"HIPAA compliant" isn't a certificate a tool can earn. Microsoft's own compliance page says there is no certification standard approved by the Department of Health and Human Services. What makes a tool safe for patient information in your practice is a signed Business Associate Agreement (BAA) with the company, and using only what that agreement covers, set up the way it says.
The rule, in one line
A practice may let a vendor create, receive, keep or send patient information only after getting "satisfactory assurance" that the vendor will safeguard it, and that assurance has to be in a written agreement: the BAA. Every person who logs in needs their own unique login.
HIPAA, 45 CFR 164.502(e) and 164.312(a).
Before any tool touches patient info
- Will they sign a BAA for the exact plan you use? Get it signed first. No BAA, no patient information in it. That answers "is ChatGPT HIPAA compliant," "is this AI note taker HIPAA compliant" and "can I text patients from this app" the same way.
- Is the feature you'll use covered? A BAA can cover some products and not others in the same account.
- Set it up the way the vendor's guide says. Big platforms publish implementation guides for exactly this.
- One login per person, no shared front-desk password, and two-step sign-in on.
- Keep every signed BAA on file, with the date and the plan it covers.
What the big platforms say
| Platform | What their page says |
|---|---|
| Google Workspace | Customers who haven't signed Google's BAA must not use patient information in Workspace; an admin reviews and accepts it in the Admin console, and only services on Google's HIPAA Included Functionality list are covered. Google |
| Microsoft | Enters into BAAs with covered-entity customers for its enterprise products and services. Microsoft |
| Zoom for Healthcare | Supports customers' HIPAA compliance by executing a BAA. Zoom |
| AI tools, texting apps, phone and fax services | Ask each company for a BAA that names the plan you're on, before patient information goes in. |
Checked October 10, 2026, on each company's own page. Plans and terms change; the signed BAA is what counts.
The package
Practice tech setup: $59 flat. The first hour at your office: PJ lists every tool that touches patient information, checks which ones have a signed BAA, and sets up separate logins and two-step sign-in.
Text PJ to book Pay $59 by Venmo
Paying first is fine: PJ texts you to set the time, and if you're outside the area he sends it back the same day. Solana Beach, Del Mar, Cardiff and Encinitas to start. No cut from any brand, seller or contractor.
PJ sets up the tools; he isn't a HIPAA compliance officer or a lawyer. For a risk assessment or policies, see HIPAA consultants in San Diego. Family paperwork instead? HIPAA forms for family.
Need a human?
This page is built every morning from public data by SideGuy, run by PJ, a local in Solana Beach. If something looks off, or you want a hand with your plans, text PJ at 858-461-8054. A real person answers.
Local help, free to read: make your fix plan · senior benefits checkup · lower your SDG&E bill · Medicare Extra Help · every 2027 Medicare plan · is my medication recalled? · the next 90 days. Plans start as low as $25. Your parent lives here and you don't? The Parent Check-In Plan, $25 a month.
Questions people ask
Is ChatGPT HIPAA compliant?
No tool is HIPAA compliant on its own. A practice can use one with patient information only after the company signs a Business Associate Agreement covering the plan in use. Without a BAA, keep patient information out of it.
Is there a HIPAA certification for software?
No. Microsoft's compliance page notes that HHS approves no certification standard for HIPAA compliance. Look for a signed Business Associate Agreement instead.
Can I text patients from my phone?
Only through a service whose company has signed a BAA with your practice for that service, set up as the BAA requires, with each person on their own login.
Does Google Workspace work for HIPAA?
Google says customers must accept its BAA in the Admin console before using patient information, and only services on its HIPAA Included Functionality list are covered.
What is a Business Associate Agreement?
The written agreement HIPAA requires before a vendor creates, receives, keeps or sends patient information for a practice, giving the satisfactory assurance that the vendor will safeguard it.
Know someone who needs this?
Got a question about this? Ask PJ a question. A real person in Solana Beach texts you back.
Something changed here? Text PJ the fix: if it changes this page, you get $5. How it works.
Spotted something new around town? Text it in. What do you want to see here? Ask PJ for a page. No login, a real person reads it.
More free local tools: the North County toolkit.