Key takeaways
- There is no official HIPAA certification for software, so treat any such claim with caution.
- A BAA is a contract that assigns the vendor's responsibilities; it does not make the clinic compliant by itself.
- Check the safeguards your team will use daily: two-step sign-in, roles, an audit log and a full export.
- Texting consent is a separate question from HIPAA, shaped by the TCPA and carrier registration rules.
Search for med spa software and you will find "HIPAA compliant" on many vendor pages. It reads like a stamp of approval, but no such stamp exists. HIPAA compliance is something a practice does, with help from its vendors, not a feature a product can carry.
This guide explains what a business associate agreement (BAA) covers, what it leaves to the clinic, which safeguards to check and where texting consent fits. This guide is general information, not legal advice. Talk to a healthcare attorney about your clinic's obligations.
Is there such a thing as HIPAA compliant software?
Not officially. HHS, which enforces HIPAA through its Office for Civil Rights, does not certify or endorse software, so "HIPAA certified" on a vendor page is a marketing phrase, not a credential.
Independent security audits exist and can be useful evidence of a vendor's security program, but none of them is a HIPAA certification. The two questions that matter are whether the vendor will sign a BAA before your client records go in, and which safeguards protect the data in daily use.
Does HIPAA apply to a med spa?
It depends on whether the practice is a covered entity. For healthcare providers, that turns largely on whether the practice conducts certain standard transactions electronically, such as billing a health plan.
A cash-pay med spa may fall outside that definition, but that does not leave client records unregulated. State privacy and medical records laws still apply, and a med spa run as part of a medical practice that bills health plans may be covered through that practice. Since the records hold medical histories, medications, photos and treatment notes, handling them to HIPAA's standard either way is a sensible default.
What is a business associate agreement?
A business associate agreement, or BAA, is a contract between a covered entity and a vendor that creates, receives, maintains or transmits protected health information on its behalf. HIPAA requires it before the vendor handles that information.
For a med spa, business associates often include the practice management or CRM software, cloud storage, texting and email services that carry client information, transcription services, billing services and IT support with access to your systems. Each vendor in turn needs BAAs with its own subcontractors that touch the data, such as its hosting provider. Sign before client records move in, not after.
What does a BAA actually cover?
A BAA sets out how the vendor may use and disclose your clients' information and what it must do to protect it. HIPAA requires certain terms in every one.
- Permitted uses. The vendor may use and disclose the information only to provide the service, or as the law requires.
- Safeguards. It must protect the information as the HIPAA Security Rule requires for electronic records.
- Reporting. It must tell you about uses or disclosures the contract does not allow, including breaches and security incidents.
- Subcontractors. Any subcontractor that handles the information must agree to the same restrictions.
- Client rights. It must help you give clients access to their records, amend them and account for disclosures.
- Government review. It must make its practices and records available to HHS during an investigation.
- End of contract. It must return or destroy the information when the relationship ends, where feasible, and keep protecting anything it cannot.
- Termination. You must be able to end the contract if the vendor violates a material term.
What does a BAA not cover?
A BAA covers the vendor's side only. Everything your own team does with client data, on its own devices and through other tools, stays the clinic's responsibility.
| The vendor's BAA covers | The clinic still owns |
|---|---|
| How the vendor may use and disclose client data | Who on your team has access, and at what level |
| Safeguards on the vendor's systems | Your own risk analysis, policies and training |
| Reporting breaches and incidents to you | Shared logins and unlocked screens at the front desk |
| Its subcontractors' obligations | Photos and notes on staff phones |
| Returning or destroying data at the end | Other tools that hold client data without a BAA |
| Helping you answer client record requests | Your privacy notice and marketing authorizations |
A signed BAA also does not prove a vendor is secure. It makes the vendor contractually responsible, which is why the safeguards below are worth checking yourself. For photos, see our guide to before and after photos.
Which safeguards should you check in the software?
Check the controls your team will use every day: unique logins with two-step sign-in, automatic sign-out, access roles, an audit log and a full data export. They line up with the technical safeguards in the HIPAA Security Rule, which include access control, audit controls, authentication and transmission security.
Audit log
An audit log records who viewed, changed or exported a record, and when, along with every sign-in. It is how you answer "who opened this client's chart?" after a complaint or an incident. Ask whether it records views as well as changes, whether exports are included and whether the clinic can see it without filing a support ticket.
Access roles
Roles let each person see what their job needs and no more, which is the idea behind HIPAA's minimum necessary standard. The front desk may need the calendar and checkout but not chart notes, and a marketing coordinator rarely needs clinical details. Ask how many roles exist, whether you can adjust them and how quickly access ends when someone leaves.
Two-step sign-in and automatic sign-out
Passwords get reused and phished. A second step, such as a code sent to a phone, makes a stolen password far less useful. Ask whether two-step sign-in is available on every account, whether the system signs out after inactivity on shared front-desk screens and whether you can review sign-in history.
Encryption
Data should be encrypted in transit, between the device and the server, and at rest, where it is stored. Ask the vendor to confirm both in writing.
Data export
Your client records belong to the practice, and state laws set how long medical records must be kept. You need a full export to switch vendors, to answer record requests and to keep records after a contract ends. Ask whether you can export everything at any time, in which formats, whether photos, signed forms and every version of a chart note are included, and what happens to your data after you cancel.
What should you ask a vendor before you sign?
Ask for specifics, in writing, before any client record moves in:
- Will you sign a BAA before we import records, and can we read it now?
- Which subcontractors handle our data, and do you have BAAs with them?
- Can we export all our data at any time, including photos and signed forms?
- What happens to our data if we cancel?
- How and when will you notify us of a security incident?
- Which features send data to outside services, such as texting or transcription, and are those covered?
For the rest of the buying checklist, see our guide to choosing med spa software.
How do texting and email consent fit in?
Consent to receive messages is a separate question from HIPAA. A BAA covers how a vendor protects data, while the TCPA, carrier rules and email law decide whether you may send a message at all.
Reminders versus marketing
Appointment reminders and other messages about a client's own care are informational. Offers, promotions and "we miss you" campaigns are marketing. The consent each needs differs, so record them separately. Under HIPAA, a covered practice may text or email a client who prefers it after warning them about the risks of unencrypted messages. Either way, keep clinical details out of the message.
TCPA consent for marketing texts
The Telephone Consumer Protection Act is the federal law behind text message consent. At a high level, marketing texts sent through an automated system require the client's prior express written consent, which should be clear, separate from other terms and not a condition of buying anything. Keep a record of when and how each client agreed, honor opt-outs such as STOP promptly and remember that some states add their own rules. Federal rules also limit the hours when telemarketing can reach consumers, and some states set narrower windows, so hold automated messages during quiet hours.
A2P 10DLC carrier registration
A2P 10DLC is the system U.S. carriers use for business texting from standard 10-digit local numbers. Before sending, the business, or its software provider on its behalf, registers its brand and each use case, with sample messages and a description of how clients opt in. Unregistered or poorly described traffic can be filtered or blocked, so reminders may never arrive.
Commercial email falls under the CAN-SPAM Act: an honest sender and subject line, a physical mailing address and a working unsubscribe that you honor. Keep email consent separate from text consent.
How Klinycs handles HIPAA and client data
Klinycs does not claim a HIPAA certification, because none exists. On the Clinic and Enterprise plans, hosting runs under a signed BAA at every layer before client records move in. Every account has two-step sign-in, with sign-out after inactivity and a sign-in history. The audit log records every record view, change, export and sign-in, and 8 roles with a permissions matrix control who sees what. A full export is available at any time. For messaging, website forms collect SMS and email consent separately, campaign audiences leave out people without consent and quiet hours are respected. See security and leads and marketing.
Frequently asked questions
Is there HIPAA certified med spa software?
No. HHS does not certify software, and there is no official HIPAA certification for any product. When a vendor uses that phrase, ask what it means in practice: will the vendor sign a business associate agreement before your records go in, and which safeguards, such as an audit log and two-step sign-in, protect the data?
What does a business associate agreement cover?
A BAA sets out how a vendor may use and disclose a practice's protected health information. It requires the vendor to safeguard that information, report breaches, bind its subcontractors to the same terms and return or destroy the data when the contract ends. It covers the vendor's side, not the clinic's own practices.
Do appointment reminder texts need consent?
They need consent too, though the rules are lighter than for marketing. A client who gave you a phone number for appointments has generally agreed to related reminders, but must be able to opt out at any time. Marketing texts generally need prior express written consent under the TCPA. This is general information, not legal advice.
What is A2P 10DLC registration?
A2P 10DLC is the registration U.S. carriers require for businesses that send texts from standard 10-digit local numbers. The business registers its brand and each use case, such as appointment reminders or marketing, with sample messages and its opt-in process. Unregistered traffic can be filtered or blocked, so registration affects whether reminders arrive at all.
In the platform