eset.com

Yes—but **only in specific Google Gemini configurations**. As of 2026, Google explicitly says that Gemini can support HIPAA workloads, but HIPAA compliance depends on the product, account/edition, configuration, and having the appropriate **Business Associate Agreement (BAA)** with Google. [knowledge.workspace.google.com](https://knowledge.workspace.google.com/admin/generative-ai/workspace-with-gemini/gemini-for-google-workspace-faq-business?co=DASHER._Family%3DEducation&rd=1&visit_id=639192202097753242-1765744769&utm_source=chatgpt.com)[knowledge.workspace.google.com](https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity?rd=1&visit_id=639178361620515873-3614651723&utm_source=chatgpt.com) ### What is covered Google's current HIPAA Included Functionality list includes: - **Gemini app** — including the web/mobile app, but **excluding Gemini in Chrome** - **Gemini in Google Workspace** (Gmail, Docs, Drive, Meet, etc.) - **Gemini Mac app** [workspace.google.com](https://workspace.google.com/terms/2015/1/hipaa_functionality/?utm_source=chatgpt.com) Google's BAA is important: organizations handling PHI must accept Google's HIPAA BAA before using covered Google services with PHI. [knowledge.workspace.google.com](https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity?rd=1&visit_id=639178361620515873-3614651723&utm_source=chatgpt.com) ### Important exceptions - **Gemini in Chrome is *not* HIPAA-covered.** Google says it is automatically blocked for customers that have signed a HIPAA BAA. [knowledge.workspace.google.com](https://knowledge.workspace.google.com/admin/generative-ai/gemini-app/turn-the-gemini-app-on-or-off?hl=en&rd=1&src=supportwidget0&visit_id=639203146065463685-923620267&utm_source=chatgpt.com) - **Gemini Notebook/NotebookLM is not currently covered by Google's HIPAA BAA.** [knowledge.workspace.google.com](https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub?rd=1&visit_id=639177225161449217-1059536237&utm_source=chatgpt.com) - Third-party integrations/add-ons connected to Workspace aren't automatically covered by Google's BAA. [knowledge.workspace.google.com](https://knowledge.workspace.google.com/admin/generative-ai/workspace-with-gemini/gemini-for-google-workspace-faq-business?co=DASHER._Family%3DEducation&rd=1&visit_id=639192202097753242-1765744769&utm_source=chatgpt.com)[knowledge.workspace.google.com](https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity?rd=1&visit_id=639178361620515873-3614651723&utm_source=chatgpt.com) - Having a BAA doesn't make your entire use of Gemini automatically HIPAA compliant; your organization still has responsibility for configuration, access controls, and how PHI is handled. [knowledge.workspace.google.com](https://knowledge.workspace.google.com/admin/compliance/hipaa-compliance-with-google-workspace-and-cloud-identity?rd=1&visit_id=639178361620515873-3614651723&utm_source=chatgpt.com) ### Bottom line If you're asking **“Can my healthcare organization use Gemini with PHI?”** the answer is **yes, for Google's HIPAA-covered Gemini services, provided you have the Google BAA and configure/use the service appropriately.** If you're considering **Gemini vs. ChatGPT for handling PHI**, I can also compare their current HIPAA/BAA offerings and tell you which setup is safer for a healthcare practice.

Yes—but only in specific configurations. It's more accurate to say **Claude can be used in a HIPAA-compliant manner**, rather than saying "Claude is HIPAA compliant." HIPAA compliance depends on both the vendor and how you use the service. Here's the breakdown: - **✅ Claude Enterprise (HIPAA-ready)**: Anthropic offers a HIPAA-ready Enterprise configuration that includes a **Business Associate Agreement (BAA)**. Organizations must enable HIPAA mode and accept the BAA before sending Protected Health Information (PHI). [support.claude.com](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers?utm_source=chatgpt.com) - **✅ Anthropic API**: The API can also be used with PHI if your organization has a BAA and meets Anthropic's configuration requirements. [support.claude.com](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers?utm_source=chatgpt.com) - **❌ Claude Free, Pro, Max, and standard Team plans**: These consumer offerings are **not covered by a BAA** and should **not** be used to process PHI. [support.claude.com](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers?utm_source=chatgpt.com) Even with a BAA, your organization is still responsible for the rest of HIPAA compliance, including: - Access controls - Audit logging - Workforce training - Appropriate security policies - Ensuring only covered features are used with PHI A BAA alone does **not** make your application or workflow HIPAA compliant. [support.claude.com](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers?utm_source=chatgpt.com) If your use case involves healthcare, I can also explain: - whether **ChatGPT** or **Claude** is the better choice for HIPAA-regulated applications, - what features are and aren't covered under Anthropic's BAA, - or how to architect a HIPAA-compliant AI workflow.

Yes—but **not every version of ChatGPT is HIPAA compliant**. OpenAI currently offers specific **HIPAA-eligible** products when used with the appropriate **Business Associate Agreement (BAA)**, including: - **ChatGPT for Healthcare** - **ChatGPT Enterprise with a regulated workspace** - **ChatGPT for Clinicians** - Certain **OpenAI API** configurations with required retention controls and a BAA [help.openai.com](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality?utm_source=chatgpt.com)[cdn.openai.com](https://cdn.openai.com/osa/hipaa-guide.pdf?utm_source=chatgpt.com) For ordinary consumer ChatGPT accounts, you **should not assume you can enter PHI (protected health information)**. A BAA is a key part of using OpenAI services for HIPAA-covered processing. OpenAI specifically says it does **not offer a BAA for ChatGPT Business**. [help.openai.com](https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate-agreement-baa-with-openai%25252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252527.midi?utm_source=chatgpt.com) ### Practical rule If you're a healthcare provider and you're thinking about entering something like: > “Patient John Smith, DOB 4/3/1980, has diabetes and these lab results…” **Don't put that PHI into a regular personal ChatGPT account.** Use a HIPAA-eligible OpenAI product/workspace with a BAA and the appropriate configuration. Also, HIPAA compliance isn't just about the AI vendor—the healthcare organization remains responsible for how the system is configured and used. OpenAI's HIPAA guidance explicitly places responsibilities on the customer as well. [cdn.openai.com](https://cdn.openai.com/osa/hipaa-guide.pdf?utm_source=chatgpt.com) If you tell me **which ChatGPT plan you're using (Free, Plus, Pro, Business, Enterprise, etc.) and what you want to use it for**, I can tell you whether that particular setup is appropriate for PHI.

**Yes—but only certain OpenAI products and configurations are HIPAA-eligible.** It is not accurate to say that “ChatGPT” in general is automatically HIPAA compliant. As of August 2026, OpenAI lists these as HIPAA-eligible when used with the appropriate **Business Associate Agreement (BAA)**: - **ChatGPT for Healthcare** - **ChatGPT Enterprise with a Regulated Workspace** - **ChatGPT for Clinicians** - Certain **OpenAI API** configurations, including Modified Retention - Certain FedRAMP offerings [help.openai.com](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality?utm_source=chatgpt.com)[help.openai.com](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare?utm_source=chatgpt.com) For handling **PHI (protected health information)**, OpenAI's HIPAA guide explicitly says that you must have a BAA with OpenAI; having an ordinary ChatGPT account by itself isn't sufficient. [cdn.openai.com](https://cdn.openai.com/osa/hipaa-guide.pdf?utm_source=chatgpt.com) ### What this means in practice If you're a doctor's office, therapist, hospital, healthcare startup, etc. and want to paste patient information into ChatGPT, **don't assume your current ChatGPT plan is approved for that use**. You need an eligible product/account and the appropriate BAA and configuration. For example, OpenAI says **ChatGPT Business does not currently offer a BAA**, while sales-managed ChatGPT Enterprise/Edu customers can be eligible for one. [cdn.openai.com](https://cdn.openai.com/osa/hipaa-guide.pdf?utm_source=chatgpt.com)[help.openai.com](https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate?utm_source=chatgpt.com) OpenAI also says that content in ChatGPT for Healthcare isn't used to train its models and that the product provides controls such as audit logs, RBAC, data-retention controls, and other enterprise security features. [help.openai.com](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality?utm_source=chatgpt.com)[help.openai.com](https://help.openai.com/en/articles/20001046-chatgpt-for-healthcare?utm_source=chatgpt.com) urlOpenAI's HIPAA-eligible products guideturn0search0 If you tell me **which ChatGPT plan/product you're using (Free, Plus, Pro, Business, Enterprise, Healthcare, or API)**, I can tell you whether you can use it for PHI and what you'd need to do.

Yes — **Caspio offers a HIPAA-compliant environment**, but specifically through its **HIPAA Edition**, rather than assuming every Caspio account is HIPAA compliant. According to Caspio’s current documentation, the HIPAA Edition includes: - **Signed Business Associate Agreement (BAA)** - Dedicated HIPAA-compliant cloud environment - Encryption at rest and in transit - Role-based and record-level access controls - Detailed audit logging - Secure authentication, including 2FA/SSO - Independent annual auditing of its HIPAA controls [www.caspio.com](https://www.caspio.com/compliance/?utm_source=chatgpt.com)[www.caspio.com](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) Caspio also says its HIPAA Edition starts at **$800/month on a one-year term**. [www.caspio.com](https://www.caspio.com/compliance/?utm_source=chatgpt.com)[www.caspio.com](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) ### Important distinction HIPAA compliance isn't something Caspio can guarantee for an application simply because it runs on Caspio. **Your organization still has to configure and use the application appropriately**—for example, controlling access to PHI, establishing appropriate policies, and ensuring any connected third-party services also have the necessary HIPAA agreements. Caspio itself makes this distinction in its guidance. [www.caspio.com](https://www.caspio.com/blog/hipaa-compliant-forms-for-healthcare-organizations/?utm_source=chatgpt.com) urlCaspio HIPAA Compliance detailsturn0search2 If you're considering Caspio for a **specific healthcare application**, I can also break down **whether a particular Caspio setup (forms, patient portal, database, API integrations, email/SMS, AI, etc.) would be HIPAA-compliant** and what you'd need to configure.

For a small healthcare practice, I’d choose the vendor as a **security/compliance partner first and a software-development vendor second**. A polished portal that creates a HIPAA problem is much more expensive than a less flashy portal built correctly. ### 1. Start with your requirements Before talking to vendors, define what the portal will actually do: - Patient registration/intake - Secure messaging - Appointment requests or scheduling - Forms and signatures - Upload/download of medical documents - Billing/payment information - Patient access to records - Provider/staff messaging - Email/SMS notifications - Integration with your EHR/EMR - Admin reporting Separate **PHI/ePHI** from ordinary information. This matters because vendors that create, receive, maintain, or transmit ePHI on your behalf generally become HIPAA business associates. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### 2. Make the BAA a hard requirement Don't accept "we're HIPAA compliant" as the answer. If the vendor will handle ePHI, require a **Business Associate Agreement (BAA)** before giving them access to real patient information. HHS specifically says that a cloud provider handling ePHI for a covered entity needs a HIPAA-compliant BAA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) Ask the vendor: > "Will you sign our BAA, and can I review your proposed BAA before we select you?" A vendor that refuses to sign one—or says its terms of service are "HIPAA compliant" and that's sufficient—is a major red flag. The BAA should address, among other things, permitted uses of PHI, safeguards, breach reporting, subcontractors, cooperation with patient-access obligations, and what happens to PHI when the relationship ends. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) ### 3. Ask for evidence, not marketing claims I'd put these questions into your RFP/vendor questionnaire: | Area | What to ask | |---|---| | **BAA** | Will you sign a BAA? | | **Security** | What administrative, physical and technical safeguards do you use? | | **Encryption** | Is data encrypted in transit and at rest? | | **Access** | Do you support MFA, role-based access and least privilege? | | **Audit logs** | Can we see who accessed/changed patient information and when? | | **Backups** | How are backups protected, tested and restored? | | **Disaster recovery** | What's your RTO/RPO? | | **Development** | Do you perform code review, vulnerability scanning and penetration testing? | | **Testing** | Do you have an independent SOC 2 Type II, HITRUST certification, penetration-test report, or similar evidence? | | **Incidents** | How quickly will you notify us of a suspected breach/security incident? | | **Subcontractors** | Which third parties can access PHI? | | **Data location** | Where is PHI stored and processed? | | **AI** | Is patient information used to train models or for analytics? | | **Integrations** | How will the portal connect to our EHR? | | **Export** | Can we retrieve all of our data in a usable format? | | **Termination** | How is data returned/deleted when we leave? | | **Support** | Can support personnel access patient data? Under what controls? | HIPAA requires appropriate **administrative, physical and technical safeguards**, but it doesn't prescribe one particular technology stack. Your practice still has to conduct its own risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### 4. Pay particular attention to the architecture For a custom-built portal, I'd want the vendor to explain—in plain English—this flow: **Patient → portal → application/API → database/storage → EHR** For every component, ask: - Does it contain PHI? - Who can access it? - Is access logged? - Is it encrypted? - Who administers it? - Is there a third-party service involved? - Is that third party covered by an appropriate BAA? - What happens if that service goes down? This is especially important with cloud services. Even a cloud provider that stores **only encrypted ePHI without possessing the decryption key** can still be a HIPAA business associate. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### 5. Don't let "HIPAA certified" end the discussion There isn't an HHS "HIPAA-certified vendor" stamp that makes your practice compliant. HHS says OCR does **not endorse, certify, or recommend specific technology or products**. [www.hhs.gov](https://www.hhs.gov/answers/business-associates/index.html?utm_source=chatgpt.com) Instead, look for evidence such as: - SOC 2 Type II - HITRUST certification, where appropriate - Independent penetration testing - Vulnerability-management program - Written incident-response plan - Security policies - Employee security/privacy training - Strong identity/access controls - Documented backup and disaster-recovery testing These aren't substitutes for HIPAA compliance, but they give you substantially more evidence than a vendor's marketing page. ### 6. Make incident response part of the contract Don't merely ask, "Are you secure?" Ask: > **"If you discover unauthorized access to our patient data at 2 a.m. on Saturday, exactly what happens, who contacts us, and how quickly?"** Your contract should establish meaningful incident/breach notification obligations. Under HIPAA, a business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovery, subject to the applicable rules. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html?utm_source=chatgpt.com) For a small practice, I'd negotiate for **much faster contractual notification** than the 60-day outer limit—for example, prompt notice after confirmation or discovery of a potentially significant security incident. ### 7. Don't overlook your exit strategy This is one of the biggest things small practices forget. Before signing, determine: **If we fire you five years from now, how do we get our patients' data?** Specify: - Complete data export - Machine-readable format - Attachments/documents included - Audit logs, where appropriate - Export costs - Migration assistance - Retention/deletion period - Written confirmation of deletion - What happens to backups HHS's model BAA provisions specifically contemplate return/destruction of PHI at termination and requirements concerning subcontractors. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) ### 8. Use a weighted scorecard For a small practice, I'd score vendors roughly like this: | Category | Weight | |---|---:| | HIPAA/security architecture | **25%** | | BAA + contract terms | **15%** | | Relevant healthcare experience | **15%** | | EHR/integration capability | **15%** | | Usability/patient experience | **10%** | | Reliability/support | **10%** | | Price/TCO | **10%** | Notice that **price is only 10%**. I'd rather pay $50k more for a vendor with a mature security program, healthcare experience, clean contracts and reliable integration than save $50k and discover later that the portal can't pass a security review or safely exchange data with the EHR. ### 9. Red flags that should eliminate a vendor I'd be very cautious if you hear: - "We're HIPAA compliant because we use AWS/Azure." - "Our customers don't need a BAA." - "We don't have a BAA, but our software is HIPAA certified." - "We don't provide security documentation." - "Our developers can access the production database whenever they need to." - "We don't really have audit logs." - "We use patient data to improve our AI unless you opt out." - "We don't disclose our subprocessors." - "You'll have to call us if you want your data exported." - "We don't support MFA." - "We can't explain our backup/restore process." - "We'll figure out the security requirements after development." Using a cloud provider doesn't automatically make an application HIPAA compliant; your practice needs to understand the environment and conduct its own risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### 10. For a small practice, consider buying instead of building This is perhaps the most important strategic question. If your portal requirements are fairly standard—secure messaging, forms, document exchange, scheduling, payments, etc.—I'd first compare **established healthcare patient-portal products** against custom development. Custom development makes more sense when you have something genuinely unusual, such as: - a specialized workflow, - unusual patient/provider interaction, - proprietary clinical functionality, - complex integration requirements, or - a need to own/control the entire application. Otherwise, you're effectively asking a small practice to become a software company **and** a security organization. That's a lot of responsibility. ### My recommended selection process **Week 1:** Define requirements and data flows. **Week 2:** Send the same security/RFP questionnaire to 5–7 vendors. **Week 3:** Narrow to 3 and conduct technical/security interviews. **Week 4:** Review BAA, MSA, SLA, privacy terms and data ownership. **Week 5:** Have an independent HIPAA/security professional review the finalist's architecture. **Then:** Run a proof-of-concept with **synthetic/test patient data**, not live PHI. Your practice should also perform its own HIPAA risk analysis; HHS describes risk analysis as the foundational step in the Security Rule process. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) **If I were choosing for a 5–20-person practice, my "must have" list would be:** BAA + strong contract, documented security controls, MFA/RBAC/audit logging, encryption, tested backups/DR, independent security evidence, transparent subprocessors, good EHR integration, clean data export, and a vendor with demonstrable healthcare experience. If you tell me **what kind of practice you run, approximately how many providers/patients you have, and what the portal needs to do**, I can turn this into a **vendor RFP/checklist with scoring criteria and 20–30 questions you can send to prospective vendors**. | Area | What to ask | |---|---| | **BAA** | Will you sign a BAA? | | **Security** | What administrative, physical and technical safeguards do you use? | | **Encryption** | Is data encrypted in transit and at rest? | | **Access** | Do you support MFA, role-based access and least privilege? | | **Audit logs** | Can we see who accessed/changed patient information and when? | | **Backups** | How are backups protected, tested and restored? | | **Disaster recovery** | What's your RTO/RPO? | | **Development** | Do you perform code review, vulnerability scanning and penetration testing? | | **Testing** | Do you have an independent SOC 2 Type II, HITRUST certification, penetration-test report, or similar evidence? | | **Incidents** | How quickly will you notify us of a suspected breach/security incident? | | **Subcontractors** | Which third parties can access PHI? | | **Data location** | Where is PHI stored and processed? | | **AI** | Is patient information used to train models or for analytics? | | **Integrations** | How will the portal connect to our EHR? | | **Export** | Can we retrieve all of our data in a usable format? | | **Termination** | How is data returned/deleted when we leave? | | **Support** | Can support personnel access patient data? Under what controls? | HIPAA requires appropriate **administrative, physical and technical safeguards**, but it doesn't prescribe one particular technology stack. Your practice still has to conduct its own risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### 4. Pay particular attention to the architecture For a custom-built portal, I'd want the vendor to explain—in plain English—this flow: **Patient → portal → application/API → database/storage → EHR** For every component, ask: - Does it contain PHI? - Who can access it? - Is access logged? - Is it encrypted? - Who administers it? - Is there a third-party service involved? - Is that third party covered by an appropriate BAA? - What happens if that service goes down? This is especially important with cloud services. Even a cloud provider that stores **only encrypted ePHI without possessing the decryption key** can still be a HIPAA business associate. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### 5. Don't let "HIPAA certified" end the discussion There isn't an HHS "HIPAA-certified vendor" stamp that makes your practice compliant. HHS says OCR does **not endorse, certify, or recommend specific technology or products**. [www.hhs.gov](https://www.hhs.gov/answers/business-associates/index.html?utm_source=chatgpt.com) Instead, look for evidence such as: - SOC 2 Type II - HITRUST certification, where appropriate - Independent penetration testing - Vulnerability-management program - Written incident-response plan - Security policies - Employee security/privacy training - Strong identity/access controls - Documented backup and disaster-recovery testing These aren't substitutes for HIPAA compliance, but they give you substantially more evidence than a vendor's marketing page. ### 6. Make incident response part of the contract Don't merely ask, "Are you secure?" Ask: > **"If you discover unauthorized access to our patient data at 2 a.m. on Saturday, exactly what happens, who contacts us, and how quickly?"** Your contract should establish meaningful incident/breach notification obligations. Under HIPAA, a business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovery, subject to the applicable rules. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html?utm_source=chatgpt.com) For a small practice, I'd negotiate for **much faster contractual notification** than the 60-day outer limit—for example, prompt notice after confirmation or discovery of a potentially significant security incident. ### 7. Don't overlook your exit strategy This is one of the biggest things small practices forget. Before signing, determine: **If we fire you five years from now, how do we get our patients' data?** Specify: - Complete data export - Machine-readable format - Attachments/documents included - Audit logs, where appropriate - Export costs - Migration assistance - Retention/deletion period - Written confirmation of deletion - What happens to backups HHS's model BAA provisions specifically contemplate return/destruction of PHI at termination and requirements concerning subcontractors. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) ### 8. Use a weighted scorecard For a small practice, I'd score vendors roughly like this: | Category | Weight | |---|---:| | HIPAA/security architecture | **25%** | | BAA + contract terms | **15%** | | Relevant healthcare experience | **15%** | | EHR/integration capability | **15%** | | Usability/patient experience | **10%** | | Reliability/support | **10%** | | Price/TCO | **10%** | Notice that **price is only 10%**. I'd rather pay $50k more for a vendor with a mature security program, healthcare experience, clean contracts and reliable integration than save $50k and discover later that the portal can't pass a security review or safely exchange data with the EHR. ### 9. Red flags that should eliminate a vendor I'd be very cautious if you hear: - "We're HIPAA compliant because we use AWS/Azure." - "Our customers don't need a BAA." - "We don't have a BAA, but our software is HIPAA certified." - "We don't provide security documentation." - "Our developers can access the production database whenever they need to." - "We don't really have audit logs." - "We use patient data to improve our AI unless you opt out." - "We don't disclose our subprocessors." - "You'll have to call us if you want your data exported." - "We don't support MFA." - "We can't explain our backup/restore process." - "We'll figure out the security requirements after development." Using a cloud provider doesn't automatically make an application HIPAA compliant; your practice needs to understand the environment and conduct its own risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### 10. For a small practice, consider buying instead of building This is perhaps the most important strategic question. If your portal requirements are fairly standard—secure messaging, forms, document exchange, scheduling, payments, etc.—I'd first compare **established healthcare patient-portal products** against custom development. Custom development makes more sense when you have something genuinely unusual, such as: - a specialized workflow, - unusual patient/provider interaction, - proprietary clinical functionality, - complex integration requirements, or - a need to own/control the entire application. Otherwise, you're effectively asking a small practice to become a software company **and** a security organization. That's a lot of responsibility. ### My recommended selection process **Week 1:** Define requirements and data flows. **Week 2:** Send the same security/RFP questionnaire to 5–7 vendors. **Week 3:** Narrow to 3 and conduct technical/security interviews. **Week 4:** Review BAA, MSA, SLA, privacy terms and data ownership. **Week 5:** Have an independent HIPAA/security professional review the finalist's architecture. **Then:** Run a proof-of-concept with **synthetic/test patient data**, not live PHI. Your practice should also perform its own HIPAA risk analysis; HHS describes risk analysis as the foundational step in the Security Rule process. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) **If I were choosing for a 5–20-person practice, my "must have" list would be:** BAA + strong contract, documented security controls, MFA/RBAC/audit logging, encryption, tested backups/DR, independent security evidence, transparent subprocessors, good EHR integration, clean data export, and a vendor with demonstrable healthcare experience. If you tell me **what kind of practice you run, approximately how many providers/patients you have, and what the portal needs to do**, I can turn this into a **vendor RFP/checklist with scoring criteria and 20–30 questions you can send to prospective vendors**.