HIPAA GUIDE · Updated October 15, 2026
BAAs Explained: Which Common Practice Vendors Sign Them (2026)
A Business Associate Agreement (BAA) is the contract HIPAA requires before a vendor handles patient information on your behalf.
Not legal advice. This is general information for small practices, summarized from HHS.gov. Talk to a healthcare attorney or qualified compliance professional about your specific situation.
What a BAA does
HHS publishes sample BAA provisions. A BAA sets out how the vendor may use the information, requires safeguards, and requires the vendor to report breaches to you.
Which vendors sign one
| Vendor | BAA status (from vendor sources, checked Oct 2026) |
|---|---|
| Jane App | Jane says it is HIPAA compliant and will sign its standard BAA on request. |
| Weave | Publishes a Business Associate Addendum (getweave.com/legal/baa); Weave says an active BAA is required before storing PHI. |
| Podium | Its terms say covered entities and Podium "agree to the terms of Podium's BAA" (legal.podium.com). |
| Birdeye | Birdeye's HIPAA page includes business associate agreement terms. |
| Solutionreach | Says it acts as your HIPAA business associate, and its terms reference a Solutionreach BAA. |
| IntakeQ | BAA included; sign it in Account settings. |
| Cliniko | Enable HIPAA support in settings, then request a BAA in-app (per Cliniko Help). |
| Acuity Scheduling | Sign Squarespace's BAA in-app on Premium/Powerhouse. Covers Acuity only, not other Squarespace features. |
| Freed | BAA is Schedule A of Freed's platform Terms of Use (accepted at sign-up); a signed copy is available on request. Groups plans add an organization-wide BAA. |
| Heidi Health | Heidi's US clinic agreement says the parties enter into a Business Associate (Subcontractor) Agreement. Confirm in writing which plan it covers. |
| ActiveCampaign | BAA "available on eligible plans"; ActiveCampaign's plan overview lists "HIPAA support" under Enterprise. Confirm the tier with sales. |
| GoHighLevel | BAA available only with the HIPAA add-on ($297/mo). HighLevel says it is "not HIPAA compliant by default." |
| NexHealth | Pricing page lists "HIPAA compliance and security" and encryption at rest. We did not find a published BAA, so ask for one. |
| NiceJob | unknown. We found no HIPAA statement or BAA on NiceJob's site, so the score is capped at 2/5. |
| Calendly | No BAA. Calendly's customer terms say customer data must not contain HIPAA-regulated PHI. |
| Mailchimp | No BAA. Mailchimp's Acceptable Use Policy bars uploading "sensitive personal information regulated by applicable law," and its terms say it isn't liable if the service doesn't meet HIPAA. |
From our tool research; vendor terms change, so confirm in writing before sharing patient data.
Tips
- Keep a list of every vendor that touches patient data and where its signed BAA is filed.
- A BAA often covers only certain plans or products. Check the tier.
- No BAA? Keep patient information out of that tool.
FAQ
Does Mailchimp sign a BAA?
No. Its terms bar regulated sensitive data, so do not upload patient lists.
Does Jane sign a BAA?
Jane says it is HIPAA compliant and will sign its standard BAA on request.