes a Business Associate Agreement at all paid plan tiers. No enterprise upgrade is required. Telehealth, notes, scheduling, intake forms, and billing are covered. The nuance: SimplePractice’s BAA covers the software platform. The clinic’s compliance program — risk assessment, training records, written policies, incident response plan — remains the practice’s own responsibility. A BAA with one good vendor does not replace a HIPAA compliance program.

BAA availability across SimplePractice plans

SimplePractice’s approach to BAA coverage is notably accessible compared to many other vendors in this series. While tools like SurveyMonkey and Doxy.me require enterprise-tier plans or specific paid upgrades to access a BAA, SimplePractice includes the BAA for all paying subscribers.

This reflects SimplePractice’s positioning as a healthcare-first platform. Mental and behavioral health practitioners — the primary user base — are nearly always covered entities under HIPAA. A platform designed for this market that gated BAA access behind an enterprise tier would underserve its users.

Review SimplePractice’s current terms of service and security documentation to understand exactly how the BAA is presented to subscribers. The mechanics of accepting or executing the BAA may be embedded in the subscription agreement or available as a separate document. Confirm the current process and retain documentation.

What SimplePractice’s BAA covers

Under the BAA, SimplePractice is a business associate for covered entities using the platform. SimplePractice’s obligations include:

• Protecting the confidentiality, integrity, and availability of PHI stored in the platform
• Reporting breaches of PHI to the covered entity
• Ensuring that any subcontractors it uses who handle PHI are similarly bound
• Returning or destroying PHI upon termination of the business associate relationship per the BAA terms

SimplePractice covers these clinical and administrative functions under the BAA:

Clinical documentation: Progress notes, treatment plans, assessments, and clinical records created in SimplePractice are PHI. The BAA covers their storage and handling within the platform.

Scheduling: Appointment records, session history, and scheduling data are covered.

Telehealth: SimplePractice’s built-in telehealth video sessions are covered under the BAA. This eliminates the need for a separate telehealth BAA (such as a separate Doxy.me agreement) if you conduct telehealth within SimplePractice.

Client intake and forms: Digital intake forms submitted through SimplePractice’s client portal are covered.

Billing and superbills: Insurance claims, superbills, and payment records are covered.

What the BAA does not cover

Your other software tools: If your practice uses any tool outside of SimplePractice that handles PHI — a separate billing service, a referral management tool, an email platform with patient data, a scheduling tool other than SimplePractice — those tools require their own BAA evaluation. SimplePractice’s BAA applies only to SimplePractice.

Your practice’s internal operations: The BAA does not address how your staff handles PHI outside the software — physical records, conversations about patients, how providers access patient information from personal devices. These are your HIPAA administrative and physical safeguard obligations.

Your compliance program: The BAA establishes SimplePractice’s obligations. Your practice’s HIPAA compliance program is a separate and required body of work.

What your practice still needs

Having a BAA with SimplePractice is necessary. It is not sufficient. HIPAA requires covered entities to implement administrative, physical, and technical safeguards independent of any vendor agreement. For a small mental or behavioral health practice, the minimum compliance program includes:

Risk assessment: A documented analysis of the risks to PHI in your practice — how PHI is created, stored, transmitted, and accessed; what vulnerabilities exist; and what safeguards are in place. This is required under the HIPAA Security Rule and must be updated when significant changes occur.

Written HIPAA policies: Documented policies covering access control, workforce training, media disposal, breach response, and other required areas. SimplePractice may provide template resources, but the policies must be adopted and implemented by your practice.

Workforce training: All staff who handle PHI must receive HIPAA training at hire and at least annually thereafter. Training must be documented — who attended, when, what was covered.

Sanctions policy: A written policy describing consequences for workforce members who violate HIPAA requirements. Required under the Security Rule.

Physical safeguards: Policies governing workstation security (screen locking, positioning screens away from patient areas), facility access controls, and mobile device use when accessing PHI.

Incident response and breach notification: A written plan for responding to potential HIPAA incidents — what constitutes a breach, how to investigate, when HHS and patient notification is required, and who is responsible for each step.

SimplePractice in the broader tool ecosystem

Many SimplePractice users also use other tools:

• Email (Google Workspace, Microsoft 365, or personal email) for patient communication
• Payment processing (Stripe or Square) for copayments or self-pay billing
• Video conferencing (Zoom, Google Meet) for sessions outside SimplePractice’s telehealth
• Scheduling tools for new patient intake before they are in SimplePractice

Each of these requires its own compliance evaluation. SimplePractice’s strong HIPAA posture does not extend to any of these adjacent tools. A practice that uses SimplePractice plus Gmail for patient communication has a HIPAA gap at the Gmail layer — unless Gmail is configured under a Google Workspace for Healthcare BAA.

Compliance operations alongside SimplePractice

SimplePractice handles the clinical software layer. The compliance program operations — tracking training completion, conducting and documenting risk assessments, managing policies, running breach response — are a separate administrative function.